test: register every oracle test through oracleProperty and remove declareOracle

.agents/skills/oracle-authoring/SKILL.md

@@ -54,15 +54,28 @@ Follow the subsystem reading requirements in AGENTS.md.
 
 Name the production code that the oracle judges in `owns` on each
 `oracleProperty` call, as an inline literal array; the law has no owner field.
+A file that registers through a wrapper passes the list in the wrapper call's
+options literal, and the wrapper forwards it to `oracleProperty`.
 The [oracle guide](../../../docs/contributing/oracle-rubric.md#name-oracle-files-consistently)
 states the form that the gap report reads.
 
-Keep unit tests and standalone concrete type assertions out of oracle files
-(ORC-016). Fixed regressions are inputs to the same model, production driver,
-and comparison as the broader campaign, without their own expected answers.
-Compile-time oracles generate legal TypeScript inputs and compare public types
-with a reusable independent law; a matrix of fixed assertions does not satisfy
-this requirement. Supplemental examples belong in ordinary test files.
+An oracle file registers its tests only through `oracleProperty`; the
+`oracle/no-unit-test` rule reports any other registration. Keep unit tests and
+standalone concrete type assertions out of oracle files (ORC-016). A fixed
+regression is a `histories.fixed` entry, or a history of an enumerated
+property with the same driver, model, and check, without its own expected
+answer. A finite table of cases is an enumerated source; a check that rejects a
+wrong answer is a `calibrations` entry; a reach check over fixed scenarios is
+an enumerated source with declared `states`. Never register a list of closures
+under one property. Compile-time oracles generate legal TypeScript inputs and
+compare public types with a reusable independent law; a matrix of fixed
+assertions does not satisfy this requirement. Supplemental examples, model-rule
+expectations, and grammar-size checks belong in ordinary test files. An
+`it.fails` witness of a known defect goes in an ordinary
+`<subject>-known-defects.test.ts` that reuses the oracle's driver and check,
+with the defect open in the coverage map. A spec for a runtime where
+`oracleProperty` cannot load, such as Playwright or a bundled WebView suite, is
+a receiving witness named `*-witness.*`.
 
 Use the [instrument library](../../../docs/contributing/instruments/index.md)
 when there is a material uncertainty. Select cards within the authorized task;

AGENTS.md

@@ -747,15 +747,20 @@ entry, contract comment, or table of fixtures does not turn examples into an
 oracle.
 
 Keep a fixed regression as input to the same model, production driver, and
-comparison that the generated campaign uses. It must not carry a separate
-expected answer or its own assertions. Checker calibration may supply a wrong
-observation to that same comparison. Put supplemental unit tests in ordinary
-test files; they do not discharge an oracle-owned coverage obligation.
+comparison that the generated campaign uses: a fixed history
+(`histories.fixed`) of that `oracleProperty`, or an enumerated property with
+the same driver, model, and check when the grammar cannot produce it. It must
+not carry a separate expected answer or its own assertions. A checker
+calibration is a `calibrations` entry that supplies a wrong observation or a
+mutant driver to that same comparison. Put supplemental unit tests, and
+expectations that step only the model, in ordinary test files; they do not
+discharge an oracle-owned coverage obligation.
 
 For compile-time contracts, generate legal TypeScript inputs and check their
-public types against a reusable independent type law. A list of
-`expectTypeOf` calls or `@ts-expect-error` examples is not an oracle. Negative
-checks derived by the shared law from generated inputs are permitted.
+public types against a reusable independent type law, with an `oracleProperty`
+whose driver runs the type checker. A list of `expectTypeOf` calls or
+`@ts-expect-error` examples is not an oracle. Negative checks derived by the
+shared law from generated inputs are permitted.
 
 ### Name Oracle Files for Discovery
 
@@ -765,17 +770,28 @@ Modules that define the model, checker, or its history grammar also qualify.
 Identify the actual mechanism before renaming a file. A coverage-map entry,
 contract comment, or collection of fixed assertions is not sufficient evidence.
 
-An oracle file holds only oracle tests. It declares its check, model, and
-history grammar with `declareOracle` from
-`packages/db/tests/oracle-declaration.ts`. A type-level oracle names its model
-types in `typeModel`. Each part is optional. Every test in the file must use a
-declared part, directly or through a production driver, or run a generated
-property that states its law inline. A test that compares production with a
-hand-written value is a unit test: put it in an ordinary test file. The
-`oracle/no-unit-test` lint rule reports a test that does neither.
+An oracle file holds only oracle tests, and it registers them only through
+`oracleProperty`, which takes the check, model, history grammar, and driver.
+Its fixed regressions and cases are its histories, its calibrations are its
+`calibrations`, and its reach checks are its declared states. Every other
+test belongs in an ordinary test file, including a test that compares
+production with a hand-written value and a test that steps only the model.
+The `oracle/no-unit-test` lint rule reports every other registration in a file
+whose name contains `oracle` (maintainer decision, 2026-11-11).
+
+Two kinds of test files support an oracle without being oracle files. An
+`it.fails` witness of a known defect goes in an ordinary
+`<subject>-known-defects.test.ts` that reuses the oracle's driver and check;
+the coverage map records the defect as open and names the file. A spec for a
+runtime where `oracleProperty` cannot load, such as a Playwright spec or a
+suite that a WebView app bundles, is a receiving witness named `*-witness.*`:
+it compares production with its oracle owner's shared check, and every oracle
+lint rule except `oracle/no-unit-test` applies to it.
 
 Name the production code that an oracle file judges in the `owns` list of each
-`oracleProperty` call, written inline as a literal array. A law has no owner
+`oracleProperty` call, written inline as a literal array. A file that registers
+through a wrapper passes the list in the wrapper call's options literal, and
+the wrapper forwards it to `oracleProperty`. A law has no owner
 field; code ownership belongs to CODEOWNERS. The oracle rubric's
 [naming section](docs/contributing/oracle-rubric.md#name-oracle-files-consistently)
 states the form that the gap report reads.

docs/contributing/glossary.md

@@ -236,7 +236,7 @@ crossing subsystem boundaries; these comparisons are not interchangeable.
 | differential law | A law that compares observations from two production paths at a checkpoint where the contract owes the same answer. It uses no reference model. |
 | receiving path | A further production path, such as a real host, SDK, browser, or provider, that shares an oracle's reference model and refinement check. A receiving witness is the evidence that the path ran and was compared. |
 | oracle owner | The file that owns a law's judgment, as listed in the coverage map. Always qualify it; owner alone is a product term. It is not a field of the law: an `OracleLaw` has no owner, and code ownership by people and teams belongs to CODEOWNERS. |
-| owned code | The production code that an oracle file judges in the gap report, named by the `owns` list of its `oracleProperty` calls: a source file, or a function with its static call tree. A file with no inline `oracleProperty` call names it in `declareOracle({ owns })` during the migration. |
+| owned code | The production code that an oracle file judges in the gap report, named by the `owns` lists that it passes to its calls: its `oracleProperty` calls, or a wrapper's call that forwards the list to `oracleProperty`. An entry is a source file, or a function with its static call tree. |
 | decision record | A recorded maintainer decision with an id, date, scope, and text. A law or a limit cites it as its authority. Production output is never authority. |
 | limit | A declared statement of what an oracle does not establish, such as a state, dimension, production path, or comparison that it does not cover. It names an oracle owner and a decision record and reports whether it was in effect. A tool-detected hole is a gap, not a limit. |
 | gap | A hole that a tool or review detects, such as a declared state that was never reached or a mutant that survived. A reach gap closes when generated histories meet the declared state's enforced minimum under ORC-015. A mutant gap in a changed function closes with an oracle kill or an explicit maintainer allowance for its anchored gaps. Recording either as a limit does not close it. Qualify it; a sequence gap is a product term. |