@pyric/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/serve/{docs-ui → site-ui}/docs/rules-compat.md

@@ -21,9 +21,9 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">CEL builtins <code>math.<em></code>/<code>timestamp.</em></code>/<code>duration.*</code> (FM3) — arithmetic, date, and duration comparisons in rules</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-builtins-time-and-math</code> — production Firestore Rules Test API verdicts for corpus scenario "builtins-time-and-math", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Bytes</code>, <code>String.toUtf8()</code>, and <code>hashing.{md5,sha256,crc32,crc32c}()</code> (Item 5.3) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-bytes-toutf8-and-hashing</code> — production Firestore Rules Test API verdicts for corpus scenario "bytes-toutf8-and-hashing", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator's toUtf8/md5/sha256/crc32/crc32c byte-encoding and reference-hash implementations diverge from production on all 5 scenario cases, so a rule that should DENY on hash mismatch ALLOWs locally — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Bytes</code>, <code>String.toUtf8()</code>, and <code>hashing.{md5,sha256,crc32,crc32c}()</code> (Item 5.3) in rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-bytes-toutf8-and-hashing</code> — a 2026-07-21 production Firestore Rules Test API recapture supplies 20 verdicts, including paired negative and positive witnesses for padded base64url, the URL-safe alphabet, uppercase hexadecimal MD5/SHA-256, and production's little-endian CRC32/CRC32C byte serialization. <code>unit:rules/oracle-conformance.test.ts</code> replays all verdicts against the local simulator; <code>unit:rules/simulator/wrappers/bytes.test.ts</code> pins the exact representations and reference digests.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Typed cross-type operator overloads for <code>Timestamp</code>/<code>Duration</code> (Item 2) in rules — no silent numeric coercion / type-identity loss</span></span></span></summary>
@@ -33,25 +33,25 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">CEL tri-state error absorption in <code>||</code>/<code>&amp;&amp;</code> (RULES-B3) — <code>error || true</code> → ALLOW, <code>error &amp;&amp; false</code> → DENY, commutative absorption (not JS left-to-right short-circuit)</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-error-absorption-and-or</code> — production Firestore Rules Test API verdicts for corpus scenario "error-absorption-and-or", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>getAfter()</code>/<code>existsAfter()</code> (Item 7) in rules — post-write document identity and existence semantics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-after-and-exists-after</code> — production Firestore Rules Test API verdicts for corpus scenario "get-after-and-exists-after", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator does not model the post-write document identity/existence production compares against on 4 scenario cases (getAfter target identity, existsAfter on create/delete, existsAfter over an unrelated mocked path) — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>getAfter()</code>/<code>existsAfter()</code> expose the projected post-write target and cross-document atomic batch state; create exists, delete does not, and an unrelated unchanged document falls back to its committed existence</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-after-and-exists-after</code> records authenticated Web SDK verdicts against temporarily deployed production rules, including target create/delete and unrelated-path semantics. Its lifecycle proves exact rules release restoration; retained diagnostics document why the hosted Rules Test API was not sufficient. Replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>; <code>get-after.test.ts</code> and <code>get-after-batch.test.ts</code> cover target, sibling-write, solo-write denial, delete, and atomicity locally.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>get()</code> of a missing document (RULES-B8) in rules — resource identity (<code>id</code>/<code>__name__</code>) exposure on a mocked/missing get() result</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-missing-doc</code> — production Firestore Rules Test API verdicts for corpus scenario "get-missing-doc", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator synthesizes a resource identity (<code>id</code>, <code>__name__</code>) for mocked get() results that production leaves absent, on 2 scenario cases — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>get()</code> of a missing document (RULES-B8) in rules — resource identity (<code>id</code>/<code>__name__</code>) exposure on a mocked/missing get() result</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-missing-doc</code> — production Firestore Rules Test API verdicts for corpus scenario "get-missing-doc", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. Serializable <code>functionMocks</code> now retain their production data-only shape, so mocked <code>get()</code> results leave <code>id</code>/<code>__name__</code> absent and both identity reads error to DENY; real DocStore lookups retain their separate identity-bearing path. All 8 cases match production.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>request.path</code>/<code>request.query</code>/<code>resource.id</code>/<code>resource.__name__</code> globals (Item 6) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-globals-request-path-and-resource-id</code> — production Firestore Rules Test API verdicts for corpus scenario "globals-request-path-and-resource-id", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator models <code>request.query</code> as an empty map on the empty-query case where production denies the equivalent comparison — pinned KNOWN_DIVERGENCE. Contamination scope is <code>request.query</code> ALONE: the scenario's <code>request.path</code> cases conform, and its <code>resource.id</code>/<code>resource.__name__</code> cases conform because they run on a <code>create</code> (where <code>resource</code> is null pre-write). Resource identity on an EXISTING document is scoped to firestore-rules#183.</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>request.path</code>/<code>request.query</code>/<code>resource.id</code>/<code>resource.__name__</code> globals (Item 6) in rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-globals-request-path-and-resource-id</code> — production Firestore Rules Test API verdicts for corpus scenario "globals-request-path-and-resource-id", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. <code>request.query</code> is now absent on non-list operations, so reading it on create errors to DENY instead of false-ALLOWing through an invented empty map. <code>request.path</code> and the create-time absent-resource controls remain unchanged; all 6 cases match production. Resource identity on an EXISTING document is scoped to firestore-rules#183.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>int</code>/<code>float</code> division and type distinction (RULES-B5) in rules — truncating int÷int, float division stays float, div-by-zero denies, <code>is int</code>/<code>is float</code> distinct</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-int-float-and-division</code> — production Firestore Rules Test API verdicts for corpus scenario "int-float-and-division", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator narrows a float-valued payload field toward int on the float-payload case, unlike production which preserves the float type — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>int</code>/<code>float</code> division and type distinction (RULES-B5) in rules — truncating int÷int, float division stays float, div-by-zero denies, <code>is int</code>/<code>is float</code> distinct</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-int-float-and-division</code> — production Firestore Rules Test API verdicts for all ten corpus cases, replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>. The simulator now revives non-integral JSON wire numbers as RulesFloat values, preserving production's float payload type while retaining bare integral numbers as ints; <code>unit:rules/simulator/handler.test.ts</code> pins both literal and payload distinctions.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>List.concat()</code>/<code>removeAll()</code>/<code>toSet()</code> (Item 5.2) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-list-methods-concat-removeall-toset</code> — production Firestore Rules Test API verdicts for corpus scenario "list-methods-concat-removeall-toset", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-list-methods-concat-removeall-toset</code> — production Firestore Rules Test API verdicts for all nine cases, replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>. The seven positive List witnesses and the concat DENY witness match; the historical <code>toSet().difference(list)</code> case remains DENY because production requires a Set argument.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Map.get(key, default)</code>, including list-form nested-path traversal (Item 3), in rules</span></span></span></summary>
@@ -61,21 +61,21 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>matches()</code> as an anchored full-string RE2 match (RULES-B4) in rules — a pattern matching only a substring is <code>false</code></span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-matches-full-string-regex</code> — production Firestore Rules Test API verdicts for corpus scenario "matches-full-string-regex", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Path</code> wrapper, <code>path()</code> constructor, and <code>Path.bind()</code> (Item 5.4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-path-constructor-and-bind</code> — production Firestore Rules Test API verdicts for corpus scenario "path-constructor-and-bind", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator treats <code>path()</code> as idempotent on an already-Path argument where production denies — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Path</code> wrapper, <code>path()</code> constructor, and <code>Path.bind()</code> (Item 5.4) in rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-path-constructor-and-bind</code> — production Firestore Rules Test API verdicts for all nine corpus cases in "path-constructor-and-bind", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>, including production's rejection of a Path argument to <code>path()</code>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Own-keys-only map membership and constructor-access denial (RULES-B7) in rules — <code>'toString' in map</code> is <code>false</code>, <code>.constructor</code> access errors (no JS prototype-chain leakage)</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-prototype-chain-keys</code> — production Firestore Rules Test API verdicts for corpus scenario "prototype-chain-keys", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Range-slice <code>[i:j]</code> syntax for <code>List</code> and <code>String</code> (Item 4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-range-slice-list-and-string</code> — production Firestore Rules Test API verdicts for corpus scenario "range-slice-list-and-string", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator clamps an out-of-bounds slice end to the collection length on both the list and string OOB-slice cases; production denies — pinned KNOWN_DIVERGENCE</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Range-slice <code>[i:j]</code> syntax for <code>List</code> and <code>String</code> (Item 4) in rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-range-slice-list-and-string</code> — production Firestore Rules Test API verdicts for all ten corpus cases in "range-slice-list-and-string", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>, including out-of-bounds slice-end rejection for both lists and strings.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Set.difference()</code>/<code>union()</code>/<code>intersection()</code> (Item 5.1) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-set-algebra-difference-union-intersection</code> — production Firestore Rules Test API verdicts for corpus scenario "set-algebra-difference-union-intersection", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-set-algebra-difference-union-intersection</code> captures the receiver and argument boundary in twelve production cases: Map.keys() is a List and rejects Set-only algebra, explicit toSet() receivers ALLOW difference/union/intersection with Set arguments, and a wrong-result control DENIES. The local simulator replays every verdict and the per-construct acceptance probes use the same positive toSet() shapes.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">String-literal escape handling feeding <code>matches()</code> (Class B) in rules — <code>\\.</code> is unescaped before RE2 compilation, not forwarded raw to a JS <code>RegExp</code></span></span></span></summary>
@@ -103,7 +103,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>latlng.value().latitude()/longitude()/distance()</code> and <code>duration.value()/time()/abs()</code> in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 2 cases (coordinate + duration bounds). <code>oracle:rules-firestore-duration-and-latlng</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">Production captures from 2026-07-12 and the 2026-07-21 recapture prove the simulator matches the Firestore Rules Test API verdict-for-verdict on all 3 cases: coordinate and duration bounds plus exact <code>duration.value(1500, 'ms').seconds()</code> / <code>.nanos()</code> components. <code>oracle:rules-firestore-duration-and-latlng</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">User-defined <code>function</code>/<code>let</code>, granular <code>allow get/list/update/write</code> verbs, the ternary operator, and a recursive <code>{document=**}</code> match in rules</span></span></span></summary>
@@ -125,6 +125,18 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Function declarations at GLOBAL and SERVICE scope in a Firestore ruleset, with match-scope shadowing</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): the simulator now seeds the match-tree walk with global- and service-scope function declarations (declaration order global → service → match preserves inner-shadows-outer), so the previously-abstaining cases evaluate. <code>oracle:rules-firestore-global-and-service-scope-functions</code> — production Firestore Rules Test API verdicts captured 2026-07-17 — now replays verdict-for-verdict against the local simulator with all 5 cases matching (shadowing included), asserted by <code>unit:rules/oracle-conformance.test.ts</code>. The prior unsupported row recorded the honest UNSUPPORTED abstention; that gap is closed (#346).</div></div>
 </details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Hierarchical nested <code>match</code> composition — a child match resolves relative to its parent and grants only the exact nested document path</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-hierarchical-match-cascade</code> captures the exact nested child ALLOW plus parent, sibling, and over-deep DENY controls from the production Firestore Rules Test API, replayed verdict-for-verdict by <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Strict boolean operands for <code>&amp;&amp;</code>, <code>||</code>, and ternary control flow, plus create-time <code>resource</code> / <code>request.resource</code> semantics</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-strict-boolean-control-flow</code> captures three direct non-boolean DENYs, three tautological error discriminators that still DENY, a boolean ALLOW control, create-time <code>resource == null</code> DENY, and incoming <code>request.resource.data</code> ALLOW; replayed verdict-for-verdict by <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">The exact six shared <code>auth</code> and <code>membership</code> function bodies preserve signed-in, owner, custom-claim, explicit membership-map, and role semantics under Firestore Rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded, read-only Firestore Rules Test API request captured 12 verdicts for the exact bodies shipped from <code>auth</code> and <code>membership</code>; <code>oracle:rules-firestore-common-auth-membership-firestore</code> matches the local Firestore rules simulator verdict-for-verdict (6 ALLOW, 6 DENY). The cross-service source-lock test requires these six Firestore corpus bodies, the previously captured Storage corpus bodies, and the shipped modules to remain normalized-AST-identical.</div></div>
+</details>
 </div>
 
 ## Storage rules engine — `parseStorageRules` / `evaluateStorageRules` (rules-storage corpus)
@@ -132,11 +144,11 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules(source)</code> returns an opaque handle</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("parses the canonical session-archive ruleset")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("parses the canonical session-archive ruleset")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules</code> rejects non-<code>firebase.storage</code> service headers</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("rejects unknown service header")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("rejects unknown service header")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports granular verbs (<code>get</code>/<code>list</code>/<code>create</code>/<code>update</code>/<code>delete</code>) alongside <code>read</code>/<code>write</code> umbrella expansion, comma-separated verb lists, and per-verb default-deny</span></span></span></summary>
@@ -144,31 +156,31 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules</code> rejects unterminated string literals with <code>SyntaxError</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("rejects unterminated strings")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("rejects unterminated strings")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> matches <code>match /sessions/{id} { allow read: if request.auth != null; }</code> for an authed read</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("allows authenticated reads of /sessions/{id}")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("allows authenticated reads of /sessions/{id}")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> denies anonymous reads when the rule requires <code>request.auth != null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("denies anonymous reads")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("denies anonymous reads")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports <code>request.resource.size &lt; N</code> constraints (with arithmetic literals like <code>10 <em> 1024 </em> 1024</code>)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> ("allows JSON writes under 10MB")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("allows JSON writes under 10MB")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports <code>request.resource.contentType == '&lt;mime&gt;'</code> constraints</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> (mime constraint inside the session-archive ruleset)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> (mime constraint inside the session-archive ruleset)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Multi-segment wildcard <code>{allPaths=**}</code> matches zero-or-more remaining segments</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code> (parser + evaluator both honor the <code>**</code> form)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> (parser + evaluator both honor the <code>**</code> form)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Path-parameter binding (<code>{sessionId}</code>) accessible inside the <code>if</code> expression</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:rules.test.ts</code></div></div>
+<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">User-defined <code>function</code> definitions — <code>let</code> bindings, functions calling functions, and match-block-scoped helper functions (lexical scoping)</span></span></span></summary>
@@ -198,9 +210,9 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>request.resource.size</code> arithmetic bounds (<code>+</code>/<code>-</code>/<code><em></code>/<code>/</code>, <code>&gt;=</code>/<code>&lt;=</code>), request/existing content-type and custom <code>metadata</code> checks, <code>request.method</code>/<code>request.path</code>, a <code>request.auth.token</code> custom-claim branch, granular <code>allow list</code>, and a recursive <code>{allPaths=</em>*}</code> public read tree</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the evaluator matches the production Storage Rules Test API verdict-for-verdict on all 8 cases (owner-scoped size-bounded upload, immutable-content-type update, list grant, public recursive read). <code>oracle:rules-storage-metadata-verbs-and-arithmetic</code> — replayed by <code>packages/pyric/test/storage/rules-oracle-conformance.test.ts</code>.</div></div>
 </details>
-<details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource</code> on a create where no object exists: the create-if-absent guard <code>allow create: if resource == null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">divergence, over-permissive (the evaluator ALLOWs where production DENIEs, the highest-severity direction defined in <code>docs/storage/reference/conformance-gaps.md</code>). <code>oracle:rules-storage-verbs-umbrella-granular</code>, case "create allowed when object does not exist (resource == null)": production DENIES. Production raises a null value error on a <code>resource</code> reference in a create where no object exists, and the errored expression denies, so a <code>create</code> rule guarded by <code>resource == null</code> never allows. The evaluator models <code>resource</code> as null on create, evaluates the comparison as documented, and ALLOWS. Live-probed against production before pinning with both an omitted <code>resource</code> field and an explicit null, which denied identically, ruling out a capture-harness wire-shape bug. Both sides pinned in <code>unit:storage/rules-oracle-conformance.test.ts</code> KNOWN_DIVERGENCES. Same error-value class as the Firestore <code>resource</code> identity on a missing document.</div></div>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource</code> on a create where no object exists: the create-if-absent guard <code>allow create: if resource == null</code></span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production raises a null-value error when <code>resource</code> is referenced on a create where no object exists, including <code>resource == null</code>, so the expression denies. The evaluator now represents the missing binding as a Rules error rather than a usable null. <code>oracle:rules-storage-verbs-umbrella-granular</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Ternary <code>?:</code> — branch selection, error-in-condition deny, and <code>error || true</code> absorption</span></span></span></summary>
@@ -208,7 +220,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>in</code> on list literals (membership) and on maps (OWN-key membership) — prototype names (<code>toString</code>/<code>constructor</code>/<code>hasOwnProperty</code>) are never keys</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves <code>in</code> tests list membership and map OWN keys only — <code>'toString' in metadata</code> is false unless the map literally carries that key, for both custom-metadata maps and map literals. <code>oracle:rules-storage-in-membership-and-proto-keys</code> matches production verdict-for-verdict on all 8 cases. Pre-fix the evaluator used JS <code>in</code>, which walks the prototype chain and false-ALLOWed the proto-key cases (the same bug class the Firestore simulator fixed under RULES-B7); the own-key check now guards it, pinned by <code>unit:rules.test.ts</code> JS-semantics guards.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves <code>in</code> tests list membership and map OWN keys only — <code>'toString' in metadata</code> is false unless the map literally carries that key, for both custom-metadata maps and map literals. <code>oracle:rules-storage-in-membership-and-proto-keys</code> matches production verdict-for-verdict on all 8 cases. Pre-fix the evaluator used JS <code>in</code>, which walks the prototype chain and false-ALLOWed the proto-key cases (the same bug class the Firestore simulator fixed under RULES-B7); the own-key check now guards it, pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>is</code> type tests over the storage bindings (<code>size is int</code>, <code>contentType is string</code>, <code>metadata is map</code>, <code>split() is list</code>) and int/float LITERAL typing (<code>1.0 is float</code>, <code>1 is int</code>, cross checks false)</span></span></span></summary>
@@ -216,7 +228,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">List/map literals, range-slice access <code>[i:j]</code> on lists and strings (out-of-range bounds ERROR, no JS clamp), and structural <code>==</code> on lists</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves slices evaluate on <code>split()</code> lists and on strings, that an out-of-range slice END errors and denies (production does NOT clamp to length the way JS <code>.slice()</code> does — same semantics the Firestore capture pinned in rules-firestore-range-slice-list-and-string), and that a slice compares equal to a list literal structurally. <code>oracle:rules-storage-list-map-literals-and-slice</code> matches production verdict-for-verdict on all 6 cases. Pre-fix the evaluator clamped bounds JS-style and compared lists by reference identity; both fixed and pinned by <code>unit:rules.test.ts</code> JS-semantics guards.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves slices evaluate on <code>split()</code> lists and on strings, that an out-of-range slice END errors and denies (production does NOT clamp to length the way JS <code>.slice()</code> does — same semantics the Firestore capture pinned in rules-firestore-range-slice-list-and-string), and that a slice compares equal to a list literal structurally. <code>oracle:rules-storage-list-map-literals-and-slice</code> matches production verdict-for-verdict on all 6 cases. Pre-fix the evaluator clamped bounds JS-style and compared lists by reference identity; both fixed and pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Float literals, <code>%</code>, unary minus, float division, negative-dividend modulo (<code>-7 % 2 == -1</code>), and TRUNCATING int division (<code>10 / 4 == 2</code>, <code>-7 / 2 == -3</code>)</span></span></span></summary>
@@ -226,6 +238,38 @@
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Function declarations at GLOBAL scope (above <code>service</code>) and SERVICE scope (inside <code>service</code>, outside any match), with inner-shadows-outer resolution</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves production accepts functions declared at global and service scope and resolves a match-scope function over a same-named global (inner shadows outer). <code>oracle:rules-storage-function-scopes-and-shadowing</code> matches production verdict-for-verdict on all 5 cases. The shared grammar previously rejected both placements at parse (PR #333 grammar fix); the storage evaluator attaches global- and service-scope functions to the root match block, which the capture proves is verdict-equivalent to production's scoping for this surface.</div></div>
 </details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>2+modules</code> Storage rules resolve through service-aware contracts: the common <code>auth</code> and <code>membership</code> exports are admitted and retain their production auth, claim, map-membership, and role semantics; Firestore-only helpers are rejected before evaluation</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20; paired proof added 2026-07-21: one targeted production Rules Test API capture proves the exact six bundled function bodies (<code>isAuthenticated</code>, <code>isOwner</code>, <code>hasClaim</code>, <code>hasClaimRole</code>, <code>isMemberOf</code>, <code>hasRole</code>) under <code>firebase.storage</code>, matching the local evaluator verdict-for-verdict on 12 allow/deny cases. <code>oracle:rules-storage-common-auth-membership</code> supplies the Storage answer key; Firestore Rules row #189 independently captures the same exact bodies under <code>cloud.firestore</code> (12 matching verdicts). A separately authored, explicitly reconstructed normalized-AST digest locks the captured Storage corpus bodies, and the source-lock test requires the Firestore corpus and shipped modules to remain AST-identical. Resolver tests separately prove <code>2+modules</code> lowers these imports to plain v2 and fails closed with <code>INCOMPATIBLE_FUNCTION</code> for a Firestore-only export and for a transitive helper that reads <code>resource.data</code>; the Storage service integration test proves normal setup invokes that checked resolver.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Storage-native upload primitives at security boundaries: inclusive byte maximums, exact and whole-string MIME checks, metadata-only updates with unchanged bytes/owner, string path wildcards, generation/metageneration identity, and strict creation-time windows</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20: <code>oracle:rules-storage-upload-primitives-boundaries</code> captures 26 production cases in one Rules Test API request. The local evaluator matches every case scoped to this row: size 0/exact/+1, MIME exact/case/parameter and regex anchoring, metadata update invariants, filename wildcard typing, exact/absent generation identity, and request.time just before/at/after a strict 60-second boundary plus a future timeCreated fixture. Metadata collection methods and missing request.resource are separated into divergence rows #127/#128 rather than contaminating this credit.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Storage custom-metadata collection methods: <code>Map.keys().hasAll()</code> for required-key policy and <code>Map.get(key, default)</code> for an absent key</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: the Storage evaluator now implements own-key <code>Map.keys()</code>, structural <code>hasAll()</code>, and string-key <code>Map.get(key, default)</code>. <code>oracle:rules-storage-upload-primitives-boundaries</code> replays the production required-key and absent-key-default cases directly with no divergence pin; public-seam unit cases cover both admitted forms.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>request.resource</code> on delete where no incoming object exists: <code>request.resource == null</code></span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production errors when <code>request.resource</code> is absent on delete, including a direct null comparison. The evaluator now carries the absent incoming binding as a Rules error. <code>oracle:rules-storage-upload-primitives-boundaries</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam.</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Mocked Storage-to-Firestore lookup evaluation: get/exists return and missing-field errors, repeated and same-resolved-path calls, get+exists composition, and lazy <code>||</code>/<code>&amp;&amp;</code>/ternary branches with hosted function-call diagnostics</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <code>oracle:rules-storage-firestore-lookup-budget</code> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Anonymous <code>request.auth != null</code> used as a ternary condition before a cross-service lookup</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: anonymous <code>request.auth</code> is now represented as an absent-property Rules error, so a ternary condition denies before selecting either lookup branch, matching hosted diagnostics. <code>oracle:rules-storage-firestore-lookup-budget</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-methods.test.ts</code> covers the lookup evaluator seam.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Real-resource Storage-to-Firestore contract: at most two distinct document paths per evaluation with repeated-path caching; typed document data and missing-document errors; default-database-only and owning-project isolation; lazy/helper/let composition; and independence from Firestore client rules</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: four deploy-observe-restore captures establish the real-resource contract beyond Rules Test API mocks: <code>oracle:stdlib-realstorage-p3-lookup-budget-iam-enabled</code>, <code>oracle:stdlib-realstorage-p3-advanced-iam-enabled</code>, <code>oracle:stdlib-realstorage-p3-named-database</code>, and <code>oracle:stdlib-realstorage-p3-project-isolation</code>. <code>unit:conformance/storage-stdlib-real-replay.test.ts</code> executes the locally decidable lookup matrices and locks reviewed reconstructions of their normalized probe code; the lock records state whether the digest covers an injected block or a canonical synthetic wrapper. The surrounding deployed base rules were not retained, so no full-source digest is claimed for these historical captures. Future rigs emit both probe-block and full deployed-rules-file digests. <code>unit:storage/enforce.test.ts</code> proves the normal enforcement seam reads only its owning sandbox and bypasses Firestore client rules. The separate consistency capture remains bounded characterization and is not promoted into a latency guarantee.</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">The service-scoped <code>storage/uploads</code>, <code>storage/metadata</code>, <code>storage/objects</code>, and <code>storage/time</code> modules resolve through <code>2+modules</code> and preserve their production upload-bound, MIME, metadata, operation-identity, and strict timestamp-window semantics</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded Rules Test API batch captures 15 verdicts for the exact 13 deployable function bodies in the four shipped modules (<code>oracle:rules-storage-stdlib-storage-modules</code>). A separately authored, explicitly reconstructed normalized-AST digest locks the captured corpus bodies, and the source-lock test requires the shipped modules to remain AST-identical. The generic Storage stdlib fixture runner and oracle replay execute those bodies locally; resolver tests prove the modules are admitted only for <code>firebase.storage</code>, lower to plain v2, and fail closed under Firestore. The module surface intentionally excludes the advanced integrity, metadata-diff, and cross-service lookup candidates.</div></div>
+</details>
 </div>
 
 ## RTDB rules engine — production simulator conformance (rules-rtdb corpus)
@@ -300,20 +344,6 @@
 Known differences between Pyric and production Firebase. Each remains tracked as a non-conforming row.
 
 <div class="compat-list">
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Bytes</code>, <code>String.toUtf8()</code>, and <code>hashing.{md5,sha256,crc32,crc32c}()</code> (Item 5.3) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-bytes-toutf8-and-hashing</code> — production Firestore Rules Test API verdicts for corpus scenario "bytes-toutf8-and-hashing", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator's toUtf8/md5/sha256/crc32/crc32c byte-encoding and reference-hash implementations diverge from production on all 5 scenario cases, so a rule that should DENY on hash mismatch ALLOWs locally — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>getAfter()</code>/<code>existsAfter()</code> (Item 7) in rules — post-write document identity and existence semantics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-get-after-and-exists-after</code> — production Firestore Rules Test API verdicts for corpus scenario "get-after-and-exists-after", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator does not model the post-write document identity/existence production compares against on 4 scenario cases (getAfter target identity, existsAfter on create/delete, existsAfter over an unrelated mocked path) — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>get()</code> of a missing document (RULES-B8) in rules — resource identity (<code>id</code>/<code>__name__</code>) exposure on a mocked/missing get() result</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-get-missing-doc</code> — production Firestore Rules Test API verdicts for corpus scenario "get-missing-doc", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator synthesizes a resource identity (<code>id</code>, <code>__name__</code>) for mocked get() results that production leaves absent, on 2 scenario cases — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>request.path</code>/<code>request.query</code>/<code>resource.id</code>/<code>resource.__name__</code> globals (Item 6) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-globals-request-path-and-resource-id</code> — production Firestore Rules Test API verdicts for corpus scenario "globals-request-path-and-resource-id", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator models <code>request.query</code> as an empty map on the empty-query case where production denies the equivalent comparison — pinned KNOWN_DIVERGENCE. Contamination scope is <code>request.query</code> ALONE: the scenario's <code>request.path</code> cases conform, and its <code>resource.id</code>/<code>resource.__name__</code> cases conform because they run on a <code>create</code> (where <code>resource</code> is null pre-write). Resource identity on an EXISTING document is scoped to firestore-rules#183.</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>int</code>/<code>float</code> division and type distinction (RULES-B5) in rules — truncating int÷int, float division stays float, div-by-zero denies, <code>is int</code>/<code>is float</code> distinct</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-int-float-and-division</code> — production Firestore Rules Test API verdicts for corpus scenario "int-float-and-division", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator narrows a float-valued payload field toward int on the float-payload case, unlike production which preserves the float type — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Path</code> wrapper, <code>path()</code> constructor, and <code>Path.bind()</code> (Item 5.4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-path-constructor-and-bind</code> — production Firestore Rules Test API verdicts for corpus scenario "path-constructor-and-bind", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator treats <code>path()</code> as idempotent on an already-Path argument where production denies — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Range-slice <code>[i:j]</code> syntax for <code>List</code> and <code>String</code> (Item 4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><code>oracle:rules-firestore-range-slice-list-and-string</code> — production Firestore Rules Test API verdicts for corpus scenario "range-slice-list-and-string", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. simulator clamps an out-of-bounds slice end to the collection length on both the list and string OOB-slice cases; production denies — pinned KNOWN_DIVERGENCE</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource</code> on a create where no object exists: the create-if-absent guard <code>allow create: if resource == null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">divergence, over-permissive (the evaluator ALLOWs where production DENIEs, the highest-severity direction defined in <code>docs/storage/reference/conformance-gaps.md</code>). <code>oracle:rules-storage-verbs-umbrella-granular</code>, case "create allowed when object does not exist (resource == null)": production DENIES. Production raises a null value error on a <code>resource</code> reference in a create where no object exists, and the errored expression denies, so a <code>create</code> rule guarded by <code>resource == null</code> never allows. The evaluator models <code>resource</code> as null on create, evaluates the comparison as documented, and ALLOWS. Live-probed against production before pinning with both an omitted <code>resource</code> field and an explicit null, which denied identically, ruling out a capture-harness wire-shape bug. Both sides pinned in <code>unit:storage/rules-oracle-conformance.test.ts</code> KNOWN_DIVERGENCES. Same error-value class as the Firestore <code>resource</code> identity on a missing document.</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Mocked Storage-to-Firestore lookup evaluation: get/exists return and missing-field errors, repeated and same-resolved-path calls, get+exists composition, and lazy <code>||</code>/<code>&amp;&amp;</code>/ternary branches with hosted function-call diagnostics</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <code>oracle:rules-storage-firestore-lookup-budget</code> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit.</div></div></details>
 </div>