fix(db): enforce functional callback metadata boundaries

.changeset/fix-correlated-callback-metadata.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/db': patch
+---
+
+Fix reserved metadata before `fn.select()`, `fn.where()`, and `fn.having()` callbacks in live queries, Effects, and correlated includes. Preserve genuine source metadata, authored inline values, and selected output when compiled queries share a cache. Preserve every ordered window and joined-source publication dependency when one source feeds multiple compiled views or nested queries.

.changeset/retain-loading-sibling-replay.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/db': patch
+---
+
+Keep the last complete live-query result when a new include demand fails while a sibling subscription is still replaying after truncate. A successful sibling load cannot publish an incomplete replacement.

docs/contributing/oracle-coverage.md

@@ -796,27 +796,66 @@ stay ready/empty, and a new interval gets a new handle. This assumes no
 facade-local optimistic mutations. Every shape declares active empty readiness
 and nonempty child receiving cuts. Six lifetime and four inline-value hostile
 controls reject wrong observations. See [chunk 5](oracle-reviews/2026-10-28-pr-2171-oracle-chunks.md).
-Functional callback-input observations now have a separate receiving boundary
-in `virtual-row-fields-input-oracle.test.ts`, sharing source metadata judgment
-with the existing root/Effect owners. Its finite 33 authoring descriptions cross
-seven QueryRef/join/union consumers through root and correlated inline-child
-compilation (462 histories), plus two direct-source controls. Each compares
-immutable callback captures and their ordinary derived output at initial
-readiness, held mutation, settlement and remote next use. Complete before/after
-source facts permit retraction evaluation; startup LEFT joins may expose an
-absent side, while established outputs require both typed-key rows. Reserved
-metadata is judged by presence/readable value, with ownership flags diagnostic;
-ordinary own undefined remains distinct from absence. Another 66 histories keep
-nested inline array/materialized authored values, and 33 reject compiled
-Collection inputs before callbacks. Per-history/path/cut reach is mandatory even
-under unrelated replay seeds; unentered calibration-only runs stand aside.
-Unchanged production exposes 203 correlated-child violations: new-shape fields
-leak and source-spread collisions spoof genuine metadata. Root receivers and
-nested inline preservation pass. All 2,153 declared states reach; 17 controls
-and independent seeded/unentered/partial-selection checks calibrate this owner.
-See [chunk 17](oracle-reviews/2026-10-28-pr-2171-oracle-chunks.md) for exact
-fingerprints and independent evidence. Production repair is deferred under the
-[RC oracle challenge](oracle-reviews/2026-10-28-pr-2171-oracle-challenge.md).
+Functional callback-input observations have a separate receiving boundary in
+`virtual-row-fields-input-oracle.test.ts`, sharing the existing source metadata
+judgment. The maintainer extended O12 on 2026-10-30 from fn.select to fn.where
+and fn.having while preserving authored inline output. Thirty-three authoring
+descriptions cross seven QueryRef/join/union paths, five callback forms
+(select, where, having, where-select, having-select), and root, wrapped child,
+direct child and real Effect receivers. Flat union children require a named
+QueryRef for include correlation; direct flat union children remain inadmissible.
+The finite grammar has 4,290 receiving histories and 20 direct-source controls.
+
+Each receiver checks immutable callback captures and complete derived or
+predicate-filtered output at initial readiness, held mutation, settlement and
+remote next use. Effects also check exit/reentry, every delivered value and
+previousValue, continuity in both callback channels and silence after disposal.
+Before/after source facts permit retraction evaluation. Startup LEFT joins may
+expose an absent side; after source exit the unmatched peer remains a result.
+Reserved fields use presence/readable value, with ownership diagnostic.
+Ordinary own undefined remains distinct from absence. Another 132 histories
+retain inline array/materialized authored values through direct and QueryRef
+paths; 66 reject compiled Collection inputs before callbacks. All 20,720
+callback and 594 inline/rejection states reach once.
+
+Another 396 histories use exported `compileQuery`, the same exact QueryIR and
+D2 input streams, both compilation orders, shared/separate caches, and FROM,
+joined-source and union-branch placement. At initial graph drain, all 1,188
+states compare callback captures, complete derived output and raw authored
+output. Raw output uses a shared-cache/separate-cache differential, while both
+executions still undergo the independent callback/derived-output judgment.
+The union optimizer clones branch IR: counters establish original-key reuse
+for FROM/JOIN, while union checks propagation/transparency without claiming
+that cache hit. This receiver supplies no Effect-root metadata attribution law.
+
+The owner has 4,923 tests. Before callback production edits, it rejected 1,102
+metadata input comparisons on the reviewed implementation; 3,821 tests passed.
+All 22,502 callback, inline and compiler states reached. The repaired owner
+passes. Final mutants reject a WHERE-only repair (551 comparisons), enabling
+normalization for every predicate pipeline (696 authored-output comparisons),
+and dropping the selected-row cache mode (26 comparisons). Earlier path-specific
+FROM/JOIN/union normalization mutants each failed 112 compiler comparisons.
+The real Effect receiver additionally rejects 203 metadata comparisons on the
+actual PR base. That receiving evidence does not retroactively supply the
+historical selection repair's initial pre-edit gate.
+
+The ordered-work owner, `ordered-work-oracle.property.test.ts`, adds 144 finite
+histories through `ordered-compiler-cache-driver.ts`. Two compilation orders,
+shared/separate caches, FROM/JOIN/union paths, two projection forms, two order
+directions and three window moves exercise actual source Collections and the
+real OrderedSourceLoader. The independent installed-window model checks signed
+output bags at initial, moved and returned cuts. Original registration overwrite
+fails 48 histories; the repaired full 424-test owner passes. All 432 new states
+reach once. This receiver claims the controlled compiler/loader boundary, not
+public Collection window-promise integration. Its 280 existing histories retain
+their Collection/Effect receiving evidence. Separate metadata-mode pipelines
+remain a permitted representation; no one-pipeline performance promise follows.
+The [runtime repair record](oracle-reviews/callback-metadata.md) retains the
+commands, source bindings, lossless nine-item audit, calibrations and limits.
+Historical instrument acceptance remains in
+[chunk 17](oracle-reviews/2026-10-28-pr-2171-oracle-chunks.md).
+The separate static receiving-type failures in the
+[deferred record](oracle-reviews/2026-10-29-pr-2171-deferred-oracles.md) remain open.
 This extension does not establish arbitrary descriptors/prototypes, greater
 recursive depth, same-source overlapping transactions, other dynamic
 join kinds, truncate, provider scheduling, framework receivers or construction
@@ -1108,6 +1147,23 @@ that fails one receiver's current request while comparing another receiver's
 status at the same checkpoint. This is a stated observation limit, not a
 retirement of the per-demand error-ownership law.
 
+The replay error-identity comparison keeps subscription ownership separate
+from the source-wide publication barrier. CI seed `1926301329`, path
+`251:2:1:4:2:2`, exposed a false failure: an include replay rejected while a
+join replay still loaded, and the comparison required the join's earlier
+failure instead. Adapter request data now identifies each load's subscription.
+Only failures and covering replacements within that subscription compete for
+its replay error. A 96-history finite grammar crosses root/marker replay,
+oldest/newest failure order, four join forms, both directions and three window
+widths. It measures 52 histories with multiple failures of one subscription
+and six with sibling failures; both require at least five. The old source-wide
+comparison and a production mutant that returns the last replay failure each
+fail the intended identity assertion. Publication, request-error, retirement,
+readiness and convergence comparisons and campaign budgets remain. This is a
+controlled Collection/live-query witness, with no provider or framework claim.
+Evidence and the oracle self-review are in
+[the callback metadata record](oracle-reviews/callback-metadata.md#replay-error-identity-ci-follow-up-2026-10-30).
+
 The ordered replay owner distinguishes replay renewal from an ordinary lazy
 demand created during another subscription's replay. Its adapter records the
 leases held at truncate, then matches subscription identity and independently
@@ -5939,6 +5995,27 @@ path from a later run. Until then, this entry cannot tell an operator
 regression from an older defect. A later failure of that campaign must record
 its seed here before anyone calls it pre-existing.
 
+### Ordered joined dependency composition, October 30
+
+October 30 receiving extension: the same ordered-work owner now checks joined
+dependency composition across direct, wrapped QueryRef and two-filter nested
+ordered plans. Its 128 finite histories cross actual Collection and Effect
+receivers, two directions, matched/anti-joined membership, widths one/two,
+joined answer order and which of two joined sources vetoes a new head row.
+Each history checks settled initial rows, then every recorded publication and
+public read at held, partial and settled cuts. All 256 declared held/settled
+states reach their minimum once. Unchanged `8464ec977` fails 24 publication
+comparisons (12 per receiver); the repair passes all 128 histories. Overwrite,
+last-only and first-only dependency mutants fail 24, eight and eight intended
+comparisons respectively. The original 424 owner tests and their budgets stay.
+This is a controlled adapter witness through real core receivers: one inserted
+head row, two joined sources, one QueryRef level and windows of one/two rows.
+Ordinary progressive Effect startup callbacks remain outside this new atomicity
+claim. No provider/framework, arbitrary nesting, rejection, cleanup or public
+window-promise integration claim follows. See the versioned
+[joined dependency review](oracle-reviews/callback-metadata.md#ordered-joined-dependency-review-2026-10-30)
+for the pre-edit gate, experiments, source binding and loss audit.
+
 ### Ordered signalling-refetch work scope, October 27
 
 Owner: `packages/db/tests/query/ordered-work-oracle.property.test.ts`. The
@@ -6230,6 +6307,17 @@ bundle erasure, Typedoc generation, tooling GREEN and restored-old-tooling
 mutants remain required receiving checks. Generated docs remain CI-owned.
 
 
+### Replay successful-retirement ownership, October 30
+
+The load-subset replay refinement owner scopes successful replacement to the
+same subscription as the failure. Its 96-history failure/success matrix reaches
+four sibling-success coverage histories and calibrates that another subscription's
+failure survives the account action. The original account fails that comparison;
+all 44 normal owner tests pass after repair, with existing budgets intact.
+No production change or new provider/framework claim follows. See the
+[versioned retirement review](oracle-reviews/callback-metadata.md#replay-retirement-scope-review-2026-10-30).
+
+
 ### Distinct collision review extension (2026-10-30)
 
 The existing distinct incrementalization owner now also generates four unequal
@@ -6304,3 +6392,37 @@ useful extension: the hash identity oracle owns those semantic distinctions,
 but its helper-level evidence does not by itself exercise distinct storage.
 The separate Index structural-collision obligation above remains open.
 See the appended [review evidence](oracle-reviews/2026-10-30-distinct-collisions.md).
+
+## Loading sibling replay and final catch-up reach (2026-10-30)
+
+The primary load-subset replay owner now constructs 48 finite histories where
+an include with no demand at truncate starts under its sibling's loading replay.
+It measures held failure (44 histories), failure retirement (33), and later own
+coverage (12), through the existing public retention and recovery comparisons.
+The original guard fails the quiet retention check. Subscription-scoped verdict
+and successful-coverage calibrations remain in that primary owner.
+
+The browser multi-tab Electric owner preserves its stop prefix and arbitrary
+tail and constructs an abandoned reservation immediately before final catch-up.
+This removes dependence on sampling that boundary without changing its model,
+80-run budgets, comparisons or reach minima.
+
+See [the versioned experiment record](oracle-reviews/2026-10-30-release-replay-retention.md)
+for authority, RED, reach, mutant, grammar controls, historical gate limits and
+receiving-path limits. This is core Collection publication evidence and a Node
+SQLite/coordinator receiving witness with controlled Electric streams. It does
+not claim Effect, provider, framework, deeper include, or browser-process closure.
+
+
+### Subscription-scoped request-error assertion (2026-10-30)
+
+The primary load-subset replay owner now retains subscription identity in its
+later-request and successful-coverage account. A sibling requesting overlapping
+source keys cannot exempt the failed demand's public health error. Its existing
+96-history sibling-success grammar measures the actual owed-error assertion in
+four histories, alongside four successful-sibling-coverage histories. A targeted
+omitted-error observation passes the former source-wide account and fails the
+scoped health comparison. All existing comparisons, histories, budgets and
+reach minima remain. The controlled core, one-level include and peer limits
+remain those of this owner; no provider or framework claim follows. See the
+[versioned repair record](oracle-reviews/2026-10-30-release-replay-retention.md#subscription-scoped-request-error-checker-repair).

docs/contributing/oracle-reviews/2026-10-29-pr-2171-deferred-oracles.md

@@ -19,6 +19,13 @@ No follow-up PR is claimed until one is actually created.
   callbacks. The approved callback law remains normative. The accepted runtime
   owner has 377 passes / 203 intended REDs and all 2,153 cells; the bounded
   concrete lane has the same seven failures and one compatible pass on main.
+  The runtime follow-up restores this owner and adds direct child receivers.
+  It reproduces 348 REDs before repair and passes all 979 tests afterward, with
+  all 3,510 states reached. This includes a low-level shared compiler-cache
+  receiver whose 132 histories reproduced 26 failures before its cache repair.
+  Inline QueryRef histories also reject an overbroad
+  first repair before the corrected production edit. See [the runtime repair](callback-metadata.md).
+  This does not close the separate static metadata receiving-type failures below.
 - P11/P12: raw undefined becomes null and selected empty records disappear.
   Their root/QueryRef runtime owner retains 18 REDs, correlated receiver 72 REDs,
   and source-public type receiver 280 REDs. Every declared receiving cell and