diff --git a/.changeset/solid-row-snapshot-isolation.md b/.changeset/solid-row-snapshot-isolation.md
new file mode 100644
index 0000000000..55dc4367b2
--- /dev/null
+++ b/.changeset/solid-row-snapshot-isolation.md
@@ -0,0 +1,8 @@
+---
+'@tanstack/solid-db': patch
+'@tanstack/db': patch
+---
+
+Preserve Collection rows and mutation originals while Solid `useLiveQuery` updates, including nested values, live getters, callable fields, and explicit undefined fields. Keep unchanged nested elements stable and avoid repeated expansion of shared acyclic values.
+
+Preserve enumerable own source fields through Core query selection, including user symbols and inherited-name shadows. Build nested projections without changing borrowed source data or retaining fields the authored object replaces.
diff --git a/docs/contributing/oracle-coverage.md b/docs/contributing/oracle-coverage.md
index 6e5ba7182e..515939ec54 100644
--- a/docs/contributing/oracle-coverage.md
+++ b/docs/contributing/oracle-coverage.md
@@ -6230,6 +6230,155 @@ bundle erasure, Typedoc generation, tooling GREEN and restored-old-tooling
 mutants remain required receiving checks. Generated docs remain CI-owned.
 
 
+### Framework row snapshot isolation
+
+The **Frameworks** owner judges preservation of borrowed Collection values at
+actual framework boundaries. Authority is immutable updates,
+`PendingMutation.original`, `ChangeMessage.previousValue`, and the shared
+`packages/db/tests/conformance/contract.ts` result law. The shared executable
+owner is `packages/db/tests/conformance/row-snapshot-oracle.ts`. Core supplies
+admitted source facts before materialization. This relational comparison judges
+adapter preservation, not Core draft normalization or prototype policy.
+
+Nine common shapes cross one/two keys, callback/config/supplied Collection
+inputs, and sync/optimistic writes: 108 histories per common driver. Solid adds
+native stores for 120 histories, plus 60 real local-only histories. React has two
+registrations of its derived-identity API, labelled `react` and
+`react (dependency list)`; neither is a DbClient receiving driver. Two-key
+histories share initial containers and alternate updates. Actual mutable sharing
+is asserted before crediting cross-row alias reach: eight common histories and
+nine Solid histories per group. The later-object shape starts at null and gets
+no mutable-alias credit. Three updates per key distinguish initial and later
+admissions, alias split/merge, hidden string data, inherited-name shadows, and
+own-undefined/omission. The grammar contains 828 history slots across 45 group tests, including the
+duplicate React API registration.
+
+Every receiving group asserts its own reach. The shared comparison checks
+complete current framework and source values, retained initial `get()` and
+admitted `change.value` references, `previousValue`, and actual transaction
+`original` references at every existing cut. Optimistic handlers also have a
+held cut. Three isolated source-corruption controls reject damage limited to
+current, initial, or newly admitted values. A real Solid fault injection is
+rejected at the current-source comparison, even when its detached output is
+correct. The local-only driver returns actual mutation receipts.
+Alternative legal source-shape policy is accepted. Original-only corruption and
+cross-row caching mutants distinguish the extended owner from its predecessor.
+
+Solid's separate receiving owner,
+`packages/solid-db/tests/row-materialization-oracle.test.tsx`, judges nested
+identity, binding lifetime, current array membership, live nested getters, and
+bounded shared-graph work. Its original 85 finite histories include real `For` and effect
+consumers, native-store-only writes, reorder, growth/shrink/empty arrays, getter
+admission/replacement/omission/readmission, and crossed old/new graph sharing.
+The maintainer chose live getters and efficient shared acyclic graphs on
+2026-10-30, with cyclic support decided separately. Work counts source and owned
+container enumerations against an unchanged 32-per-distinct-container budget.
+This is a bounded regression check, not a public SLO or a complexity proof.
+
+The native-store revision skips unchanged source rows and memoizes immutable,
+detached nested stores by source identity within each row. Solid setters update
+the ordinary stable root row and replace changed nested containers. Consumers
+must read the current nested path reactively: a captured old nested proxy does
+not follow replacement. Native stores supply getter tracking and notifications.
+Explicit root own-key admission handles inherited-name and own-undefined cases.
+The complete graph comparison checks mixed paths without imposing alias identity.
+Twelve additional controlled-helper histories vary descriptor visibility for
+undefined, null, scalar, object, array, and native-store payloads. They observe
+captured-root `Object.keys` consumers across unchanged, hidden, visible, and
+restored-visibility stages while retaining payload and root identity. The raw/proxy
+identity guard fails six container histories before repair. These histories
+test only the materializer's internal invariant. Core public row snapshots
+normalize root descriptors, so no public descriptor-admission claim follows.
+Valid derived array-wrapper prototypes retain source methods, and local-only
+original reach requires a nonempty actual receipt. See the
+[native revision review](oracle-reviews/2026-10-30-solid-native-store-review.md)
+and the historical [materialization](oracle-reviews/2026-10-30-solid-row-materialization-review.md)
+and [snapshot](oracle-reviews/2026-10-30-solid-row-snapshot-isolation.md) records.
+
+**Core source-field and destination preservation:** the maintainer authorized
+fixing the sibling Core boundary in this PR. The existing context-transport
+owner now imports its public-field model/grammar from
+`packages/db/tests/conformance/public-field-oracle.ts`. Sixty histories cross
+six source keys, root/nested location, four selection forms, five stages, and
+ordinary/inherited nested destinations. Root Collection and three correlated
+forms supply 1,200 path/stage observations; the original 819 observations remain.
+The source admission check precedes result comparisons. Five restored wrong
+merge/destination designs fail intended own-field assertions. Real framework
+callback/config receivers reuse the same models and comparison for twelve
+new destination cells per input. Fourteen groups across seven registrations
+supply 168 histories / 840 comparisons. Core creates own enumerable data fields
+and own destination containers; unsafe authored alias paths retain rejection.
+The final [review record](oracle-reviews/2026-10-30-solid-native-store-review.md)
+records RED, GREEN, mutant classifications, reviewer outcomes, and exact code.
+
+The second independent review extends the same public-field owner with thirty
+overlap cells. Twenty-four legal expression cells reach every framework input;
+six functional controls supply a second Core formulation. A prior outer spread
+borrows the destination before a nested spread, literal field, or dotted alias
+writes it. Ordinary, inherited-name, and deeper destinations cross writable
+configurable/nonconfigurable source data. Authored nested objects replace their
+field; dotted aliases preserve siblings without writing through source objects.
+The four Core paths supply 120 path histories and 360 result cuts. Fourteen real
+framework groups supply another 336 histories and 1,008 result cuts. All compare
+current and retained source rows and require the actual source descriptor at
+all three stages. Existing 819 and 1,200 observations and the earlier receiving
+histories remain. Unkeyed functional projections are not legal derived-identity
+framework inputs, so they receive no framework handoff credit. Legal fresh-object
+expression controls provide those neighboring receiving comparisons instead.
+See the [second review record](oracle-reviews/2026-10-30-solid-oracle-review-round-two.md)
+for complete intake, RED gates, GREEN, hostile variants, and bounded closure.
+
+The same review adds six ordinary/subclass-array overlap cells. Dotted writes
+select lengths zero, one, and two while current and retained source arrays keep
+length three. Core now has 36 overlap cells / 144 path histories / 432 selected
+cuts. The fourteen real receiving groups each run thirty cells: 420 histories
+and 1,260 selected cuts. Each history independently requires all twelve declared
+checkpoints. Post-admission mount errors are recorded and later stages retry
+mounting; they cannot escape the shared comparison or supply false reach.
+
+Solid adds 93 actual receiving histories to its original 85: 24 native-parent
+identity transitions, 33 tracked callable data/getter histories, eighteen
+reserved-field histories, and eighteen inherited array-method histories. All
+three public inputs supply their own source admission and tracked consumers.
+The reorder comparison now checks complete current/rendered values and every
+element identity. A canonical backing-node memo preserves unchanged children
+across ordinary/native parent changes; a read facade retains live accessors and
+prototype methods while native nodes/setters supply updates. Original-code,
+missing-node, accessor/method, and reordered-tail mutants distinguish these
+repairs. No output alias topology or public elapsed-time budget is imposed.
+
+The local-only draft driver does not claim top-level symbol-write admission.
+Its shared preservation comparison still checks every field actually admitted,
+including nested symbols and all actual mutation originals. The proxy-revert
+owner excludes top-level symbol writes explicitly; **Drafts and native values**
+and [#1820](https://github.com/TanStack/db/issues/1820) own that support decision.
+The minimal trace assigns a fresh enumerable root symbol and nested symbol
+through `Collection.update`: the root is absent from the modified/source row,
+the nested symbol survives. Current and clean-main traces agree. Initial data
+admits both. No adapter or Core-selection claim extends through this missing
+source premise.
+
+Limits: the stated finite histories and real hosts' settled/held-handler cuts.
+Core normalization, arbitrary cycles, arbitrary getter/setter bodies, hidden
+symbols, all descriptor-visibility notification combinations, callback atomicity,
+other settlement schedules, and real browser rendering are not established.
+Core may evaluate root getters before the adapter receives them. The live
+getter claim covers nested accessors actually admitted to Solid. Cycle policy
+remains a separate maintainer decision, as explicitly requested. Existing
+framework, includes, and optimistic-history owners retain other responsibilities.
+
+The **Drafts and native values** owner retains an unresolved Core boundary:
+assigning a native Solid store through `Collection.update` can promote hidden
+host bookkeeping symbols during Core detachment. Support policy for that
+host-proxy assignment needs a maintainer decision before classification as a
+product-law violation. The needed receiving witness is actual `createStore`
+into `Collection.update`, distinguishing user keys from wrapper metadata in
+stored and retained values. Local-only histories use ordinary replacements
+after initial admission. Controlled sync histories admit native stores on
+every update and cover direct adapter input.
+
+
+
 ### Distinct collision review extension (2026-10-30)
 
 The existing distinct incrementalization owner now also generates four unequal
diff --git a/docs/contributing/oracle-reviews/2026-10-30-solid-native-store-review.md b/docs/contributing/oracle-reviews/2026-10-30-solid-native-store-review.md
new file mode 100644
index 0000000000..ea1fff257f
--- /dev/null
+++ b/docs/contributing/oracle-reviews/2026-10-30-solid-native-store-review.md
@@ -0,0 +1,314 @@
+# PR 2307: native stores and oracle review
+
+This record covers code commit `2e962b1797e69066de52344fad9ea71811bc843e`. It supersedes the implementation
+account at published head `ca5597803ac385a945105785c498f28d7082488f`.
+Documentation-only commits can follow this code commit. Source SHA-256 at that commit:
+
+- Solid materializer: `2aa43e691bf9a84101cd3ed92fbdfc28601d01523261b217ff1c0a9ed79443cb`.
+- Core select compiler: `959faf4dc755cf381af07e1381730ce5ac5b78e1a6544992e61c5cd872523a8d`.
+
+Historical findings and experiments remain in the
+[materialization review](2026-10-30-solid-row-materialization-review.md) and
+[snapshot review](2026-10-30-solid-row-snapshot-isolation.md).
+
+## Laws and accepted design
+
+Framework materialization borrows Collection values. It preserves admitted user
+values and retained `Collection.get`, `ChangeMessage.previousValue`, and actual
+`PendingMutation.original` references. Authority is immutable updates, those
+public snapshot contracts, and the shared framework result contract. Core source
+admission supplies a premise, not an expected normalization algorithm.
+
+The maintainer chose live nested getters, efficient shared acyclic graphs, and
+native stores. Changed nested source containers may replace their owned proxy.
+Consumers must read the current path reactively. Captured old nested proxies
+need not follow replacement. Unchanged source containers retain identity.
+Ordinary root data rows stay stable. Core can evaluate root getters before
+adapter admission. Cyclic support remains a separate maintainer decision.
+
+Core selection preserves enumerable own source fields, including user symbols
+and ordinary inherited-name shadows. Authority is live-queries.md's "Include
+all user fields" and live/ARCHITECTURE.md's public-boundary preservation.
+Accepted nested destinations such as `toString` are ordinary own fields.
+Authored unsafe alias-path restrictions remain separately enforced.
+
+## Implementation and shipped size
+
+The Solid helper is 136 formatted lines, down from 330. A per-row WeakMap
+memoizes detached immutable nested native stores by source identity. Native
+stores supply getter tracking and notifications. Root setters replace changed
+nested values. An own-key shim handles inherited names, explicit undefined,
+omission, and descriptor visibility. Root accessor rows may replace their wrapper.
+Unchanged source rows return before copying, although whole-result iteration
+still visits rows. No constant-time whole-hook claim follows.
+
+The same externalized hook bundle uses 4,789 minified / 2,026 gzip bytes,
+compared with 6,825 / 2,714 for the previous custom implementation: savings of
+2,036 minified / 688 gzip bytes. The originally reviewed cut used 3,988 / 1,797.
+These are isolated hook measurements, not release-package size or app timings.
+
+Core uses one own-enumerable-field copy helper for both merge branches. It
+creates data properties rather than invoking inherited setters. Nested merges
+create missing own destination containers before reading them. This also fixes
+silent omission at an accepted `toString` destination without changing authored
+alias rejection or the existing handling of conflicting own scalar fields.
+
+## Review ledger and repairs
+
+The original F1-F10, S1, and R1-R4 retain their raw claims, evidence, and verdicts
+in the historical review. Native stores replace their earlier reconciliation
+mechanisms while retaining their laws. Original ten-item totals remain nine
+`fixed-now` and one `accepted-design` for the explicitly separate cyclic policy.
+S1 and R1-R4 remain five `fixed-now` items.
+
+| ID | Challenged claim | Final disposition and durable improvement |
+| --- | --- | --- |
+| O1 | Exact direct array-prototype identity rejects legal derived wrappers. | `fixed-now`: inherited capability and independent subclass-method result, positive wrapper plus lost/wrong-method controls. |
+| O2 | A null starting value receives mutable-alias reach credit. | `fixed-now`: require actual nonnull shared source identity before credit. |
+| O3 | The second React registration supplies DbClient evidence. | `fixed-now`: both registrations use derived identity. Current claims and historical corrections say so. No DbClient credit. |
+| O4 | Empty mutation receipts receive original reach without observations. | `fixed-now`: draft sources require nonempty actual receipts. Empty-receipt rejection calibration. |
+| O5 | Inherited-name own admission can become undefined. | `fixed-now`: shared inherited-name grammar and explicit own admission before native setter comparison. |
+| O6 | Changed source elements must remount exactly twice. | `fixed-now`: compare current values at replacement, then constrain subsequent unchanged admissions. The approved law permits native retained-element updates. |
+| O7 | Extreme graph paths miss interior corruption. | `fixed-now`: complete value/shape comparison with pair memoization and three mixed-path corruption controls. |
+| S2 | Native stores can replace custom reconciliation if changed nested proxies may replace. | `accepted-design`: explicit maintainer approval. Current-path consumers and unchanged-source identity remain tested. |
+| O8 | Core loses an own root `__proto__` source field. | `fixed-now`: own field creation, root/nested selection and all receiving paths. Maintainer explicitly authorized fixing Core in this PR. |
+| O9 | A nested cleanup failure skips root cleanup in the new Core driver. | `fixed-now`: nested existing cleanup helpers. Actual fault injection preserves the error and attempts both cleanups. |
+| O10 | Object.entries also omits enumerable user symbols. | `fixed-now`: own-key enumeration plus enumerable filtering. Symbol field grammar distinguishes string-only fixes. |
+| O11 | Newly required root-symbol draft admission is an unsupported premise. | `fixed-now`: require that admission only for controlled sync sources. Every actual admitted-value/current/retained/original comparison remains. Drafts/proxy-revert and #1820 own top-level symbol-write policy. |
+| O12 | An accepted nested `toString` destination is skipped as an inherited function. | `fixed-now`: create an own destination before lookup. Destination grammar and same-model real-host receivers cover direct and deeper containers. |
+
+This round accounts for twelve oracle findings and one approved native design.
+Across F1-F10, S1, R1-R4, O1-O12, and S2: **28 items = 26 fixed-now + two
+accepted-design**. No item in this declared repair boundary remains open.
+Separate pre-existing policy/lifecycle boundaries below retain their owners.
+
+## Oracle-first experiments
+
+Before native adoption, the extended shared grammar failed inherited-name
+preservation on the unchanged 330-line helper. The five neighboring adapters
+passed nested-shadow controls. Fifteen shared calibrations and three mixed-path
+controls passed before the production switch. The first native full suite
+passed 226 tests. Later root-shadow histories exposed O8/O10 in common Core.
+
+Before the Core field-copy edit, its expanded owner gave six failed and 138
+passing tests, without type errors. Both `__proto__` and user symbols failed at
+root spread, root whole-row, and nested spread. Four public paths at admission,
+own undefined, and readmission yielded 72 intended own-field mismatches.
+All six real framework gates failed callback/config field preservation while
+direct Collection controls passed. Actual source symbol admission was checked.
+
+O12 was discovered during final production review. The first deeper-destination
+builder accidentally authored the literal key `wrapper.toString`, while the
+model required a nested wrapper. That failure was a driver/model mismatch and
+receives no deep-path RED credit. A candidate production edit passed the direct
+`toString` cases but exposed this mismatch. The candidate was removed, both
+builders were corrected to actual nested objects, and the unfixed compiler was
+rebuilt. The corrected pre-edit owner then failed all twelve destination cells
+at intended own-field comparisons, with 144 controls passing and no type errors.
+Every real framework callback/config receiver also failed its intended
+comparison before the final destination repair. Earlier invalid deep-path
+experiments are not substituted for these actual-path results.
+
+The public-field model and grammar now live in the directly named companion
+`packages/db/tests/conformance/public-field-oracle.ts`. The original Core owner
+still executes root Collection plus correlated Collection facade, `toArray`,
+and `materialize` drivers. Framework receivers reuse the same scalar models,
+stages, and complete row comparison through their own source/mount/flush realm.
+
+## Reach and final GREEN
+
+Shared snapshot coverage retains nine common shapes and ten Solid shapes,
+one/two source keys, three updates per key, three inputs, and sync/optimistic
+writes. Common groups have eighteen histories, Solid groups twenty. Solid adds
+sixty real local-only histories. There are 828 history slots across 45 groups,
+including the duplicate React API registration. Every group guards its own
+reach. Mutable alias counts are eight common / nine Solid per group. Local-only
+original reach requires actual nonempty mutation receipts.
+
+The Solid-specific owner retains 85 histories: 24 identity/lifetime, twelve
+reorder, twelve resize, 24 getters, and thirteen graphs. Three additional tests
+calibrate mixed-path graph judgment. Work is captured before graph comparison
+and retains the 32-enumerations-per-distinct-container budget unchanged.
+
+The Core public-field family has sixty histories and 1,200 path/stage
+observations. Its original 819 other observations remain intact. Each cell guards
+its four paths and five stages. Six source keys cross root/nested location and
+four selection forms. Only nested spread varies destination: `payload`,
+`toString`, or actual nested `wrapper.toString`. Removing an axis loses a merge
+branch, ownness distinction, source-key class, or receiving boundary. Invalid
+unsafe authored aliases remain rejection controls. Bounds are one source row,
+one matching parent, scalar strings/undefined, and five stages.
+
+Additional framework destination receivers run twelve histories per input,
+five stages per history, through callback and config on each actual host.
+Each group asserts twelve histories per stage and six per destination. Fourteen
+groups across seven registrations supply 168 histories and 840 comparisons.
+Direct Collection has no authored destination and remains a snapshot control.
+React's two registrations are the same API, not independent semantic coverage.
+
+Final local results, all with `--maxWorkers=2 --coverage.enabled=false`:
+
+- Complete Solid package: **228 passed**, no type errors.
+- Core/query neighborhood, eight files: **344 passed**, no type errors. Includes
+  complete context-transport owner, select/alias controls, public-container copy,
+  user values, functional projections, and fifteen snapshot calibrations.
+- Snapshot receiving groups: React twelve, Preact/Vue/Svelte/Angular six each,
+  and Solid nine all pass. New destination receiving groups: React four and
+  each other adapter two all pass.
+- Builds for Core/dependencies and Solid pass. Changed TypeScript ESLint,
+  formatting, `pnpm lint:changed`, and diff checks pass. No budget was lowered.
+
+Svelte initially read stale built Core through package exports. Independent
+source-alias checks passed six groups. Rebuilding Core made the normal Svelte
+command pass. That stale run receives no repaired-code GREEN credit.
+
+Top-level symbol writes through Core drafts are outside the accepted source
+premise. Current and clean-main traces both drop the new root symbol while
+preserving nested symbols and own undefined. Initial data admits both. The
+existing proxy-revert oracle explicitly states that top-level symbols are not
+written, and Drafts/#1820 owns the policy. No actual admitted-value comparison
+was removed, and no local-only root-symbol-write reach is claimed.
+
+## Hostile checks and independent review
+
+Temporary production mutants restore source in `finally`. On the final owner:
+
+- Old root merge rejects root source-field comparisons.
+- Old nested merge rejects nested source-field comparisons.
+- String-only copying rejects user-symbol comparisons.
+- Ordinary assignment rejects `__proto__` ownness comparisons.
+- Removing own-destination creation rejects direct and deeper destination cells.
+
+All five reach intended assertion failures without type errors. The original
+native calibration also rejects missing source memo reuse (24 identity/reorder
+histories), omitted `toString` own admission, exact-prototype overconstraint,
+empty-receipt credit, and extreme-path-only graph checking. Removing all own
+admission caused a post-setup proxy runtime failure, not an assertion kill. An
+earlier selector skipped all tests and receives no credit.
+
+Four independent oracle reviewers found O1-O7 and the Core sibling O8. Native
+reactivity and graph follow-ups each passed ninety focused tests with no new
+finding. Production review independently passed ninety Solid tests and thirteen
+Core controls, then found O12. The receiving reviewer reproduced O8/O10,
+calibrated O9, confirmed O11's existing authority, and reviewed the final companion
+extraction. Its five final probes pass: real Solid callback/config reach,
+corrupted-output rejection, preservation of primary plus cleanup diagnostics,
+and source cleanup for all twelve mount failures.
+
+Hire recommendation: yes for all four oracle reviewers and the production
+reviewer. They supplied executable counterexamples, challenged overconstraints
+and false reach, and distinguished driver faults, policy choices, and product
+violations. Green bounded tests did not become universal correctness claims.
+
+## Guide audit and limits
+
+| Requirement | Final evidence |
+| --- | --- |
+| ORC-001 | Public snapshot/source-field authorities and explicit native/getter/acyclic decisions above. |
+| ORC-002 | Immutable admitted-source facts, scalar stages, and independent explicit selected shapes. No compiler path walker computes expectations. |
+| ORC-003 | Literate contract/model/grammar/path/comparison prose accompanies both owners and the directly named companion. |
+| ORC-004 | Reconstruction, axis ablation, bounds and invalid authored-path controls above; exact product/uniqueness calibration remains. |
+| ORC-005 | Actual source admission, Core four paths and real host cuts. No missing source fact identified in this finite domain. |
+| ORC-006 | Original REDs, final five production mutants, wrong-result and cleanup calibrations. Outcomes are classified above. |
+| ORC-007 | Not applicable to finite bounded enumeration. Named cases provide direct replay. Existing random campaign budgets remain unchanged. |
+| ORC-008 | Retained source versions remain distinguishable by later updates. Core field computation is stateless. |
+| ORC-009 | Source Collection, live-query Collection, materialization forms and host cuts retain glossary terms. Version is only the model's stage selector. |
+| ORC-010 | Independent cleanup attempts preserve exact primary and secondary failures; actual Core and framework fault injections pass. Arbitrary constructor-failure combinations are not established. |
+| ORC-011 | The shared-normalization fault is removed by relational source facts and alternate legal-source calibration. Projection forms are controls, not claimed independent reference models. |
+| ORC-012 | Exact code commit, source hashes, every requirement, dispositions and finite closure boundary appear in this versioned record. |
+| ORC-013 | Own undefined/omission/readmission, source location, direct/deeper destinations, and ordinary-name controls distinguish narrow wrong fixes. |
+| ORC-014 | Every required actual host supplies its own source/mount/flush premise before each final production repair. No provider or browser-rendering evidence is claimed. |
+| ORC-015 | Per-group and per-cell guarded reach and concrete counts above. Invalid literal-dotted driver experiments receive no deep-path credit. |
+| ORC-016 | Fixed cells use the shared models and comparisons. Checker controls supply deliberately wrong observations. Supplemental examples remain ordinary tests. |
+
+Closure is bounded by these contracts, finite histories, production paths,
+and synchronous Core or settled/held-handler framework observations. It does
+not establish arbitrary cycles, deep recursion, getter/setter bodies, hidden
+symbols, every descriptor visibility notification, callback atomicity, other
+settlement schedules, browser rendering, or external-provider behavior.
+
+Native Solid proxy assignment through Core drafts remains a separate Drafts
+support-policy question. Cycles remain the maintainer's separate decision.
+The lifecycle publication counterexample at seed `-1439698414`, path `1:22`,
+reproduces on clean main and remains separately tracked by the maintainer's
+explicit decision in [#2310](https://github.com/TanStack/db/issues/2310).
+This PR's Core change concerns selection, not publication expectations.
+Final pushed-head CI/review status belongs to the PR and is separate from these
+local verification results.
+
+## Integration with main
+
+Main advanced to `0531c50ad419a1b51ad3e27e3632e70be3c6bdb3` before publication.
+The merge conflict was confined to appended coverage-map sections. Both the
+framework/selection evidence and main's distinct-collision evidence remain.
+The production file hashes above are unchanged. The combined tree passes the
+Core/dependency build, 344 Core/query tests, all 228 Solid tests, and snapshot
+plus destination groups on all six adapters, without type errors. Changed-oracle
+lint and diff checks pass. This tests integration with main's Effect and D2
+changes without revising their laws or the separate counterexample owners.
+
+## Later CodeRabbit visibility finding
+
+This follow-up covers code commit `213a55f8b`. It leaves the Core compiler
+unchanged. The independent reactivity reviewer found no blocking issue in the
+new helper-only comparison or the one-line repair.
+
+Review `5718065479` covered `3ca65a6a1`; inline `4428014103` identified a
+raw/proxy comparison in the root descriptor-visibility branch. The same source
+was present after merge commit `11b42a11f`. The claim is correct for the internal
+materializer: an unchanged nested payload becomes a native proxy, while the
+current raw row contains its unwrapped node. Changing only enumerability then
+skipped a native write and left captured-root `Object.keys` consumers stale.
+
+Public-path probes did not supply this premise. Direct sync input and functional
+projection through callback, config, and supplied live-query Collection inputs
+omit the hidden root field before adapter admission. Core's public row snapshot
+enrichment spreads the row, normalizing root descriptors. The snapshot in
+`sync.ts` is a reused-row guard, not the admission copy. These probes are missing
+public premises, not public-hook RED evidence. No public descriptor-admission
+promise follows from this repair.
+
+The internal invariant preserves the helper's existing data-descriptor behavior
+and native shape notifications. Twelve helper histories cross six payload kinds
+with both initial visibility flags. Fresh immutable roots retain one payload
+through unchanged, toggled, returned, and toggled visibility. The independent
+comparison derives visible keys from the flag and observes a real Solid render
+effect on the captured stable root. It also checks current keys, retained source
+descriptors, payload identity, and root identity at each settled host cut.
+
+Before the production edit, the extended owner rejected six object, array, and
+native-store histories at the intended enumeration assertion. Six scalar, null,
+and undefined controls passed. The repair compares against `unwrap(value)` in
+the existing visibility guard. This changes one line and lets the existing
+setter restore the exact admitted payload after its notification pulse.
+
+All 240 Solid tests pass without type errors. The old raw/proxy guard mutant
+again fails the six container histories at the same assertions, with six
+controls passing and no type errors. The source is restored afterward. Solid
+build, changed-file ESLint, `pnpm lint:changed`, and diff checks pass. Each of
+the twelve histories guards unchanged, hidden, visible, and restored visibility.
+The externalized hook now uses 4,792 minified / 2,024 gzip bytes at gzip level 9.
+The same command on the parent produces 4,789 / 2,026. The helper remains 136
+lines. Its new SHA-256 is
+`4041a16af2f55e47f952fba1979796e2410be6c90102c86d52556530eb5d3ed9`.
+Core's source hash is unchanged.
+
+Guide audit for this extension: ORC-001/002 use the internal descriptor invariant
+and independent visibility flag. ORC-003 keeps the model, grammar, driver, and
+limits beside the family. ORC-004 reconstructs both visibility directions and
+separates scalar controls from wrapped containers; accessor and mutable-source
+updates are excluded. ORC-005/014 claim only the real Solid helper boundary and
+record the absent public premise. ORC-006/013 use the six REDs and restored
+wrong-guard mutant. ORC-007 does not apply to finite enumeration. ORC-008 has no
+stateful reference change. ORC-009 uses existing terms. ORC-010 uses the existing
+failure-preserving lifetime. ORC-011 has no identified shared semantic fault:
+the visibility flag and JavaScript key enumeration are separate formulations.
+ORC-012 records exact source hashes and outcomes here. ORC-015 guards every
+declared state per history. ORC-016 runs one reusable comparison over the grammar.
+
+The reviewer found a valid internal edge case but did not establish a public
+receiving path. The suggested unconditional pulse is broader than necessary;
+the one-line unwrapped comparison preserves existing scalar behavior. Hire
+recommendation remains yes for useful source analysis, with that reach limit.
+This adds C1 as `fixed-now`: **29 items = 27 fixed-now + two accepted-design**.
+The earlier 28-item audit remains unchanged as historical evidence.
diff --git a/docs/contributing/oracle-reviews/2026-10-30-solid-oracle-review-round-two.md b/docs/contributing/oracle-reviews/2026-10-30-solid-oracle-review-round-two.md
new file mode 100644
index 0000000000..cfcf7311d2
--- /dev/null
+++ b/docs/contributing/oracle-reviews/2026-10-30-solid-oracle-review-round-two.md
@@ -0,0 +1,272 @@
+# PR 2307: second independent oracle review
+
+Five independent reviewers used `oracle-review` on code commit
+`77c27a9d9031d58362d779d029cebd4928238e81`, against base
+`0531c50ad419a1b51ad3e27e3632e70be3c6bdb3`. The evaluation used
+`evaluate-review`. This record supplements the earlier
+[native-store review](2026-10-30-solid-native-store-review.md); its historical
+findings, decisions, and process qualifications remain intact.
+
+## Laws, experiments, and repairs
+
+**Borrowed source values remain unchanged.** Immutable updates,
+`PendingMutation.original`, `ChangeMessage.previousValue`, and the shared
+framework result contract supply authority. The snapshot owner previously
+checked retained rows but could miss corruption confined to the latest source
+row. A fault control passed twenty actual Solid histories despite fifteen
+corrupted source containers. Three controlled variants also escaped the old
+checker: current source, newly admitted change value, and initial borrowed row.
+
+The owner now captures initial and admitted references before materialization
+and compares current source rows at every initial, held-handler, and settled
+cut. Expectations remain earlier admitted facts, independent of adapter code.
+All 45 receiving groups / 828 finite histories and eighteen calibrations pass.
+Each group requires complete reach for all three added observations. The same
+real Solid fault control now fails at `current source row a`, 999 versus 3.
+
+**Current tracked consumers observe admitted user values.** The Solid overview
+promises reactive updates; the shared framework result contract preserves user
+fields. Existing accepted values include functions, inherited-name shadows,
+null-prototype nested objects, and live nested getters. Untracked comparisons
+did not test their interaction in a real Solid consumer. Native callable reads
+could throw through a shadowed `hasOwnProperty`, and stable-root replacements
+could leave callable or `__proto__` consumers stale. Inherited array methods and
+callable getter results supplied adjacent witnesses.
+
+The primary Solid owner adds 33 callable, eighteen reserved-field, and eighteen
+array-method histories across callback/config/supplied-Collection inputs. It
+checks actual tracked function identity, receiver-sensitive results, signal-only
+changes, omission/readmission, exact helper-name shadows, source preservation,
+and quiet unrelated consumers. Source-admission premises precede receiving
+credit. Root getters remain subject to Core admission; nested callable getters
+are the live-getter witness.
+
+Native setters and nodes still own updates. A read facade handles live accessor
+results and inherited methods without invoking Solid's user-shadowed helper.
+Admission seeds native data nodes for callable data and the reserved field.
+Bookkeeping identities and resource tracking remain transparent.
+
+**Unchanged admitted children retain identity and complete values.** The
+maintainer's native-store decision permits replacing changed nested containers,
+while unchanged source containers retain identity. Twenty-four added histories
+cross one/two array levels, three inputs, and ordinary/native parent transitions.
+Twelve wrapper-switching histories failed before repair; twelve same-wrapper
+controls passed. Source child identity is asserted before checking actual `For`
+mounts. Memo lookup now uses the canonical native backing node.
+
+The existing reorder check also ignored tail values. Two reviewers independently
+showed a wrong native setter could publish `[10, 99]` instead of `[10, 0]` while
+all 240 original Solid tests passed. Every reordered element's current scalar,
+identity, and rendered position is now compared using immutable admitted facts.
+All twelve original reorder histories reject that mutant at value assertions.
+No production reorder repair was necessary.
+
+**Selection constructs results without modifying borrowed source paths.**
+Authority is the select/spread guide and live materialization's pure-composition
+law. Nested authored objects replace earlier fields; dotted paths preserve
+unrelated siblings. The old grammar tested root and nested selection separately.
+Their overlap exposed source mutation, nonconfigurable-input redefinition, and
+incorrect retention of fields absent from an authored replacement object.
+
+The existing public-field companion now supplies thirty overlap cells: three
+destinations, four expression operations, two source descriptor policies, plus
+six functional Core controls. Four Core paths use fresh independent sources.
+Twenty-four legal expression cells also use every real framework callback/config
+driver. Each cell checks selected output, current source, retained source, and
+descriptor admission at three stages, with twelve required checkpoints.
+Unkeyed functional projections remain Core-only because they lack the stable
+query identity required by React and Preact. Fresh expression controls supply
+the receiving neighbors instead.
+
+Before production edits, Core reported eighteen failures and 168 passing tests.
+Every one of fourteen actual receiving groups reported eighteen failing overlap
+cells and six passing controls. The repair emits fresh-object operations for
+authored nested objects and shares one output-ownership resolver between nested
+spreads and dotted writes. It copies borrowed paths before modifying them.
+No descriptor-specific workaround weakens source preservation.
+
+A follow-up review found E2: defining a configurable `length` on an owned array
+throws. Six additional ordinary/subclass-array cells cross the same three
+destinations and selected lengths zero, one, and two. Before that repair, all
+six failed on Core and every receiving group; old controls passed. Source
+length and intrinsic descriptor premises remained intact. The driver records
+post-admission mount errors and continues each stage's comparisons, so an early
+throw cannot evade reach accounting. The writer preserves existing own property
+attributes when changing its value; new output fields retain ordinary attributes.
+
+## Lossless finding ledger
+
+IDs retain reviewer source order; independently reported duplicates remain rows.
+Severity is P2 for behavioral findings. Scope notes do not assert product bugs.
+
+| ID | Original claim | Evaluation and action | Durable owner or value |
+| --- | --- | --- | --- |
+| S1 | Newly current borrowed source escapes snapshot comparison | `fixed-now`; controlled and real-host fault rejection | Shared snapshot owner; current/initial/admitted references at every cut |
+| G1 | Native/ordinary parent switch remounts unchanged child | `fixed-now`; twelve REDs and twelve controls before canonical memo repair | Solid native-parent grammar and actual `For` observations |
+| F1 | Overlapping nested spread redefines nonconfigurable source data | `fixed-now`; all Core/receiving paths reject old compiler | Public-field overlap grammar and output ownership |
+| F2 | Overlapping writes mutate current and retained source rows | `fixed-now`; baseline age did not waive the defect | Same owner; current and retained source comparisons |
+| R1 | Tracked callable reads crash or stay stale with helper-name shadows/null prototypes | `fixed-now`; actual three-input receiving histories | Solid callable grammar, exact shadow and tracked-result comparisons |
+| R2 | Reorder comparison misses tail corruption | `fixed-now`; full value/render comparison rejects twelve cases | Solid reorder owner |
+| E1 | Independent second-element corruption survives complete package | `duplicate` of R2; complete 240-test survivor retained as evidence | Same repair; no separate production defect inferred |
+| E-H1 | Initial historical local-only gate followed first repair | `stale`; recorded historical process variance, not retroactively repaired | Earlier snapshot record; subsequent repairs require receiving RED before edits |
+| G-N1 | Module-global immutable memo survives selected tests | `accepted-design`; bounded survival does not imply a forbidden output-alias topology | Approved immutable nested replacement law; preserve implementation freedom |
+| S-N1 | Snapshot owner does not compare keyed state | `accepted-design`; keyed state remains in neighboring shared result laws | Do not expand this partial preservation claim into whole-adapter proof |
+| R1a | Live getter returning callable defeats data-node-only fix | `fixed-now`; separate signal-only result histories | Same callable owner; accessor-result read facade |
+| R1b | Own reserved root field misses first tracked replacement | `fixed-now`; initially absent/undefined/value and omission/readmission cases | Same Solid owner; cold native-node admission |
+| F3 | Flattened nested literal retains earlier spread fields | `fixed-now`; flatten-only mutant fails selected shape with sources intact | Public-field fresh-object replacement model |
+| R1c | Inherited array/subclass methods fail behind helper-name shadows | `fixed-now`; eighteen histories include omission/readmission neighbors | Same Solid owner; method reads use exposed receiver |
+| E2 | Dotted array-length write throws after ownership repair | `fixed-now`; six added cells fail before repair on Core and every host | Same public-field owner; intrinsic writable-field range |
+
+Totals: **15 items = eleven fixed-now + one duplicate + one stale + two
+accepted-design**. No review item is deferred or left confirmed-open. The stale
+process item cannot be erased by a later passing run. No new law decision was
+required. Raw reviews, probes, and the append-only intake ledger are task-local
+under `/private/tmp/issue-2305-audit/review-11/`; the decisive evidence is recorded
+here so the conclusion does not depend on those temporary files.
+
+All five reviewers merit a hire recommendation within their scopes. Each
+supplied executable counterexamples, distinguished oracle faults from shipped
+defects, and retained relevant controls. Reactivity and field reviewers found
+baseline defects without dismissing them. The independent reorder findings
+corroborate one gap rather than inflating the distinct-defect count. Suggested
+repairs were useful, but the data-node-only candidate was incomplete for getter
+results, and runtime failures receive no assertion-calibration credit.
+
+## Guide conformance and finite limits
+
+| Requirement | Evidence or applicability |
+| --- | --- |
+| ORC-001/002 | Public immutable/result/projection contracts and explicit maintainer decisions; expected admitted facts/scalar shapes do not use production materialization or compiler logic. |
+| ORC-003 | Each changed owner explains its contract, model, finite grammar, real entry point, observations, and checkpoint beside executable code. |
+| ORC-004 | Added dimensions reconstruct every reported witness. Removing overlap, native-parent switching, callable/getter/method values, or the current-source cut loses a demonstrated counterexample. Bounds and controls appear above. Unsafe alias paths and invalid unkeyed functional receiving inputs remain rejected. |
+| ORC-005 | Actual source admission precedes each receiving assertion. Current, retained, rendered, and tracked observations remain distinct. E2 mount failures are recorded after source admission, not treated as setup success. |
+| ORC-006 | Original implementations, narrow wrong repairs, current-source corruption, and reordered-tail corruption are rejected. Runtime errors, assertion failures, surviving equivalent designs, and setup failures are recorded separately. |
+| ORC-007 | New histories use bounded enumeration. No sampled campaign was added, and no existing run budget was lowered or removed. |
+| ORC-008/009 | Retained facts distinguish later corruption; native source identity distinguishes unchanged children. Stage numbers are model-only selectors. Shared concepts use glossary terms. |
+| ORC-010 | Existing independent resource cleanup and primary/secondary error preservation remain. E2 records mount failures and retries later stages without fabricating a handle. |
+| ORC-011 | Functional Core projections independently challenge expression overlap. Relational source facts and alternate legal-source calibrations avoid coupling expectations to Core normalization. |
+| ORC-012 | This versioned record retains findings, exact source identity, chronology, finite evidence, and limits. |
+| ORC-013 | Same-wrapper controls, data/getter controls, omission/readmission, fresh-object/dotted updates, and zero/one/two array lengths distinguish nearby wrong rules. |
+| ORC-014/015 | All three Solid inputs and every required real framework callback/config path ran before their production repair; each declares its own reach. Helper visibility and supplied-Collection graph work retain their earlier narrower claims. |
+| ORC-016 | Finite cases and regression inputs share their owners' models and comparisons. Ordinary calibration examples remain in the calibration file. |
+
+The evidence concerns the finite admitted value grammar, four Core selection
+paths, actual framework scheduler cuts, and the named initial/held/settled
+observations. It does not prove arbitrary cycles, deep recursion, arbitrary
+getter/setter bodies, complete descriptor/class fidelity, callback atomicity,
+other settlement schedules, external providers, or native browser rendering.
+Changed nested proxies may be replaced, as explicitly approved. Native Solid
+proxy assignment through Core drafts retains its separate Drafts support-policy
+boundary. No new exclusion weakens a tested contract. Work instrumentation
+retains the earlier factor-32 per-distinct-container regression budget; it is
+neither an elapsed-time measurement nor a public SLO.
+
+E2's array evidence uses three dense scalar entries and selected lengths 0/1/2.
+It does not establish sparse arrays, growing or invalid lengths, or arbitrary
+array-subclass behavior. General root Object-prototype method lifecycle is not
+claimed by the inherited-array-method family. No counterexample in those
+unexercised regimes was established by this review.
+
+## Exact code and verification
+
+Production and oracle repairs are commit
+`5e7bda09f2e97b927a365d46fa2dd4e6a2224591`. Integration commit
+`f67a87671c8694313f8db9684d16f6291fac9efc` merges main
+`a2f346596c34faa7e65211134194337bd2e0007d`. The three production source hashes
+remain identical after integration:
+
+```text
+70396560a8a16ff5f5113c3cfcb8f75c513563255163acd4affb4801790efc56  packages/solid-db/src/store-materialization.ts
+60ff0338e10ff65f8babc23d498156e9746ea20a7524d6efbfd28b67d6f80f58  packages/solid-db/src/useLiveQuery.ts
+9546b43f29c2e782cc239cc379cb5e4e662435b938355a9881be7e9953a2e37b  packages/db/src/query/compiler/select.ts
+```
+
+Before integration, the final Core owner and select/alias/container-copy
+neighbors pass 223 tests. The wider select/compiler/builder/spread/functional/
+alias neighborhood passes 325 tests. The six real frameworks pass all fourteen
+destination groups, with 420 overlap histories and 1,260 new selected-result
+cuts. Every one of the 144 Core path histories and 420 receiving histories
+reaches each of its twelve declared checkpoints exactly once. Each records
+zero result mismatches and runtime failures. The earlier 819 context, 1,200
+field, and 840 receiving-destination comparisons remain.
+
+After integration, all 333 Solid tests pass without type errors. The Core
+owner, select, aliases, container-copy, snapshot calibration, and restarted
+subscription boundary tests pass all 248 tests. The lifecycle publication
+owner passes 145 tests with the previously failing seed `-1439698414`, path
+`1:22`, selected for replay. Main's #2313 fixes the separately reported #2310;
+that issue is closed. This PR does not alter its lifecycle model or expectations.
+
+Final integrated snapshot/destination replay also passes on React (sixteen
+groups), Preact/Vue/Svelte/Angular (eight groups each), and the full Solid run
+above, without type errors. These retain all 45 snapshot groups and fourteen
+destination groups, including actual local-only Solid histories. The lifecycle
+random/replay property additionally passes alone with the same seed and shrink
+path. Core and Solid builds, `pnpm lint:changed`, and whitespace checks pass.
+
+Reproduction commands from the repository root:
+
+```sh
+pnpm --filter @tanstack/db build
+pnpm --filter @tanstack/solid-db exec vitest run --maxWorkers=2 --coverage.enabled=false
+pnpm --filter @tanstack/db exec vitest run tests/query/includes-context-transport-oracle.test.ts tests/query/select.test.ts tests/query/validate-aliases.test.ts tests/query/public-container-copy.test.ts tests/conformance/row-snapshot-calibration.test.ts tests/collection-restart-publication-boundaries.test.ts --maxWorkers=2 --coverage.enabled=false
+TANSTACK_DB_ORACLE_PROPERTY=subscription-lifecycle.publication-history TANSTACK_DB_ORACLE_SEED=-1439698414 TANSTACK_DB_ORACLE_PATH=1:22 pnpm --filter @tanstack/db exec vitest run tests/collection-subscription-lifecycle-publication-oracle.property.test.ts --maxWorkers=2 --coverage.enabled=false
+pnpm lint:changed
+```
+
+For receiving replay, select `row-snapshot-isolation|public-field-destination`
+in each framework's conformance runner. React/Solid use
+`tests/conformance.test.tsx`, Preact/Vue/Angular use
+`tests/conformance.test.ts`, and Svelte uses
+`tests/conformance.svelte.test.ts`. Solid's full command also runs local-only
+snapshots. `TANSTACK_DB_ORACLE_STATISTICS=1` and `--disableConsoleIntercept`
+retain each field history's reach record.
+
+Hostile checks distinguish three Core wrong designs: restoring the original
+compiler gives eighteen failures, omitting fresh-object operations gives twelve
+selected-shape failures with sources intact, and bypassing borrowed-path copies
+gives six source/retained-source failures. The pre-E2 writer and ignored-length
+mutants each fail six array cells. The latter has 72 selected-result failures
+and zero runtime errors. The pre-E2 variant has 72 primary intrinsic-length
+errors and 54 secondary reads of absent correlated results. Secondary reads
+are not counted as additional defects or independent witnesses.
+
+Solid's old memo key fails twelve identity comparisons with twelve controls
+passing. Removing node seeding gives twelve stale-value assertions and nine
+post-setup callable runtime failures. Removing the getter or inherited-method
+bypass gives six post-setup runtime failures each. Four separate wrong-observation
+calibrations reject incorrect callable/method results using the same comparisons.
+These runtime outcomes are not described as assertion kills. The reorder-tail
+mutant fails all twelve original reorder value comparisons. Source-only
+corruption fails the strengthened shared snapshot comparison.
+
+The final helper is 192 lines, compared with 136 at the reviewed native cut
+and 330 before the native-store redesign. A same-tool externalized hook build
+changes from 4,792 minified / 2,032 gzip / 1,865 brotli bytes to
+5,623 / 2,296 / 2,111: +831 / +264 / +246 bytes. These are isolated hook
+measurements with Core, Solid, and primitives externalized, not application
+timings or release-package size.
+
+The final independent follow-up passes the original E2 public witness and all
+six new primary-oracle cells without type errors. It finds no further supported
+defect or overconstraint in the bounded final repair. Local review accounting
+and implementation are complete within the stated limits. Final pushed-head CI
+status is a separate PR observation, not supplied by local test results.
+
+### CI integration follow-up
+
+The formatter advanced the branch to
+`0937a17ec9e53b32d828714a9ce374a2c149c5bf`; its only change wrapped the
+`defineSelectField` signature. CI run `41137359075` passed all 24,661 runtime
+and type tests across both Core shards, but each shard reported the same three
+source type errors in the new overlap driver. Contextual inference introduced a
+different generic `T` for the returned mutation callbacks. The targeted runtime
+selection above had not started Vitest's type-test worker, so its clean output
+did not establish a complete source typecheck.
+
+`pnpm exec tsc -p packages/db/tsconfig.json --noEmit` reproduced all three
+errors at lines 2372–2374 before the correction. Explicit `row: T` annotations
+bind the callbacks to their enclosing source's row type. This changes no runtime
+code, law, history, observation, or comparison. The same complete source
+typecheck now passes, and the context-transport owner passes all 192 tests.
+The earlier behavioral RED, GREEN, reach, and mutant evidence remains applicable.
diff --git a/docs/contributing/oracle-reviews/2026-10-30-solid-row-materialization-review.md b/docs/contributing/oracle-reviews/2026-10-30-solid-row-materialization-review.md
new file mode 100644
index 0000000000..36cccbae38
--- /dev/null
+++ b/docs/contributing/oracle-reviews/2026-10-30-solid-row-materialization-review.md
@@ -0,0 +1,288 @@
+# PR 2307: Solid materialization review
+
+This record evaluates the ten-item external review of published commit
+`1d619bb672b500099d05459927c10d21ba08fcb6`. The repaired code and executable
+coverage are commit `bcbab51355b87a37fc9ab3c8c73887972be2fde8`.
+Documentation-only commits can follow that code commit. This record supplements
+the [earlier snapshot record](2026-10-30-solid-row-snapshot-isolation.md), whose
+historical results remain intact.
+
+The external reviewer executed Node probes with Solid 1.9.11 for findings F1
+and F3. It did not execute the other findings or package suites. This evaluation
+uses installed dependencies and the real framework test hosts.
+
+## Law, experiment, and inference
+
+Materialization borrows source Collection rows. It must preserve their values,
+including retained `get()`, `previousValue`, and actual mutation `original`
+references. Current consumers must follow current selected values. Authority:
+[immutable updates](../../guides/mutations.md#update),
+[PendingMutation.original](../../reference/interfaces/PendingMutation.md#original),
+[ChangeMessage.previousValue](../../reference/interfaces/ChangeMessage.md#previousvalue),
+and the [framework contract](../../../packages/db/tests/conformance/contract.ts).
+Existing Solid fine-grained tests supply the unchanged-value identity promise.
+
+The maintainer made two explicit decisions during this evaluation: preserve live
+getters, and support shared acyclic graphs efficiently while deciding cycles
+separately. Getter liveness applies when a getter actually reaches the adapter.
+Core can evaluate a root getter before that boundary. The receiving histories
+therefore exercise nested getters.
+
+Two independent judgments cover these interacting laws:
+
+- The shared [snapshot owner](../../../packages/db/tests/conformance/row-snapshot-oracle.ts)
+  records admitted source facts before framework materialization. It compares
+  current results and retained references with immutable trees of own keys and
+  scalar or opaque leaves. Core supplies the premise. The adapter must preserve
+  it. This owner does not prescribe Core draft normalization.
+- The Solid [materialization owner](../../../packages/solid-db/tests/row-materialization-oracle.test.tsx)
+  predicts consumer admissions from source identity, getter values from scalar
+  signal versions, and array consumers from admitted scalar sequences. It also
+  compares deterministic enumeration work with distinct admitted containers.
+  It does not reproduce the materializer's cache or reconciliation algorithm.
+
+The whole-review plan grouped source ownership, identity and lifetime, getter
+liveness, and graph work before production edits. Required real-host paths ran
+at the RED gate. Later independent findings received the same oracle-first
+sequence before their repairs. The final suite then exposed one more array
+notification defect. Its new grammar also ran RED before the production repair.
+
+The repair keeps private graph copies and skips unchanged source rows. It reuses
+copies of unchanged nested elements across edits and reorder. Native store reads
+stay outside the binding's dependency set. Getter cells remain live and use
+private result copies. Reconciliation separates conflicting aliases, prepares
+replacement store wrappers once, and lets Solid setters admit array indices
+before restoring descriptors. This preserves notifications without expanding
+shared graphs by path count.
+
+## Histories, receiving paths, and measured reach
+
+The snapshot grammar crosses eight common shapes, one or two keys, three hook
+inputs, and sync or optimistic writes. Shapes are ordinary records, hidden
+string data, arrays, later object admission, null-prototype records, aliases,
+accessors, and array subclasses. Solid adds actual native stores. Each key gets
+three updates. Two-key starts share a nested source object. Odd alias splits
+retain the actual previous right node while the left changes.
+
+Every receiving group asserts exact reach counts:
+
+| Receiving group | Histories | Each shape | Cross-row alias | Retained previous value | Retained original | Source reference reuse |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: |
+| Common driver, each input/sync | 16 | 2 | 8 | 16 | Not required | 2 |
+| Common driver, each input/optimistic | 16 | 2 | 8 | 16 | 16 | Not required |
+| Solid, each input/sync | 18 | 2 | 9 | 18 | Not required | 2 |
+| Solid, each input/optimistic | 18 | 2 | 9 | 18 | 18 | Not required |
+| Solid local-only, each input/sync | 18 | 2 | 9 | 18 | 18 | Not required |
+
+Input, write, later admission, root omission, and nested own-undefined states
+also reach every history in each group. The current and retained comparisons
+run after each update. Optimistic histories also compare while the mutation
+handler remains held. Local-only histories retain the returned transaction's
+actual originals, independently of `get()` and event values.
+
+All six real adapters receive the shared judgment. React runs both ordinary
+and DbClient drivers. Common drivers run 96 histories each. Solid runs 108
+shared histories plus 54 local-only histories. Together these are 738 receiving
+histories across 45 registered group tests. Each group has its own reach guard.
+
+The Solid-specific finite grammar has 85 histories:
+
+| Law | Histories and declared reach |
+| --- | --- |
+| Identity and binding lifetime | 24 histories reach peer edit, same-row scalar edit, element replacement, and source-only write. Twelve have actual native-store payloads. |
+| Reorder | 12 histories reach source reorder without admitting new elements. |
+| Array resize | 12 histories reach growth, shrink, repeated growth, and emptying with reactive map and rendered `For` consumers. |
+| Live getters | 24 histories reach initial or later getter admission, source replacement, signal-only writes, retained getter reads, omission, and readmission. |
+| Shared graph work | 13 histories reach admission, replacement, and branch divergence. Three also reach crossed old/new sharing topology. |
+
+Each Solid history has a separate asserted reach guard. Inputs cross callback,
+config, and supplied Collection. Graph work uses supplied Collection input to
+isolate the adapter from query hashing. Graph depths are 0, 1, 4, 8, and 12 for
+linear and shared controls. Crossed sharing uses depths 4, 6, and 8.
+
+## RED, GREEN, and hostile calibration
+
+All commands use `--maxWorkers=2 --coverage.enabled=false`. The following
+selectors reproduce the owning comparisons:
+
+```sh
+pnpm --filter @tanstack/solid-db exec vitest run tests/row-materialization-oracle.test.tsx --maxWorkers=2 --coverage.enabled=false
+pnpm --filter @tanstack/solid-db exec vitest run tests/conformance.test.tsx -t 'row-snapshot-isolation|local-only row snapshots' --maxWorkers=2 --coverage.enabled=false
+pnpm --filter @tanstack/db exec vitest run tests/conformance/row-snapshot-calibration.test.ts --maxWorkers=2 --coverage.enabled=false
+```
+
+Before the first production edit, all six adapters passed the expanded snapshot
+premise checks. Solid's extended identity, lifetime, reorder, and getter grammar
+failed 34 of 48 cases. The initial graph extension failed 3 of 10 cases. A depth
+12 shared graph caused 24,573 enumerations for 13 distinct source containers.
+
+The old expected-source profile rejected a legitimate source that preserved
+prototypes and removed omitted keys. The relational replacement accepted that
+source without changing its law. A mutant corrupting only local mutation
+originals passed all three old local-only groups and failed all three extended
+groups at the `local mutation.original` comparison.
+
+Independent review exposed getter omission, hidden string fields, and crossed
+sharing. Before their repair, repository extensions failed 24 getter cases,
+nine Solid snapshot groups, and two crossed graph work cases. The other five
+adapters passed the hidden-field extension on unchanged production. A first
+repair still failed crossed work because Solid recursively unwrapped raw
+replacements. The final wrapper preparation pass removed that remaining work.
+
+The final full-suite gate exposed stale rendered array membership: 210 tests
+passed and the array include test failed. Twelve new resize histories then
+failed on unchanged production. Letting setters admit indices repaired that
+notification law. All 223 Solid tests now pass, including the actual include.
+
+Temporary mutants were restored after execution:
+
+| Wrong design | Executed outcome |
+| --- | --- |
+| Reviewed materializer at `1d619bb67` | 45 failures in the then-current 70-history owner. Identity, lifetime, getters, and graph work distinguish it. |
+| Only a row-level source guard, without nested reuse | Identity/reorder assertions fail. |
+| Tracked native source reads | Two supplied-Collection/native lifetime assertions fail. |
+| Frozen enumerable getter values | Live getter assertions fail. |
+| Getter result copies shared with ordinary data | Three retained-getter assertions fail when ordinary aliases diverge. |
+| Persistent copy cache shared across rows | Old owner passes nine groups. Extended two-key owner fails nine groups. |
+| Missing alias conflict separation | Nine snapshot groups fail current-value assertions. |
+| Missing protected reused-node marking | Three controlled-sync groups fail: right value becomes 1 when its retained source value is 0. Six other groups pass. |
+| Hidden fields omitted from reconciliation | Nine snapshot groups fail exact current values or own-key sets. |
+| Missing replacement wrapper preparation | Crossed depth 8 fails: 140,316 enumerations exceed the unchanged 98,496 budget. Twelve graph controls pass. |
+| Getter omission without writable conversion | All 24 getter cases throw after setup. This is a runtime failure, not an assertion kill. |
+| Premature array-index definition | All 12 resize histories fail the current-membership comparison. |
+
+An early attempted shared-getter transform changed no source and passed. It
+receives no calibration credit. The later real getter-alias RED supplies that
+evidence. Earlier selector mistakes and nonexistent test-file paths also
+receive no coverage credit. Corrected commands executed the intended tests.
+
+Final local verification at the code commit:
+
+- Complete Solid package: 223 tests, nine files, no type errors.
+- Other five adapters: 36 snapshot group tests pass, including React DbClient.
+- Shared checker calibrations: 13 tests pass.
+- Solid TypeScript check, ESLint on changed TypeScript, `pnpm lint:changed`,
+  Prettier, `git diff --check`, and Solid build pass.
+
+A consistent esbuild comparison bundles only the hook and its helper, with all
+package dependencies external. The reviewed version is 3,988 minified bytes
+and 1,797 gzip bytes. The repair is 6,825 and 2,714 bytes: +917 gzip bytes over
+the reviewed cut. This is an isolated hook comparison, not the repository's
+release-size scenario. The approved getter-cache simplification removes two
+captured variables and saved 18 gzip bytes in its isolated helper comparison.
+
+The earlier row-guard prototype benchmark measured materialization only. With
+10,000 rows and eight tags per row, it measured 294.60 to 34.99 milliseconds.
+It does not measure this final algorithm or total application performance.
+
+## Lossless finding dispositions
+
+IDs retain source order despite repeated numbers in the original review.
+Locations below refer to the reviewed cut.
+
+| ID | Original claim and proposed repair | Technical validity and PR action | Durable value and destination |
+| --- | --- | --- | --- |
+| F1, Solid 1, `useLiveQuery.ts:423` | Fresh copied nested-array elements make `reconcile(key:null)` replace identities, remount `For`, and rerun reference effects on unrelated updates. | Confirmed P1. `fixed-now`: per-row guard plus nested source-identity reuse, including reorder. A root-only cure fails the receiving oracle. | Missing source-identity dimension and actual consumer observations now live in the Solid owner. |
+| F2, Solid 2, `:415` | Every event copies and reconciles every row. Remember each key's last immutable source reference. | Confirmed P2. `fixed-now`: unchanged sources return before copying or reconciliation. The main result iteration still scales with row count. | Single-row stream workload and bounded benchmark preserved above. No constant-time whole-hook claim. |
+| F3, Solid 3, `:61` | Tracked native-store reads add payload dependencies to the main effect and later rebind the hook. Use `untrack` or `unwrap`. | Confirmed P1. `fixed-now`: untracked admission/update plus backing-store reads. Blind recursive unwrap of borrowed ordinary trees would itself mutate inputs. | Real native-store lifetime histories and tracked-read mutant. |
+| F4, Solid 4, `:54` | Cycle memo adds bytes although cyclic updates overflow. Drop it or fail fast. | Partly confirmed. Initial cyclic admission works at the reviewed cut, but its first update overflows. Removing memo also makes admission overflow. `accepted-design` for this PR's explicit acyclic boundary, per maintainer choice. The efficient graph repair needs memoization for a different reason. | Cycle support remains a separate policy decision in the coverage map. No cyclic-update support claim or silent size cutoff. |
+| F5, Solid 5, `:82` | Deleting ancestor entries expands shared acyclic graphs exponentially on every event. | Confirmed P1 at growing depth. `fixed-now`: one owned copy per source graph plus conflict-aware linear passes. Source reads grow from 16 to 65,536 over depths 4 to 16 in the reviewed helper. | Distinct-container work judgment, aligned/crossed sharing, and value checks in the Solid owner. |
+| F6, Solid 6, `:74` | Enumerable signal-reading getters become frozen values. | Confirmed P2. `fixed-now` under the explicit live-getter decision. Private getter copies also protect retained source objects. | Nested scalar/object getters cross signal writes, source replacement, aliases, removal and readmission. Root getters evaluated by Core are outside this claim. |
+| F7, Oracle 4, `row-snapshot-oracle.ts:95` | `draftSource` hardcodes own-undefined deletion and lost prototypes without authority. A Core fix would fail it. | Confirmed test-integrity defect. `fixed-now`: relational admitted-source facts replace expected Core normalization. The alternative legal source passes. | Explicit trusted base and calibration keep adapter preservation separate from Core policy. |
+| F8, Oracle 5, `conformance.test.tsx:392` | Local-only histories never observe actual mutation originals, so original-only corruption passes. | Confirmed test gap. `fixed-now`: retain transaction receipts and compare originals throughout later updates. Old/new owner discriminator executed. | Actual local-only source path uses the same shared model and comparison. |
+| F9, Oracle 6, `row-snapshot-oracle.ts:126` | One key misses cross-row shared defaults and accepts cross-row copy caching. | Confirmed test gap. `fixed-now`: one/two-key dimension with shared initial containers and alternating updates. Old owner accepts the cache mutant, extended owner rejects it. | Cross-row aliases and exact reach in every receiving group. |
+| F10, Oracle 7, `conformance.test.tsx:372` | Virtual-field list and symbol filter duplicate `selectedRow`. | Virtual-field duplication confirmed. The claimed duplicate symbol filter was inaccurate: the old source driver did not contain that filter. `fixed-now`: both use `selectedRowKeys`. | One selected-value boundary, with hidden host symbols excluded by the existing contract. |
+
+Additional findings remain distinct:
+
+| ID | Source, gap, and disposition |
+| --- | --- |
+| S1 | Simplifier proposed removing redundant getter `lastSource` and `lastCopy`. Private WeakMap already handles repeat values. User approved. Applied and verified. `fixed-now`. |
+| R1 | Independent reviewer found getter omission throws. Missing present-to-omitted transition. Added omission/readmission and shape observers before repair. `fixed-now`. |
+| R2 | Independent reviewer found hidden string data stays stale. Added hidden update, own-undefined, and omission dimensions to the shared owner before repair. `fixed-now`. |
+| R3 | Independent reviewer found crossed sharing creates old/new pair work. Added independently varying sharing topology and stronger enumeration recorder before repair. `fixed-now`. |
+| R4 | Final package suite found array growth misses length notification. Added 12 real-host resize histories before repair, then killed the premature-admission mutant. `fixed-now`. |
+
+Loss audit: **10 original items = nine fixed-now + one accepted-design**.
+The accepted boundary is explicit and does not decide universal cycle support.
+**Five additional items = five fixed-now.** No raw item, proposed cure, runtime
+qualification, testing idea, or newly found sibling was dropped. No confirmed
+in-scope counterexample remains in the declared finite boundary.
+
+## Oracle conformance audit
+
+| Requirement | Evidence or applicability |
+| --- | --- |
+| ORC-001 | Source snapshot authority and explicit live-getter/acyclic decisions appear above and beside executable laws. Limits remain explicit. |
+| ORC-002 | Captured immutable source facts, scalar identity/getter inputs, admitted resize sequences, and distinct-container work are independent judgments. Core admission and selected-value metadata policy are declared trusted premises. |
+| ORC-003 | Both owners explain contract, model, grammar, actual driver, and checkpoints beside executable code. |
+| ORC-004 | Reconstruction includes cross-row aliases, later admissions, getter/data aliasing, omission/readmission, resizing, hidden fields, and crossed sharing. Removing an axis loses its corresponding mutant or receiving path. Bounds are listed above. Absent-key writes are illegal and excluded. Cycles are an explicitly separate decision. |
+| ORC-005 | All six real hooks run at documented settled cuts. Solid also records actual `For`, effect, getter, and subscription observations. Source subscribers capture premises before materialization. No unresolved missing-input hypothesis arose at these cuts. |
+| ORC-006 | The hostile table distinguishes assertion failures, post-setup runtime failures, and no-op or selection mistakes. |
+| ORC-007 | Not applicable: these campaigns exhaust declared finite grammars. They introduce no random property or reduced run budget. Group selectors directly replay each input/write cell. |
+| ORC-008 | Retained facts stay versioned because later writes can expose corruption of any earlier reference. Removed Core profiles impose no adapter obligation. Alias identity remains an input premise, not an output alias promise. |
+| ORC-009 | Model facts represent selected Collection values. Consumer admissions and enumeration budgets are model-only observations, not new production lifecycle states. Shared glossary terms name binding, Collection, mutation, and checkpoint boundaries. |
+| ORC-010 | `ScenarioLifetime` releases scopes, handlers, subscriptions, spies, and Collections. Existing cleanup calibrations preserve primary and distinct cleanup failures. Finite enumeration needs no shrinker. |
+| ORC-011 | The named shared-fault hypothesis was expected Core normalization copied into the adapter model. Relational preservation replaces that dependency, and a legitimate alternate source is an executed discriminator. Other adapters supply corroboration, not independent Core policy proof. |
+| ORC-012 | This versioned record names the exact code commit, every applicable requirement, closure boundary, and remaining limits. |
+| ORC-013 | Unchanged/changed identities, same/different aliases, initial/later getters, present/omitted/readmitted fields, growing/shrinking arrays, and aligned/crossed graphs distinguish plausible narrow repairs. The work budget remains a bounded regression judgment. |
+| ORC-014 | The same snapshot model/check receives six actual framework hosts and Solid's real local-only source. Native-store and getter premises use actual Solid APIs. No browser-engine or external-database claim follows. |
+| ORC-015 | Each receiving group and Solid history asserts declared reach. Exact measured counts appear above. |
+| ORC-016 | Owners contain reusable judgments and finite histories through shared drivers. Calibration examples remain in the ordinary calibration file. No standalone concrete type assertions were added to an oracle. |
+
+## Reviewer assessment and readiness
+
+**Hire recommendation: yes.** The external review found valuable correctness,
+reactivity, work, and test-integrity issues beside green tests. It separated
+runtime evidence from unexecuted analysis. Prioritization was mostly useful.
+The cycle recommendation needed correction because memoization also preserves
+initial admission and efficient acyclic sharing. Its proposed root guard alone
+would not preserve nested identity. The duplicate symbol-filter claim was too
+broad. Independent review later found missing omission, visibility, and topology
+interactions, so the original ten items were not complete closure evidence.
+
+The independent prep reviewer verified the three repairs it reported: 73 then
+current materialization tests and three original hidden-field receiving cases
+passed. The final resize finding came afterward and is covered by the additional
+RED, GREEN, and mutant evidence above. No claim of an independent review of
+that later repair follows.
+
+Local enforcement is complete within the stated finite boundary. Whole-PR
+readiness still depends on current CI and review of the pushed head. The older
+published head has a separate Core publication mismatch, independently replayed
+on clean main and recorded in [issue #2310](https://github.com/TanStack/db/issues/2310).
+The maintainer requested separate tracking. This PR does not change Core
+production, its publication model, expectations, or run budgets. A green retry
+cannot close that known counterexample.
+
+Limits: arbitrary cycles, deep recursion beyond the finite graphs, arbitrary
+getter bodies or setters, hidden symbol fidelity, all descriptor-visibility
+notification combinations, callback-time atomicity, other settlement schedules,
+and real browser rendering are not established. Native Solid proxy assignment
+through Core drafts remains a separate support-policy question. The coverage
+map retains its owner and required receiving witness. No wall-clock SLO or
+universal graph-complexity proof follows from the bounded counters.
+
+
+## Subsequent oracle-review correction
+
+A later four-agent review found that the React registrations described above
+as ordinary and DbClient drivers actually execute the same derived-identity
+API. Neither supplies DbClient receiving evidence. The former alias counts also
+credited the later-object history whose initial config is null. It supplies no
+mutable cross-row alias. These historical claims are inaccurate. The current
+coverage map and [native revision record](2026-10-30-solid-native-store-review.md)
+correct them and preserve the later findings. Earlier closure statements apply
+only to their recorded comparisons and do not establish the newly expanded
+root-field boundary, which has a known Core counterexample.
+
+## Final native and Core correction, code `2e962b1797e69066de52344fad9ea71811bc843e`
+
+The maintainer authorized fixing Core here. The pending-scope status above is
+historical. The final native helper replaces custom recursive reconciliation,
+and Core now preserves enumerable own source fields and accepted inherited-name
+destinations. The final [native review](2026-10-30-solid-native-store-review.md)
+records all new O1-O12 dispositions, valid RED/GREEN/mutant evidence, exact code,
+and accepted limits. Both React registrations remain derived-identity paths,
+with no DbClient credit. Core draft symbol-write policy and lifecycle #2310
+retain their separate owners.
diff --git a/docs/contributing/oracle-reviews/2026-10-30-solid-row-snapshot-isolation.md b/docs/contributing/oracle-reviews/2026-10-30-solid-row-snapshot-isolation.md
new file mode 100644
index 0000000000..cb3ec956b7
--- /dev/null
+++ b/docs/contributing/oracle-reviews/2026-10-30-solid-row-snapshot-isolation.md
@@ -0,0 +1,420 @@
+# Issue 2305: framework row snapshot isolation
+
+> **Historical initial evaluation.** The initial record below describes the first
+> local repair. Its coverage, implementation, verification totals, and closure
+> statements are superseded by the [prep-pr reevaluation](#prep-pr-reevaluation-2026-10-30).
+> The original record remains intact so its claims and later corrections stay visible.
+
+Evaluated 2026-10-30 against `c351fc04d7f70dc59bf92ecbed310f899b9511cd`
+plus this working tree's changes. Source: [issue #2305](https://github.com/TanStack/db/issues/2305),
+by Erik Müller (`asterikx`), including its reproduction and additional context;
+there were no comments at the final source audit. Production and oracle repairs
+are implemented locally. No commit or pull request was created.
+
+## Law, experiment, and inference
+
+No product-law decision is required. Framework materialization must preserve
+borrowed Collection rows and immutable mutation snapshots. Authority:
+[immutable updates](../../guides/mutations.md#update),
+[PendingMutation.original](../../reference/interfaces/PendingMutation.md#original),
+[ChangeMessage.previousValue](../../reference/interfaces/ChangeMessage.md#previousvalue),
+and the [shared binding result contract](../../../packages/db/tests/conformance/contract.ts).
+The receiving boundary is the real framework hook, not the core draft copier.
+
+The old adapter suite compared current results. It did not retain source rows,
+mutation originals, or previous event values across later materializations.
+Thus a correct current result could hide damage to historical values. The core
+optimistic-history owner judges settlement and handler payloads; it does not
+mount a framework store. The repair belongs to the Frameworks coverage owner.
+
+The new [row snapshot oracle](../../../packages/db/tests/conformance/row-snapshot-oracle.ts)
+constructs expected rows independently from history version numbers. It keeps
+those records separate from production inputs. It checks complete nested values
+as well as current results and retained `get()`, `previousValue`, and
+`mutation.original` references. Optimistic writes are checked while their
+handler is held, and again after confirmation and settlement. Every retained
+reference is checked again after subsequent updates.
+
+The finite grammar enumerates four shapes (plain records, growing/shrinking
+arrays, null-to-object introduction, and null-prototype records), three input
+forms (callback, config, supplied Collection), and sync versus optimistic writes.
+Each history applies three successive updates. Function-valued leaves protect
+the existing non-JSON value domain. There are 24 histories per adapter, and 12
+additional local-only source histories in Solid using the same model/check.
+
+Reach is asserted separately for every input/write group. Each group reaches
+its input and write path four times; each shape once; retained `previousValue`
+and later-object admission four times; optimistic groups also retain an original
+four times. Each local-only input reaches four histories. Exact counts are
+asserted in addition to `createOracleReach`'s minimum checks. These are measured
+finite histories, not a random campaign or proof over every possible history.
+
+## RED, GREEN, and calibration
+
+Before production changes, this command failed all six Solid input/write groups:
+
+```sh
+pnpm --filter @tanstack/solid-db exec vitest run tests/conformance.test.tsx -t row-snapshot-isolation --coverage.enabled=false
+```
+
+The sync groups rejected retained `previousValue.config.value` changing from 0
+to 1. The optimistic groups rejected `mutation.original.config.value` changing
+from 0 to 1 while the handler was pending. An earlier execution of the same
+comparison rejected retained `Collection.get()` changing from 0 to 1. These
+were assertion failures at the intended cuts. React and Vue passed the new law
+on their unchanged production code before the Solid repair.
+
+The repair copies the plain records and arrays that Solid stores mutate before
+both initial store creation and later reconciliation. It retains opaque leaves,
+accessors, enumerable flags, null prototypes, array shape, and shared graph
+references. Copied data properties become writable for the store.
+Existing keyed stores continue to provide Solid's row identity and reactivity.
+
+The repaired branch passes. Temporary production mutants gave these outcomes:
+
+| Wrong implementation | Result at the shared comparison |
+| --- | --- |
+| Original implementation, neither boundary copies | Six assertion failures: event previous value / mutation original |
+| Copy only initial rows | Six assertion failures on the next update to an object introduced by an earlier update |
+| Copy only incoming updates | Six assertion failures on the first retained nested value |
+| Shallow-copy both boundaries | Six assertion failures on the first retained nested value |
+| Proposed `structuredClone` at both boundaries | `DataCloneError` for the valid function-valued field; a runtime compatibility failure, not an oracle assertion kill |
+
+The local-only receiving histories also fail all three inputs with the original
+behavior restored, and pass the repair. They use actual `localOnlyCollectionOptions`
+and `Collection.update`, reproducing the source path in the issue. This additional
+provider witness was added after the initial Solid repair; the pre-edit RED gate
+used the actual Solid host with the controlled sync source. All mutants were
+removed after their runs.
+
+Final verification:
+
+- Solid full package: 136 tests passed, including row identity, DOM reuse,
+  fine-grained reactivity, Suspense and local-only snapshot receiving checks.
+- Complete shared conformance files: React 205, Preact 100, Vue 107,
+  Svelte 104, Angular 62 tests passed. React registers two driver variants.
+- `pnpm exec tsc --project packages/solid-db/tsconfig.json --noEmit` passed.
+- ESLint on all changed TypeScript files, `pnpm lint:changed`, Prettier and
+  `git diff --check` passed.
+- Svelte initially needed built workspace dependencies; `pnpm --filter
+  @tanstack/db... build` resolved that setup failure before its successful run.
+- `pnpm size:compare --packages solid-db --no-scenarios`: +194 gzip bytes,
+  +189 brotli bytes. The helper serves both admission boundaries; the tested
+  smaller copying strategies violate the law. Retaining stores preserves
+  existing granular identity. No core or other adapter production code changed.
+  Test and documentation growth is separate from these shipped-byte figures.
+
+## Lossless source-order finding ledger
+
+| ID | Original claim / proposal | Technical verdict and evidence | Action / disposition | Durable value |
+| --- | --- | --- | --- | --- |
+| R1 | `createStore(value)` / `reconcile(nextValue)` mutate retained rows and shared nested source objects (`useLiveQuery.ts`, original lines 332–335). | Confirmed, high severity: silent historical-value corruption. Retained get/event values fail on unchanged HEAD. | `fixed-now`: detach mutable store containers at both boundaries. | Shared receiving oracle, complete nested comparisons. |
+| R2 | `mutation.original` / `previousValue` can change, breaking undo/redo that replays originals. | Snapshot corruption confirmed at the pending-handler and later update cuts. The application's undo UI was not run. | `fixed-now`: same production repair, distinct original/event observations. | Preserve historical payloads across later materializations. |
+| R3 | The supplied local-only, shallow-projection, nested-replacement reproduction should retain the original config value. | Confirmed by the same shared comparison through actual local-only Collection updates; original implementation fails, repair passes. | `duplicate` of R1; its unique receiving source path is retained. | Three local-only input witnesses use all four shapes, without separate expected answers. |
+| R4 | rc.1/main and 0.2.45 have this mechanism; it is not browser-specific. | Current rc.1 source and Node-hosted Solid tests confirmed. Tag `@tanstack/solid-db@0.2.45` uses `setData(reconcile(Array.from(currentCollection.values())))`. The old release was source-inspected, not executed. | `duplicate` of R1; no historical-release patch proposed. | Preserve the version provenance and host limit. |
+| R5 | Clone on store creation and on every update, specifically with `structuredClone`. | Both admission boundaries are necessary; the specific clone is too restrictive for valid function-valued rows. Its mutant throws `DataCloneError`. | `fixed-now` with a container-copy helper that preserves opaque leaves. | Later-object histories reject an initial-only cure; opaque leaves reject narrowing the value domain. |
+
+Totals: **5 raw items = 3 fixed-now + 2 duplicates**. Zero confirmed-open,
+deferred, stale, refuted, accepted-design, or design-decision items. No sibling
+contract violation was found in the exercised histories. The final audit reread
+the raw issue, including the version note, environment note, and proposed patch.
+Item accounting and authorized repairs are complete within the stated boundary.
+
+## Reviewer assessment
+
+**Hire recommendation: yes, with a correction to the proposed cure.** The report
+accurately identifies ownership aliasing, supplies a small public reproduction,
+and connects it to valuable historical-value consumers. Its prioritization is
+appropriate for silent undo data corruption. Signal is high. Its clone suggestion
+recognizes both entry points, but does not consider valid opaque values or prove
+that objects first admitted by an update remain isolated on later updates.
+The shared suite now preserves both ideas. This is a strong bug report; it is
+not a whole-PR review or evidence about the reporter's broader review work.
+
+## Oracle conformance and remaining limits
+
+- ORC-001–003: authority, independent scalar-input model, and literate contract,
+  grammar, production driver and comparison are beside the executable check.
+- ORC-004: all 24 finite combinations run; removing each dimension loses the
+  corresponding witness. Three updates distinguish initial detachment from
+  later admission. Updates to an absent key are excluded as illegal.
+- ORC-005–006: real hooks and actual host scheduling reach the named cuts;
+  original, initial-only, update-only and shallow-copy mutants fail assertions.
+- ORC-007: no random property was introduced. The bounded grammar runs in full;
+  `-t row-snapshot-isolation-<input>-<writes>` replays a receiving group directly.
+- ORC-008–009: the model retains versioned expected rows because later updates
+  distinguish historical versions. Model records do not represent mutable
+  framework proxies; those remain live. No new production state was named.
+- ORC-010: each history uses `ScenarioLifetime`; held handlers, subscriptions,
+  mounted scopes and Collections release without discarding primary failures.
+- ORC-011: no shared semantic-computation fault is hypothesized: the model
+  constructs scalar-selected data and does not copy production materialization.
+- ORC-012–016: this record ties evidence to the evaluated code; later-object
+  admission is the neighboring distinguishing case; real framework drivers and
+  local-only source supply receiving premises; declared reach is asserted; every
+  retained history uses the shared model/check, without pinned expected answers.
+
+The claim ends at one-row, three-update histories with these container shapes,
+immutable function leaves, the held optimistic cut, and each framework's settled
+cut. It does not establish every value type, arbitrary getters or cyclic updates,
+callback-by-callback publication atomicity, failure/rollback schedules, real
+browser rendering, or application undo UI behavior. The existing framework and
+optimistic-history owners retain their other guarantees; none were relaxed.
+There is no known in-scope counterexample. A future broader value or schedule
+claim needs a corresponding grammar and observation in these owners.
+
+PR readiness: **not assessed**. This task evaluated an issue and repaired a local
+working tree; no PR, pushed repair head, or remote CI was evaluated.
+
+Evaluated code fingerprint (SHA-256 over the ordered paths and contents of the
+five changed TypeScript files): `4ce4f7ac3df872dbaa11a4a3ed039d3c81d283815b3c7c00bfa2837fb730b328`.
+
+## Prep-pr reevaluation (2026-10-30)
+
+The prep review evaluated the initial repair against refreshed `origin/main`,
+`c351fc04d7f70dc59bf92ecbed310f899b9511cd`. The independent code review found
+four production defects and two oracle enforcement gaps. Subsequent evaluation
+found another adapter defect and two further oracle gaps. These findings
+supersede the initial record's statement that no neighboring violation was known.
+The simplification review found no useful optional code simplification. Its
+follow-up supplied two compatibility constraints, preserved separately below.
+
+### Lossless prep finding ledger
+
+The B1–B6 order matches the comprehensive review's source-order inventory.
+Aliases preserve the original reviewer identifiers. All confirmed findings
+were P2. `fixed-now` describes a completed repair with executable evidence;
+the two accepted constraints were not shipped defects.
+
+| ID | Review claim, authority, and missing distinction | Evaluation and disposition |
+| --- | --- | --- |
+| B1 / PC2 | A global copy memo preserves sibling aliases. Splitting `left` from `right` leaves the hook at `left=1/right=1` while its source is `left=2/right=1`. The current-result law lacked alias-topology histories. | **fixed-now:** independent store paths receive independent container copies; ancestor tracking retains backedge detection. Split/merge/split histories reject the shared-alias mutant at the current-row comparison. |
+| B2 / PC4 | `new Array(length)` loses an Array subclass's prototype and `total()` method. The original hook exposes the method. The receiving suite lacked subclass values and a method observation. | **fixed-now:** copied arrays retain their prototype. Independent model premises require methods on current and retained values when the source profile supplies them. The array-prototype mutant fails the subclass assertion. |
+| B3 / PC1 | A preserved enumerable nested getter returns a source-owned plain object. Reconciliation changes a retained source getter's value from 0 to 1. The ownership law lacked accessor-returned containers. | **fixed-now:** enumerable accessors materialize detached writable values. Stable getter histories run through the same scalar model and historical-value check. Restored source getters fail historical-value assertions. |
+| B4 / PC3 | A nested native Solid store reports accessor descriptors. Copying those descriptors creates getter-only backing fields, and the next update throws `TypeError`. The real-host proxy input was missing. | **fixed-now:** copy accessible enumerable values and omit the store's hidden symbol metadata. A real `createStore` driver seam exercises initial and later admissions. The descriptor mutant has a runtime failure after setup; this is distinct from an assertion rejection. |
+| B5 / OE2 | `toMatchObject` accepts added ordinary root fields. A hostile driver corrupted 12 retained rows while four histories passed. The comparison observed a subset of the immutable snapshot. | **fixed-now:** compare complete selected values and recursive own-key sets. Ordinary root fields, nested fields, array holes, and own undefined fields remain distinguishable. Permanent wrong-observation controls use the shared checker. |
+| B6 / OE1 | Projection and source teardown share one callback. A projection rejection prevents attempting source cleanup. ORC-010 requires resource release and distinct diagnostics. | **fixed-now:** independent ordered deferred callbacks attempt both cleanups. RED observed source attempts 0 versus projection attempts 7. GREEN preserves the original primary and cleanup Error identities through labelled aggregates. |
+| B7 / PC5 | Solid treats assigning undefined as deletion, so a source row's own undefined field disappears from hook output. Reconciliation can also retain a stale own undefined field after full-sync omission. The exact-row law lacked these transitions. | **fixed-now:** restore or remove own undefined fields recursively after reconciliation. Public setter pulses notify enumeration and membership subscribers inside the store batch; raw definition preserves the final own undefined property. Root and nested values remain checked by the shared oracle. |
+| B8 | A method check conditioned on the source's post-observation `instanceof` can erase its own premise. A hostile recorder stripped four source subclass prototypes while all seven histories passed. | **fixed-now:** method premises come from the independent model, including the source profile. Current and retained method checks now reject that same hostile driver at the initial receiving checkpoint. |
+| B9 | Undefined fields only inside a newly admitted `extra` object do not establish restoration inside an existing nested container. A root-only repair could escape that witness. | **fixed-now:** scalar versions 1 and 2 give the existing config payload an own undefined field; version 3 removes it. The root-only-undefined mutant now fails recursive key comparisons. |
+| S1 | Eagerly reading every accessor would invoke a nonenumerable getter that Solid's original `createStore` never reads. The review's throwing-getter probe recorded zero original reads versus one read and a throw for that proposed copier. | **accepted-design constraint:** preserve nonenumerable accessor descriptors. The final implementation evaluates enumerable accessors only. This avoided a proposed compatibility regression; it was not a defect in the earlier descriptor-preserving repair. |
+| S2 | Omitting all nonenumerable symbols from a detected store also omits user-authored hidden symbols. Public `$PROXY` identifies a store, but private bookkeeping symbol identities are unavailable. | **accepted-design constraint:** retain the existing shared selected-value boundary, which excludes hidden symbols. Enumerable user symbols remain copied data. No hidden-symbol promise is introduced, and these histories do not establish general symbol-update fidelity. |
+
+Prep totals: **11 raw items = 9 fixed-now + 2 accepted-design constraints**.
+There are no optional simplifications, duplicates, confirmed-open adapter
+findings, or discarded suggestions in this prep inventory. The original issue
+inventory remains five separate historical items: three fixes and two duplicates.
+Together the records account for 16 items: 12 fixes, two duplicates, and two
+accepted constraints. The unresolved Core policy boundary below is recorded as
+an explicit limit, not counted as a confirmed product-law violation.
+
+### Prep reviewer assessment
+
+The code review was accurate and had high signal: all six original findings
+reproduced. It challenged both production compatibility and the oracle's ability
+to detect corruption. P2 prioritization fits the demonstrated failures. The
+follow-up review also exposed a false-green method premise and distinguished
+Core draft behavior from adapter defects. Proposed repairs needed those broader
+checks before they established closure. Hire recommendation: yes for this review
+role, based on the executable counterexamples and successful calibrations.
+
+The simplification review showed useful restraint: it proposed no unsupported
+code reduction. Its hidden-getter probe and symbol-boundary analysis identified
+concrete compatibility constraints before the proposed changes shipped. Its
+final production review found no further actionable defect. Hire recommendation:
+yes for this role; there is no demonstrated simplification benefit to claim.
+
+### Contract and source-profile correction
+
+The receiving law remains unchanged: materialization preserves borrowed rows,
+mutation originals, and previous values; current results follow source rows.
+The expanded comparison judges full values and exact recursive own keys.
+It uses `toEqual` for values rather than inventing a draft-prototype policy.
+Independent method assertions retain the subclass promise where the source
+supplies it. Missing and own-undefined fields still fail in either direction.
+
+Expanded optimistic histories initially failed in the unchanged React and Vue
+adapters because the model predicted a confirming sync row at the held edit
+checkpoint. Core-only probes separated those source transformations from
+adapter defects. Deleting a draft field produces an own undefined patch field,
+as the draft-detachment and flat-change-tracking owners state. Assigning a
+null-prototype record or Array subclass currently emits an ordinary record or
+Array through Core detachment. The adapter repair does not revise that policy.
+
+Ordinary optimistic histories retain nested replacement and root deletion.
+Their held model explicitly contains own `extra: undefined` after deletion;
+full-sync confirmation removes the omitted field. Null-prototype, subclass,
+and host-store histories change only the scalar during the held edit, then
+confirm the full replacement through sync. Changing an object-valued sibling
+can also cause Core to detach an unchanged subclass, so these scalar-only
+histories change neither config nor extra. The local-only source profile
+models its actual draft-confirmed rows, including own undefined deletes and
+ordinary containers after draft replacement. These distinctions preserve
+ownership and value observations without declaring Core's copier an oracle.
+
+### Histories, paths, reach, and RED
+
+Every common driver runs **42 bounded histories**: seven shapes, three input
+forms, and sync versus optimistic writes. Solid also supplies native store
+inputs, giving **48 histories**, and runs **24 local-only histories** across
+the three input forms. React retains both existing suite registrations.
+Each history applies three updates and rechecks every retained value.
+
+Each input/write group asserts its own reach. Common groups reach their input,
+write path, retained previous value, later admission, root-delete representation,
+and nested own undefined seven times; each shape reaches once. Optimistic groups
+retain originals seven times. Solid's corresponding counts are eight, and each
+local-only input reaches eight histories. The object history keeps its config
+container across versions, admits nested own undefined at version 1, and removes
+it at version 3. This stable-container witness distinguishes recursive repair
+from a root-only implementation. Exact count assertions accompany minimum reach.
+
+Before the prep production repair, the expanded real Solid hook failed all six
+shared groups and all three local-only groups. Independent cases completed
+before a labelled aggregate reported their failures. The campaign exposed
+alias-current-value mismatches, accessor historical corruption, lost subclass
+methods, native-store runtime failures, and root own-key mismatches. The later
+stable-container comparison rejects both absent and stale nested undefined keys.
+
+```sh
+pnpm --filter @tanstack/solid-db exec vitest run tests/conformance.test.tsx -t 'row-snapshot-isolation|local-only row snapshots' --coverage.enabled=false --maxWorkers=2
+```
+
+The RED evidence is retained locally in `prep-red.log` and `prep-final-red.log`
+under `/private/tmp/issue-2305-audit/`. Core-only probes and unchanged-adapter
+results separated draft normalization from adapter defects. The final
+stable-container calibration and local-only host-proxy-assignment limit were
+added after the generic repair; production needed no further behavior change
+for those challenges. No oracle exclusion dismisses an adapter counterexample.
+
+### Mutants, calibration, and verification
+
+The restored final implementation passes the strengthened receiving suite.
+The following temporary production mutants ran the callback sync, callback
+optimistic, and actual local-only callback groups. Each failed all three groups;
+the mutated source was restored after every run.
+
+| Mutant | Observed rejection |
+| --- | --- |
+| Original copying behavior | Current-row and retained previous/original assertions. |
+| Copy only initial values | Historical values introduced by preceding updates change. |
+| Copy only updates | Initial borrowed snapshots change; current-result assertions also fail. |
+| Restore globally shared alias copies | Current-row values disagree after alias splitting. |
+| Drop copied Array prototypes | Independent source-supplied subclass assertion. |
+| Preserve enumerable source getter descriptors | Historical assertions and native-store `TypeError` after setup. |
+| Remove undefined-shape repair | Root and nested exact-key assertions, including stale undefined keys. |
+| Repair undefined shape at root only | Nested exact-key assertions on the stable config container. |
+
+The per-mutant logs are `prep-mutant-{original,initial-only,update-only,shared-alias,array-prototype,source-getters,no-undefined,root-only-undefined}.log`
+in the same local audit directory. Assertion failures and the native-store
+runtime failure are reported separately; no timeout or setup failure is cited
+as a successful comparison rejection.
+
+The ordinary DB calibration file has **11 passing tests**. Its wrong observations
+cover added and missing root fields, own undefined fields, nested undefined
+fields, and array holes versus own undefined elements. Its cleanup regressions
+also preserve primary and secondary error identities. The ordinary Solid shape
+test has two receiving cases: root and nested admission/removal, with separate
+`Object.keys` and `in` subscribers. Core emits those full-row updates even when
+only own-key presence changes. Both cases reject an alternate hook copy with
+only `reconcileUndefined` removed and pass restored production. They observe
+only final shapes and retain row identity. The isolated logs are
+`/private/tmp/solid-shape-subscriptions/red.log` and `green-package.log`; an
+earlier concurrent-mutant capture was detected, retained as `red-compound.log`,
+and excluded from the isolated-mutant claim.
+
+Final verification is **727 passing tests** across the complete files:
+Solid 138, React 205, Preact 100, Vue 107, Svelte 104, Angular 62, and DB
+calibration 11. The final row grammar was rechecked in every adapter after its
+last extension. Type checking, changed-file ESLint, `pnpm lint:changed`,
+Prettier, and `git diff --check` pass. The final size comparison against
+`origin/main` is **+430 gzip bytes / +404 brotli bytes** for Solid.
+
+### Updated oracle audit and limits
+
+- ORC-001–003: the same public authority governs the independent scalar model,
+  receiving source profiles, literate grammar, and exact public observations.
+- ORC-004: bounded enumeration reconstructs the reported and adjacent cases;
+  ablations lose aliases, accessors, methods, host stores, or source entry paths.
+  Three updates distinguish later admission and removal. Absent-key updates
+  remain excluded as illegal.
+- ORC-005–006: real framework hooks reach held and settled cuts. Original,
+  neighboring-design, wrong-observation, and runtime compatibility controls
+  have the classified outcomes above. Stable nested admission/removal rejects
+  a root-only repair.
+- ORC-007: these are finite exhaustive histories, not an important random
+  generated property. Fixed/random campaigns and seed shrinking do not apply;
+  the input/write test selector directly replays a receiving group.
+- ORC-008–009: versioned expected rows preserve distinctions that later writes
+  can observe. Source profiles describe the receiving inputs, not mutable
+  framework proxies or a replacement settlement model.
+- ORC-010: independent deferred cleanups and labelled cause chains preserve
+  the violated checkpoint, secondary diagnostics, and source teardown attempts.
+- ORC-011: no shared value-computation fault requiring a second model was found.
+  Core-only source-premise probes and hostile observation controls address the
+  concrete profile and premise-erasure hypotheses without duplicating the oracle.
+- ORC-012–016: this append preserves the loss audit, neighboring witnesses,
+  receiving source paths, measured reach, and direct shared judgment. Calibration
+  and notification examples remain in ordinary test files; all generated
+  receiving histories use the same model and comparison.
+
+The claim remains one key and three updates over the stated values, immutable
+function leaves, stable enumerable getters, native Solid store inputs, source
+profiles, and each driver's held/settled cuts. Hidden symbols retain the existing
+selected-value exclusion. Arbitrary getters, cyclic updates, class private-state
+cloning, general symbol updates, callback atomicity, other rollback schedules,
+real-browser rendering, and the application's undo UI are not established.
+
+One separate Core boundary remains unresolved: assigning a native Solid store
+through `Collection.update` can promote its hidden bookkeeping symbols during
+draft detachment. The supported policy for host-proxy assignment is not settled,
+so this is not labelled a confirmed product-law violation. Owner: **Drafts and
+native values**, with a maintainer support-policy decision and a real
+`createStore` → `Collection.update` receiving witness still needed. That witness
+must distinguish user keys from wrapper metadata and observe the stored and
+retained values. Local-only histories therefore begin with a native store and
+use ordinary replacements; controlled sync histories admit native stores on
+every update. This limit does not exempt the adapter's direct store inputs.
+
+No confirmed adapter counterexample remains inside the declared boundary.
+Quality evaluation is complete; changeset and PR-body creation await the user's
+next prep-pr gate. No remote CI or PR readiness claim follows from local checks.
+
+Final evaluated code fingerprint: **`bf8ca3a767dc7d204a75a3f4d69386b58c8e9669fc22de59ce99244472600656`**.
+This is SHA-256 over the 13 changed TypeScript paths in sorted repository-relative
+order, each path followed by NUL, file contents, and NUL. It supersedes the initial
+five-file fingerprint above.
+
+## Subsequent materialization review
+
+The ten-item external review and later independent findings changed the
+materializer and snapshot model again. The append-only
+[materialization review](2026-10-30-solid-row-materialization-review.md) records
+that evaluation against published head `1d619bb67`, the repaired code commit,
+final receiving reach, RED/GREEN/mutant evidence, and remaining limits. Its
+current evidence supersedes the earlier implementation and coverage summaries
+above without rewriting their historical claims.
+
+
+## Subsequent oracle-review correction
+
+A later four-agent review found that the React registrations described above
+as ordinary and DbClient drivers actually execute the same derived-identity
+API. Neither supplies DbClient receiving evidence. The former alias counts also
+credited the later-object history whose initial config is null. It supplies no
+mutable cross-row alias. These historical claims are inaccurate. The current
+coverage map and [native revision record](2026-10-30-solid-native-store-review.md)
+correct them and preserve the later findings. Earlier closure statements apply
+only to their recorded comparisons and do not establish the newly expanded
+root-field boundary, which has a known Core counterexample.
+
+## Final native and Core correction, code `2e962b1797e69066de52344fad9ea71811bc843e`
+
+The maintainer authorized fixing Core here. The pending-scope status above is
+historical. The final native helper replaces custom recursive reconciliation,
+and Core now preserves enumerable own source fields and accepted inherited-name
+destinations. The final [native review](2026-10-30-solid-native-store-review.md)
+records all new O1-O12 dispositions, valid RED/GREEN/mutant evidence, exact code,
+and accepted limits. Both React registrations remain derived-identity paths,
+with no DbClient credit. Core draft symbol-write policy and lifecycle #2310
+retain their separate owners.
diff --git a/packages/angular-db/tests/conformance.test.ts b/packages/angular-db/tests/conformance.test.ts
index 170ebe1f0b..9b8107d64e 100644
--- a/packages/angular-db/tests/conformance.test.ts
+++ b/packages/angular-db/tests/conformance.test.ts
@@ -70,12 +70,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ): SourceHandle<T> {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-angular-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)
diff --git a/packages/db/src/query/compiler/select.ts b/packages/db/src/query/compiler/select.ts
index f9db0515be..d07360aafd 100644
--- a/packages/db/src/query/compiler/select.ts
+++ b/packages/db/src/query/compiler/select.ts
@@ -24,6 +24,7 @@ type SelectOp =
       source: (row: NamespacedRow) => any
     }
   | { kind: `field`; alias: string; compiled: (row: NamespacedRow) => any }
+  | { kind: `object`; targetPath: Array<string> }
 
 /**
  * Unwraps any Value expressions
@@ -43,6 +44,63 @@ function assertSafeAliasSegments(segments: ReadonlyArray<string>): void {
   }
 }
 
+// A source spread copies enumerable own data, including user symbols. Defining
+// fields avoids invoking inherited setters for ordinary source property names.
+function mergeSourceFields(target: object, source: object): void {
+  for (const key of Reflect.ownKeys(source)) {
+    if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue
+    defineSelectField(target, key, unwrapVal(Reflect.get(source, key)))
+  }
+}
+
+// Only containers created by this evaluation may be modified. A spread or ref
+// can borrow a source object, so copy each borrowed destination at most once.
+function ownedDestination(
+  result: object,
+  path: ReadonlyArray<string>,
+  owned: WeakSet<object>,
+): object {
+  let cursor = result
+  for (const segment of path) {
+    const next = Object.hasOwn(cursor, segment)
+      ? Reflect.get(cursor, segment)
+      : undefined
+    if (next != null && typeof next === `object` && owned.has(next)) {
+      cursor = next
+      continue
+    }
+    const destination = Array.isArray(next)
+      ? new Array<unknown>(next.length)
+      : {}
+    if (Array.isArray(next)) {
+      Object.setPrototypeOf(destination, Object.getPrototypeOf(next))
+    }
+    if (next != null && typeof next === `object`) {
+      mergeSourceFields(destination, next)
+    }
+    owned.add(destination)
+    defineSelectField(cursor, segment, destination)
+    cursor = destination
+  }
+  return cursor
+}
+
+function defineSelectField(
+  target: object,
+  key: PropertyKey,
+  value: unknown,
+): void {
+  // Owned fields are normalized data. Preserve intrinsic array-length attributes
+  // when replacing its value; only newly created fields need ordinary defaults.
+  Object.defineProperty(
+    target,
+    key,
+    Object.hasOwn(target, key)
+      ? { value }
+      : { value, enumerable: true, configurable: true, writable: true },
+  )
+}
+
 /**
  * Processes a merge operation by merging source values into the target path
  */
@@ -50,37 +108,15 @@ function processMerge(
   op: Extract<SelectOp, { kind: `merge` }>,
   namespacedRow: NamespacedRow,
   selectResults: Record<string, any>,
+  owned: WeakSet<object>,
 ): void {
   assertSafeAliasSegments(op.targetPath)
   const value = op.source(namespacedRow)
   if (value && typeof value === `object`) {
-    // Ensure target object exists
-    let cursor: any = selectResults
-    const path = op.targetPath
-    if (path.length === 0) {
-      // Top-level merge
-      for (const [k, v] of Object.entries(value)) {
-        selectResults[k] = unwrapVal(v)
-      }
-    } else {
-      for (let i = 0; i < path.length; i++) {
-        const seg = path[i]!
-        if (i === path.length - 1) {
-          const dest = (cursor[seg] ??= {})
-          if (typeof dest === `object`) {
-            for (const [k, v] of Object.entries(value)) {
-              dest[k] = unwrapVal(v)
-            }
-          }
-        } else {
-          const next = cursor[seg]
-          if (next == null || typeof next !== `object`) {
-            cursor[seg] = {}
-          }
-          cursor = cursor[seg]
-        }
-      }
-    }
+    mergeSourceFields(
+      ownedDestination(selectResults, op.targetPath, owned),
+      value,
+    )
   }
 }
 
@@ -91,24 +127,47 @@ function processNonMergeOp(
   op: Extract<SelectOp, { kind: `field` }>,
   namespacedRow: NamespacedRow,
   selectResults: Record<string, any>,
+  owned: WeakSet<object>,
 ): void {
   // Support nested alias paths like "meta.author.name"
   const path = op.alias.split(`.`)
   assertSafeAliasSegments(path)
-  if (path.length === 1) {
-    selectResults[op.alias] = op.compiled(namespacedRow)
-  } else {
-    let cursor: any = selectResults
-    for (let i = 0; i < path.length - 1; i++) {
-      const seg = path[i]!
-      const next = cursor[seg]
-      if (next == null || typeof next !== `object`) {
-        cursor[seg] = {}
-      }
-      cursor = cursor[seg]
+  const target = ownedDestination(selectResults, path.slice(0, -1), owned)
+  defineSelectField(
+    target,
+    path[path.length - 1]!,
+    unwrapVal(op.compiled(namespacedRow)),
+  )
+}
+
+function evaluateSelectObject(
+  namespacedRow: NamespacedRow,
+  ops: Array<SelectOp>,
+): Record<string, unknown> {
+  const selectResults: Record<string, unknown> = {}
+  const owned = new WeakSet<object>([selectResults])
+  for (const op of ops) {
+    if (op.kind === `merge`) {
+      processMerge(op, namespacedRow, selectResults, owned)
+    } else if (op.kind === `field`) {
+      processNonMergeOp(op, namespacedRow, selectResults, owned)
+    } else {
+      assertSafeAliasSegments(op.targetPath)
+      const target = ownedDestination(
+        selectResults,
+        op.targetPath.slice(0, -1),
+        owned,
+      )
+      const destination = {}
+      owned.add(destination)
+      defineSelectField(
+        target,
+        op.targetPath[op.targetPath.length - 1]!,
+        destination,
+      )
     }
-    cursor[path[path.length - 1]!] = unwrapVal(op.compiled(namespacedRow))
   }
+  return selectResults
 }
 
 /**
@@ -118,15 +177,7 @@ function processRow(
   [key, namespacedRow]: [unknown, NamespacedRow],
   ops: Array<SelectOp>,
 ): [unknown, typeof namespacedRow & { $selected: any }] {
-  const selectResults: Record<string, any> = {}
-
-  for (const op of ops) {
-    if (op.kind === `merge`) {
-      processMerge(op, namespacedRow, selectResults)
-    } else {
-      processNonMergeOp(op, namespacedRow, selectResults)
-    }
-  }
+  const selectResults = evaluateSelectObject(namespacedRow, ops)
 
   // Return the namespaced row with $selected added
   return [
@@ -171,17 +222,7 @@ function compileSelectObject(
   const ops: Array<SelectOp> = []
   addFromObject([], obj, ops)
 
-  return (row) => {
-    const selectResults: Record<string, any> = {}
-    for (const op of ops) {
-      if (op.kind === `merge`) {
-        processMerge(op, row, selectResults)
-      } else {
-        processNonMergeOp(op, row, selectResults)
-      }
-    }
-    return selectResults
-  }
+  return (row) => evaluateSelectObject(row, ops)
 }
 
 function compileSelectValue(
@@ -315,8 +356,10 @@ function addFromObject(
       continue
     }
     if (isNestedSelectObject(expression)) {
-      // Nested selection object
-      addFromObject([...prefixPath, key], expression, ops)
+      // An authored object replaces any value supplied by an earlier spread.
+      const targetPath = [...prefixPath, ...key.split(`.`)]
+      ops.push({ kind: `object`, targetPath })
+      addFromObject(targetPath, expression, ops)
       continue
     }
 
diff --git a/packages/db/tests/conformance/contract.ts b/packages/db/tests/conformance/contract.ts
index 6469f4f085..897e2a1d48 100644
--- a/packages/db/tests/conformance/contract.ts
+++ b/packages/db/tests/conformance/contract.ts
@@ -86,7 +86,10 @@ export interface Row {
 export interface SourceHandle<T extends { id: string } = Row> {
   collection: Collection<any, any, any>
   insert: (row: T) => void
-  update: (row: T) => void
+  /** Local mutation sources can return the transaction's borrowed originals. */
+  update: (row: T) => void | {
+    mutations: ReadonlyArray<{ original: unknown }>
+  }
   remove: (row: T) => void
 }
 
@@ -154,7 +157,11 @@ export interface DbOps {
   createOptimisticAction: (config: {
     onMutate: (variables: any) => void
     mutationFn: (variables: any) => Promise<any>
-  }) => (variables?: any) => { when: (state: 'settled') => Promise<any> }
+  }) => (variables?: any) => {
+    when: (state: 'settled') => Promise<any>
+    /** Borrowed mutation snapshots must survive framework materialization. */
+    mutations: ReadonlyArray<{ original: unknown }>
+  }
 }
 
 /** Normalized, adapter-agnostic view of a live query's current result. */
@@ -270,7 +277,12 @@ export interface LiveQueryDriver {
   makeSource: <T extends { id: string }>(
     initialData: ReadonlyArray<T>,
     collectionId?: string,
+    options?: { rowUpdateMode?: `full` },
   ) => SourceHandle<T>
+  /** Wrap a source value in the real host's observable container, when supported. */
+  wrapSnapshotValue?: <T extends object>(value: T) => T
+  /** Local-only sources return actual transactions; host proxies enter initially. */
+  snapshotSourceUsesDraft?: boolean
   /** Create a source that starts `loading` and readies on demand (keyed by `id`). */
   makeDeferredSource: <T extends { id: string }>() => DeferredSourceHandle<T>
   /** Create a ready source whose sync adapter reports the scenario controls. */
diff --git a/packages/db/tests/conformance/public-field-oracle.ts b/packages/db/tests/conformance/public-field-oracle.ts
new file mode 100644
index 0000000000..cfba36e9da
--- /dev/null
+++ b/packages/db/tests/conformance/public-field-oracle.ts
@@ -0,0 +1,692 @@
+/**
+ * Enumerable own source fields survive selection as data. Authority:
+ * live-queries.md, "Include all user fields", and live/ARCHITECTURE.md's
+ * public-boundary preservation. Accepted destinations such as `toString` name
+ * ordinary output fields. Unsafe authored alias paths keep their restrictions.
+ *
+ * This is the public-field family of includes-context-transport-oracle.test.ts,
+ * shared with real framework receivers. Scalar stages independently construct
+ * source and selected rows. The grammar crosses source keys, root/nested
+ * selection, and accepted nested destinations. It bounds values to strings and
+ * own undefined, and does not judge arbitrary descriptors or notification-only
+ * changes. A version field makes every stage a distinct source update.
+ */
+import { expect } from 'vitest'
+import { declareOracle } from '../oracle-declaration'
+import { createOracleReach } from '../oracle-reach'
+import { expectRowSnapshot } from './row-snapshot-oracle'
+import { ScenarioLifetime } from './scenario-lifetime'
+import type {
+  LiveQueryDriver,
+  LiveQueryHandle,
+  QueryBuild,
+  SourceHandle,
+} from './contract'
+
+export const publicFieldSymbol = Symbol(`user field`)
+export const publicFieldGrammar = {
+  keys: [
+    `__proto__`,
+    `constructor`,
+    `prototype`,
+    `toString`,
+    `ordinary`,
+    publicFieldSymbol,
+  ] as const,
+  locations: [`root`, `nested`] as const,
+  selections: [`spread`, `whole-row`, `functional`, `implicit`] as const,
+  destinations: [`payload`, `toString`, `wrapper.toString`] as const,
+}
+export type PublicFieldCell = {
+  family: `public-field`
+  key: (typeof publicFieldGrammar.keys)[number]
+  location: (typeof publicFieldGrammar.locations)[number]
+  selection: (typeof publicFieldGrammar.selections)[number]
+  destination: (typeof publicFieldGrammar.destinations)[number]
+}
+// Destination variation matters only when a nested spread creates that output
+// container. The other formulations are neighboring direct-reference controls.
+export const publicFieldCells = publicFieldGrammar.keys.flatMap((key) =>
+  publicFieldGrammar.locations.flatMap((location) =>
+    publicFieldGrammar.selections.flatMap((selection) =>
+      (location === `nested` && selection === `spread`
+        ? publicFieldGrammar.destinations
+        : ([`payload`] as const)
+      ).map((destination): PublicFieldCell => ({
+        family: `public-field`,
+        key,
+        location,
+        selection,
+        destination,
+      })),
+    ),
+  ),
+)
+export type PublicFieldRow = {
+  id: number
+  parentGroup: number
+  version: number
+  payload: Record<PropertyKey, string | undefined>
+}
+export const fieldStages = [0, 1, 2, 3, 4] as const
+// Stage 0/3 omits the key; stage 2 owns undefined. Those are different facts.
+function fields(cell: PublicFieldCell, version: number) {
+  return version === 0 || version === 3
+    ? {}
+    : { [cell.key]: version === 2 ? undefined : `ordinary data ${version}` }
+}
+export function expectedPublicField(
+  cell: PublicFieldCell,
+  version: number,
+): PublicFieldRow {
+  return {
+    id: 10,
+    parentGroup: 1,
+    version,
+    payload: cell.location === `nested` ? fields(cell, version) : {},
+    ...(cell.location === `root` ? fields(cell, version) : {}),
+  }
+}
+// The expected output uses explicit shapes, independently of the compiler's
+// dotted-path walker or the production builder's computed property name.
+export function expectedSelectedPublicField(
+  cell: PublicFieldCell,
+  version: number,
+) {
+  if (cell.destination === `payload`) return expectedPublicField(cell, version)
+  const base = { id: 10, parentGroup: 1, version }
+  return cell.destination === `toString`
+    ? { ...base, ...Object.fromEntries([[`toString`, fields(cell, version)]]) }
+    : {
+        ...base,
+        wrapper: {
+          ...Object.fromEntries([[`toString`, fields(cell, version)]]),
+        },
+      }
+}
+
+/**
+ * Frameworks supply actual mount/flush/source operations from their own realm.
+ * Only the new nested-destination cells need an additional receiving path here;
+ * the snapshot owner already covers ordinary source-field preservation. After
+ * each full source write, compare the complete selected row at the native host
+ * cut. A mismatch on one cell must not suppress other cells or later stages.
+ */
+export async function runPublicFieldHistories(
+  driver: LiveQueryDriver,
+  input: `callback` | `config`,
+) {
+  const cases = publicFieldCells.filter(
+    (cell) => cell.destination !== `payload`,
+  )
+  const reach = createOracleReach(
+    `framework.${driver.name}.${input}.public-fields`,
+    [input, `toString`, `wrapper.toString`, ...fieldStages.map(String)],
+  )
+  const failures: Array<Error> = []
+  for (const cell of cases) {
+    reach.beginHistory()
+    const resources = new ScenarioLifetime()
+    try {
+      await resources.run(async () => {
+        const sourceRow = (version: number) => ({
+          ...expectedPublicField(cell, version),
+          id: `a`,
+        })
+        const source = driver.makeSource([sourceRow(0)], undefined, {
+          rowUpdateMode: `full`,
+        })
+        let handle: LiveQueryHandle | undefined
+        try {
+          const build: QueryBuild = (q) =>
+            q
+              .from({ row: source.collection })
+              .select(({ row }: { row: PublicFieldRow }) => ({
+                id: row.id,
+                parentGroup: row.parentGroup,
+                version: row.version,
+                ...(cell.destination === `wrapper.toString`
+                  ? { wrapper: { toString: { ...row.payload } } }
+                  : { [cell.destination]: { ...row.payload } }),
+              }))
+          handle =
+            input === `config` ? driver.mountConfig(build) : driver.mount(build)
+          reach.reach(input)
+          reach.reach(cell.destination)
+          for (const version of fieldStages) {
+            if (version > 0)
+              await handle.apply(() => source.update(sourceRow(version)))
+            await handle.flush()
+            expectRowSnapshot(
+              source.collection.get(`a`),
+              sourceRow(version),
+              `source admitted fields`,
+            )
+            reach.reach(String(version))
+            try {
+              const rows = handle.current().data as ReadonlyArray<unknown>
+              expect(rows, `complete framework result`).toHaveLength(1)
+              expectRowSnapshot(
+                rows[0],
+                { ...expectedSelectedPublicField(cell, version), id: `a` },
+                `framework selected fields`,
+              )
+            } catch (cause) {
+              failures.push(
+                new Error(
+                  `${input}/${String(cell.key)}/${cell.destination}/stage ${version}`,
+                  { cause },
+                ),
+              )
+            }
+          }
+        } finally {
+          resources.defer(() => handle?.unmount())
+          resources.defer(() => handle?.collection()?.cleanup())
+          resources.defer(() => source.collection.cleanup())
+        }
+      })
+    } catch (cause) {
+      failures.push(
+        new Error(`${input}/${String(cell.key)}/${cell.destination}`, {
+          cause,
+        }),
+      )
+    }
+  }
+  if (failures.length)
+    throw new AggregateError(failures, `Selected source fields were lost`)
+  reach.assertReached()
+  expect(Object.fromEntries(reach.counts())).toEqual({
+    [input]: 12,
+    toString: 6,
+    'wrapper.toString': 6,
+    ...Object.fromEntries(fieldStages.map((stage) => [String(stage), 12])),
+  })
+  await runPublicFieldOverlapHistories({
+    name: `framework.${driver.name}.${input}`,
+    makeSource: driver.makeSource,
+    mount(build) {
+      const handle =
+        input === `config` ? driver.mountConfig(build) : driver.mount(build)
+      return { ...handle, read: () => handle.current().data }
+    },
+  })
+}
+
+/**
+ * A nested object literal replaces the field supplied by an earlier spread.
+ * A dotted alias instead changes its named path and preserves its siblings.
+ * Neither projection may write through a borrowed source object. Authority:
+ * live-queries.md's Select contract and ARCHITECTURE.md's pure composition law.
+ * Writable nonconfigurable input data is still readable source data; output
+ * fields need not inherit that descriptor. Descriptor identity is not judged.
+ *
+ * This finite overlap grammar adds one rule missing from the field-name matrix:
+ * a destination already contains a source reference. Three paths distinguish a
+ * normal field, an inherited-name shadow, and a deeper borrowed parent. Four
+ * operations distinguish nested replacement from dotted writes, with a fresh
+ * destination as a control. Core also runs a real functional formulation.
+ * Source destinations share
+ * one target, so a write through one path cannot hide in another selected path.
+ * Array neighbors shorten a borrowed ordinary or subclass array to lengths
+ * zero, one, and two. The intrinsic nonconfigurable length is writable; changing
+ * an owned copy must preserve the source array and the subclass's methods.
+ * Unsafe authored path segments remain outside this legal grammar.
+ */
+export const publicFieldOverlapGrammar = {
+  destinations: [`payload`, `toString`, `wrapper.toString`] as const,
+  operations: [
+    `nested-spread`,
+    `nested-field`,
+    `dotted-field`,
+    `fresh-nested`,
+  ] as const,
+  descriptors: [`configurable`, `nonconfigurable`] as const,
+  arrayOperations: [`dotted-array-length`, `dotted-subclass-length`] as const,
+}
+export type PublicFieldOverlapCell = {
+  family: `public-field-overlap`
+  destination: (typeof publicFieldOverlapGrammar.destinations)[number]
+  operation:
+    | (typeof publicFieldOverlapGrammar.operations)[number]
+    | (typeof publicFieldOverlapGrammar.arrayOperations)[number]
+    | `functional`
+  descriptor:
+    (typeof publicFieldOverlapGrammar.descriptors)[number] | `intrinsic`
+}
+export const publicFieldOverlapCells = [
+  ...publicFieldOverlapGrammar.destinations.flatMap((destination) =>
+    publicFieldOverlapGrammar.operations.flatMap((operation) =>
+      publicFieldOverlapGrammar.descriptors.map(
+        (descriptor): PublicFieldOverlapCell => ({
+          family: `public-field-overlap`,
+          destination,
+          operation,
+          descriptor,
+        }),
+      ),
+    ),
+  ),
+  ...publicFieldOverlapGrammar.destinations.flatMap((destination) =>
+    publicFieldOverlapGrammar.arrayOperations.map(
+      (operation): PublicFieldOverlapCell => ({
+        family: `public-field-overlap`,
+        destination,
+        operation,
+        descriptor: `intrinsic`,
+      }),
+    ),
+  ),
+]
+// A functional callback is a legal Core formulation. Unkeyed React/Preact
+// bindings intentionally reject it under contract.ts's query-identity law, so
+// their callback/config receiving drivers use the legal fresh-expression control.
+export const publicFieldOverlapFunctionalCells = publicFieldOverlapCells
+  .filter((cell) => cell.operation === `nested-spread`)
+  .map((cell): PublicFieldOverlapCell => ({ ...cell, operation: `functional` }))
+export const overlapStages = [0, 1, 2] as const
+type OverlapTarget = { value: string | number | undefined; sourceOnly: string }
+class OverlapValues extends Array<number> {
+  total(): number {
+    return this.reduce((sum, value) => sum + value, 0)
+  }
+}
+function isArrayLengthOverlap(cell: PublicFieldOverlapCell): boolean {
+  return publicFieldOverlapGrammar.arrayOperations.some(
+    (operation) => cell.operation === operation,
+  )
+}
+function expectedOverlapArray(
+  cell: PublicFieldOverlapCell,
+  version: number,
+  length: number,
+): Array<number> {
+  const values = [version * 10 + 1, version * 10 + 2, version * 10 + 3].slice(
+    0,
+    length,
+  )
+  if (cell.operation === `dotted-subclass-length`)
+    Object.setPrototypeOf(values, OverlapValues.prototype)
+  return values
+}
+export type PublicFieldOverlapRow = {
+  id: string
+  parentGroup: number
+  version: number
+  payload: OverlapTarget | Array<number>
+  toString: OverlapTarget | Array<number>
+  wrapper: { toString: OverlapTarget | Array<number>; sibling: string }
+  replacement: { value: string | undefined }
+}
+
+// Expectations are explicit scalar shapes. They do not walk compiler alias
+// paths or share the source's mutable containers. The descriptor is a premise,
+// not part of the expected public representation.
+export function expectedPublicFieldOverlapSource(
+  version: number,
+  cell?: PublicFieldOverlapCell,
+): PublicFieldOverlapRow {
+  const target = () =>
+    cell && isArrayLengthOverlap(cell)
+      ? expectedOverlapArray(cell, version, 3)
+      : {
+          value: `source ${version}`,
+          sourceOnly: `retained ${version}`,
+        }
+  return {
+    id: `a`,
+    parentGroup: 1,
+    version,
+    payload: target(),
+    toString: target(),
+    wrapper: { toString: target(), sibling: `sibling ${version}` },
+    replacement: { value: version === 1 ? undefined : `selected ${version}` },
+  }
+}
+export function publicFieldOverlapSource(
+  cell: PublicFieldOverlapCell,
+  version: number,
+): PublicFieldOverlapRow {
+  const row = expectedPublicFieldOverlapSource(version, cell)
+  const target = row.payload
+  if (!Array.isArray(target))
+    Object.defineProperty(target, `value`, {
+      value: target.value,
+      writable: true,
+      enumerable: true,
+      configurable: version === 0 || cell.descriptor === `configurable`,
+    })
+  return {
+    ...row,
+    toString: target,
+    wrapper: { ...row.wrapper, toString: target },
+  }
+}
+export function expectedSelectedPublicFieldOverlap(
+  cell: PublicFieldOverlapCell,
+  version: number,
+) {
+  const source = expectedPublicFieldOverlapSource(version, cell)
+  if (isArrayLengthOverlap(cell)) {
+    const selected = expectedOverlapArray(cell, version, version)
+    if (cell.destination === `payload`) return { ...source, payload: selected }
+    if (cell.destination === `toString`)
+      return { ...source, toString: selected }
+    return {
+      ...source,
+      wrapper: { ...source.wrapper, toString: selected },
+    }
+  }
+  const selected =
+    cell.operation === `dotted-field`
+      ? { value: version, sourceOnly: `retained ${version}` }
+      : {
+          value:
+            cell.operation === `nested-field`
+              ? version
+              : source.replacement.value,
+        }
+  if (cell.destination === `payload`) return { ...source, payload: selected }
+  if (cell.destination === `toString`) return { ...source, toString: selected }
+  return {
+    ...source,
+    wrapper:
+      cell.operation === `dotted-field`
+        ? { toString: selected, sibling: `sibling ${version}` }
+        : { toString: selected },
+  }
+}
+
+// The builder authors actual nested objects for replacement, and literal
+// dotted aliases only for the separate path-update operation. Expectations above
+// are not computed by this production-path construction.
+function overlapProjection(
+  row: PublicFieldOverlapRow,
+  cell: PublicFieldOverlapCell,
+) {
+  if (isArrayLengthOverlap(cell))
+    return { ...row, [`${cell.destination}.length`]: row.version }
+  if (cell.operation === `dotted-field`)
+    return { ...row, [`${cell.destination}.value`]: row.version }
+  const value =
+    cell.operation === `nested-field`
+      ? { value: row.version }
+      : { ...row.replacement }
+  if (cell.operation === `fresh-nested`) {
+    const base = {
+      id: row.id,
+      parentGroup: row.parentGroup,
+      version: row.version,
+      replacement: row.replacement,
+    }
+    if (cell.destination === `payload`)
+      return {
+        ...base,
+        payload: value,
+        toString: row.toString,
+        wrapper: row.wrapper,
+      }
+    if (cell.destination === `toString`)
+      return {
+        ...base,
+        payload: row.payload,
+        toString: value,
+        wrapper: row.wrapper,
+      }
+    return {
+      ...base,
+      payload: row.payload,
+      toString: row.toString,
+      wrapper: { toString: value },
+    }
+  }
+  if (cell.destination === `payload`) return { ...row, payload: value }
+  if (cell.destination === `toString`) return { ...row, toString: value }
+  return { ...row, wrapper: { toString: value } }
+}
+export function buildPublicFieldOverlap(
+  source: SourceHandle<PublicFieldOverlapRow>,
+  cell: PublicFieldOverlapCell,
+): QueryBuild {
+  return (q) => {
+    const base = q.from({ row: source.collection })
+    const select = ({ row }: { row: PublicFieldOverlapRow }) =>
+      overlapProjection(row, cell)
+    return cell.operation === `functional`
+      ? base.fn.select(select)
+      : base.select(select)
+  }
+}
+
+export type PublicFieldOverlapHost = {
+  name: string
+  makeSource: LiveQueryDriver[`makeSource`]
+  mount: (build: QueryBuild) => Pick<
+    LiveQueryHandle,
+    `apply` | `flush` | `unmount` | `collection`
+  > & {
+    read: () => unknown
+  }
+}
+
+/**
+ * Every host supplies its own source/mount/flush operations. Capture a source
+ * reference before mount and after each full write; compare current and retained
+ * rows with independent scalar facts at each host cut. A query runtime failure
+ * after admission, including a mount that throws before returning a handle, is
+ * a recorded observation: the comparison requires readable complete rows. A
+ * failed mount is retried after each source update so every scalar stage enters
+ * the actual receiving path. It is not discarded as a provider failure.
+ */
+export async function runPublicFieldOverlapCell(
+  host: PublicFieldOverlapHost,
+  cell: PublicFieldOverlapCell,
+) {
+  const label = `${host.name}/${cell.destination}/${cell.operation}/${cell.descriptor}`
+  const runtimeFailures: Array<{ stage: number; error: unknown }> = []
+  const states = overlapStages.flatMap((stage) => [
+    `${stage}:result`,
+    `${stage}:source`,
+    `${stage}:retained`,
+    `${stage}:descriptor`,
+  ])
+  const reach = createOracleReach(label, states)
+  reach.beginHistory()
+  const failures: Array<Error> = []
+  const check = (checkpoint: string, compare: () => void) => {
+    reach.reach(checkpoint)
+    try {
+      compare()
+    } catch (cause) {
+      failures.push(new Error(`${label}/${checkpoint}`, { cause }))
+    }
+  }
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const source = host.makeSource(
+      [publicFieldOverlapSource(cell, 0)],
+      undefined,
+      { rowUpdateMode: `full` },
+    )
+    let handle: ReturnType<PublicFieldOverlapHost[`mount`]> | undefined
+    try {
+      await source.collection.preload()
+      expectRowSnapshot(
+        source.collection.get(`a`),
+        expectedPublicFieldOverlapSource(0, cell),
+        `${label}: admitted before mount`,
+      )
+      const retained = [{ actual: source.collection.get(`a`), version: 0 }]
+      const admitted = source.collection.get(`a`) as PublicFieldOverlapRow
+      expect(admitted.payload, `${label}: shared source target`).toBe(
+        admitted.toString,
+      )
+      expect(admitted.payload, `${label}: deeper shared source target`).toBe(
+        admitted.wrapper.toString,
+      )
+      for (const version of overlapStages) {
+        const runtimeErrors: Array<unknown> = []
+        if (version > 0) {
+          try {
+            const write = () => {
+              source.update(publicFieldOverlapSource(cell, version))
+            }
+            if (handle) await handle.apply(write)
+            else write()
+          } catch (error) {
+            runtimeErrors.push(error)
+          }
+          retained.push({ actual: source.collection.get(`a`), version })
+        }
+        if (!handle) {
+          try {
+            handle = host.mount(buildPublicFieldOverlap(source, cell))
+          } catch (error) {
+            runtimeErrors.push(error)
+          }
+        }
+        try {
+          await handle?.flush()
+        } catch (error) {
+          runtimeErrors.push(error)
+        }
+        let rows: unknown
+        try {
+          rows = handle?.read()
+        } catch (error) {
+          runtimeErrors.push(error)
+        }
+        runtimeFailures.push(
+          ...runtimeErrors.map((error) => ({ stage: version, error })),
+        )
+        check(`${version}:result`, () => {
+          expect(runtimeErrors, `${label}: query remains readable`).toEqual([])
+          expect(Array.isArray(rows), `${label}: complete result array`).toBe(
+            true,
+          )
+          expect(rows, `${label}: complete result`).toHaveLength(1)
+          expectRowSnapshot(
+            (rows as Array<unknown>)[0],
+            expectedSelectedPublicFieldOverlap(cell, version),
+            `${label}: selected row`,
+          )
+        })
+        check(`${version}:source`, () =>
+          expectRowSnapshot(
+            source.collection.get(`a`),
+            expectedPublicFieldOverlapSource(version, cell),
+            `${label}: current source`,
+          ),
+        )
+        check(`${version}:retained`, () => {
+          for (const prior of retained)
+            expectRowSnapshot(
+              prior.actual,
+              expectedPublicFieldOverlapSource(prior.version, cell),
+              `${label}: retained source ${prior.version}`,
+            )
+        })
+        check(`${version}:descriptor`, () => {
+          const current = source.collection.get(`a`) as PublicFieldOverlapRow
+          if (isArrayLengthOverlap(cell)) {
+            expect(
+              Array.isArray(current.payload),
+              `${label}: admitted array`,
+            ).toBe(true)
+            expect(
+              current.payload,
+              `${label}: unchanged source length`,
+            ).toHaveLength(3)
+            expect(
+              Object.getOwnPropertyDescriptor(current.payload, `length`),
+              `${label}: admitted intrinsic length`,
+            ).toEqual({
+              value: 3,
+              writable: true,
+              enumerable: false,
+              configurable: false,
+            })
+            return
+          }
+          expect(
+            Object.getOwnPropertyDescriptor(current.payload, `value`),
+            `${label}: admitted descriptor`,
+          ).toMatchObject({
+            writable: true,
+            enumerable: true,
+            configurable: version === 0 || cell.descriptor === `configurable`,
+          })
+        })
+      }
+    } finally {
+      resources.defer(() => handle?.unmount())
+      resources.defer(() => handle?.collection()?.cleanup())
+      resources.defer(() => source.collection.cleanup())
+    }
+    reach.assertReached()
+    if (process.env.TANSTACK_DB_ORACLE_STATISTICS === `1`)
+      console.info(
+        JSON.stringify({
+          oracle: `public-field-overlap`,
+          host: host.name,
+          cell,
+          reach: Object.fromEntries(reach.counts()),
+          runtimeFailures: runtimeFailures.map(({ stage, error }) => ({
+            stage,
+            name: error instanceof Error ? error.name : typeof error,
+            message: error instanceof Error ? error.message : String(error),
+          })),
+          failures: failures.map((failure) => ({
+            checkpoint: failure.message,
+            cause:
+              failure.cause instanceof Error
+                ? failure.cause.message
+                : String(failure.cause),
+          })),
+        }),
+      )
+    if (failures.length)
+      throw new AggregateError(
+        failures,
+        `${label}: projection changed borrowed data or failed`,
+      )
+  })
+}
+export async function runPublicFieldOverlapHistories(
+  host: PublicFieldOverlapHost,
+) {
+  const failures: Array<Error> = []
+  for (const cell of publicFieldOverlapCells) {
+    try {
+      await runPublicFieldOverlapCell(host, cell)
+    } catch (cause) {
+      failures.push(
+        new Error(`${cell.destination}/${cell.operation}/${cell.descriptor}`, {
+          cause,
+        }),
+      )
+    }
+  }
+  if (failures.length)
+    throw new AggregateError(failures, `${host.name}: overlapping projections`)
+}
+
+declareOracle({
+  model: [
+    expectedPublicField,
+    expectedSelectedPublicField,
+    expectedPublicFieldOverlapSource,
+    expectedSelectedPublicFieldOverlap,
+  ],
+  grammar: [
+    publicFieldCells,
+    publicFieldOverlapCells,
+    publicFieldOverlapFunctionalCells,
+  ],
+  check: [
+    runPublicFieldHistories,
+    runPublicFieldOverlapCell,
+    runPublicFieldOverlapHistories,
+  ],
+})
diff --git a/packages/db/tests/conformance/result-laws.ts b/packages/db/tests/conformance/result-laws.ts
index 9013f86925..6e778b9a7a 100644
--- a/packages/db/tests/conformance/result-laws.ts
+++ b/packages/db/tests/conformance/result-laws.ts
@@ -15,13 +15,10 @@ export function expectResultSurface<
   return result
 }
 
-/** Selected values, separate from virtual row metadata and framework internals. */
-export function selectedRow(row: unknown): Record<PropertyKey, unknown> {
-  expect(row).not.toBeNull()
-  expect(typeof row).toBe(`object`)
-  const value = row as Record<PropertyKey, unknown>
+/** The selected-value boundary shared by recorders and source drivers. */
+export function selectedRowKeys(value: object): Array<PropertyKey> {
   const virtual = [`$hasPendingWrites`, `$origin`, `$key`, `$collectionId`]
-  return Object.fromEntries(
+  return (
     Reflect.ownKeys(value)
       // Solid stores nonenumerable bookkeeping symbols on its row wrappers.
       // This shared law observes selected values, not all hidden wrapper state.
@@ -31,7 +28,16 @@ export function selectedRow(row: unknown): Record<PropertyKey, unknown> {
           Object.prototype.propertyIsEnumerable.call(value, key),
       )
       .filter((key) => typeof key !== `string` || !virtual.includes(key))
-      .map((key) => [key, value[key]]),
+  )
+}
+
+/** Selected values, separate from virtual row metadata and framework internals. */
+export function selectedRow(row: unknown): Record<PropertyKey, unknown> {
+  expect(row).not.toBeNull()
+  expect(typeof row).toBe(`object`)
+  const value = row as Record<PropertyKey, unknown>
+  return Object.fromEntries(
+    selectedRowKeys(value).map((key) => [key, value[key]]),
   )
 }
 
diff --git a/packages/db/tests/conformance/row-snapshot-calibration.test.ts b/packages/db/tests/conformance/row-snapshot-calibration.test.ts
new file mode 100644
index 0000000000..38e9d72896
--- /dev/null
+++ b/packages/db/tests/conformance/row-snapshot-calibration.test.ts
@@ -0,0 +1,323 @@
+import { describe, expect, it } from 'vitest'
+import {
+  expectRowSnapshot,
+  runRowSnapshotHistories,
+} from './row-snapshot-oracle'
+import type { LiveQueryDriver } from './contract'
+
+// Wrong observations go through the same checker as receiving histories.
+// These controls judge checker sensitivity, not a separate product model.
+describe(`row snapshot comparison calibration`, () => {
+  const expected = { id: `a`, value: 0 }
+  const cases = [
+    {
+      name: `unexpected ordinary root field`,
+      actual: { ...expected, unexpected: { value: 1 } },
+      expected,
+    },
+    {
+      name: `missing ordinary root field`,
+      actual: { id: `a` },
+      expected,
+    },
+    {
+      name: `unexpected undefined root field`,
+      actual: { ...expected, unexpected: undefined },
+      expected,
+    },
+    {
+      name: `missing explicitly undefined root field`,
+      actual: expected,
+      expected: { ...expected, optional: undefined },
+    },
+    {
+      name: `unexpected nested undefined field`,
+      actual: { ...expected, config: { value: 0, optional: undefined } },
+      expected: { ...expected, config: { value: 0 } },
+    },
+    {
+      name: `missing explicitly undefined nested field`,
+      actual: { ...expected, config: { value: 0 } },
+      expected: { ...expected, config: { value: 0, optional: undefined } },
+    },
+    {
+      name: `unexpected undefined array element`,
+      actual: { ...expected, config: [undefined] },
+      expected: { ...expected, config: new Array(1) },
+    },
+    {
+      name: `missing explicitly undefined array element`,
+      actual: { ...expected, config: new Array(1) },
+      expected: { ...expected, config: [undefined] },
+    },
+  ]
+
+  it.each(cases)(`rejects $name`, ({ actual, expected: model, name }) => {
+    expect(() => expectRowSnapshot(actual, model, name)).toThrow()
+  })
+
+  it(`accepts the complete matching user shape`, () => {
+    expect(() =>
+      expectRowSnapshot({ ...expected }, expected, `matching snapshot`),
+    ).not.toThrow()
+  })
+})
+
+type CalibrationRow = { id: string } & Record<string, unknown>
+type Changes = ReadonlyArray<{
+  key: string
+  type: `update`
+  value: CalibrationRow
+  previousValue: CalibrationRow
+}>
+
+function cleanupDriver(
+  options: {
+    primaryFailure?: Error
+    corruptOriginal?: boolean
+    omitOriginals?: boolean
+    failCleanup?: boolean
+    corruptSource?: `current` | `admitted` | `initial`
+  } = {},
+) {
+  const projectionFailure = new Error(`projection cleanup rejected`)
+  let sourceCleanups = 0
+  let projectionCleanups = 0
+  let rows = new Map<string, CalibrationRow>()
+  let published = new Map<string, CalibrationRow>()
+  let notify: ((changes: Changes) => void) | undefined
+  const source = {
+    get: (id: string) => rows.get(id),
+    subscribeChanges(callback: (changes: Changes) => void) {
+      notify = callback
+      return {
+        unsubscribe() {
+          notify = undefined
+        },
+      }
+    },
+    cleanup() {
+      sourceCleanups++
+      return Promise.resolve()
+    },
+  }
+  const projection = {
+    cleanup() {
+      projectionCleanups++
+      return options.failCleanup === false
+        ? Promise.resolve()
+        : Promise.reject(projectionFailure)
+    },
+  }
+  const handle = {
+    current: () => ({ data: [...published.values()] }),
+    collection: () => projection,
+    flush() {
+      return options.primaryFailure
+        ? Promise.reject(options.primaryFailure)
+        : Promise.resolve()
+    },
+    apply(write: () => void) {
+      write()
+      return Promise.resolve()
+    },
+    unmount() {},
+  }
+  // Only the callback/sync path runs. The fixture supplies its minimal driver
+  // at this boundary; it does not pretend to implement a real Collection.
+  const driver = {
+    name: `cleanup-calibration`,
+    snapshotSourceUsesDraft: true,
+    makeSource(initial: ReadonlyArray<CalibrationRow>) {
+      rows = new Map(initial.map((row) => [row.id, row]))
+      published = new Map(rows)
+      return {
+        collection: source,
+        update(next: CalibrationRow) {
+          const previousValue = rows.get(next.id)!
+          rows.set(next.id, next)
+          published.set(next.id, next)
+          notify?.([
+            { key: next.id, type: `update`, value: next, previousValue },
+          ])
+          if (options.corruptSource && next.value === 3) {
+            const correct = { ...next }
+            published.set(next.id, correct)
+            if (options.corruptSource === `current`)
+              rows.set(next.id, { ...next, corrupted: true })
+            if (options.corruptSource === `admitted`) {
+              rows.set(next.id, correct)
+              next.corrupted = true
+            }
+          }
+          return {
+            mutations: options.omitOriginals
+              ? []
+              : [
+                  {
+                    original: options.corruptOriginal
+                      ? { ...previousValue, config: `corrupted original` }
+                      : previousValue,
+                  },
+                ],
+          }
+        },
+      }
+    },
+    mount: () => {
+      if (options.corruptSource === `initial`)
+        for (const [id, row] of rows) {
+          const correct = { ...row }
+          rows.set(id, correct)
+          published.set(id, correct)
+          row.corrupted = true
+        }
+      return handle
+    },
+  } as unknown as LiveQueryDriver
+  return {
+    driver,
+    projectionFailure,
+    counts: () => ({ sourceCleanups, projectionCleanups }),
+  }
+}
+
+function containsFailure(
+  actual: unknown,
+  expected: Error,
+  seen = new Set<unknown>(),
+): boolean {
+  if (actual === expected) return true
+  if (!(actual instanceof Error) || seen.has(actual)) return false
+  seen.add(actual)
+  return (
+    containsFailure(actual.cause, expected, seen) ||
+    (actual instanceof AggregateError &&
+      actual.errors.some((error: unknown) =>
+        containsFailure(error, expected, seen),
+      ))
+  )
+}
+
+describe(`row snapshot history cleanup`, () => {
+  it(`attempts source cleanup after projection cleanup rejects`, async () => {
+    const subject = cleanupDriver()
+    const failure: unknown = await runRowSnapshotHistories(
+      subject.driver,
+      `callback`,
+      `sync`,
+    ).catch((error: unknown) => error)
+    expect(containsFailure(failure, subject.projectionFailure)).toBe(true)
+    const { sourceCleanups, projectionCleanups } = subject.counts()
+    expect(projectionCleanups).toBeGreaterThan(0)
+    expect(sourceCleanups).toBe(projectionCleanups)
+  })
+
+  it(`preserves a primary failure and the distinct cleanup failure`, async () => {
+    const primaryFailure = new Error(`framework flush failed`)
+    const subject = cleanupDriver({ primaryFailure })
+    const failure: unknown = await runRowSnapshotHistories(
+      subject.driver,
+      `callback`,
+      `sync`,
+    ).catch((error: unknown) => error)
+    expect(containsFailure(failure, primaryFailure)).toBe(true)
+    expect(containsFailure(failure, subject.projectionFailure)).toBe(true)
+    const { sourceCleanups, projectionCleanups } = subject.counts()
+    expect(projectionCleanups).toBeGreaterThan(0)
+    expect(sourceCleanups).toBe(projectionCleanups)
+  })
+})
+
+// This driver changes only a returned local transaction original. Current
+// rows and event previousValue stay correct, so those observations cannot
+// substitute for retaining the local-only receipt itself.
+it(`rejects corruption confined to local mutation originals`, async () => {
+  const subject = cleanupDriver({ corruptOriginal: true, failCleanup: false })
+  const failure: unknown = await runRowSnapshotHistories(
+    subject.driver,
+    `callback`,
+    `sync`,
+  ).catch((error: unknown) => error)
+  expect(String(failure)).toContain(`local mutation.original`)
+  expect(containsFailure(failure, subject.projectionFailure)).toBe(false)
+})
+
+it(`accepts admitted source shapes without assuming draft normalization`, async () => {
+  const subject = cleanupDriver({ failCleanup: false })
+  // This legal source preserves input prototypes and actually removes omitted
+  // keys. The adapter boundary must accept it as well as today's local-only
+  // source, without a second expected-result profile for either source.
+  await runRowSnapshotHistories(
+    { ...subject.driver, snapshotSourceUsesDraft: true },
+    `callback`,
+    `sync`,
+  )
+})
+
+class CalibrationValues extends Array<number> {
+  total(): number {
+    return this.reduce((sum, value) => sum + value, 0)
+  }
+}
+
+it(`accepts private subclass wrapper prototypes and rejects lost methods`, () => {
+  const source = new CalibrationValues(1, 2)
+  const wrapper = new CalibrationValues(1, 2)
+  Object.setPrototypeOf(wrapper, Object.create(CalibrationValues.prototype))
+  expectRowSnapshot(
+    { id: `a`, config: wrapper },
+    { id: `a`, config: source },
+    `private wrapper`,
+  )
+  expect(() =>
+    expectRowSnapshot(
+      { id: `a`, config: [1, 2] },
+      { id: `a`, config: source },
+      `lost method`,
+    ),
+  ).toThrow()
+  Object.setPrototypeOf(
+    wrapper,
+    Object.assign(Object.create(CalibrationValues.prototype), {
+      total: () => 99,
+    }),
+  )
+  expect(() =>
+    expectRowSnapshot(
+      { id: `a`, config: wrapper },
+      { id: `a`, config: source },
+      `wrong method`,
+    ),
+  ).toThrow()
+})
+
+it(`rejects a draft-source receipt without any actual original`, async () => {
+  const subject = cleanupDriver({ omitOriginals: true, failCleanup: false })
+  const failure: unknown = await runRowSnapshotHistories(
+    subject.driver,
+    `callback`,
+    `sync`,
+  ).catch((error: unknown) => error)
+  expect(String(failure)).toContain(`actual local originals`)
+})
+
+// Each fault leaves the framework result and the other source observations
+// correct. Final admission has no following update that could expose it later.
+it.each([
+  [`current`, `current source row`],
+  [`admitted`, `change.value`],
+  [`initial`, `initial Collection.get`],
+] as const)(
+  `rejects corruption confined to the %s source row`,
+  async (kind, label) => {
+    const subject = cleanupDriver({ corruptSource: kind, failCleanup: false })
+    const failure: unknown = await runRowSnapshotHistories(
+      subject.driver,
+      `callback`,
+      `sync`,
+    ).catch((error: unknown) => error)
+    expect(String(failure)).toContain(label)
+    expect(containsFailure(failure, subject.projectionFailure)).toBe(false)
+  },
+)
diff --git a/packages/db/tests/conformance/row-snapshot-oracle.ts b/packages/db/tests/conformance/row-snapshot-oracle.ts
new file mode 100644
index 0000000000..254ffd9930
--- /dev/null
+++ b/packages/db/tests/conformance/row-snapshot-oracle.ts
@@ -0,0 +1,584 @@
+/**
+ * Framework materialization borrows Collection rows; it cannot edit them.
+ * Authority: mutations.md's immutable updates and PendingMutation.original,
+ * ChangeMessage.previousValue's previous row, and contract.ts's result law.
+ * Current and retained source rows, admitted change values, mutation originals
+ * and previous values keep their complete user values. Current results follow
+ * the current source row.
+ *
+ * Source facts are captured before framework admission. Aliases and accessors
+ * describe production inputs, not additional identity promises for hook output.
+ * A framework may expose live proxies while keeping borrowed snapshots intact.
+ * The optimistic-history owner covers other settlement schedules. Limits here:
+ * one or two keys, three updates per key, the value grammar below, and settled
+ * or held-handler cuts. Core's normalization policy, arbitrary cycles, hidden
+ * symbols and callback atomicity are not judged.
+ */
+import { expect } from 'vitest'
+import { declareOracle } from '../oracle-declaration'
+import { createOracleReach } from '../oracle-reach'
+import { ScenarioLifetime } from './scenario-lifetime'
+import { selectedRow } from './result-laws'
+import type {
+  LiveQueryDriver,
+  LiveQueryHandle,
+  QueryBuild,
+  SourceHandle,
+} from './contract'
+
+type Shape =
+  | `object`
+  | `hidden-data`
+  | `shadowed`
+  | `array`
+  | `introduced`
+  | `null-prototype`
+  | `aliases`
+  | `accessor`
+  | `array-subclass`
+  | `store-proxy`
+export type SnapshotInput = `callback` | `config` | `collection`
+export type SnapshotWrites = `sync` | `optimistic`
+type Payload = {
+  value: number
+  added?: { value: number }
+  optional?: undefined
+}
+type SnapshotRow = {
+  id: string
+  value: number
+  config: unknown
+  format: () => string
+  extra?: Payload
+}
+const format = () => `row`
+const userField = Symbol(`selected user field`)
+
+class SnapshotValues extends Array<number> {
+  total(): number {
+    return this.reduce((sum, value) => sum + value, 0)
+  }
+}
+
+// Scalar versions construct source inputs, including alias splits and merges.
+// The preservation model below records what the source admitted separately.
+function snapshot(shape: Shape, value: number): SnapshotRow {
+  const payload: Payload = { value }
+  if (value === 1 || value === 2) {
+    payload.added = { value }
+    payload.optional = undefined
+  }
+  let config: unknown = payload
+  if (shape === `hidden-data` && value < 3)
+    Object.defineProperty(payload, `hidden`, {
+      value: value === 2 ? undefined : value,
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    })
+  if (shape === `shadowed` && value > 0 && value < 3)
+    for (const [key, supplied] of [
+      [`toString`, Object.prototype.toString],
+      [`constructor`, Object],
+      [`__proto__`, `ordinary user data ${value}`],
+      [userField, `user symbol ${value}`],
+    ] as const)
+      Object.defineProperty(payload, key, {
+        value: value === 2 ? undefined : supplied,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+  if (shape === `array`)
+    config = Array.from({ length: value % 3 }, (_, index) => ({
+      value: value + index,
+    }))
+  if (shape === `introduced` && value === 0) config = null
+  if (shape === `null-prototype`)
+    config = Object.assign(Object.create(null) as Payload, payload)
+  if (shape === `aliases`) {
+    const shared = { value }
+    config =
+      value % 2 === 0
+        ? { left: shared, right: shared }
+        : { left: { value }, right: { value: value - 1 } }
+  }
+  if (shape === `accessor`) config = { nested: payload }
+  if (shape === `array-subclass`) {
+    const values = new SnapshotValues()
+    values.push(value, value + 1)
+    config = values
+  }
+  const row: SnapshotRow = {
+    id: `a`,
+    value,
+    config,
+    format,
+    ...(value === 1 || value === 2
+      ? { extra: { value, optional: undefined } }
+      : {}),
+  }
+  // The same names cross root admission and nested admission. A root-only or
+  // nested-only ownership fix must not satisfy the full selected-value law.
+  if (shape === `shadowed`)
+    for (const key of [`toString`, `constructor`, `__proto__`, userField]) {
+      const descriptor = Object.getOwnPropertyDescriptor(payload, key)
+      if (descriptor) Object.defineProperty(row, key, descriptor)
+    }
+  return row
+}
+
+// Bounded exhaustive grammar: every shape crosses the three input forms and
+// both write paths in suite.ts. Three versions split, merge and split aliases,
+// introduce nested objects, and remove root fields. Absent-key writes are illegal
+// and excluded. Only a driver with a real store supplies the store-proxy premise.
+function* histories(
+  driver: LiveQueryDriver,
+  input: SnapshotInput,
+  writes: SnapshotWrites,
+) {
+  const shapes: Array<Shape> = [
+    `object`,
+    `hidden-data`,
+    `shadowed`,
+    `array`,
+    `introduced`,
+    `null-prototype`,
+    `aliases`,
+    `accessor`,
+    `array-subclass`,
+  ]
+  if (driver.wrapSnapshotValue) shapes.push(`store-proxy`)
+  for (const shape of shapes)
+    for (const peers of [false, true]) yield { shape, input, writes, peers }
+}
+
+function sourceRow(
+  driver: LiveQueryDriver,
+  shape: Shape,
+  value: number,
+): SnapshotRow {
+  const row = snapshot(shape, value)
+  if (shape === `accessor`) {
+    const nested = (row.config as { nested: Payload }).nested
+    row.config = {
+      get nested() {
+        return nested
+      },
+    }
+  }
+  // Local-only replacements pass through Core draft detachment. That boundary
+  // owns assigning host proxies; this receiving witness starts with a native
+  // store and then supplies ordinary replacement data. The controlled sync
+  // witness admits native stores on every update as well.
+  if (
+    shape === `store-proxy` &&
+    (!driver.snapshotSourceUsesDraft || value === 0)
+  )
+    row.config = driver.wrapSnapshotValue!(row.config as Payload)
+  return row
+}
+
+/**
+ * The adapter borrows the values the source actually admitted, regardless of
+ * which representation Core's draft boundary produces. Capture those facts
+ * before mounting, and in a source subscriber installed before the hook. This
+ * is a relational model of adapter preservation, not a second Core draft model.
+ * A future change to Core's own-key or prototype policy changes the premise;
+ * it must not require changing this adapter law to match Core's implementation.
+ *
+ * Facts are immutable trees of keys and scalar/opaque leaves, separate from
+ * production containers. Array prototypes retain the existing method premise.
+ * Hidden host symbols are outside the selected-value boundary at every level.
+ */
+type Fact =
+  | { kind: `leaf`; value: unknown }
+  | {
+      kind: `container`
+      array: boolean
+      arrayPrototype: unknown
+      arrayTotal: unknown
+      fields: Map<PropertyKey, Fact>
+    }
+
+function facts(value: unknown): Fact {
+  if (value === null || typeof value !== `object`)
+    return { kind: `leaf`, value }
+  const prototype: unknown = Object.getPrototypeOf(value)
+  const array = Array.isArray(value)
+  if (!array && prototype !== Object.prototype && prototype !== null)
+    return { kind: `leaf`, value }
+  return {
+    kind: `container`,
+    array,
+    arrayPrototype: array ? prototype : undefined,
+    // The grammar's subclass supplies a zero-argument total method. Preserve
+    // that observable capability while permitting private wrapper prototypes.
+    arrayTotal:
+      array && typeof Reflect.get(value, `total`) === `function`
+        ? Reflect.apply(Reflect.get(value, `total`) as () => unknown, value, [])
+        : undefined,
+    fields: new Map(
+      Reflect.ownKeys(value)
+        .filter(
+          (key) =>
+            typeof key !== `symbol` ||
+            Object.prototype.propertyIsEnumerable.call(value, key),
+        )
+        .map((key) => [key, facts(Reflect.get(value, key))]),
+    ),
+  }
+}
+
+function rowFacts(value: unknown): Fact {
+  return facts(selectedRow(value))
+}
+
+type Retained = { label: string; actual: unknown; expected: Fact }
+
+// Preserve methods supplied by a source subclass. A plain source array does
+// not promise that a framework removes every additional inherited method.
+function expectFact(actual: Fact, expected: Fact, label: string): void {
+  expect(actual.kind, label).toBe(expected.kind)
+  if (actual.kind === `leaf` || expected.kind === `leaf`) {
+    expect(actual, label).toEqual(expected)
+    return
+  }
+  expect(actual.array, label).toBe(expected.array)
+  if (expected.arrayPrototype && expected.arrayPrototype !== Array.prototype) {
+    expect(
+      actual.arrayPrototype === expected.arrayPrototype ||
+        (actual.arrayPrototype !== null &&
+          typeof actual.arrayPrototype === `object` &&
+          Object.prototype.isPrototypeOf.call(
+            expected.arrayPrototype,
+            actual.arrayPrototype,
+          )),
+      `${label}: source-supplied array methods`,
+    ).toBe(true)
+    expect(actual.arrayTotal, `${label}: source-supplied array total`).toBe(
+      expected.arrayTotal,
+    )
+  }
+  expect(new Set(actual.fields.keys()), label).toEqual(
+    new Set(expected.fields.keys()),
+  )
+  for (const [key, wanted] of expected.fields)
+    expectFact(actual.fields.get(key)!, wanted, label)
+}
+
+export function expectRowSnapshot(
+  actual: unknown,
+  expected: unknown,
+  label: string,
+): void {
+  expectFact(rowFacts(actual), rowFacts(expected), label)
+}
+
+function expectSnapshots(
+  handle: LiveQueryHandle,
+  source: SourceHandle<SnapshotRow>,
+  expected: ReadonlyMap<string, Fact>,
+  retained: ReadonlyArray<Retained>,
+): void {
+  const data = handle.current().data as Array<SnapshotRow>
+  expect(data, `complete current result`).toHaveLength(expected.size)
+  expect(new Set(data.map((row) => row.id)), `complete current keys`).toEqual(
+    new Set(expected.keys()),
+  )
+  for (const row of data)
+    expectFact(
+      rowFacts(row),
+      expected.get(row.id)!,
+      `current framework row ${row.id}`,
+    )
+  // A correct detached framework result cannot excuse damage to the value it
+  // borrowed. Check the current source at this cut, including the final update
+  // that has no later get or previousValue to reveal the damage.
+  for (const [id, wanted] of expected)
+    expectFact(
+      rowFacts(source.collection.get(id)),
+      wanted,
+      `current source row ${id}`,
+    )
+  for (const saved of retained)
+    expectFact(rowFacts(saved.actual), saved.expected, saved.label)
+}
+
+export async function runRowSnapshotHistories(
+  driver: LiveQueryDriver,
+  input: SnapshotInput,
+  writes: SnapshotWrites,
+): Promise<void> {
+  const cases = [...histories(driver, input, writes)]
+  const states = [
+    input,
+    writes,
+    ...new Set(cases.map(({ shape }) => shape)),
+    `cross-row-alias`,
+    `current-source-row`,
+    `retained-initial-row`,
+    `retained-change-value`,
+    `retained-previousValue`,
+    ...(writes === `optimistic` || driver.snapshotSourceUsesDraft
+      ? [`retained-original`]
+      : []),
+    `later-object-admission`,
+    `root-delete-representation`,
+    `nested-own-undefined`,
+    ...(!driver.snapshotSourceUsesDraft ? [`enumerable-user-symbol`] : []),
+    ...(!driver.snapshotSourceUsesDraft && writes === `sync`
+      ? [`source-reference-reuse`]
+      : []),
+  ]
+  const reach = createOracleReach(
+    `framework.${driver.name}.${input}.${writes}.row-snapshots`,
+    states,
+  )
+  const failures: Array<Error> = []
+  for (const history of cases) {
+    reach.beginHistory()
+    const resources = new ScenarioLifetime()
+    try {
+      await resources.run(async () => {
+        const expected = new Map<string, Fact>()
+        const check = (retained: ReadonlyArray<Retained>) => {
+          expectSnapshots(handle!, source, expected, retained)
+          reach.reach(`current-source-row`)
+        }
+        const initial = sourceRow(driver, history.shape, 0)
+        const rows = history.peers
+          ? [initial, { ...initial, id: `b` }]
+          : [initial]
+        const source = driver.makeSource(rows, undefined, {
+          rowUpdateMode: `full`,
+        })
+        let handle: LiveQueryHandle | undefined
+        try {
+          const retained: Array<Retained> = []
+          for (const { id } of rows) {
+            const actual = source.collection.get(id)
+            const wanted = rowFacts(actual)
+            expected.set(id, wanted)
+            retained.push({
+              label: `initial Collection.get ${id}`,
+              actual,
+              expected: wanted,
+            })
+            reach.reach(`retained-initial-row`)
+          }
+          // Register before the hook so the source facts are recorded before
+          // framework materialization can mutate any borrowed container.
+          const subscription = source.collection.subscribeChanges(
+            (changes) => {
+              for (const change of changes) {
+                const id = String(change.key)
+                if (change.previousValue) {
+                  retained.push({
+                    label: `previousValue ${id}`,
+                    actual: change.previousValue,
+                    expected: expected.get(id)!,
+                  })
+                  reach.reach(`retained-previousValue`)
+                }
+                if (change.type === `delete`) expected.delete(id)
+                else {
+                  const wanted = rowFacts(change.value)
+                  expected.set(id, wanted)
+                  // Record facts and the actual borrowed value before the hook
+                  // sees this admission. Keep checking it even if get() later
+                  // returns another object or the framework output is correct.
+                  retained.push({
+                    label: `change.value ${id}`,
+                    actual: change.value,
+                    expected: wanted,
+                  })
+                  reach.reach(`retained-change-value`)
+                }
+              }
+            },
+            { includeInitialState: false },
+          )
+          resources.defer(() => subscription.unsubscribe())
+          if (input === `collection`)
+            handle = driver.mountCollection(source.collection)
+          else {
+            const build: QueryBuild = (q) =>
+              q
+                .from({ row: source.collection })
+                .select(({ row }: { row: SnapshotRow }) => ({ ...row }))
+            handle =
+              input === `config`
+                ? driver.mountConfig(build)
+                : driver.mount(build)
+          }
+          resources.defer(() => handle?.unmount())
+          await handle.flush()
+          reach.reach(input)
+          reach.reach(history.shape)
+          check(retained)
+          if (history.peers && history.shape !== `introduced`) {
+            const first = source.collection.get(`a`).config
+            const second = source.collection.get(`b`).config
+            expect(first, `admitted shared container`).not.toBeNull()
+            expect(typeof first, `admitted shared container`).toBe(`object`)
+            expect(second, `admitted shared container identity`).toBe(first)
+            reach.reach(`cross-row-alias`)
+          }
+          for (let value = 1; value <= 3; value++)
+            for (const { id } of rows) {
+              retained.push({
+                label: `Collection.get before ${value}`,
+                actual: source.collection.get(id),
+                expected: expected.get(id)!,
+              })
+              const before = expected.get(id)!
+              const next = { ...sourceRow(driver, history.shape, value), id }
+              // Odd versions split a shared node while retaining the previous
+              // right input itself. Fresh-but-equal right objects cannot expose
+              // a materializer that mutates a copy still needed by that path.
+              const previousConfig = source.collection.get(id).config as {
+                right: unknown
+              }
+              if (history.shape === `aliases` && value % 2 === 1)
+                (next.config as { right: unknown }).right = previousConfig.right
+              if (writes === `optimistic`) {
+                let release!: () => void
+                const gate = new Promise<void>((resolve) => {
+                  release = resolve
+                })
+                resources.defer(release)
+                const edit = driver.ops.createOptimisticAction({
+                  onMutate: () =>
+                    source.collection.update(id, (draft: SnapshotRow) => {
+                      draft.value = next.value
+                      if (
+                        history.shape !== `null-prototype` &&
+                        history.shape !== `array-subclass` &&
+                        history.shape !== `store-proxy`
+                      ) {
+                        draft.config = next.config
+                        if (next.extra) draft.extra = next.extra
+                        else delete draft.extra
+                      }
+                    }),
+                  mutationFn: async () => {
+                    await gate
+                    source.update(next)
+                  },
+                })
+                const tx = edit()
+                void tx.when(`settled`).catch(() => undefined)
+                resources.defer(() => tx.when(`settled`))
+                retained.push({
+                  label: `mutation.original before ${value}`,
+                  actual: tx.mutations[0]!.original as SnapshotRow,
+                  expected: before,
+                })
+                reach.reach(`retained-original`)
+                await handle.flush()
+                check(retained)
+                release()
+                await tx.when(`settled`)
+              } else {
+                await handle.apply(() => {
+                  const mutation = source.update(next)
+                  if (driver.snapshotSourceUsesDraft)
+                    expect(
+                      mutation?.mutations.length,
+                      `actual local originals`,
+                    ).toBeGreaterThan(0)
+                  if (mutation && mutation.mutations.length > 0) {
+                    for (const item of mutation.mutations)
+                      retained.push({
+                        label: `local mutation.original ${id}`,
+                        actual: item.original,
+                        expected: before,
+                      })
+                    reach.reach(`retained-original`)
+                  }
+                })
+              }
+              await handle.flush()
+              if (
+                history.shape === `aliases` &&
+                value % 2 === 1 &&
+                !driver.snapshotSourceUsesDraft &&
+                writes === `sync`
+              ) {
+                expect(
+                  (source.collection.get(id).config as { right: unknown })
+                    .right,
+                ).toBe(previousConfig.right)
+                reach.reach(`source-reference-reuse`)
+              }
+              reach.reach(writes)
+              if (value >= 2) reach.reach(`later-object-admission`)
+              if (value === 3) reach.reach(`root-delete-representation`)
+              if (value === 1) reach.reach(`nested-own-undefined`)
+              // Only the controlled sync source promises this admission. The
+              // local-only draft boundary owns its normalization policy; every
+              // path still compares all user fields that it actually admits.
+              if (
+                history.shape === `shadowed` &&
+                value === 1 &&
+                !driver.snapshotSourceUsesDraft
+              ) {
+                expect(
+                  Object.getOwnPropertyDescriptor(
+                    source.collection.get(id),
+                    userField,
+                  )?.enumerable,
+                  `source admitted enumerable user symbol`,
+                ).toBe(true)
+                reach.reach(`enumerable-user-symbol`)
+              }
+              check(retained)
+            }
+        } finally {
+          resources.defer(() => handle?.collection()?.cleanup())
+          resources.defer(() => source.collection.cleanup())
+        }
+      })
+    } catch (cause) {
+      failures.push(new Error(`${history.shape}/${input}/${writes}`, { cause }))
+    }
+  }
+  // Histories are independent. Finish the finite grammar before reporting every
+  // failure; one broken shape must not hide another receiving path's result.
+  if (failures.length)
+    throw new AggregateError(
+      failures,
+      failures
+        .map((error) => `${error.message}: ${String(error.cause)}`)
+        .join(`\n`),
+      { cause: failures[0] },
+    )
+  reach.assertReached()
+  expect(Object.fromEntries(reach.counts())).toEqual({
+    [input]: cases.length,
+    [writes]: cases.length,
+    ...Object.fromEntries(cases.map(({ shape }) => [shape, 2])),
+    'cross-row-alias': cases.length / 2 - 1,
+    'current-source-row': cases.length,
+    'retained-initial-row': cases.length,
+    'retained-change-value': cases.length,
+    'retained-previousValue': cases.length,
+    ...(writes === `optimistic` || driver.snapshotSourceUsesDraft
+      ? { 'retained-original': cases.length }
+      : {}),
+    'later-object-admission': cases.length,
+    'root-delete-representation': cases.length,
+    'nested-own-undefined': cases.length,
+    ...(!driver.snapshotSourceUsesDraft ? { 'enumerable-user-symbol': 2 } : {}),
+    ...(!driver.snapshotSourceUsesDraft && writes === `sync`
+      ? { 'source-reference-reuse': 2 }
+      : {}),
+  })
+}
+
+declareOracle({
+  model: [facts, rowFacts],
+  grammar: [histories],
+  check: [expectRowSnapshot, expectSnapshots, expectFact],
+})
diff --git a/packages/db/tests/conformance/suite.ts b/packages/db/tests/conformance/suite.ts
index f8705b3e04..3d27674596 100644
--- a/packages/db/tests/conformance/suite.ts
+++ b/packages/db/tests/conformance/suite.ts
@@ -61,6 +61,8 @@ import { ScenarioSources } from './scenario-sources'
 import { scenarioRegistry } from './registration'
 import { expectDisabledResult } from './disabled-laws'
 import { expectPublishedRows } from './publication-laws-oracle'
+import { runRowSnapshotHistories } from './row-snapshot-oracle'
+import { runPublicFieldHistories } from './public-field-oracle'
 import {
   expectKeyedRows,
   expectOrderedRows,
@@ -176,8 +178,8 @@ export function runSuite(rawDriver: LiveQueryDriver) {
   }
   const driver: LiveQueryDriver = {
     ...rawDriver,
-    makeSource: (data, collectionId) =>
-      sources!.track(rawDriver.makeSource(data, collectionId)),
+    makeSource: (data, collectionId, options) =>
+      sources!.track(rawDriver.makeSource(data, collectionId, options)),
     makeDeferredSource: <T extends { id: string }>() =>
       sources!.track(rawDriver.makeDeferredSource<T>()),
     makeLaggingSource: <T extends { id: string }>() =>
@@ -229,6 +231,21 @@ export function runSuite(rawDriver: LiveQueryDriver) {
   }
 
   describe(`live-query conformance :: ${driver.name}`, () => {
+    for (const input of [`callback`, `config`, `collection`] as const)
+      for (const writes of [`sync`, `optimistic`] as const)
+        scenario(
+          `row-snapshot-isolation-${input}-${writes}`,
+          `materialization preserves borrowed rows and immutable mutation snapshots`,
+          () => runRowSnapshotHistories(rawDriver, input, writes),
+          30000,
+        )
+    for (const input of [`callback`, `config`] as const)
+      scenario(
+        `public-field-destination-${input}`,
+        `nested source spreads preserve accepted inherited-name destinations`,
+        () => runPublicFieldHistories(rawDriver, input),
+        30000,
+      )
     // ---- spine: query + liveness ----------------------------------------
 
     scenario(
@@ -2189,7 +2206,7 @@ export function runSuite(rawDriver: LiveQueryDriver) {
     )
 
     it(`registers every distinct scenario without whole-test waivers`, () => {
-      expect(registry.size).toBe(49)
+      expect(registry.size).toBe(57)
     })
   })
 }
diff --git a/packages/db/tests/query/includes-context-transport-oracle.test.ts b/packages/db/tests/query/includes-context-transport-oracle.test.ts
index acb28abde3..7e3f7f6424 100644
--- a/packages/db/tests/query/includes-context-transport-oracle.test.ts
+++ b/packages/db/tests/query/includes-context-transport-oracle.test.ts
@@ -1,5 +1,23 @@
 import { describe, expect, test } from 'vitest'
 import { declareOracle } from '../oracle-declaration.js'
+import { createOracleReach } from '../oracle-reach.js'
+import { expectRowSnapshot } from '../conformance/row-snapshot-oracle.js'
+import {
+  expectedPublicField,
+  expectedPublicFieldOverlapSource,
+  expectedSelectedPublicField,
+  expectedSelectedPublicFieldOverlap,
+  fieldStages,
+  overlapStages,
+  publicFieldCells,
+  publicFieldGrammar,
+  publicFieldOverlapCells,
+  publicFieldOverlapFunctionalCells,
+  publicFieldSymbol,
+  runPublicFieldOverlapCell,
+} from '../conformance/public-field-oracle.js'
+import { createCollection } from '../../src/collection/index.js'
+import { mockSyncCollectionOptions } from '../utils.js'
 import {
   add,
   and,
@@ -14,6 +32,7 @@ import {
   multiply,
   sum,
 } from '../../src/query/index.js'
+import { createControlledCollection } from './includes-oracle-helpers.js'
 import {
   createGrammarCollection,
   expectEveryForm,
@@ -24,7 +43,15 @@ import {
   readEveryForm,
   runWithCleanup,
 } from './includes-context-transport-helpers.js'
+import type {
+  PublicFieldCell,
+  PublicFieldOverlapCell,
+  PublicFieldOverlapHost,
+  PublicFieldOverlapRow,
+  PublicFieldRow,
+} from '../conformance/public-field-oracle.js'
 import type { RefLeaf } from '../../src/query/builder/types.js'
+import type { InitialQueryBuilder } from '../../src/query/builder/index.js'
 import type { Collection } from '../../src/collection/index.js'
 import type { ControlledCollection } from './includes-oracle-helpers.js'
 import type {
@@ -58,7 +85,9 @@ import type {
  * Each grammar family has a small JavaScript model for its own result. The
  * production side compiles the matching live query and crosses the full
  * boundary. The suite expands the grammar across three materialization forms
- * and three checkpoints for 819 explicit observations. This finite matrix does
+ * and three checkpoints for 819 explicit observations. The public-field family
+ * adds 1200 observations across five admission stages and four receiving paths.
+ * This finite matrix does
  * not establish arbitrary query structures, values, or update histories.
  *
  * This suite owns route-context transport and public-data hygiene. The temporal
@@ -141,6 +170,7 @@ const routeContextGrammar = {
       `identity`,
     ] as const,
   },
+  publicField: publicFieldGrammar,
   publicSurface: {
     shapes: [
       `object-query-ref-scalar`,
@@ -223,6 +253,8 @@ type GrammarCell =
   | DerivedResultCell
   | NamespaceCollisionCell
   | PublicSurfaceCell
+  | PublicFieldCell
+  | PublicFieldOverlapCell
 
 // Expand every declared product once. The calibration test below rejects both
 // missing cells and duplicate cells.
@@ -298,6 +330,9 @@ const grammarCells: Array<GrammarCell> = [
       ),
     ),
   ),
+  ...publicFieldCells,
+  ...publicFieldOverlapCells,
+  ...publicFieldOverlapFunctionalCells,
   ...routeContextGrammar.publicSurface.shapes.map(
     (shape): PublicSurfaceCell => ({ family: `public-surface`, shape }),
   ),
@@ -323,6 +358,10 @@ function grammarCellName(cell: GrammarCell): string {
       return `${cell.family} / ${cell.boundary} / ${cell.selection} / ${cell.domain}`
     case `namespace-collision`:
       return `${cell.family} / ${cell.location} / ${cell.boundary} / ${cell.name}`
+    case `public-field`:
+      return `${cell.family} / ${String(cell.key)} / ${cell.location} / ${cell.selection} / ${cell.destination}`
+    case `public-field-overlap`:
+      return `${cell.family} / ${cell.destination} / ${cell.operation} / ${cell.descriptor}`
     case `public-surface`:
       return `${cell.family} / ${cell.shape}`
   }
@@ -2184,6 +2223,203 @@ async function runPublicSurfaceCell({
   )
 }
 
+/**
+ * Whole-row and spread selection preserve enumerable own source data fields,
+ * including inherited-name shadows and user symbols. Authority: live-queries.md's
+ * "Include all user fields" and ARCHITECTURE.md's public-boundary preservation.
+ * Authored alias paths retain their separate restrictions. These keys are data.
+ *
+ * The independent model constructs immutable scalar-version rows. Every key
+ * crosses absent, admitted, own undefined, omitted, and readmitted stages at
+ * both root and nested locations. A version field forces every stage through
+ * change-event equality. The source assertion proves admission before querying.
+ * Root Collections and all three correlated forms use the same comparison at
+ * the synchronous source-write cut. No asynchronous or descriptor claim is
+ * added by this finite field-data family.
+ */
+function selectPublicFields(
+  q: InitialQueryBuilder,
+  source: Collection<PublicFieldRow>,
+  cell: PublicFieldCell,
+  group: number | RefLeaf<number> = 1,
+) {
+  const base = q
+    .from({ row: source })
+    .where(({ row }) => eq(row.parentGroup, group))
+  if (cell.selection === `implicit`) return base
+  if (cell.selection === `functional`)
+    return base.fn.select(({ row }) => ({
+      ...row,
+      ...(cell.location === `nested` ? { payload: { ...row.payload } } : {}),
+    }))
+  if (cell.selection === `whole-row`)
+    return cell.location === `root`
+      ? base.select(({ row }) => row)
+      : base.select(({ row }) => ({
+          id: row.id,
+          parentGroup: row.parentGroup,
+          version: row.version,
+          payload: row.payload,
+        }))
+  return cell.location === `root`
+    ? base.select(({ row }) => ({ ...row }))
+    : base.select(({ row }) => ({
+        id: row.id,
+        parentGroup: row.parentGroup,
+        version: row.version,
+        ...(cell.destination === `wrapper.toString`
+          ? { wrapper: { toString: { ...row.payload } } }
+          : { [cell.destination]: { ...row.payload } }),
+      }))
+}
+async function runPublicFieldCell(cell: PublicFieldCell): Promise<void> {
+  const paths = [`root`, ...materializationForms] as const
+  const stages = [
+    `initial-absence`,
+    `admission`,
+    `own-undefined`,
+    `omission`,
+    `readmission`,
+  ]
+  const reach = createOracleReach(grammarCellName(cell), [...paths, ...stages])
+  reach.beginHistory()
+  const source = createControlledCollection(
+    `public-field`,
+    [expectedPublicField(cell, 0)],
+    { rowUpdateMode: `full` },
+  )
+  const parents = createGrammarCollection(`public-field-parent`, [
+    { id: 1, group: 1 },
+  ])
+  const root = createLiveQueryCollection((q) =>
+    selectPublicFields(q, source.collection, cell),
+  )
+  const nested = createLiveQueryCollection((q) =>
+    q.from({ parent: parents.collection }).select(({ parent }) => ({
+      id: parent.id,
+      ...includeInEveryForm(
+        selectPublicFields(q, source.collection, cell, parent.group),
+      ),
+    })),
+  )
+  await runWithCleanup(root, [source, parents], () =>
+    runWithCleanup(nested, [], async () => {
+      await Promise.all([root.preload(), nested.preload()])
+      const failures: Array<Error> = []
+      for (const version of fieldStages) {
+        if (version > 0)
+          source.write(`update`, expectedPublicField(cell, version))
+        const expected = expectedSelectedPublicField(cell, version)
+        expectRowSnapshot(
+          source.collection.get(10),
+          expectedPublicField(cell, version),
+          `source admitted fields`,
+        )
+        const compare = (rows: Iterable<unknown>, path: string) => {
+          const values = [...rows]
+          reach.reach(path)
+          // A root mismatch must not prevent the correlated receiving paths
+          // from reaching their own comparisons in this same history.
+          try {
+            expect(values, `complete ${path} result`).toHaveLength(1)
+            expectRowSnapshot(values[0], expected, `${path} own data`)
+            expectNoPrivateSymbolsDeep(values[0], new Set([publicFieldSymbol]))
+          } catch (cause) {
+            failures.push(new Error(`${path}, stage ${version}`, { cause }))
+          }
+        }
+        compare(root.toArray, `root`)
+        const forms = nested.get(1)!
+        compare(forms.collection.values(), `collection`)
+        compare(forms.array, `array`)
+        compare(forms.materialized, `materialized`)
+        reach.reach(stages[version]!)
+      }
+      if (failures.length)
+        throw new AggregateError(failures, `Public source fields were lost`)
+    }),
+  )
+  reach.assertReached()
+}
+
+// Each receiving path gets a fresh source. Sharing one source across four
+// queries could let one corrupting projection supply another query's premise.
+// The common history/checker owns scalar expectations and retained references;
+// this driver supplies only real Core source writes and the selected public form.
+async function runPublicFieldOverlapPaths(cell: PublicFieldOverlapCell) {
+  const failures: Array<Error> = []
+  for (const path of [`root`, ...materializationForms] as const) {
+    const parents = createGrammarCollection(`overlap-parent`, [
+      { id: 1, group: 1 },
+    ])
+    const host: PublicFieldOverlapHost = {
+      name: `core.${path}`,
+      makeSource<T extends { id: string }>(initialData: ReadonlyArray<T>) {
+        const options = mockSyncCollectionOptions<T>({
+          id: `overlap-${grammarCellName(cell)}-${path}`,
+          getKey: (row) => row.id,
+          initialData: [...initialData],
+          rowUpdateMode: `full`,
+        })
+        const collection = createCollection(options)
+        const write = (type: `insert` | `update` | `delete`, value: T) => {
+          options.utils.begin()
+          options.utils.write({ type, value })
+          options.utils.commit()
+        }
+        return {
+          collection,
+          insert: (row: T) => write(`insert`, row),
+          update: (row: T) => write(`update`, row),
+          remove: (row: T) => write(`delete`, row),
+        }
+      },
+      mount(build) {
+        const live =
+          path === `root`
+            ? createLiveQueryCollection(build)
+            : createLiveQueryCollection((q) =>
+                q.from({ parent: parents.collection }).select(({ parent }) => ({
+                  id: parent.id,
+                  ...includeInEveryForm(
+                    build(q).where(({ row }: { row: PublicFieldOverlapRow }) =>
+                      eq(row.parentGroup, parent.group),
+                    ),
+                  ),
+                })),
+              )
+        return {
+          apply: (write) => {
+            write()
+            return Promise.resolve()
+          },
+          flush: () => live.preload(),
+          unmount: () => {},
+          collection: () => live,
+          read: () =>
+            path === `root` ? live.toArray : [...live.get(1)![path].values()],
+        }
+      },
+    }
+    try {
+      await runPublicFieldOverlapCell(host, cell)
+    } catch (cause) {
+      failures.push(new Error(`${path}: overlapping projection`, { cause }))
+    } finally {
+      try {
+        await parents.collection.cleanup()
+      } catch (cause) {
+        failures.push(new Error(`${path}: parent cleanup failed`, { cause }))
+      }
+    }
+  }
+  if (failures.length)
+    throw new AggregateError(
+      failures,
+      `Overlapping source paths changed borrowed data or failed`,
+    )
+}
+
 async function runGrammarCell(cell: GrammarCell): Promise<void> {
   switch (cell.family) {
     case `parent-projection`:
@@ -2204,6 +2440,10 @@ async function runGrammarCell(cell: GrammarCell): Promise<void> {
       return runDerivedResultCell(cell)
     case `namespace-collision`:
       return runNamespaceCollisionCell(cell)
+    case `public-field`:
+      return runPublicFieldCell(cell)
+    case `public-field-overlap`:
+      return runPublicFieldOverlapPaths(cell)
     case `public-surface`:
       return runPublicSurfaceCell(cell)
   }
@@ -2225,6 +2465,10 @@ declareOracle({
     expectedDerivedRows,
     expectedJoinRows,
     expectedCollisionRows,
+    expectedPublicField,
+    expectedSelectedPublicField,
+    expectedPublicFieldOverlapSource,
+    expectedSelectedPublicFieldOverlap,
   ],
   grammar: [grammarCells],
 })
@@ -2248,18 +2492,42 @@ describe(`correlated include route-context transport grammar`, () => {
       routeContextGrammar.namespaceCollision.locations.length *
         routeContextGrammar.namespaceCollision.boundaries.length *
         routeContextGrammar.namespaceCollision.names.length +
-      routeContextGrammar.publicSurface.shapes.length
+      routeContextGrammar.publicSurface.shapes.length +
+      publicFieldCells.length +
+      publicFieldOverlapCells.length +
+      publicFieldOverlapFunctionalCells.length
     const names = grammarCells.map(grammarCellName)
 
     expect(grammarCells).toHaveLength(expectedCellCount)
     expect(new Set(names)).toHaveLength(expectedCellCount)
     expect(
-      grammarCells.length * materializationForms.length * checkpoints.length,
+      grammarCells.filter(
+        (cell) =>
+          cell.family !== `public-field` &&
+          cell.family !== `public-field-overlap`,
+      ).length *
+        materializationForms.length *
+        checkpoints.length,
     ).toBe(819)
+    expect(
+      grammarCells.filter((cell) => cell.family === `public-field`).length *
+        fieldStages.length *
+        4,
+    ).toBe(1200)
+    expect(
+      (publicFieldOverlapCells.length +
+        publicFieldOverlapFunctionalCells.length) *
+        overlapStages.length *
+        4,
+    ).toBe(432)
   })
 
   for (const cell of grammarCells) {
-    test(`${grammarCellName(cell)} × every materialization form × parent/child updates`, () =>
+    const observations =
+      cell.family === `public-field` || cell.family === `public-field-overlap`
+        ? `root and correlated forms × field admission stages`
+        : `every materialization form × parent/child updates`
+    test(`${grammarCellName(cell)} × ${observations}`, () =>
       runGrammarCell(cell))
   }
 })
diff --git a/packages/db/tests/utils.ts b/packages/db/tests/utils.ts
index 0e092c2e2a..422b1582ad 100644
--- a/packages/db/tests/utils.ts
+++ b/packages/db/tests/utils.ts
@@ -294,6 +294,7 @@ type MockSyncCollectionConfig<T extends object = Record<string, unknown>> = {
   getKey: (item: T) => string | number
   autoIndex?: `off` | `eager`
   sync?: SyncConfig<T>
+  rowUpdateMode?: `full`
   syncMode?: `eager` | `on-demand`
   defaultStringCollation?: StringCollationConfig
   defaultIndexType?: IndexConstructor
@@ -362,6 +363,7 @@ export function mockSyncCollectionOptions<
   }
 
   const sync = config.sync ?? {
+    rowUpdateMode: config.rowUpdateMode,
     sync: (params: Parameters<SyncConfig<T>[`sync`]>[0]) => {
       begin = params.begin
       write = params.write
@@ -381,7 +383,11 @@ export function mockSyncCollectionOptions<
   }
 
   // Destructure to avoid passing test-only properties (like initialData) to createCollection
-  const { initialData: _initialData, ...collectionConfig } = config
+  const {
+    initialData: _initialData,
+    rowUpdateMode: _rowUpdateMode,
+    ...collectionConfig
+  } = config
 
   const options: CollectionConfig<T, string | number, never> & {
     utils: typeof utils
diff --git a/packages/preact-db/tests/conformance.test.ts b/packages/preact-db/tests/conformance.test.ts
index 43b4d82c0e..005419e019 100644
--- a/packages/preact-db/tests/conformance.test.ts
+++ b/packages/preact-db/tests/conformance.test.ts
@@ -65,12 +65,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ): SourceHandle<T> {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-preact-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)
diff --git a/packages/react-db/tests/conformance.test.tsx b/packages/react-db/tests/conformance.test.tsx
index 9f28cded8d..a9a6f55b0f 100644
--- a/packages/react-db/tests/conformance.test.tsx
+++ b/packages/react-db/tests/conformance.test.tsx
@@ -56,12 +56,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ) {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-react-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)
diff --git a/packages/solid-db/src/store-materialization.ts b/packages/solid-db/src/store-materialization.ts
new file mode 100644
index 0000000000..32ab38759d
--- /dev/null
+++ b/packages/solid-db/src/store-materialization.ts
@@ -0,0 +1,192 @@
+import { $PROXY, untrack } from 'solid-js'
+import { $RAW, createStore, produce, unwrap } from 'solid-js/store'
+
+type RecordValue = Record<PropertyKey, unknown>
+function container(value: unknown): value is RecordValue {
+  if (value === null || typeof value !== `object`) return false
+  const proto: unknown = Object.getPrototypeOf(value)
+  return Array.isArray(value) || proto === Object.prototype || proto === null
+}
+function keys(value: object) {
+  return Reflect.ownKeys(value).filter(
+    (key) =>
+      (typeof key !== `symbol` ||
+        Object.prototype.propertyIsEnumerable.call(value, key)) &&
+      !(Array.isArray(value) && key === `length`),
+  )
+}
+// Native setters and data nodes own updates. The read view preserves accessor
+// results and prototype methods when a user field shadows hasOwnProperty.
+export function createStoreReadView<T extends object>(store: T): T {
+  const views = new WeakMap<object, object>()
+  function exposed<V>(value: V): V {
+    if (!container(value) || !($PROXY in value)) return value
+    const target = unwrap(value)
+    if (views.has(target)) return views.get(target) as V
+    const native = Reflect.get(target, $PROXY) as RecordValue
+    const view = new Proxy(native, {
+      get(current, key, receiver) {
+        // Native bookkeeping has fixed identities and must remain transparent.
+        if (key === $RAW || key === $PROXY) return Reflect.get(current, key)
+        const descriptor = Object.getOwnPropertyDescriptor(target, key)
+        let result: unknown
+        if (descriptor?.get)
+          result = Reflect.apply(descriptor.get, receiver, [])
+        else if (!descriptor && key in target) {
+          // The own-field admission shim notifies native membership nodes.
+          // __proto__ bypasses native membership tracking, so read its data node.
+          if (key === `__proto__`) Reflect.get(current, key)
+          else Reflect.has(current, key)
+          result = Reflect.get(target, key, receiver)
+        } else result = Reflect.get(current, key, receiver)
+        return exposed(result)
+      },
+    })
+    views.set(target, view)
+    return view as V
+  }
+  return exposed(store)
+}
+export function createRowStore<T extends object>(source: T) {
+  // Every nested node is immutable after admission. Native stores supply reads
+  // and getter tracking, while one per-row memo preserves source identities.
+  const copies = new WeakMap<object, object>()
+  function detached<V>(value: V, root = false): V {
+    if (!container(value)) return value
+    const native = $PROXY in value
+    const original = (
+      native ? unwrap(Reflect.get(value, $PROXY)) : value
+    ) as RecordValue
+    if (!root && copies.has(original)) return copies.get(original) as V
+    const target: RecordValue = Array.isArray(original)
+      ? Object.setPrototypeOf(
+          new Array(original.length),
+          Object.getPrototypeOf(original),
+        )
+      : Object.create(Object.getPrototypeOf(original))
+    const [view, setView] = createStore(target)
+    if (!root) copies.set(original, view)
+    for (const key of Reflect.ownKeys(original)) {
+      if (Array.isArray(original) && key === `length`) continue
+      const desc = Object.getOwnPropertyDescriptor(original, key)!
+      if (native && typeof key === `symbol` && !desc.enumerable) continue
+      Object.defineProperty(
+        target,
+        key,
+        `value` in desc
+          ? {
+              value: detached(desc.value),
+              enumerable: desc.enumerable,
+              writable: true,
+              configurable: true,
+            }
+          : desc.enumerable && desc.get
+            ? {
+                get: () => detached(Reflect.get(original, key)),
+                enumerable: true,
+                configurable: true,
+              }
+            : { ...desc, configurable: true },
+      )
+    }
+    // Native reads skip node creation for callables behind a shadowed
+    // hasOwnProperty and for __proto__. Seed those nodes before observation.
+    // An absent __proto__ keeps a node while retaining its inherited fallback.
+    for (const key of new Set([...keys(target), `__proto__`])) {
+      const descriptor = Object.getOwnPropertyDescriptor(target, key)
+      if (descriptor && !(`value` in descriptor)) continue
+      const initialValue: unknown = descriptor?.value
+      if (typeof initialValue !== `function` && key !== `__proto__`) continue
+      if (!descriptor)
+        Object.defineProperty(target, key, {
+          value: undefined,
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        })
+      setView(
+        produce((draft) => {
+          draft[key] = initialValue === null ? undefined : null
+          draft[key] = initialValue
+        }),
+      )
+      if (descriptor) Object.defineProperty(target, key, descriptor)
+      else delete target[key]
+    }
+    return view as V
+  }
+  return untrack(() => {
+    let [row, setRow] = createStore(unwrap(detached(source, true)))
+    const entry = {
+      value: row,
+      update(nextSource: T) {
+        if (nextSource === source) return
+        untrack(() => {
+          const next = detached(nextSource, true)
+          const target = unwrap(next) as RecordValue
+          const current = unwrap(row) as RecordValue
+          // Native setters do not replace accessor definitions. A root-accessor
+          // row is a separate boundary; nested accessors remain immutable views.
+          const rootAccessor = [...keys(current), ...keys(target)].some(
+            (key) =>
+              Object.getOwnPropertyDescriptor(current, key)?.get ||
+              Object.getOwnPropertyDescriptor(target, key)?.get,
+          )
+          if (rootAccessor) {
+            ;[row, setRow] = createStore(target as T)
+            entry.value = row
+          } else
+            setRow(
+              produce((draft: RecordValue) => {
+                for (const key of keys(current))
+                  if (!Object.hasOwn(target, key)) {
+                    if (draft[key] === undefined) draft[key] = null
+                    delete draft[key]
+                  }
+                for (const key of keys(target)) {
+                  const desc = Object.getOwnPropertyDescriptor(target, key)!
+                  const value: unknown = Reflect.get(next, key)
+                  const existed = Object.hasOwn(current, key)
+                  const visibility =
+                    existed &&
+                    Object.prototype.propertyIsEnumerable.call(current, key) !==
+                      desc.enumerable
+                  // Shadow inherited names before native setters compare them.
+                  if (!existed)
+                    Object.defineProperty(current, key, {
+                      value: undefined,
+                      enumerable: desc.enumerable,
+                      writable: true,
+                      configurable: true,
+                    })
+                  if (value === undefined) {
+                    if (!existed || current[key] !== undefined || visibility) {
+                      draft[key] = null
+                      draft[key] = undefined
+                      Object.defineProperty(current, key, {
+                        value: undefined,
+                        enumerable: desc.enumerable,
+                        writable: true,
+                        configurable: true,
+                      })
+                    }
+                  } else {
+                    if (visibility && current[key] === unwrap(value))
+                      draft[key] = value === null ? undefined : null
+                    if (current[key] !== unwrap(value)) draft[key] = value
+                    if (!existed || visibility)
+                      Object.defineProperty(current, key, {
+                        enumerable: desc.enumerable,
+                      })
+                  }
+                }
+                if (Array.isArray(target)) draft.length = target.length
+              }) as (previous: T) => T,
+            )
+          source = nextSource
+        })
+      },
+    }
+    return entry
+  })
+}
diff --git a/packages/solid-db/src/useLiveQuery.ts b/packages/solid-db/src/useLiveQuery.ts
index 92c69928c1..164a941e0d 100644
--- a/packages/solid-db/src/useLiveQuery.ts
+++ b/packages/solid-db/src/useLiveQuery.ts
@@ -18,6 +18,7 @@ import {
   toBoundaryError,
 } from '@tanstack/db'
 import { createStore, reconcile } from 'solid-js/store'
+import { createRowStore, createStoreReadView } from './store-materialization'
 import type { Accessor } from 'solid-js'
 import type {
   ChangeMessage,
@@ -301,6 +302,8 @@ export function useLiveQuery(
     name: `TanstackDBData`,
   })
 
+  const readData = createStoreReadView(data)
+
   // Track collection status reactively
   const [status, setStatus] = createSignal(
     collection() ? collection()!.status : (`disabled` as const),
@@ -329,12 +332,9 @@ export function useLiveQuery(
         existing.update(value)
         nextRows.push(existing.value)
       } else {
-        const [row, setRow] = createStore(value)
-        rowsByKey.set(key, {
-          value: row,
-          update: (nextValue) => setRow(reconcile(nextValue, { key: null })),
-        })
-        nextRows.push(row)
+        const row = createRowStore(value)
+        rowsByKey.set(key, row)
+        nextRows.push(row.value)
       }
     }
 
@@ -521,10 +521,11 @@ export function useLiveQuery(
       if (isSingleResultCollection(currentCollection)) {
         // Force resource tracking so Suspense works
         getDataResource()
-        return data[0]
+        return readData[0]
       }
     }
-    return getDataResource()
+    const result = getDataResource()
+    return result === data ? readData : result
   }
 
   Object.defineProperties(getData, {
diff --git a/packages/solid-db/tests/conformance.test.tsx b/packages/solid-db/tests/conformance.test.tsx
index 44d074f3be..e96f3d564a 100644
--- a/packages/solid-db/tests/conformance.test.tsx
+++ b/packages/solid-db/tests/conformance.test.tsx
@@ -19,6 +19,7 @@ import {
   eq,
   groupKeys,
   gt,
+  localOnlyCollectionOptions,
   sum,
 } from '@tanstack/db'
 import {
@@ -27,18 +28,23 @@ import {
   createSignal,
   onCleanup,
 } from 'solid-js'
+import { createStore } from 'solid-js/store'
 import {
   mockSyncCollectionOptions,
   mockSyncCollectionOptionsNoInitialState,
 } from '../../db/tests/utils'
 import { useLiveQuery } from '../src/useLiveQuery'
 import { runSuite } from '../../db/tests/conformance/suite'
+import { runRowSnapshotHistories } from '../../db/tests/conformance/row-snapshot-oracle'
 import { createPublicationLog } from '../../db/tests/conformance/publication-log'
 import { expectPublishedRows } from '../../db/tests/conformance/publication-laws-oracle'
 import { makeLaggingSource } from '../../db/tests/conformance/lagging-source'
 import { makeSyncSource } from '../../db/tests/conformance/sync-source'
 import { makeErrorSource as makeSharedErrorSource } from '../../db/tests/conformance/error-source'
-import { expectResultSurface } from '../../db/tests/conformance/result-laws'
+import {
+  expectResultSurface,
+  selectedRowKeys,
+} from '../../db/tests/conformance/result-laws'
 import { withScopeSetup } from '../../db/tests/conformance/scope-setup'
 import type { PooledLiveQueries } from '@tanstack/db'
 import type {
@@ -64,12 +70,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ): SourceHandle<T> {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-solid-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)
@@ -260,6 +268,7 @@ const solidDriver: LiveQueryDriver = {
   disabledRepresentation: `empty-reactive`,
   ops: { eq, gt, count, sum, coalesce, groupKeys, createOptimisticAction },
   makeSource,
+  wrapSnapshotValue: <T extends object>(value: T) => createStore(value)[0],
   makeDeferredSource,
   makeLaggingSource: <T extends { id: string }>() =>
     makeLaggingSource<T>(
@@ -331,6 +340,57 @@ describe(`owned native scope setup`, () => {
 })
 
 runSuite(solidDriver)
+
+// The reported source is local-only. Keep that receiving path on the same
+// snapshot law and histories as the adapter suite's controlled sync source.
+it.each([`callback`, `config`, `collection`] as const)(
+  `preserves local-only row snapshots through the %s input`,
+  async (input) => {
+    await runRowSnapshotHistories(
+      {
+        ...solidDriver,
+        name: `solid-local-only`,
+        snapshotSourceUsesDraft: true,
+        makeSource<T extends { id: string }>(
+          initialData: ReadonlyArray<T>,
+          collectionId?: string,
+          options?: { rowUpdateMode?: `full` },
+        ) {
+          const collection = createCollection(
+            localOnlyCollectionOptions<T>({
+              id: collectionId,
+              getKey: (row) => row.id,
+              initialData: [...initialData],
+            }),
+          )
+          return {
+            collection,
+            insert: (row: T) => {
+              collection.insert(row)
+            },
+            update: (row: T) => {
+              return collection.update(row.id, (draft) => {
+                // Local-only sync already replaces full rows. Remove omitted
+                // keys from the draft when the shared history requests it.
+                if (options?.rowUpdateMode === `full`)
+                  for (const key of selectedRowKeys(draft))
+                    if (!Object.hasOwn(row, key))
+                      Reflect.deleteProperty(draft, key)
+                Object.assign(draft, row)
+              })
+            },
+            remove: (row: T) => {
+              collection.delete(row.id)
+            },
+          }
+        },
+      },
+      input,
+      `sync`,
+    )
+  },
+)
+
 it(`preserves raw result types through the actual driver reader`, () => {
   const rawData = [{ id: `a`, value: undefined }]
   const raw = Object.assign(() => rawData, {
diff --git a/packages/solid-db/tests/row-materialization-oracle.test.tsx b/packages/solid-db/tests/row-materialization-oracle.test.tsx
new file mode 100644
index 0000000000..e02e6dd44f
--- /dev/null
+++ b/packages/solid-db/tests/row-materialization-oracle.test.tsx
@@ -0,0 +1,1663 @@
+/**
+ * Solid's fine-grained result contract keeps consumers of unchanged values
+ * quiet. The existing Fine-grained reactivity tests establish this for scalar
+ * row fields; this receiving oracle crosses nested array elements and binding
+ * lifetime. An identical source container has not changed merely because a
+ * peer row or another field changed. Materializing a row must not add that
+ * row's native store dependencies to the query-input dependency set.
+ *
+ * The independent model counts admissions of new element objects. The grammar
+ * alternates two keys, retains nested inputs through scalar edits, introduces a
+ * new element, and then edits a peer again. Reorder histories compare every
+ * current value and rendered child while retaining element identities. Native
+ * descendants also cross ordinary/native parent replacements in both directions,
+ * with same-parent controls. Resize histories grow, shrink and empty arrays.
+ * The shared snapshot owner's immutable-update law also preserves source values.
+ * All three inputs run on the real Solid host at one or two array levels.
+ * Comparison follows the host's settled cut. This law does not promise
+ * identity for an element whose source object changed, live mutable-source
+ * values, arbitrary getters, cyclic updates, or a wall-clock work bound.
+ */
+import { createCollection } from '@tanstack/db'
+import { render, waitFor } from '@solidjs/testing-library'
+import { For, createRenderEffect, createRoot, createSignal } from 'solid-js'
+import { createStore } from 'solid-js/store'
+import { expect, it, vi } from 'vitest'
+import { useLiveQuery } from '../src/useLiveQuery'
+import { createRowStore } from '../src/store-materialization'
+import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { createOracleReach } from '../../db/tests/oracle-reach'
+import { ScenarioLifetime } from '../../db/tests/conformance/scenario-lifetime'
+import type { InitialQueryBuilder } from '@tanstack/db'
+
+type Element = { value: number }
+type Row = {
+  id: string
+  value: number
+  tags: Array<Element> | { items: Array<Element> }
+  payload: { value: number }
+}
+type History = {
+  input: `callback` | `config` | `collection`
+  nested: boolean
+  native: boolean
+  law: `identity` | `lifetime` | `reorder` | `resize`
+  nativeElements?: boolean
+  initialParent?: boolean
+  nextParent?: boolean
+}
+
+// Unchanged source elements retain the identity and admission counts observed
+// at their admission cut. Changed sources may reuse or replace an owned element.
+type Admission = { element: Element; mounts: number; reads: number }
+
+function* histories(): Generator<History> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const nested of [false, true])
+      for (const native of [false, true])
+        for (const law of [
+          `identity`,
+          `lifetime`,
+          `reorder`,
+          `resize`,
+        ] as const)
+          yield { input, nested, native, law }
+}
+
+// Replacing a parent can expose the same native child through raw descriptors
+// or public store reads. Those representations cannot change child admission.
+// Same-parent controls distinguish that transition from native support itself.
+function* nativeParentHistories(): Generator<History> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const nested of [false, true])
+      for (const initialParent of [false, true])
+        for (const nextParent of [false, true])
+          yield {
+            input,
+            nested,
+            native: true,
+            law: `reorder`,
+            nativeElements: true,
+            initialParent,
+            nextParent,
+          }
+}
+
+function arrayParent(
+  items: Array<Element>,
+  nested: boolean,
+  native: boolean,
+): Row[`tags`] {
+  const parent = nested ? { items } : items
+  return native ? createStore(parent)[0] : parent
+}
+
+function elements(row: Row): Array<Element> {
+  return Array.isArray(row.tags) ? row.tags : row.tags.items
+}
+
+function compare(
+  current: Row,
+  expectedValue: number,
+  admitted: Admission,
+  mounts: number,
+  reads: number,
+) {
+  expect(elements(current)[0]!.value, `current element value`).toBe(
+    expectedValue,
+  )
+  expect(mounts, `unchanged elements do not remount`).toBe(admitted.mounts)
+  expect(reads, `unchanged element references do not invalidate effects`).toBe(
+    admitted.reads,
+  )
+  expect(elements(current)[0], `unchanged nested element identity`).toBe(
+    admitted.element,
+  )
+}
+
+// The resize model is the admitted scalar sequence. Both the reactive map
+// consumer and rendered children must follow it at each host checkpoint.
+function compareArray(
+  observed: Array<number>,
+  rendered: string | null,
+  admitted: Array<number>,
+) {
+  expect(observed, `array consumers follow current membership`).toEqual(
+    admitted,
+  )
+  expect(rendered, `rendered array membership`).toBe(admitted.join(``))
+}
+
+async function runHistory(history: History) {
+  const parentState =
+    history.initialParent === history.nextParent
+      ? `same-parent-control`
+      : `parent-transition`
+  const reach = createOracleReach(
+    `solid.materialization.${history.input}.${history.nested}.${history.native}.${history.law}.${history.initialParent}.${history.nextParent}`,
+    history.law === `reorder` || history.law === `resize`
+      ? [
+          history.law === `reorder` ? `source-reorder` : `array-resize`,
+          ...(history.nativeElements
+            ? [`native-element-admission`, `source-identity-reuse`, parentState]
+            : []),
+        ]
+      : [
+          `peer-edit`,
+          `same-row-scalar-edit`,
+          `element-replacement`,
+          `source-only-write`,
+        ],
+  )
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const [nativePayload, setNativePayload] = createStore({ value: 0 })
+    const initialValues = history.law === `reorder` ? [0, 10] : [0]
+    const tags = initialValues.map((value) =>
+      history.nativeElements ? createStore({ value })[0] : { value },
+    )
+    // Keep the native public references before a parent store unwraps its input.
+    const sourceElements = [...tags]
+    const initialTags = history.nativeElements
+      ? arrayParent([...tags], history.nested, history.initialParent ?? false)
+      : tags
+    const rows: Array<Row> = [`a`, `b`].map((id) => ({
+      id,
+      value: 0,
+      tags: history.nativeElements
+        ? initialTags
+        : history.nested
+          ? { items: tags }
+          : tags,
+      payload: history.native ? nativePayload : { value: 0 },
+    }))
+    const source = createCollection(
+      mockSyncCollectionOptions<Row>({
+        id: `materialization-${history.input}-${history.nested}-${history.native}`,
+        getKey: (row) => row.id,
+        initialData: rows,
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      const subscriptions = vi.spyOn(source, `subscribeChanges`)
+      resources.defer(() => subscriptions.mockRestore())
+      let view: ReturnType<typeof render> | undefined
+      let disposeEffects: (() => void) | undefined
+      resources.defer(() => view?.unmount())
+      resources.defer(() => disposeEffects?.())
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        const build = (q: InitialQueryBuilder) =>
+          q.from({ row: source }).select(({ row }) => ({ ...row }))
+        return history.input === `collection`
+          ? useLiveQuery(() => source)
+          : history.input === `config`
+            ? useLiveQuery(() => ({ query: build }))
+            : useLiveQuery(build)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(2))
+      const current = () => query().find((row) => row.id === `a`)!
+      if (history.law === `resize`) {
+        let observed: Array<number> = []
+        createRoot((dispose) => {
+          resources.defer(dispose)
+          createRenderEffect(() => {
+            observed = elements(current()).map((element) => element.value)
+          })
+        })
+        view = render(() => (
+          <For each={elements(current())}>
+            {(element) => <span>{element.value}</span>}
+          </For>
+        ))
+        // Growth must notify length readers before a later shrink can conceal
+        // it. Repeated growth also checks objects admitted by earlier updates.
+        for (const values of [[0, 1], [0], [0, 2, 3], []]) {
+          const admitted = values.map((value) => ({ value }))
+          const next = {
+            ...rows[0]!,
+            value: rows[0]!.value + 1,
+            tags: history.nested ? { items: admitted } : admitted,
+          }
+          rows[0] = next
+          source.utils.begin()
+          source.utils.write({ type: `update`, value: next })
+          source.utils.commit()
+          await waitFor(() => expect(current().value).toBe(next.value))
+          compareArray(observed, view.container.textContent, values)
+          reach.reach(`array-resize`)
+        }
+        return
+      }
+      if (history.law === `reorder`) {
+        const initialElements = [...elements(current())]
+        const initialSources = elements(source.get(`a`)!)
+        expect(
+          initialSources.map((element) => element.value),
+          `complete admitted source values`,
+        ).toEqual(initialValues)
+        if (history.nativeElements) {
+          expect(
+            initialSources,
+            `complete source child admission`,
+          ).toHaveLength(sourceElements.length)
+          for (const [index, element] of initialSources.entries())
+            expect(element, `source admitted the native child`).toBe(
+              sourceElements[index],
+            )
+          reach.reach(`native-element-admission`)
+        }
+        let admissions = 0
+        view = render(() => (
+          <For each={elements(current())}>
+            {(element) => {
+              admissions++
+              return <span>{element.value}</span>
+            }}
+          </For>
+        ))
+        compareArray(
+          elements(current()).map((element) => element.value),
+          view.container.textContent,
+          initialValues,
+        )
+        // Permuting identical source elements admits no new element. Repeating
+        // the permutation distinguishes stable source identity from index merges.
+        for (let turn = 0; turn < 2; turn++) {
+          const reordered =
+            turn === 0
+              ? [...sourceElements].reverse()
+              : history.nativeElements
+                ? [...sourceElements]
+                : tags
+          const expectedValues =
+            turn === 0 ? [...initialValues].reverse() : initialValues
+          const expectedElements =
+            turn === 0 ? [...initialElements].reverse() : initialElements
+          const next = {
+            ...rows[0]!,
+            value: turn + 1,
+            tags: arrayParent(
+              reordered,
+              history.nested,
+              (turn === 0 ? history.nextParent : history.initialParent) ??
+                false,
+            ),
+          }
+          source.utils.begin()
+          source.utils.write({ type: `update`, value: next })
+          source.utils.commit()
+          await waitFor(() => expect(current().value).toBe(next.value))
+          const admittedSources = elements(source.get(`a`)!)
+          expect(
+            admittedSources.map((element) => element.value),
+            `complete unchanged source values`,
+          ).toEqual(expectedValues)
+          if (history.nativeElements) {
+            const expectedSources =
+              turn === 0 ? [...sourceElements].reverse() : sourceElements
+            expect(
+              admittedSources,
+              `complete unchanged source child admission`,
+            ).toHaveLength(expectedSources.length)
+            for (const [index, element] of admittedSources.entries())
+              expect(
+                element,
+                `source retained the unchanged native child`,
+              ).toBe(expectedSources[index])
+            reach.reach(`source-identity-reuse`)
+            reach.reach(parentState)
+          }
+          compareArray(
+            elements(current()).map((element) => element.value),
+            view.container.textContent,
+            expectedValues,
+          )
+          for (const [index, element] of elements(current()).entries())
+            expect(element, `source element identity follows reorder`).toBe(
+              expectedElements[index],
+            )
+          expect(admissions, `reordering does not admit new elements`).toBe(
+            tags.length,
+          )
+          reach.reach(`source-reorder`)
+        }
+        return
+      }
+      const initial = elements(current())[0]!
+      let mounts = 0
+      let reads = 0
+      let admitted: Admission = { element: initial, mounts: 1, reads: 1 }
+      if (history.law === `identity`) {
+        view = render(() => (
+          <For each={elements(current())}>
+            {(element) => {
+              mounts++
+              return <span>{element.value}</span>
+            }}
+          </For>
+        ))
+        createRoot((dispose) => {
+          disposeEffects = dispose
+          createRenderEffect(() => {
+            void elements(current())[0]
+            reads++
+          })
+        })
+        compare(current(), 0, admitted, mounts, reads)
+      }
+      const write = (index: number, replacement: boolean) => {
+        const previous = rows[index]!
+        const next = { ...previous, value: previous.value + 1 }
+        if (replacement) {
+          const replacementItems = [{ value: 1 }]
+          next.tags = history.nested
+            ? { items: replacementItems }
+            : replacementItems
+        }
+        rows[index] = next
+        source.utils.begin()
+        source.utils.write({ type: `update`, value: next })
+        source.utils.commit()
+      }
+      for (const [index, replacement] of [
+        [1, false],
+        [0, false],
+        [0, true],
+        [1, false],
+      ] as const) {
+        write(index, replacement)
+        await waitFor(() =>
+          expect(query().find((row) => row.id === rows[index]!.id)!.value).toBe(
+            rows[index]!.value,
+          ),
+        )
+        const replaced = rows[0]!.value >= 2
+        if (history.law === `identity`) {
+          if (replacement) {
+            // Only current values are promised at a changed-source cut. The
+            // next peer edit must preserve whichever identity was admitted.
+            expect(elements(current())[0]!.value).toBe(1)
+            expect(view!.container.textContent).toBe(`1`)
+            admitted = { element: elements(current())[0]!, mounts, reads }
+          } else compare(current(), replaced ? 1 : 0, admitted, mounts, reads)
+        }
+        reach.reach(
+          replacement
+            ? `element-replacement`
+            : index === 0
+              ? `same-row-scalar-edit`
+              : `peer-edit`,
+        )
+      }
+      // A native source write supplies a tracked read premise, not a Collection
+      // change. Its liveness policy is outside this law; binding lifetime is not.
+      const starts = subscriptions.mock.calls.length
+      setNativePayload(`value`, 1)
+      await new Promise<void>((resolve) => queueMicrotask(resolve))
+      expect(
+        subscriptions.mock.calls.length,
+        `row reads cannot rebind the hook`,
+      ).toBe(starts)
+      reach.reach(`source-only-write`)
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+
+it.each([...histories()])(
+  `preserves $law through $input, nested=$nested native=$native`,
+  runHistory,
+)
+
+it.each([...nativeParentHistories()])(
+  `preserves native element identity through $input, nested=$nested parents=$initialParent->$nextParent`,
+  runHistory,
+)
+
+declareOracle({
+  grammar: [histories, nativeParentHistories],
+  check: [compare, compareArray],
+})
+
+/**
+ * The materializer's own data-field boundary preserves descriptor visibility
+ * and supplies native shape notifications. This is a helper-only law: Core
+ * public row snapshots copy enumerable root fields before hook admission.
+ * These histories therefore establish no public descriptor-admission promise.
+ * The existing supplied-Collection shape test covers public field admission.
+ *
+ * The model retains only a descriptor's enumerable flag. An Object.keys
+ * consumer of the stable root must see that flag at every settled host cut.
+ * Payload identity, scalar value, and source descriptors remain unchanged.
+ * Accessors, symbols, frozen descriptors, and in-place source edits are outside
+ * this family. Each update admits a fresh root with an immutable payload.
+ */
+function* visibilityHistories() {
+  for (const kind of [
+    `undefined`,
+    `null`,
+    `scalar`,
+    `object`,
+    `array`,
+    `native`,
+  ] as const)
+    for (const initial of [false, true]) yield { kind, initial }
+}
+
+function compareVisibility(
+  observed: Array<string>,
+  current: object,
+  visible: boolean,
+) {
+  const expected = visible ? [`payload`] : []
+  expect(
+    observed,
+    `enumeration observer follows descriptor visibility`,
+  ).toEqual(expected)
+  expect(Object.keys(current), `current descriptor visibility`).toEqual(
+    expected,
+  )
+}
+
+it.each([...visibilityHistories()])(
+  `notifies helper visibility for $kind, initially=$initial`,
+  async ({ kind, initial }) => {
+    const reach = createOracleReach(
+      `solid.materialization.visibility.${kind}.${initial}`,
+      [`unchanged`, `hidden`, `visible`, `visibility-restored`],
+    )
+    reach.beginHistory()
+    const payload =
+      kind === `undefined`
+        ? undefined
+        : kind === `null`
+          ? null
+          : kind === `scalar`
+            ? 1
+            : kind === `array`
+              ? [1]
+              : kind === `native`
+                ? createStore({ value: 1 })[0]
+                : { value: 1 }
+    const sourceRow = (visible: boolean) =>
+      Object.defineProperty({ payload }, `payload`, { enumerable: visible })
+    const resources = new ScenarioLifetime()
+    await resources.run(async () => {
+      const original = sourceRow(initial)
+      const entry = createRowStore(original)
+      const row = entry.value
+      const admitted = row.payload
+      let observed: Array<string> = []
+      createRoot((dispose) => {
+        resources.defer(dispose)
+        createRenderEffect(() => {
+          observed = Object.keys(row)
+        })
+      })
+      compareVisibility(observed, row, initial)
+      for (const visible of [initial, !initial, initial, !initial]) {
+        entry.update(sourceRow(visible))
+        await new Promise<void>((resolve) => queueMicrotask(resolve))
+        compareVisibility(observed, row, visible)
+        expect(entry.value, `ordinary root identity`).toBe(row)
+        expect(row.payload, `visibility keeps the admitted payload`).toBe(
+          admitted,
+        )
+        expect(original.payload, `source payload remains borrowed`).toBe(
+          payload,
+        )
+        expect(Object.keys(original)).toEqual(initial ? [`payload`] : [])
+        reach.reach(visible ? `visible` : `hidden`)
+      }
+      reach.reach(`unchanged`)
+      reach.reach(`visibility-restored`)
+    })
+    reach.assertReached()
+  },
+)
+
+declareOracle({
+  grammar: [visibilityHistories],
+  check: [compareVisibility],
+})
+
+/**
+ * Maintainer decision, 2026-10-30: preserve live row getters. A signal change
+ * must reach a getter consumer without a Collection publication. Getter-returned
+ * objects still belong to the source; reconciling a later row cannot edit them.
+ * These are different observations: liveness follows the current signal, while
+ * each retained source getter keeps its admitted scalar version.
+ */
+type GetterHistory = {
+  input: History[`input`]
+  object: boolean
+  later: boolean
+  stable: boolean
+}
+type Label = string | { locale: string; value: number }
+type GetterRow = { id: string; value: number; config: { label?: Label } | null }
+
+function expectedLabel(object: boolean, locale: string, value: number): Label {
+  return object ? { locale, value } : `${locale}:${value}`
+}
+
+function* getterHistories(): Generator<GetterHistory> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const object of [false, true])
+      for (const later of [false, true])
+        for (const stable of [false, true])
+          yield { input, object, later, stable }
+}
+
+function compareLabel(
+  actual: Label | undefined,
+  history: GetterHistory,
+  locale: string,
+  value: number,
+) {
+  expect(actual, `live getter at the host cut`).toEqual(
+    expectedLabel(history.object, locale, value),
+  )
+}
+
+// Every history crosses a source replacement with subsequent signal writes.
+// Initial and later container admission use the same model and observation.
+// The getter is nested: spreading a root getter in a query projection would
+// evaluate it in Core before it could reach the framework adapter boundary.
+async function runGetterHistory(history: GetterHistory) {
+  const reach = createOracleReach(
+    `solid.getter.${history.input}.${history.object}.${history.later}.${history.stable}`,
+    [
+      `getter-admission`,
+      `source-replacement`,
+      `signal-only-write`,
+      `retained-getter`,
+      `getter-omission`,
+      `getter-readmission`,
+    ],
+  )
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const [locale, setLocale] = createSignal(`en`)
+    const stableValues = new Map(
+      [`en`, `fr`, `de`].map((language) => [
+        language,
+        expectedLabel(history.object, language, 0),
+      ]),
+    )
+    const admitted: Array<{ value: number; config: { label: Label } }> = []
+    const sourceRow = (value: number): GetterRow => {
+      const values = history.stable
+        ? stableValues
+        : new Map(
+            [`en`, `fr`, `de`].map((language) => [
+              language,
+              expectedLabel(history.object, language, value),
+            ]),
+          )
+      const config = {
+        data:
+          value === 0
+            ? values.get(`en`)!
+            : expectedLabel(history.object, `en`, value),
+        get label() {
+          return values.get(locale())!
+        },
+      }
+      admitted.push({ value: history.stable ? 0 : value, config })
+      return { id: `a`, value, config }
+    }
+    const source = createCollection(
+      mockSyncCollectionOptions<GetterRow>({
+        id: `getter-${history.input}-${history.object}-${history.later}`,
+        getKey: (row) => row.id,
+        initialData: [
+          history.later ? { id: `a`, value: -1, config: null } : sourceRow(0),
+        ],
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      const subscriptions = vi.spyOn(source, `subscribeChanges`)
+      resources.defer(() => subscriptions.mockRestore())
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        const build = (q: InitialQueryBuilder) =>
+          q.from({ row: source }).select(({ row }) => ({ ...row }))
+        return history.input === `collection`
+          ? useLiveQuery(() => source)
+          : history.input === `config`
+            ? useLiveQuery(() => ({ query: build }))
+            : useLiveQuery(build)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(1))
+      let observed: Label | undefined
+      let member = false
+      let keys: Array<string> = []
+      createRoot((dispose) => {
+        resources.defer(dispose)
+        createRenderEffect(() => {
+          observed = query()[0]?.config?.label
+        })
+        createRenderEffect(() => {
+          const config = query()[0]?.config
+          member = config !== null && config !== undefined && `label` in config
+          keys = config ? Object.keys(config) : []
+        })
+      })
+      for (let value = history.later ? 0 : 1; value <= 2; value++) {
+        source.utils.begin()
+        source.utils.write({ type: `update`, value: sourceRow(value) })
+        source.utils.commit()
+        await waitFor(() => expect(query()[0]!.value).toBe(value))
+        reach.reach(value === 0 ? `getter-admission` : `source-replacement`)
+        if (!history.later) reach.reach(`getter-admission`)
+        const labelVersion = history.stable ? 0 : value
+        compareLabel(observed, history, locale(), labelVersion)
+        const language = value % 2 === 0 ? `fr` : `de`
+        const starts = subscriptions.mock.calls.length
+        setLocale(language)
+        await new Promise<void>((resolve) => queueMicrotask(resolve))
+        reach.reach(`signal-only-write`)
+        compareLabel(observed, history, language, labelVersion)
+        expect(
+          subscriptions.mock.calls.length,
+          `getter reads cannot rebind the hook`,
+        ).toBe(starts)
+        for (const saved of admitted)
+          compareLabel(saved.config.label, history, language, saved.value)
+        reach.reach(`retained-getter`)
+      }
+      source.utils.begin()
+      source.utils.write({
+        type: `update`,
+        value: { id: `a`, value: 3, config: {} },
+      })
+      source.utils.commit()
+      await waitFor(() => expect(query()[0]!.value).toBe(3))
+      expect(observed, `omitted getter value`).toBeUndefined()
+      expect(member, `omitted getter membership`).toBe(false)
+      expect(keys, `omitted getter enumeration`).toEqual([])
+      reach.reach(`getter-omission`)
+      source.utils.begin()
+      source.utils.write({ type: `update`, value: sourceRow(4) })
+      source.utils.commit()
+      await waitFor(() => expect(query()[0]!.value).toBe(4))
+      compareLabel(observed, history, locale(), history.stable ? 0 : 4)
+      setLocale(`de`)
+      await new Promise<void>((resolve) => queueMicrotask(resolve))
+      compareLabel(observed, history, `de`, history.stable ? 0 : 4)
+      expect(member, `readmitted getter membership`).toBe(true)
+      expect(keys, `readmitted getter enumeration`).toContain(`label`)
+      reach.reach(`getter-readmission`)
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+
+it.each([...getterHistories()])(
+  `preserves live getters through $input, object=$object later=$later stable=$stable`,
+  runGetterHistory,
+)
+
+declareOracle({
+  model: [expectedLabel],
+  grammar: [getterHistories],
+  check: [compareLabel],
+})
+
+/**
+ * Maintainer decision, 2026-10-30: shared acyclic graphs must materialize
+ * efficiently. This cost judgment counts source enumerations, not elapsed time.
+ * This bounded witness allows 32 enumerations per distinct admitted container.
+ * It includes source and owned nodes, observer startup and Core's comparison.
+ * The generous regression budget distinguishes linear passes from path
+ * expansion; it is not a public performance SLO or a bound on getter bodies.
+ * Cyclic support remains undecided. The supplied-Collection input isolates this
+ * materialization boundary from live-query graph hashing and query evaluation.
+ */
+type Graph = { value: number } | { left: Graph; right: Graph }
+function* graphHistories() {
+  for (const depth of [0, 1, 4, 8, 12])
+    for (const shared of [false, true]) yield { depth, shared, crossed: false }
+  for (const depth of [4, 6, 8]) yield { depth, shared: true, crossed: true }
+}
+function enumerationBudget(containers: number): number {
+  return containers * 32
+}
+// The model forgets sharing identity but retains every public value path.
+function semanticGraph(
+  level: number,
+  value: number,
+  shared: boolean,
+  crossed: boolean,
+): Graph {
+  if (crossed) return semanticGraph(level * 2, value, true, false)
+  if (!level) return { value }
+  const child = semanticGraph(level - 1, value, shared, false)
+  return { left: child, right: shared ? child : { value } }
+}
+
+export function compareGraphValues(
+  actual: unknown,
+  expected: Graph,
+  seen = new WeakMap<object, Set<object>>(),
+): void {
+  expect(actual).not.toBeNull()
+  expect(typeof actual).toBe(`object`)
+  expect(Array.isArray(actual)).toBe(false)
+  const record = actual as Record<string, unknown>
+  const pairs = seen.get(record) ?? new Set<object>()
+  if (pairs.has(expected)) return
+  pairs.add(expected)
+  seen.set(record, pairs)
+  if (`value` in expected) {
+    expect(Object.keys(record)).toEqual([`value`])
+    expect(record.value, `complete graph leaf`).toBe(expected.value)
+  } else {
+    expect(new Set(Object.keys(record))).toEqual(new Set([`left`, `right`]))
+    compareGraphValues(record.left, expected.left, seen)
+    compareGraphValues(record.right, expected.right, seen)
+  }
+}
+
+function compareGraph(
+  actual: Graph,
+  expected: Graph,
+  visits: number,
+  containers: number,
+) {
+  // Counts enter by value before the checker traverses any observation.
+  expect(
+    visits,
+    `source enumeration scales with distinct containers`,
+  ).toBeLessThanOrEqual(enumerationBudget(containers))
+  compareGraphValues(actual, expected)
+}
+
+// A wrong observation changes one interior path while keeping the two extreme
+// paths intact. The same complete comparison must reject it at every crossed
+// depth; a checker of only all-left/all-right leaves would accept it.
+it.each([...graphHistories()].filter((history) => history.crossed))(
+  `rejects mixed-path corruption at crossed depth=$depth`,
+  ({ depth, shared, crossed }) => {
+    const expected = semanticGraph(depth, 0, shared, crossed)
+    function corrupted(graph: Graph, remaining: number): Graph {
+      if (`value` in graph) return { value: 99 }
+      const side = remaining === depth * 2 - 1 ? `right` : `left`
+      return { ...graph, [side]: corrupted(graph[side], remaining - 1) }
+    }
+    expect(() =>
+      compareGraphValues(corrupted(expected, depth * 2), expected),
+    ).toThrow()
+  },
+)
+
+async function runGraphHistory({
+  depth,
+  shared,
+  crossed,
+}: {
+  depth: number
+  shared: boolean
+  crossed: boolean
+}) {
+  const reach = createOracleReach(`solid.graph.${depth}.${shared}.${crossed}`, [
+    `graph-admission`,
+    `graph-replacement`,
+    `branch-divergence`,
+    ...(crossed ? [`crossed-sharing`] : []),
+  ])
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    let visits = 0
+    let containers = 0
+    const ownKeys = Object.keys
+    const reflectKeys = Reflect.ownKeys
+    const count = (keys: Array<PropertyKey>) => {
+      if (
+        keys.includes(`left`) ||
+        keys.includes(`right`) ||
+        (keys.includes(`value`) && !keys.includes(`id`))
+      )
+        visits++
+    }
+    const enumerations = vi
+      .spyOn(Object, `keys`)
+      .mockImplementation((value) => {
+        const keys = ownKeys(value)
+        count(keys)
+        return keys
+      })
+    resources.defer(() => enumerations.mockRestore())
+    const reflected = vi
+      .spyOn(Reflect, `ownKeys`)
+      .mockImplementation((value) => {
+        const keys = reflectKeys(value)
+        count(keys)
+        return keys
+      })
+    resources.defer(() => reflected.mockRestore())
+    const makeGraph = (level: number, value: number): Graph => {
+      if (crossed) {
+        const counted = (node: Graph): Graph => {
+          containers++
+          return new Proxy(node, {
+            ownKeys(target) {
+              visits++
+              return Reflect.ownKeys(target)
+            },
+          })
+        }
+        const tail = (remaining: number, terminal: Graph): Graph => {
+          if (!remaining) return terminal
+          const child = tail(remaining - 1, terminal)
+          return counted({ left: child, right: child })
+        }
+        const tree = (remaining: number, terminal: () => Graph): Graph =>
+          remaining
+            ? counted({
+                left: tree(remaining - 1, terminal),
+                right: tree(remaining - 1, terminal),
+              })
+            : terminal()
+        // The old and new graphs share at opposite ends. Aligned sharing
+        // cannot reveal an algorithm that enumerates their pair product.
+        return value === 0
+          ? tree(level, () => tail(level, counted({ value })))
+          : tail(
+              level,
+              tree(level, () => counted({ value })),
+            )
+      }
+      const child = level ? makeGraph(level - 1, value) : undefined
+      const target: Graph = child
+        ? { left: child, right: shared ? child : { value } }
+        : { value }
+      containers++
+      if (child && !shared) containers++
+      return new Proxy(target, {
+        ownKeys(node) {
+          visits++
+          return Reflect.ownKeys(node)
+        },
+      })
+    }
+    type GraphRow = { id: string; value: number; config: Graph }
+    const source = createCollection(
+      mockSyncCollectionOptions<GraphRow>({
+        id: `graph-${depth}-${shared}`,
+        getKey: (row) => row.id,
+        initialData: [{ id: `a`, value: 0, config: makeGraph(depth, 0) }],
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      visits = 0
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        return useLiveQuery(() => source)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(1))
+      compareGraph(
+        query()[0]!.config,
+        semanticGraph(depth, 0, shared, crossed),
+        visits,
+        containers,
+      )
+      reach.reach(`graph-admission`)
+      for (const value of [1, 2]) {
+        const config =
+          value === 1
+            ? makeGraph(depth, value)
+            : { left: makeGraph(depth, value), right: makeGraph(depth, 1) }
+        if (value === 2) containers++
+        visits = 0
+        source.utils.begin()
+        source.utils.write({
+          type: `update`,
+          value: { id: `a`, value, config },
+        })
+        source.utils.commit()
+        await waitFor(() => expect(query()[0]!.value).toBe(value))
+        compareGraph(
+          query()[0]!.config,
+          value === 1
+            ? semanticGraph(depth, value, shared, crossed)
+            : {
+                left: semanticGraph(depth, value, shared, crossed),
+                right: semanticGraph(depth, 1, shared, crossed),
+              },
+          visits,
+          containers,
+        )
+        reach.reach(value === 1 ? `graph-replacement` : `branch-divergence`)
+        if (crossed && value === 1) reach.reach(`crossed-sharing`)
+      }
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+it.each([...graphHistories()])(
+  `materializes depth=$depth shared=$shared crossed=$crossed graphs`,
+  runGraphHistory,
+)
+declareOracle({
+  model: [enumerationBudget, semanticGraph],
+  grammar: [graphHistories],
+  check: [compareGraph, compareGraphValues],
+})
+
+/**
+ * Callable user fields remain usable in Solid tracking scopes. The public
+ * current-result law and the shared snapshot owner's function leaves apply to
+ * ordinary own fields, inherited-name shadows and admitted null-prototype
+ * records. Native-store adoption does not reserve hasOwnProperty as user data.
+ * The live-getter decision also applies when a simple getter returns a callable.
+ *
+ * The model keeps an authored function identity and its scalar version. Every
+ * callable reads the receiver's unchanged value, so changing only its identity
+ * must update a consumer. A scalar peer cannot supply the missing invalidation.
+ * Root accessors are excluded because Core evaluates them before admission;
+ * nested accessors and null-prototype containers receive a source-premise check.
+ * These finite histories do not judge arbitrary function/getter bodies, mutable
+ * source writes, cyclic graphs or browser rendering.
+ */
+type CallableValue = (this: { value: number }) => number
+type CallableContainer = {
+  value: number
+  format?: CallableValue
+  hasOwnProperty?: unknown
+}
+type CallableRow = {
+  id: string
+  version: number
+  unchanged: number
+  value: number
+  format?: CallableValue
+  hasOwnProperty?: unknown
+  config: CallableContainer | null
+}
+type CallableHistory = {
+  input: History[`input`]
+  location: `root` | `nested`
+  property: `data` | `getter`
+  shape: `ordinary` | `shadow-value` | `shadow-callable` | `null-prototype`
+}
+type CallableObservation = {
+  callable: CallableValue | undefined
+  value: number | undefined
+}
+type CallableChoices = ReadonlyArray<ReadonlyArray<CallableValue>>
+
+function* callableHistories(): Generator<CallableHistory> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const location of [`root`, `nested`] as const)
+      for (const property of location === `root`
+        ? ([`data`] as const)
+        : ([`data`, `getter`] as const))
+        for (const shape of location === `root`
+          ? ([`ordinary`, `shadow-value`, `shadow-callable`] as const)
+          : ([
+              `ordinary`,
+              `shadow-value`,
+              `shadow-callable`,
+              `null-prototype`,
+            ] as const))
+          yield { input, location, property, shape }
+}
+
+// Function identities come from the authored input, and the return law is
+// receiver.value + source-version * 10 + the getter's selected signal version.
+function expectedCallable(
+  history: CallableHistory,
+  version: number,
+  signal: number,
+  choices: CallableChoices,
+  omitted = false,
+): CallableObservation {
+  if (omitted) return { callable: undefined, value: undefined }
+  const selected = history.property === `getter` ? signal : 0
+  return {
+    callable: choices[version]![selected]!,
+    value: 7 + version * 10 + selected,
+  }
+}
+function compareCallable(
+  actual: CallableObservation,
+  expected: CallableObservation,
+) {
+  expect(actual.callable, `tracked callable identity`).toBe(expected.callable)
+  expect(
+    actual.value,
+    `tracked callable result with the current receiver`,
+  ).toBe(expected.value)
+}
+
+async function runCallableHistory(history: CallableHistory) {
+  const reach = createOracleReach(
+    `solid.callable.${history.input}.${history.location}.${history.property}.${history.shape}`,
+    [
+      `callable-admission`,
+      `tracked-initial`,
+      `source-replacement`,
+      `signal-only-read`,
+      `callable-omission`,
+      `callable-readmission`,
+      `retained-source`,
+      `quiet-neighbor`,
+    ],
+  )
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const [signal, setSignal] = createSignal(0)
+    const choices: CallableChoices = Array.from({ length: 4 }, (_, version) =>
+      [0, 1].map(
+        (selected) =>
+          function (this: { value: number }) {
+            return this.value + version * 10 + selected
+          },
+      ),
+    )
+    const shadow = () => false
+    const sourceRow = (version: number, omitted = false): CallableRow => {
+      const fields: CallableContainer =
+        history.shape === `null-prototype`
+          ? Object.assign(Object.create(null) as object, { value: 7 })
+          : { value: 7 }
+      if (history.shape === `shadow-value`) fields.hasOwnProperty = 0
+      if (history.shape === `shadow-callable`) fields.hasOwnProperty = shadow
+      if (!omitted)
+        Object.defineProperty(
+          fields,
+          `format`,
+          history.property === `getter`
+            ? {
+                get: () => choices[version]![signal()]!,
+                enumerable: true,
+                configurable: true,
+              }
+            : {
+                value: choices[version]![0]!,
+                enumerable: true,
+                writable: true,
+                configurable: true,
+              },
+        )
+      const base = { id: `a`, version, unchanged: 0, value: 7, config: null }
+      return history.location === `root`
+        ? { ...base, ...fields }
+        : { ...base, config: fields }
+    }
+    const source = createCollection(
+      mockSyncCollectionOptions<CallableRow>({
+        id: `callable-${history.input}-${history.location}-${history.property}-${history.shape}`,
+        getKey: (row) => row.id,
+        initialData: [sourceRow(0)],
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      const subscriptions = vi.spyOn(source, `subscribeChanges`)
+      resources.defer(() => subscriptions.mockRestore())
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        const build = (q: InitialQueryBuilder) =>
+          q.from({ row: source }).select(({ row }) => ({ ...row }))
+        return history.input === `collection`
+          ? useLiveQuery(() => source)
+          : history.input === `config`
+            ? useLiveQuery(() => ({ query: build }))
+            : useLiveQuery(build)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(1))
+      const container = (row: CallableRow): CallableContainer =>
+        history.location === `root` ? row : row.config!
+      const retained: Array<{
+        row: CallableRow
+        version: number
+        omitted: boolean
+      }> = []
+      const admit = (version: number, omitted: boolean) => {
+        const row = source.get(`a`)!
+        const fields = container(row)
+        expect(
+          Object.hasOwn(fields, `format`),
+          `source admitted callable ownness`,
+        ).toBe(!omitted)
+        if (history.shape === `null-prototype`)
+          expect(
+            Object.getPrototypeOf(fields),
+            `source admitted nested null prototype`,
+          ).toBe(null)
+        if (history.shape.startsWith(`shadow`)) {
+          expect(
+            Object.hasOwn(fields, `hasOwnProperty`),
+            `source admitted ordinary shadow`,
+          ).toBe(true)
+          expect(
+            fields.hasOwnProperty,
+            `source admitted user shadow value`,
+          ).toBe(history.shape === `shadow-value` ? 0 : shadow)
+        }
+        retained.push({ row, version, omitted })
+      }
+      admit(0, false)
+      reach.reach(`callable-admission`)
+      const root = query()[0]!
+      let observed: CallableObservation = {
+        callable: undefined,
+        value: undefined,
+      }
+      let reads = 0
+      let unchangedReads = 0
+      // This recorder runs in the actual host listener. An untracked value
+      // comparison cannot establish callable usability or dependency tracking.
+      createRoot((dispose) => {
+        resources.defer(dispose)
+        createRenderEffect(() => {
+          const current = container(query()[0]!)
+          observed = { callable: current.format, value: current.format?.() }
+          reads++
+        })
+        createRenderEffect(() => {
+          void query()[0]!.unchanged
+          unchangedReads++
+        })
+      })
+      compareCallable(observed, expectedCallable(history, 0, signal(), choices))
+      reach.reach(`tracked-initial`)
+      const compareCurrentCallable = (version: number, omitted = false) => {
+        compareCallable(
+          observed,
+          expectedCallable(history, version, signal(), choices, omitted),
+        )
+        expect(query()[0]!, `ordinary root stays stable`).toBe(root)
+        expect(unchangedReads, `unchanged scalar neighbor stays quiet`).toBe(1)
+        for (const saved of retained) {
+          const fields = container(saved.row)
+          compareCallable(
+            { callable: fields.format, value: fields.format?.() },
+            expectedCallable(
+              history,
+              saved.version,
+              signal(),
+              choices,
+              saved.omitted,
+            ),
+          )
+          expect(saved.row.version, `retained source version`).toBe(
+            saved.version,
+          )
+          expect(
+            Object.hasOwn(fields, `format`),
+            `retained source ownness`,
+          ).toBe(!saved.omitted)
+        }
+        if (history.shape.startsWith(`shadow`))
+          for (const fields of [
+            container(query()[0]!),
+            ...retained.map((saved) => container(saved.row)),
+          ]) {
+            expect(
+              Object.hasOwn(fields, `hasOwnProperty`),
+              `current and retained user shadow ownness`,
+            ).toBe(true)
+            expect(
+              fields.hasOwnProperty,
+              `current and retained user shadow value`,
+            ).toBe(history.shape === `shadow-value` ? 0 : shadow)
+          }
+        reach.reach(`retained-source`)
+        reach.reach(`quiet-neighbor`)
+      }
+      compareCurrentCallable(0)
+      const signalOnly = async (selected: number, version: number) => {
+        const starts = subscriptions.mock.calls.length
+        const before = reads
+        setSignal(selected)
+        await new Promise<void>((resolve) => queueMicrotask(resolve))
+        compareCurrentCallable(version)
+        expect(
+          subscriptions.mock.calls.length,
+          `callable reads cannot rebind the hook`,
+        ).toBe(starts)
+        if (history.property === `data`)
+          expect(
+            reads,
+            `a data callable does not depend on the getter signal`,
+          ).toBe(before)
+        reach.reach(`signal-only-read`)
+      }
+      const write = async (version: number, omitted = false) => {
+        source.utils.begin()
+        source.utils.write({
+          type: `update`,
+          value: sourceRow(version, omitted),
+        })
+        source.utils.commit()
+        await waitFor(() => expect(query()[0]!.version).toBe(version))
+        admit(version, omitted)
+        compareCurrentCallable(version, omitted)
+      }
+      await signalOnly(1, 0)
+      await write(1)
+      reach.reach(`source-replacement`)
+      await signalOnly(0, 1)
+      await write(2, true)
+      reach.reach(`callable-omission`)
+      await write(3)
+      reach.reach(`callable-readmission`)
+      await signalOnly(1, 3)
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+it.each([...callableHistories()])(
+  `tracks callable $property through $input at $location with $shape`,
+  runCallableHistory,
+)
+declareOracle({
+  model: [expectedCallable],
+  grammar: [callableHistories],
+  check: [compareCallable],
+})
+
+/**
+ * An own user data field keeps its ordinary current-result meaning even when
+ * its name is __proto__. Core's public-field owner establishes admission; this
+ * receiving family checks the distinct Solid listener boundary. Native get's
+ * reserved-name shortcut must not leave the first subscribed value stale.
+ *
+ * The independent model is a scalar stage sequence, including own undefined.
+ * The grammar starts with own data, own undefined or an inherited fallback,
+ * then replaces, omits and readmits the field. Host bookkeeping symbols and
+ * nested mutable-source writes are outside this family.
+ */
+type ReservedFieldHistory = {
+  input: History[`input`]
+  key: `ordinary` | `__proto__`
+  initial: `value` | `undefined` | `absent`
+}
+type ReservedFieldRow = {
+  id: string
+  version: number
+  unchanged: number
+  ordinary?: number
+  __proto__?: number
+}
+function* reservedFieldHistories(): Generator<ReservedFieldHistory> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const key of [`ordinary`, `__proto__`] as const)
+      for (const initial of [`value`, `undefined`, `absent`] as const)
+        yield { input, key, initial }
+}
+function expectedReservedField(
+  stage: number,
+  initial: ReservedFieldHistory[`initial`],
+  key: ReservedFieldHistory[`key`],
+): unknown {
+  const inherited = key === `__proto__` ? Object.prototype : undefined
+  if (stage === 0)
+    return initial === `absent`
+      ? inherited
+      : initial === `undefined`
+        ? undefined
+        : 0
+  if (stage === 3) return inherited
+  return stage === 2 ? undefined : stage === 1 ? 1 : 2
+}
+function compareReservedField(observed: unknown, expected: unknown) {
+  expect(observed, `tracked own data follows its admitted scalar stage`).toBe(
+    expected,
+  )
+}
+async function runReservedFieldHistory(history: ReservedFieldHistory) {
+  const reach = createOracleReach(
+    `solid.own-field.${history.input}.${history.key}.${history.initial}`,
+    [
+      `initial-source-shape`,
+      `tracked-initial`,
+      `first-replacement`,
+      `own-undefined`,
+      `omission`,
+      `readmission`,
+      `retained-source`,
+      `quiet-neighbor`,
+    ],
+  )
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const sourceRow = (stage: number): ReservedFieldRow => ({
+      id: `a`,
+      version: stage,
+      unchanged: 0,
+      ...(stage === 3 || (stage === 0 && history.initial === `absent`)
+        ? {}
+        : Object.fromEntries([
+            [
+              history.key,
+              stage === 0
+                ? history.initial === `undefined`
+                  ? undefined
+                  : 0
+                : stage === 2
+                  ? undefined
+                  : stage === 1
+                    ? 1
+                    : 2,
+            ],
+          ])),
+    })
+    const source = createCollection(
+      mockSyncCollectionOptions<ReservedFieldRow>({
+        id: `reserved-${history.input}-${history.key}-${history.initial}`,
+        getKey: (row) => row.id,
+        initialData: [sourceRow(0)],
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        const build = (q: InitialQueryBuilder) =>
+          q.from({ row: source }).select(({ row }) => ({ ...row }))
+        return history.input === `collection`
+          ? useLiveQuery(() => source)
+          : history.input === `config`
+            ? useLiveQuery(() => ({ query: build }))
+            : useLiveQuery(build)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(1))
+      const root = query()[0]!
+      const retained: Array<{ row: ReservedFieldRow; stage: number }> = []
+      const admit = (stage: number) => {
+        const row = source.get(`a`)!
+        expect(
+          Object.hasOwn(row, history.key),
+          `Core admitted the authored ownness`,
+        ).toBe(stage !== 3 && (stage !== 0 || history.initial !== `absent`))
+        compareReservedField(
+          row[history.key],
+          expectedReservedField(stage, history.initial, history.key),
+        )
+        retained.push({ row, stage })
+      }
+      admit(0)
+      reach.reach(`initial-source-shape`)
+      let observed: unknown
+      let unchangedReads = 0
+      createRoot((dispose) => {
+        resources.defer(dispose)
+        createRenderEffect(() => {
+          observed = query()[0]![history.key]
+        })
+        createRenderEffect(() => {
+          void query()[0]!.unchanged
+          unchangedReads++
+        })
+      })
+      compareReservedField(
+        observed,
+        expectedReservedField(0, history.initial, history.key),
+      )
+      reach.reach(`tracked-initial`)
+      for (const stage of [1, 2, 3, 4]) {
+        source.utils.begin()
+        source.utils.write({ type: `update`, value: sourceRow(stage) })
+        source.utils.commit()
+        await waitFor(() => expect(query()[0]!.version).toBe(stage))
+        admit(stage)
+        compareReservedField(
+          query()[0]![history.key],
+          expectedReservedField(stage, history.initial, history.key),
+        )
+        compareReservedField(
+          observed,
+          expectedReservedField(stage, history.initial, history.key),
+        )
+        expect(
+          Object.hasOwn(query()[0]!, history.key),
+          `current own user field`,
+        ).toBe(stage !== 3)
+        expect(query()[0]!, `ordinary root identity`).toBe(root)
+        expect(unchangedReads, `unchanged scalar neighbor stays quiet`).toBe(1)
+        for (const saved of retained) {
+          expect(
+            Object.hasOwn(saved.row, history.key),
+            `retained source ownness`,
+          ).toBe(
+            saved.stage !== 3 &&
+              (saved.stage !== 0 || history.initial !== `absent`),
+          )
+          compareReservedField(
+            saved.row[history.key],
+            expectedReservedField(saved.stage, history.initial, history.key),
+          )
+        }
+        reach.reach(
+          stage === 1
+            ? `first-replacement`
+            : stage === 2
+              ? `own-undefined`
+              : stage === 3
+                ? `omission`
+                : `readmission`,
+        )
+        reach.reach(`retained-source`)
+        reach.reach(`quiet-neighbor`)
+      }
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+it.each([...reservedFieldHistories()])(
+  `tracks own $key data through $input initially=$initial`,
+  runReservedFieldHistory,
+)
+declareOracle({
+  model: [expectedReservedField],
+  grammar: [reservedFieldHistories],
+  check: [compareReservedField],
+})
+
+/**
+ * Arrays retain their admitted inherited methods in a Solid listener. The
+ * snapshot owner's array/subclass capability law and ordinary user-field law
+ * compose: an own hasOwnProperty value cannot make map, reduce or a supplied
+ * subclass total method unusable. The model recomputes two scalar elements.
+ * This family judges arrays, not arbitrary class instances or prototype edits.
+ */
+class CallableMethodValues extends Array<number> {
+  total(): number {
+    return this.reduce((sum, value) => sum + value, 0)
+  }
+}
+type MethodHistory = {
+  input: History[`input`]
+  subclass: boolean
+  shape: `ordinary` | `shadow-value` | `shadow-callable`
+}
+type MethodRow = {
+  id: string
+  version: number
+  unchanged: number
+  values: Array<number>
+}
+type MethodObservation = { mapped: Array<number>; total: number }
+function* methodHistories(): Generator<MethodHistory> {
+  for (const input of [`callback`, `config`, `collection`] as const)
+    for (const subclass of [false, true])
+      for (const shape of [
+        `ordinary`,
+        `shadow-value`,
+        `shadow-callable`,
+      ] as const)
+        yield { input, subclass, shape }
+}
+function expectedMethods(version: number): MethodObservation {
+  return { mapped: [version * 2, (version + 1) * 2], total: version * 2 + 1 }
+}
+function compareMethods(actual: MethodObservation, version: number) {
+  expect(
+    actual,
+    `tracked array and subclass methods preserve their scalar result`,
+  ).toEqual(expectedMethods(version))
+}
+async function runMethodHistory(history: MethodHistory) {
+  const reach = createOracleReach(
+    `solid.methods.${history.input}.${history.subclass}.${history.shape}`,
+    [
+      `array-admission`,
+      `tracked-methods`,
+      `array-replacement`,
+      `retained-source`,
+      `quiet-neighbor`,
+    ],
+  )
+  reach.beginHistory()
+  const resources = new ScenarioLifetime()
+  await resources.run(async () => {
+    const shadow = () => false
+    const sourceRow = (version: number): MethodRow => {
+      const values = history.subclass
+        ? CallableMethodValues.from([version, version + 1])
+        : [version, version + 1]
+      if (history.shape !== `ordinary`)
+        Object.defineProperty(values, `hasOwnProperty`, {
+          value: history.shape === `shadow-value` ? 0 : shadow,
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        })
+      return { id: `a`, version, unchanged: 0, values }
+    }
+    const source = createCollection(
+      mockSyncCollectionOptions<MethodRow>({
+        id: `methods-${history.input}-${history.subclass}-${history.shape}`,
+        getKey: (row) => row.id,
+        initialData: [sourceRow(0)],
+        rowUpdateMode: `full`,
+      }),
+    )
+    try {
+      const query = createRoot((dispose) => {
+        resources.defer(dispose)
+        const build = (q: InitialQueryBuilder) =>
+          q.from({ row: source }).select(({ row }) => ({ ...row }))
+        return history.input === `collection`
+          ? useLiveQuery(() => source)
+          : history.input === `config`
+            ? useLiveQuery(() => ({ query: build }))
+            : useLiveQuery(build)
+      })
+      resources.defer(() => query.collection.cleanup())
+      await waitFor(() => expect(query()).toHaveLength(1))
+      const retained: Array<{ row: MethodRow; version: number }> = []
+      const checkFields = (values: Array<number>) => {
+        if (history.shape !== `ordinary`) {
+          expect(
+            Object.hasOwn(values, `hasOwnProperty`),
+            `array keeps user shadow ownness`,
+          ).toBe(true)
+          expect(
+            Reflect.get(values, `hasOwnProperty`),
+            `array keeps user shadow value`,
+          ).toBe(history.shape === `shadow-value` ? 0 : shadow)
+        }
+      }
+      const sourceAdmission = (version: number) => {
+        const row = source.get(`a`)!
+        expect(Array.isArray(row.values), `source admitted an array`).toBe(true)
+        if (history.subclass)
+          expect(
+            typeof Reflect.get(row.values, `total`),
+            `source admitted subclass method`,
+          ).toBe(`function`)
+        checkFields(row.values)
+        retained.push({ row, version })
+      }
+      sourceAdmission(0)
+      reach.reach(`array-admission`)
+      let observed: MethodObservation = { mapped: [], total: 0 }
+      let unchangedReads = 0
+      const readMethods = (values: Array<number>): MethodObservation => {
+        const total: unknown = Reflect.get(values, `total`)
+        return {
+          mapped: [...values.map((value) => value * 2)],
+          total: history.subclass
+            ? Reflect.apply(
+                total as (this: Array<number>) => number,
+                values,
+                [],
+              )
+            : values.reduce((sum, value) => sum + value, 0),
+        }
+      }
+      createRoot((dispose) => {
+        resources.defer(dispose)
+        createRenderEffect(() => {
+          observed = readMethods(query()[0]!.values)
+        })
+        createRenderEffect(() => {
+          void query()[0]!.unchanged
+          unchangedReads++
+        })
+      })
+      compareMethods(observed, 0)
+      reach.reach(`tracked-methods`)
+      for (const version of [1, 2]) {
+        source.utils.begin()
+        source.utils.write({ type: `update`, value: sourceRow(version) })
+        source.utils.commit()
+        await waitFor(() => expect(query()[0]!.version).toBe(version))
+        sourceAdmission(version)
+        compareMethods(observed, version)
+        checkFields(query()[0]!.values)
+        expect(unchangedReads, `unchanged scalar neighbor stays quiet`).toBe(1)
+        for (const saved of retained) {
+          compareMethods(readMethods(saved.row.values), saved.version)
+          checkFields(saved.row.values)
+        }
+        reach.reach(`array-replacement`)
+        reach.reach(`retained-source`)
+        reach.reach(`quiet-neighbor`)
+      }
+    } finally {
+      resources.defer(() => source.cleanup())
+    }
+  })
+  reach.assertReached()
+}
+it.each([...methodHistories()])(
+  `reads inherited methods through $input, subclass=$subclass with $shape`,
+  runMethodHistory,
+)
+declareOracle({
+  model: [expectedMethods],
+  grammar: [methodHistories],
+  check: [compareMethods],
+})
diff --git a/packages/solid-db/tests/useLiveQuery-row-shape.test.tsx b/packages/solid-db/tests/useLiveQuery-row-shape.test.tsx
new file mode 100644
index 0000000000..2cc9e3ae38
--- /dev/null
+++ b/packages/solid-db/tests/useLiveQuery-row-shape.test.tsx
@@ -0,0 +1,91 @@
+import { createCollection } from '@tanstack/db'
+import { createRenderEffect, createRoot } from 'solid-js'
+import { expect, it } from 'vitest'
+import { waitFor } from '@solidjs/testing-library'
+import { useLiveQuery } from '../src/useLiveQuery'
+import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import { ScenarioLifetime } from '../../db/tests/conformance/scenario-lifetime'
+
+type Row = {
+  id: string
+  config: { optional?: undefined }
+  optional?: undefined
+}
+
+// The shared oracle checks complete values. This receiving check observes
+// Solid's enumeration and membership subscriptions when only row shape changes.
+it.each([`root`, `nested`] as const)(
+  `notifies %s row shape subscriptions when an undefined field enters and leaves`,
+  async (location) => {
+    const resources = new ScenarioLifetime()
+    await resources.run(async () => {
+      const collection = createCollection(
+        mockSyncCollectionOptions<Row>({
+          id: `solid-row-shape-${location}`,
+          getKey: (row) => row.id,
+          initialData: [{ id: `a`, config: {} }],
+          rowUpdateMode: `full`,
+        }),
+      )
+      try {
+        const query = createRoot((dispose) => {
+          resources.defer(dispose)
+          return useLiveQuery(() => collection)
+        })
+        await waitFor(() => expect(query()).toHaveLength(1))
+        const row = query()[0]!
+        // The current path is reactive. A replaced source container does not
+        // promise that a separately captured old proxy becomes the new path.
+        const container = () => (location === `root` ? row : row.config)
+        const enumerated: Array<boolean> = []
+        const memberships: Array<boolean> = []
+        createRoot((dispose) => {
+          resources.defer(dispose)
+          createRenderEffect(() => {
+            enumerated.push(Object.keys(container()).includes(`optional`))
+          })
+          createRenderEffect(() => {
+            memberships.push(`optional` in container())
+          })
+        })
+        let publications = 0
+        const subscription = collection.subscribeChanges(
+          (changes) => {
+            publications += changes.length
+          },
+          { includeInitialState: false },
+        )
+        resources.defer(() => subscription.unsubscribe())
+        const write = (next: Row) => {
+          collection.utils.begin()
+          collection.utils.write({ type: `update`, value: next })
+          collection.utils.commit()
+        }
+        const next: Row = { id: `a`, config: {} }
+        if (location === `root`) next.optional = undefined
+        else next.config.optional = undefined
+        write(next)
+        // Core emits even when only own-key presence changes. The hook gets
+        // that source fact; neither subscriber reads a changed scalar value.
+        expect(publications).toBe(1)
+        await waitFor(() => {
+          expect(enumerated).toEqual([false, true])
+          expect(memberships).toEqual([false, true])
+        })
+        expect(Object.hasOwn(container(), `optional`)).toBe(true)
+        expect(container().optional).toBeUndefined()
+
+        write({ id: `a`, config: {} })
+        expect(publications).toBe(2)
+        await waitFor(() => {
+          expect(enumerated).toEqual([false, true, false])
+          expect(memberships).toEqual([false, true, false])
+        })
+        expect(Object.hasOwn(container(), `optional`)).toBe(false)
+        expect(query()[0]).toBe(row)
+      } finally {
+        resources.defer(() => collection.cleanup())
+      }
+    })
+  },
+)
diff --git a/packages/svelte-db/tests/conformance.svelte.test.ts b/packages/svelte-db/tests/conformance.svelte.test.ts
index b9fba2a7a6..d08e7f95e7 100644
--- a/packages/svelte-db/tests/conformance.svelte.test.ts
+++ b/packages/svelte-db/tests/conformance.svelte.test.ts
@@ -56,12 +56,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ): SourceHandle<T> {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-svelte-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)
diff --git a/packages/vue-db/tests/conformance.test.ts b/packages/vue-db/tests/conformance.test.ts
index 1a5e42b4b5..9f14f786c1 100644
--- a/packages/vue-db/tests/conformance.test.ts
+++ b/packages/vue-db/tests/conformance.test.ts
@@ -57,12 +57,14 @@ function writer<T extends { id: string }>(collection: any) {
 function makeSource<T extends { id: string }>(
   initialData: ReadonlyArray<T>,
   collectionId?: string,
+  options?: { rowUpdateMode?: `full` },
 ): SourceHandle<T> {
   const collection = createCollection(
     mockSyncCollectionOptions<T>({
       id: collectionId ?? `conformance-vue-${sourceSeq++}`,
       getKey: (r) => r.id,
       initialData: [...initialData],
+      rowUpdateMode: options?.rowUpdateMode,
     }),
   )
   const write = writer<T>(collection)