test(oracles): move TanStack DB onto @tanstack/oracles, declare ownership and routes in every oracle

.agents/skills/oracle-authoring/SKILL.md

@@ -22,14 +22,14 @@ Work in this order when a production change is part of the task:
 2. Inventory the materially affected public receiving paths and their promised
    observation cuts. Include required real-host receiving witnesses in this
    pre-edit gate; a controlled core witness does not supply their evidence.
-3. Extend the history grammar, driver, or observation until generated
+3. Extend the history grammar, production driver, or observation until generated
    histories reach the state where the law matters. Declare that state with
    `createOracleReach` (ORC-015) for each required receiving path.
 4. Run those comparisons on unchanged production. Record the defect's RED
    result and the neighboring guarantees' results. A setup failure or missing
    required witness blocks production edits; repair the test path first.
 5. Change production, with the oracle running after each attempt.
-6. Record the GREEN result and a hostile mutant that fails.
+6. Record the GREEN result and a mutant that fails.
 
 Do not change production before step 4. Retrospective runs or a documented
 process gap do not satisfy this gate. If a model rule disagrees with
@@ -38,7 +38,7 @@ change only so that it matches production output is model hacking.
 
 Read [the oracle guide](../../../docs/contributing/oracle-rubric.md) and
 [the glossary](../../../docs/contributing/glossary.md) in full, then read the
-relevant owner and limits in
+relevant oracle owner and limits in
 [the coverage map](../../../docs/contributing/oracle-coverage.md).
 
 After a handoff or compaction, reopen required sources whose relevant contents
@@ -51,11 +51,11 @@ concepts. Delegated agents must do the reading relevant to their own scope.
 Follow the subsystem reading requirements in AGENTS.md.
 
 Keep unit tests and standalone concrete type assertions out of oracle files
-(ORC-016). Fixed regressions are inputs to the same model, driver, and
-comparison as the broader campaign, without their own expected answers.
-Compile-time oracles generate legal TypeScript inputs and compare public
-types with a reusable independent law; a matrix of fixed assertions does not
-satisfy this requirement. Supplemental examples belong in ordinary test files.
+(ORC-016). Fixed regressions are inputs to the same model, production driver,
+and comparison as the broader campaign, without their own expected answers.
+Compile-time oracles generate legal TypeScript inputs and compare public types
+with a reusable independent law; a matrix of fixed assertions does not satisfy
+this requirement. Supplemental examples belong in ordinary test files.
 
 Use the [instrument library](../../../docs/contributing/instruments/index.md)
 when there is a material uncertainty. Select cards within the authorized task;
@@ -90,9 +90,9 @@ when requested by the task. A proposal with unresolved authority can be explored
 in a scratch model; do not silently make it a product expectation.
 
 At closeout, write the evidence block from AGENTS.md (law, reach, RED, GREEN,
-mutant, limits). Connect the law to the evidence actually obtained: which histories
-and paths ran, which wrong behavior was rejected, and what remains untested.
-Use concise prose suited to the change; no particular report template is
-required. When changing repository coverage, update the existing owner and
-coverage map to reflect the changed scope. A scratch law-design experiment
+mutant, limits). Connect the law to the evidence actually obtained: which
+histories and paths ran, which wrong behavior was rejected, and what remains
+untested. Use concise prose suited to the change; no particular report template
+is required. When changing repository coverage, update the existing oracle owner
+and coverage map to reflect the changed scope. A scratch law-design experiment
 retains its proposals and limits without claiming new repository coverage.

.agents/skills/oracle-review/SKILL.md

@@ -11,7 +11,7 @@ test can coexist with correct production.
 
 Read [the oracle guide](../../../docs/contributing/oracle-rubric.md) and
 [the glossary](../../../docs/contributing/glossary.md) in full, then read the
-relevant owner and limits in
+relevant oracle owner and limits in
 [the coverage map](../../../docs/contributing/oracle-coverage.md).
 
 After a handoff or compaction, reopen required sources whose relevant contents
@@ -41,8 +41,9 @@ from the [instrument library](../../../docs/contributing/instruments/index.md):
 - **Law restructuring** tests whether merging, splitting, replacing, or removing
   laws gives a better account while preserving necessary obligations.
 - **Mutant gap hunt** tests whether a plausible wrong implementation can pass
-  the owner and traces survivors to a missing distinction, a contract-permitted
-  difference, a scoped equivalence argument, or a baseline product bug.
+  the oracle owner and traces survivors to a missing distinction, a
+  contract-permitted difference, a scoped equivalence argument, or a baseline
+  product bug.
 
 Choose attacks for the actual uncertainty; do not run every card or require a
 finding at every level. Use a fresh reviewer for an independent challenge when
@@ -76,10 +77,48 @@ Report each one as a finding:
 - A claim about a state that no declared reach shows generated histories enter.
 - A skipped, narrowed, or relaxed comparison without a coverage-map entry and a
   maintainer decision.
-- A pinned example where the law needs a generator dimension.
+- A fixed-history-only coverage claim where the law needs a generator dimension.
 - A counterexample labeled as older than the change and then left without a
   fix, a coverage-map record, or a maintainer decision.
-- A closure claim without a hostile mutant that fails the oracle.
+- A closure claim without a mutant that fails the oracle.
+
+Lint, reach checks, coverage, and calibrations cannot see the weaknesses
+below. Treat them as your main job, and hunt for each one in the oracle under
+review, not only in the diff:
+
+- **Run but not checked.** A history executes the code, but the comparison
+  never observes its effect. Coverage and declared reach both pass. Find a
+  line the oracle claims, and name the mutant on it that would survive.
+- **A model that copies production.** The model mirrors production's branches,
+  classifications, or helpers, so both agree on the same wrong answer. Compare
+  the model's structure with production, not only its results.
+- **A grammar narrower than the law.** The law's prose claims a value domain,
+  action, or case that the grammar never generates. Examples are a type the
+  generator never produces, an exclusion stated in prose but missing from the
+  declared limits, and a size or length setting that makes part of the
+  declared range unreachable. Check each claim in the law against a generator
+  dimension.
+- **Easy declared states and probes.** A declared state or probe is placed
+  where it is always true, or is defined by a weaker condition than the state
+  it names. Its count rises without showing that histories enter the
+  interesting state. Check each definition against the state that the law
+  needs.
+- **A late or coarse checkpoint.** The comparison runs only at the end of a
+  history or observes only a summary, so a wrong intermediate observation
+  disappears. Ask whether a user could see the wrong value before the
+  checkpoint.
+- **A limit that hides in-scope work.** A declared limit, waiver, or
+  coverage-map entry excludes a legal case that the law promises. Check that
+  each limit's decision covers exactly what it excludes.
+- **A dismissed survivor.** A surviving mutant is called equivalent or out of
+  scope without an argument from the contract. Require that argument, or a
+  witness.
+- **An invariant guard without an invariant witness.** A throw for a
+  contradictory collaborator signal or impossible state has no history that
+  reaches it. Require an invariant witness: a fault-injected step that supplies
+  the contradictory signal, with the expected observation that production
+  fails at the boundary before it releases established state or publishes
+  success.
 
 Report supported findings and remaining uncertainty. Do not invent findings,
 retire laws, or rewrite expectations to make a review come out decisive.

.changeset/observer-restart-rewrite.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/db': patch
+---
+
+Show a row that a restarted sync run writes again after cleanup. A live-query observer (and so `useLiveQuery` in every framework adapter) that stayed subscribed through a Collection's cleanup and restart showed no row when the new sync run wrote a row equal to one it showed before cleanup, or when an on-demand restart reloaded it. The observer's Collection subscription now keeps none of the rows from before cleanup.

.github/pull_request_template.md

@@ -4,7 +4,7 @@
 
 ## 🔬 Oracle Coverage
 
-<!-- For a change to observable behavior, name the coverage-map owner and summarize the oracle evidence. For a non-bug change without a practical oracle, identify the relevant coverage-map entry and explain why you cannot extend its owner, create an independent oracle, or add a receiving witness. -->
+<!-- For a change to observable behavior, name the coverage-map oracle owner and summarize the oracle evidence. For a non-bug change without a practical oracle, identify the relevant coverage-map entry and explain why you cannot extend its oracle owner, create an independent oracle, or add a receiving witness. -->
 
 <!-- For a bug fix, provide evidence that closes the entire declared bug class. State the violated law, exercised histories, production paths, observation checkpoints, RED/GREEN result, and remaining limits. Resolve known in-scope gaps before submitting; a focused test alone is not sufficient. -->
 

.github/workflows/pr.yml

@@ -183,6 +183,8 @@ jobs:
         uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3
       - name: Build Packages
         run: pnpm run build
+      - name: Check that no build carries an oracle probe
+        run: node scripts/check-dist-probes.mjs
       - name: Publish Previews
         run: pnpx pkg-pr-new publish --pnpm --compact './packages/*' --template './examples/*/*'
   size:

.github/workflows/release.yml

@@ -118,6 +118,8 @@ jobs:
         run: pnpm --dir packages/db exec vitest --mergeReports .vitest-reports
       - name: Build packages
         run: pnpm run build
+      - name: Check that no build carries an oracle probe
+        run: node scripts/check-dist-probes.mjs
       - name: Run Changesets (version or publish)
         id: changesets
         uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0

.gitignore

@@ -49,10 +49,11 @@ vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 tsconfig.vitest-temp.json
 
-# The part-reach oracle lints scratch programs inside the repository; an
-# interrupted run can leave them behind.
-/part-reach-scratch-*/
-
 # Other checkouts and scratch copies. A plain directory here is not part of
 # this checkout's branch, so the oracle lint hooks must not see its files.
 /.worktrees/
+
+# The gap report CLI: evidence store and workspace bundles, and the harness
+# files that a run which died leaves beside the package
+.oracle-gaps/
+.oracle-gaps-*