@pyric/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/dist/serve/site-ui/docs/rules-compat.md

@@ -19,123 +19,131 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">CEL builtins <code>math.<em></code>/<code>timestamp.</em></code>/<code>duration.*</code> (FM3) — arithmetic, date, and duration comparisons in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-builtins-time-and-math</code> — production Firestore Rules Test API verdicts for corpus scenario "builtins-time-and-math", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-builtins-time-and-math.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-builtins-time-and-math</code></a> — production Firestore Rules Test API verdicts for corpus scenario "builtins-time-and-math", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L55" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Bytes</code>, <code>String.toUtf8()</code>, and <code>hashing.{md5,sha256,crc32,crc32c}()</code> (Item 5.3) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-bytes-toutf8-and-hashing</code> — a 2026-07-21 production Firestore Rules Test API recapture supplies 20 verdicts, including paired negative and positive witnesses for padded base64url, the URL-safe alphabet, uppercase hexadecimal MD5/SHA-256, and production's little-endian CRC32/CRC32C byte serialization. <code>unit:rules/oracle-conformance.test.ts</code> replays all verdicts against the local simulator; <code>unit:rules/simulator/wrappers/bytes.test.ts</code> pins the exact representations and reference digests.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-bytes-toutf8-and-hashing.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-bytes-toutf8-and-hashing</code></a> — a 2026-07-21 production Firestore Rules Test API recapture supplies 20 verdicts, including paired negative and positive witnesses for padded base64url, the URL-safe alphabet, uppercase hexadecimal MD5/SHA-256, and production's little-endian CRC32/CRC32C byte serialization. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a> replays all verdicts against the local simulator; <code>unit:rules/simulator/wrappers/bytes.test.ts</code> pins the exact representations and reference digests.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Typed cross-type operator overloads for <code>Timestamp</code>/<code>Duration</code> (Item 2) in rules — no silent numeric coercion / type-identity loss</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-cross-type-operator-overloads</code> — production Firestore Rules Test API verdicts for corpus scenario "cross-type-operator-overloads", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-cross-type-operator-overloads.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-cross-type-operator-overloads</code></a> — production Firestore Rules Test API verdicts for corpus scenario "cross-type-operator-overloads", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">CEL tri-state error absorption in <code>||</code>/<code>&amp;&amp;</code> (RULES-B3) — <code>error || true</code> → ALLOW, <code>error &amp;&amp; false</code> → DENY, commutative absorption (not JS left-to-right short-circuit)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-error-absorption-and-or</code> — production Firestore Rules Test API verdicts for corpus scenario "error-absorption-and-or", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-error-absorption-and-or.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-error-absorption-and-or</code></a> — production Firestore Rules Test API verdicts for corpus scenario "error-absorption-and-or", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>getAfter()</code>/<code>existsAfter()</code> expose the projected post-write target and cross-document atomic batch state; create exists, delete does not, and an unrelated unchanged document falls back to its committed existence</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-after-and-exists-after</code> records authenticated Web SDK verdicts against temporarily deployed production rules, including target create/delete and unrelated-path semantics. Its lifecycle proves exact rules release restoration; retained diagnostics document why the hosted Rules Test API was not sufficient. Replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>; <code>get-after.test.ts</code> and <code>get-after-batch.test.ts</code> cover target, sibling-write, solo-write denial, delete, and atomicity locally.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-get-after-and-exists-after.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-get-after-and-exists-after</code></a> records authenticated Web SDK verdicts against temporarily deployed production rules, including target create/delete and unrelated-path semantics. Its lifecycle proves exact rules release restoration; retained diagnostics document why the hosted Rules Test API was not sufficient. Replayed verdict-for-verdict by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/get-after.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>get-after.test.ts</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/get-after-batch.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>get-after-batch.test.ts</code></a> cover target, sibling-write, solo-write denial, delete, and atomicity locally.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>get()</code> of a missing document (RULES-B8) in rules — resource identity (<code>id</code>/<code>__name__</code>) exposure on a mocked/missing get() result</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-get-missing-doc</code> — production Firestore Rules Test API verdicts for corpus scenario "get-missing-doc", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. Serializable <code>functionMocks</code> now retain their production data-only shape, so mocked <code>get()</code> results leave <code>id</code>/<code>__name__</code> absent and both identity reads error to DENY; real DocStore lookups retain their separate identity-bearing path. All 8 cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-get-missing-doc.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-get-missing-doc</code></a> — production Firestore Rules Test API verdicts for corpus scenario "get-missing-doc", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>. Serializable <code>functionMocks</code> now retain their production data-only shape, so mocked <code>get()</code> results leave <code>id</code>/<code>__name__</code> absent and both identity reads error to DENY; real DocStore lookups retain their separate identity-bearing path. All 8 cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>request.path</code>/<code>request.query</code>/<code>resource.id</code>/<code>resource.__name__</code> globals (Item 6) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-globals-request-path-and-resource-id</code> — production Firestore Rules Test API verdicts for corpus scenario "globals-request-path-and-resource-id", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>. <code>request.query</code> is now absent on non-list operations, so reading it on create errors to DENY instead of false-ALLOWing through an invented empty map. <code>request.path</code> and the create-time absent-resource controls remain unchanged; all 6 cases match production. Resource identity on an EXISTING document is scoped to firestore-rules#183.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-globals-request-path-and-resource-id.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-globals-request-path-and-resource-id</code></a> — production Firestore Rules Test API verdicts for corpus scenario "globals-request-path-and-resource-id", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>. <code>request.query</code> is now absent on non-list operations, so reading it on create errors to DENY instead of false-ALLOWing through an invented empty map. <code>request.path</code> and the create-time absent-resource controls remain unchanged; all 6 cases match production. Resource identity on an EXISTING document is scoped to firestore-rules#183.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>int</code>/<code>float</code> division and type distinction (RULES-B5) in rules — truncating int÷int, float division stays float, div-by-zero denies, <code>is int</code>/<code>is float</code> distinct</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-int-float-and-division</code> — production Firestore Rules Test API verdicts for all ten corpus cases, replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>. The simulator now revives non-integral JSON wire numbers as RulesFloat values, preserving production's float payload type while retaining bare integral numbers as ints; <code>unit:rules/simulator/handler.test.ts</code> pins both literal and payload distinctions.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-int-float-and-division.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-int-float-and-division</code></a> — production Firestore Rules Test API verdicts for all ten corpus cases, replayed verdict-for-verdict by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>. The simulator now revives non-integral JSON wire numbers as RulesFloat values, preserving production's float payload type while retaining bare integral numbers as ints; <code>unit:rules/simulator/handler.test.ts</code> pins both literal and payload distinctions.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>List.concat()</code>/<code>removeAll()</code>/<code>toSet()</code> (Item 5.2) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-list-methods-concat-removeall-toset</code> — production Firestore Rules Test API verdicts for all nine cases, replayed verdict-for-verdict by <code>unit:rules/oracle-conformance.test.ts</code>. The seven positive List witnesses and the concat DENY witness match; the historical <code>toSet().difference(list)</code> case remains DENY because production requires a Set argument.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-list-methods-concat-removeall-toset.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-list-methods-concat-removeall-toset</code></a> — production Firestore Rules Test API verdicts for all nine cases, replayed verdict-for-verdict by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>. The seven positive List witnesses and the concat DENY witness match; the historical <code>toSet().difference(list)</code> case remains DENY because production requires a Set argument.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Map.get(key, default)</code>, including list-form nested-path traversal (Item 3), in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-map-get-string-and-list-form</code> — production Firestore Rules Test API verdicts for corpus scenario "map-get-string-and-list-form", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-map-get-string-and-list-form.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-map-get-string-and-list-form</code></a> — production Firestore Rules Test API verdicts for corpus scenario "map-get-string-and-list-form", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>matches()</code> as an anchored full-string RE2 match (RULES-B4) in rules — a pattern matching only a substring is <code>false</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-matches-full-string-regex</code> — production Firestore Rules Test API verdicts for corpus scenario "matches-full-string-regex", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-matches-full-string-regex.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-matches-full-string-regex</code></a> — production Firestore Rules Test API verdicts for corpus scenario "matches-full-string-regex", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Path</code> wrapper, <code>path()</code> constructor, and <code>Path.bind()</code> (Item 5.4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-path-constructor-and-bind</code> — production Firestore Rules Test API verdicts for all nine corpus cases in "path-constructor-and-bind", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>, including production's rejection of a Path argument to <code>path()</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-path-constructor-and-bind.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-path-constructor-and-bind</code></a> — production Firestore Rules Test API verdicts for all nine corpus cases in "path-constructor-and-bind", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>, including production's rejection of a Path argument to <code>path()</code>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Own-keys-only map membership and constructor-access denial (RULES-B7) in rules — <code>'toString' in map</code> is <code>false</code>, <code>.constructor</code> access errors (no JS prototype-chain leakage)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-prototype-chain-keys</code> — production Firestore Rules Test API verdicts for corpus scenario "prototype-chain-keys", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-prototype-chain-keys.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-prototype-chain-keys</code></a> — production Firestore Rules Test API verdicts for corpus scenario "prototype-chain-keys", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Range-slice <code>[i:j]</code> syntax for <code>List</code> and <code>String</code> (Item 4) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-range-slice-list-and-string</code> — production Firestore Rules Test API verdicts for all ten corpus cases in "range-slice-list-and-string", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>, including out-of-bounds slice-end rejection for both lists and strings.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-range-slice-list-and-string.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-range-slice-list-and-string</code></a> — production Firestore Rules Test API verdicts for all ten corpus cases in "range-slice-list-and-string", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>, including out-of-bounds slice-end rejection for both lists and strings.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>Set.difference()</code>/<code>union()</code>/<code>intersection()</code> (Item 5.1) in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-set-algebra-difference-union-intersection</code> captures the receiver and argument boundary in twelve production cases: Map.keys() is a List and rejects Set-only algebra, explicit toSet() receivers ALLOW difference/union/intersection with Set arguments, and a wrong-result control DENIES. The local simulator replays every verdict and the per-construct acceptance probes use the same positive toSet() shapes.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-set-algebra-difference-union-intersection.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-set-algebra-difference-union-intersection</code></a> captures the receiver and argument boundary in twelve production cases: Map.keys() is a List and rejects Set-only algebra, explicit toSet() receivers ALLOW difference/union/intersection with Set arguments, and a wrong-result control DENIES. The local simulator replays every verdict and the per-construct acceptance probes use the same positive toSet() shapes. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">String-literal escape handling feeding <code>matches()</code> (Class B) in rules — <code>\\.</code> is unescaped before RE2 compilation, not forwarded raw to a JS <code>RegExp</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-string-literals-and-regex</code> — production Firestore Rules Test API verdicts for corpus scenario "string-literals-and-regex", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-string-literals-and-regex.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-string-literals-and-regex</code></a> — production Firestore Rules Test API verdicts for corpus scenario "string-literals-and-regex", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Missing-field access as a runtime error (RULES-B2) in rules — <code>typo == null</code> denies (missing access is not null); <code>!(key in map)</code> is the real absence check</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-undefined-field-access</code> — production Firestore Rules Test API verdicts for corpus scenario "undefined-field-access", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-undefined-field-access.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-undefined-field-access</code></a> — production Firestore Rules Test API verdicts for corpus scenario "undefined-field-access", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Explicit <code>UNSUPPORTED</code> reporting for unimplemented built-ins (Item 0.A) in rules — an unimplemented built-in abstains rather than silently DENYing</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-unsupported-feature-witness</code> — production Firestore Rules Test API verdicts for corpus scenario "unsupported-feature-witness", replayed verdict-for-verdict against the local rules simulator by <code>unit:rules/oracle-conformance.test.ts</code>; all cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-unsupported-feature-witness.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-unsupported-feature-witness</code></a> — production Firestore Rules Test API verdicts for corpus scenario "unsupported-feature-witness", replayed verdict-for-verdict against the local rules simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>; all cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Required-fields validation idiom in rules — <code>request.resource.data.keys().hasAll()/hasOnly()</code> and the <code>diff().addedKeys()/removedKeys()/changedKeys()/affectedKeys()/unchangedKeys()</code> MapDiff family gating field-level mutations</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 7 cases (exact required-field set on create, field-scoped update via MapDiff). <code>oracle:rules-firestore-required-fields-and-mapdiff</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 7 cases (exact required-field set on create, field-scoped update via MapDiff). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-required-fields-and-mapdiff.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-required-fields-and-mapdiff</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>String.split()/lower()/upper()/trim()/replace()/size()</code>, <code>List.hasAll()/hasAny()/hasOnly()/join()</code>, and <code>Map.values()</code> in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 4 cases (CSV-split membership, slug/title/code normalization). <code>oracle:rules-firestore-list-and-string-methods</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 4 cases (CSV-split membership, slug/title/code normalization). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-list-and-string-methods.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-list-and-string-methods</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>request.time</code> Timestamp accessors (year/month/day/hours/minutes/seconds/nanos/dayOfWeek/dayOfYear/toMillis/date/time), <code>math.floor/round/sqrt/pow/isNaN</code>, <code>int()/float()/string()</code> casts, <code>request.method</code>, and <code>&gt;=</code> / <code>*</code> operators in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 3 cases (request.time pinned via requestTime for determinism). <code>oracle:rules-firestore-time-math-and-casts</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 3 cases (request.time pinned via requestTime for determinism). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-time-math-and-casts.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-time-math-and-casts</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L24" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>latlng.value().latitude()/longitude()/distance()</code> and <code>duration.value()/time()/abs()</code> in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Production captures from 2026-07-12 and the 2026-07-21 recapture prove the simulator matches the Firestore Rules Test API verdict-for-verdict on all 3 cases: coordinate and duration bounds plus exact <code>duration.value(1500, 'ms').seconds()</code> / <code>.nanos()</code> components. <code>oracle:rules-firestore-duration-and-latlng</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">Production captures from 2026-07-12 and the 2026-07-21 recapture prove the simulator matches the Firestore Rules Test API verdict-for-verdict on all 3 cases: coordinate and duration bounds plus exact <code>duration.value(1500, 'ms').seconds()</code> / <code>.nanos()</code> components. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-duration-and-latlng.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-duration-and-latlng</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">User-defined <code>function</code>/<code>let</code>, granular <code>allow get/list/update/write</code> verbs, the ternary operator, and a recursive <code>{document=**}</code> match in rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 7 cases (role-gated docs + public recursive subtree). <code>oracle:rules-firestore-functions-verbs-and-recursive</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 7 cases (role-gated docs + public recursive subtree). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-functions-verbs-and-recursive.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-functions-verbs-and-recursive</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L33" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Resource identity (<code>resource.id</code>/<code>resource.__name__</code>/<code>request.resource.id</code>) on an EXISTING document (RULES-B12) — production leaves the identity keys ABSENT, so reading one errors → DENY, the error survives negation, and only a determining <code>||</code> operand absorbs it</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 13 cases. Production builds <code>resource</code> (and <code>request.resource</code>) from the supplied document alone and derives NO identity from the request path, so <code>resource.id</code>/<code>resource.__name__</code>/<code>request.resource.id</code> read as absent properties — verbatim <code>Property id is undefined on object.</code> / <code>Property __name__ is undefined on object.</code> — which absorb to DENY. The simulator previously SYNTHESIZED <code>id</code>/<code>__name__</code> from the request path on get/list/update/delete, so <code>resource.id == id</code> ALLOWed where production DENIES: an over-permissive divergence, now removed. The negation cases (<code>resource.id != 'zzz'</code>, <code>!(resource.id == 'zzz')</code>) pin that the absent read is a propagating error rather than a false, which an absent-as-undefined model would false-ALLOW. <code>oracle:rules-firestore-resource-document-identity</code> — replayed by <code>unit:rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the production Firestore Rules Test API verdict-for-verdict on all 13 cases. Production builds <code>resource</code> (and <code>request.resource</code>) from the supplied document alone and derives NO identity from the request path, so <code>resource.id</code>/<code>resource.__name__</code>/<code>request.resource.id</code> read as absent properties — verbatim <code>Property id is undefined on object.</code> / <code>Property __name__ is undefined on object.</code> — which absorb to DENY. The simulator previously SYNTHESIZED <code>id</code>/<code>__name__</code> from the request path on get/list/update/delete, so <code>resource.id == id</code> ALLOWed where production DENIES: an over-permissive divergence, now removed. The negation cases (<code>resource.id != 'zzz'</code>, <code>!(resource.id == 'zzz')</code>) pin that the absent read is a propagating error rather than a false, which an absent-as-undefined model would false-ALLOW. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-resource-document-identity.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-resource-document-identity</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Request-target <code>resource</code> on a missing document (RULES-B13) — get/update/delete existence guards, null comparison, and data access all error to DENY</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the Firestore Rules Test API verdict-for-verdict on all 9 cases. A missing request target makes the <code>resource</code> global an error value: <code>resource != null</code>, <code>resource == null</code>, and <code>resource.data.value</code> all DENY. The simulator previously constructed <code>{ data: {} }</code> for missing get/update/delete requests, so the ordinary <code>resource != null</code> existence guard false-ALLOWed all three operations. Modeling the target as raw null fixes that guard but makes <code>resource == null</code> false-ALLOW, so the evaluator now raises <code>Null value error.</code> when the absent <code>resource</code> identifier itself is evaluated. Existing-document get/update/delete and data-access controls still ALLOW. <code>oracle:rules-firestore-resource-missing-document</code> — replayed by <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator matches the Firestore Rules Test API verdict-for-verdict on all 9 cases. A missing request target makes the <code>resource</code> global an error value: <code>resource != null</code>, <code>resource == null</code>, and <code>resource.data.value</code> all DENY. The simulator previously constructed <code>{ data: {} }</code> for missing get/update/delete requests, so the ordinary <code>resource != null</code> existence guard false-ALLOWed all three operations. Modeling the target as raw null fixes that guard but makes <code>resource == null</code> false-ALLOW, so the evaluator now raises <code>Null value error.</code> when the absent <code>resource</code> identifier itself is evaluated. Existing-document get/update/delete and data-access controls still ALLOW. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-resource-missing-document.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-resource-missing-document</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">A ruleset with NO <code>rules_version</code> declaration — production accepts it and defaults to v1</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves a version-less ruleset deploys and evaluates (production defaults <code>rules_version</code> to v1; the shared grammar previously rejected the file at parse — PR #333 grammar fix, the same evidence that reclassified corpus file 001-missing-version.rules from invalid to edge-cases). <code>oracle:rules-firestore-optional-rules-version</code> matches the local simulator verdict-for-verdict on all 3 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves a version-less ruleset deploys and evaluates (production defaults <code>rules_version</code> to v1; the shared grammar previously rejected the file at parse — PR #333 grammar fix, the same evidence that reclassified corpus file 001-missing-version.rules from invalid to edge-cases). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-optional-rules-version.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-optional-rules-version</code></a> matches the local simulator verdict-for-verdict on all 3 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Function declarations at GLOBAL and SERVICE scope in a Firestore ruleset, with match-scope shadowing</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): the simulator now seeds the match-tree walk with global- and service-scope function declarations (declaration order global → service → match preserves inner-shadows-outer), so the previously-abstaining cases evaluate. <code>oracle:rules-firestore-global-and-service-scope-functions</code> — production Firestore Rules Test API verdicts captured 2026-07-17 — now replays verdict-for-verdict against the local simulator with all 5 cases matching (shadowing included), asserted by <code>unit:rules/oracle-conformance.test.ts</code>. The prior unsupported row recorded the honest UNSUPPORTED abstention; that gap is closed (#346).</div></div>
+<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): the simulator now seeds the match-tree walk with global- and service-scope function declarations (declaration order global → service → match preserves inner-shadows-outer), so the previously-abstaining cases evaluate. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-global-and-service-scope-functions.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-global-and-service-scope-functions</code></a> — production Firestore Rules Test API verdicts captured 2026-07-17 — now replays verdict-for-verdict against the local simulator with all 5 cases matching (shadowing included), asserted by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/oracle-conformance.test.ts</code></a>. The prior unsupported row recorded the honest UNSUPPORTED abstention; that gap is closed (#346).</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Hierarchical nested <code>match</code> composition — a child match resolves relative to its parent and grants only the exact nested document path</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-hierarchical-match-cascade</code> captures the exact nested child ALLOW plus parent, sibling, and over-deep DENY controls from the production Firestore Rules Test API, replayed verdict-for-verdict by <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-hierarchical-match-cascade.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-hierarchical-match-cascade</code></a> captures the exact nested child ALLOW plus parent, sibling, and over-deep DENY controls from the production Firestore Rules Test API, replayed verdict-for-verdict by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Strict boolean operands for <code>&amp;&amp;</code>, <code>||</code>, and ternary control flow, plus create-time <code>resource</code> / <code>request.resource</code> semantics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-firestore-strict-boolean-control-flow</code> captures three direct non-boolean DENYs, three tautological error discriminators that still DENY, a boolean ALLOW control, create-time <code>resource == null</code> DENY, and incoming <code>request.resource.data</code> ALLOW; replayed verdict-for-verdict by <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-strict-boolean-control-flow.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-strict-boolean-control-flow</code></a> captures three direct non-boolean DENYs, three tautological error discriminators that still DENY, a boolean ALLOW control, create-time <code>resource == null</code> DENY, and incoming <code>request.resource.data</code> ALLOW; replayed verdict-for-verdict by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/rules/oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">The exact six shared <code>auth</code> and <code>membership</code> function bodies preserve signed-in, owner, custom-claim, explicit membership-map, and role semantics under Firestore Rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded, read-only Firestore Rules Test API request captured 12 verdicts for the exact bodies shipped from <code>auth</code> and <code>membership</code>; <code>oracle:rules-firestore-common-auth-membership-firestore</code> matches the local Firestore rules simulator verdict-for-verdict (6 ALLOW, 6 DENY). The cross-service source-lock test requires these six Firestore corpus bodies, the previously captured Storage corpus bodies, and the shipped modules to remain normalized-AST-identical.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded, read-only Firestore Rules Test API request captured 12 verdicts for the exact bodies shipped from <code>auth</code> and <code>membership</code>; <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-common-auth-membership-firestore.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-firestore-common-auth-membership-firestore</code></a> matches the local Firestore rules simulator verdict-for-verdict (6 ALLOW, 6 DENY). The cross-service source-lock test requires these six Firestore corpus bodies, the previously captured Storage corpus bodies, and the shipped modules to remain normalized-AST-identical. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">In multi-document batched writes and transactions, getAfter() deep-merges incoming updates with pre-existing sibling document state, preserving unmodified fields; updates targeting non-existent siblings project to null so existsAfter() returns false.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Captured production behavior via rules-firestore-atomic-batch-sibling-merge proves getAfter() evaluates against deep-merged sibling state during multi-document atomic updates. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-atomic-batch-sibling-merge.json" target="_blank" rel="noopener noreferrer"><code>rules-firestore-atomic-batch-sibling-merge</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/get-after-batch.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>get-after-batch.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Compile-time AST verification rejects non-conforming casts (bool()), unsupported helper methods (debug(), math.isInfinite()), and bare Map membership assertions (map.hasAll/hasAny/hasOnly).</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Captured production behavior via rules-firestore-ast-strictness-and-unsupported-casts proves compile-time AST verification and execution rejection of bool(), math.isInfinite(), debug(), and bare Map membership assertions. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore-rules/rules-firestore-ast-strictness-and-unsupported-casts.json" target="_blank" rel="noopener noreferrer"><code>rules-firestore-ast-strictness-and-unsupported-casts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/oracle-conformance.test.ts#L55" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/linter/hallucinations.test.ts#L137" target="_blank" rel="noopener noreferrer"><code>hallucinations.test.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -144,131 +152,131 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules(source)</code> returns an opaque handle</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("parses the canonical session-archive ruleset")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules.test.ts</code></a> ("parses the canonical session-archive ruleset")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules</code> rejects non-<code>firebase.storage</code> service headers</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("rejects unknown service header")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules.test.ts</code></a> ("rejects unknown service header")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports granular verbs (<code>get</code>/<code>list</code>/<code>create</code>/<code>update</code>/<code>delete</code>) alongside <code>read</code>/<code>write</code> umbrella expansion, comma-separated verb lists, and per-verb default-deny</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">STALE ROW, corrected 2026-07-10: production capture proves the evaluator already supports the full six-verb grant surface (umbrella read→{get,list}, write→{create,update,delete}, single granular grants, comma-separated grants, per-verb deny-by-default), matching production verdict-for-verdict on 12 of the scenario's 13 non-existence cases. <code>oracle:rules-storage-verbs-umbrella-granular</code> (all <code>read</code>/<code>write</code>/<code>get</code>/comma-verb cases). One related existence-semantics case in the same scenario diverges over-permissively and is carried by <code>#118 Rules</code> (the <code>resource == null</code> create-if-absent guard), not by this granular-verb row.</div></div>
+<div class="compat-evidence"><div class="compat-probe">STALE ROW, corrected 2026-07-10: production capture proves the evaluator already supports the full six-verb grant surface (umbrella read→{get,list}, write→{create,update,delete}, single granular grants, comma-separated grants, per-verb deny-by-default), matching production verdict-for-verdict on 12 of the scenario's 13 non-existence cases. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-verbs-umbrella-granular.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-verbs-umbrella-granular</code></a> (all <code>read</code>/<code>write</code>/<code>get</code>/comma-verb cases). One related existence-semantics case in the same scenario diverges over-permissively and is carried by <code>#118 Rules</code> (the <code>resource == null</code> create-if-absent guard), not by this granular-verb row. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>parseStorageRules</code> rejects unterminated string literals with <code>SyntaxError</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules.test.ts</code> ("rejects unterminated strings")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules.test.ts</code></a> ("rejects unterminated strings")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> matches <code>match /sessions/{id} { allow read: if request.auth != null; }</code> for an authed read</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("allows authenticated reads of /sessions/{id}")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a> ("allows authenticated reads of /sessions/{id}")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> denies anonymous reads when the rule requires <code>request.auth != null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("denies anonymous reads")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a> ("denies anonymous reads")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports <code>request.resource.size &lt; N</code> constraints (with arithmetic literals like <code>10 <em> 1024 </em> 1024</code>)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> ("allows JSON writes under 10MB")</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a> ("allows JSON writes under 10MB")</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>evaluateStorageRules</code> supports <code>request.resource.contentType == '&lt;mime&gt;'</code> constraints</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> (mime constraint inside the session-archive ruleset)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a> (mime constraint inside the session-archive ruleset)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Multi-segment wildcard <code>{allPaths=**}</code> matches zero-or-more remaining segments</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code> (parser + evaluator both honor the <code>**</code> form)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a> (parser + evaluator both honor the <code>**</code> form)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Path-parameter binding (<code>{sessionId}</code>) accessible inside the <code>if</code> expression</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/sandbox/rules-evaluator.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:storage/sandbox/rules-evaluator.test.ts</code></a></div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">User-defined <code>function</code> definitions — <code>let</code> bindings, functions calling functions, and match-block-scoped helper functions (lexical scoping)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">STALE ROW, corrected 2026-07-10: production capture proves the evaluator supports user-defined functions with <code>let</code> bindings, nested function calls, and block-scoped helpers. <code>oracle:rules-storage-functions-let-scope</code> matches production verdict-for-verdict on all 5 cases. Same-name shadowing and undefined-function calls are compile-time rejections in production and are covered by evaluator unit tests instead (they cannot be captured as a clean production verdict).</div></div>
+<div class="compat-evidence"><div class="compat-probe">STALE ROW, corrected 2026-07-10: production capture proves the evaluator supports user-defined functions with <code>let</code> bindings, nested function calls, and block-scoped helpers. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-functions-let-scope.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-functions-let-scope</code></a> matches production verdict-for-verdict on all 5 cases. Same-name shadowing and undefined-function calls are compile-time rejections in production and are covered by evaluator unit tests instead (they cannot be captured as a clean production verdict). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L15" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>request.time</code> compared against <code>timestamp.date(y,m,d)</code> and <code>timestamp.value(ms)</code> constructors</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves the evaluator supports <code>request.time</code> comparisons against both timestamp constructors. <code>oracle:rules-storage-request-time-timestamp</code> matches production verdict-for-verdict on all 4 cases (deadline-before/after via <code>timestamp.date()</code>, epoch-bound before/after via <code>timestamp.value()</code>).</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves the evaluator supports <code>request.time</code> comparisons against both timestamp constructors. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-request-time-timestamp.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-request-time-timestamp</code></a> matches production verdict-for-verdict on all 4 cases (deadline-before/after via <code>timestamp.date()</code>, epoch-bound before/after via <code>timestamp.value()</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>string.matches(regex)</code> with whole-string anchoring (a partial match denies)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves <code>matches()</code> is whole-string anchored, matching a RE2 pattern only when it covers the entire string. <code>oracle:rules-storage-matches-regex</code> matches production verdict-for-verdict on all 3 cases. RE2-inexpressible patterns are rejected at ruleset compile time by production and are covered by evaluator unit tests instead.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves <code>matches()</code> is whole-string anchored, matching a RE2 pattern only when it covers the entire string. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-matches-regex.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-matches-regex</code></a> matches production verdict-for-verdict on all 3 cases. RE2-inexpressible patterns are rejected at ruleset compile time by production and are covered by evaluator unit tests instead. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L194" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource.metadata.&lt;key&gt;</code> custom-metadata access in dotted (<code>resource.metadata.owner</code>) and bracket (<code>resource.metadata['owner']</code>) form, including missing-key deny</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves dotted and bracket metadata access resolve identically, and a missing key denies. <code>oracle:rules-storage-metadata-access</code> matches production verdict-for-verdict on all 5 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves dotted and bracket metadata access resolve identically, and a missing key denies. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-metadata-access.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-metadata-access</code></a> matches production verdict-for-verdict on all 5 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L131" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Cross-service <code>firestore.get()</code> / <code>firestore.exists()</code> lookups from a Storage ruleset, with <code>$(expr)</code> path interpolation and qualified function-mock names</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves the evaluator resolves cross-service Firestore lookups from Storage rules, including interpolated document paths and both the map-returning <code>get()</code> and bool-returning <code>exists()</code> forms. <code>oracle:rules-storage-firestore-lookup</code> matches production verdict-for-verdict on all 4 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-10: production capture proves the evaluator resolves cross-service Firestore lookups from Storage rules, including interpolated document paths and both the map-returning <code>get()</code> and bool-returning <code>exists()</code> forms. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-firestore-lookup.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-firestore-lookup</code></a> matches production verdict-for-verdict on all 4 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L71" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource.name</code> (full object path), <code>resource.timeCreated</code>, <code>resource.updated</code>, <code>resource.bucket</code> — the object-identity and time fields of the existing-object binding, plus <code>duration.value(n, unit)</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-12: the fields are now modeled, sourced from the persisted object record. <code>oracle:rules-storage-resource-object-identity</code> matches production verdict-for-verdict on all 9 cases — an extension guard (<code>resource.name.matches</code>), a freshness window (<code>resource.timeCreated + duration.value(1, 'h')</code>), an immutability check (<code>resource.timeCreated == resource.updated</code>), and an absent-property negation. Production semantics pinned by the capture: <code>resource.name</code> is the object's FULL path within the bucket (GCS object-name convention, sourced from the persisted record's <code>fullPath</code>, not the client SDK's last-segment <code>name</code>); <code>timeCreated</code>/<code>updated</code> are timestamps (production rejects an int with "Unsupported operation error. Received: int &lt; timestamp"); the update-time field is <code>updated</code> — there is NO <code>resource.timeUpdated</code>. An absent property is an evaluation error that absorbs to DENY and SURVIVES negation, so <code>resource.name != 'x'</code> on an object with no name denies rather than false-allowing. The prior row recorded these fields as an unsupported gap; that gap is closed.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-12: the fields are now modeled, sourced from the persisted object record. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-resource-object-identity.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-resource-object-identity</code></a> matches production verdict-for-verdict on all 9 cases — an extension guard (<code>resource.name.matches</code>), a freshness window (<code>resource.timeCreated + duration.value(1, 'h')</code>), an immutability check (<code>resource.timeCreated == resource.updated</code>), and an absent-property negation. Production semantics pinned by the capture: <code>resource.name</code> is the object's FULL path within the bucket (GCS object-name convention, sourced from the persisted record's <code>fullPath</code>, not the client SDK's last-segment <code>name</code>); <code>timeCreated</code>/<code>updated</code> are timestamps (production rejects an int with "Unsupported operation error. Received: int &lt; timestamp"); the update-time field is <code>updated</code> — there is NO <code>resource.timeUpdated</code>. An absent property is an evaluation error that absorbs to DENY and SURVIVES negation, so <code>resource.name != 'x'</code> on an object with no name denies rather than false-allowing. The prior row recorded these fields as an unsupported gap; that gap is closed. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>request.resource.size</code> arithmetic bounds (<code>+</code>/<code>-</code>/<code><em></code>/<code>/</code>, <code>&gt;=</code>/<code>&lt;=</code>), request/existing content-type and custom <code>metadata</code> checks, <code>request.method</code>/<code>request.path</code>, a <code>request.auth.token</code> custom-claim branch, granular <code>allow list</code>, and a recursive <code>{allPaths=</em>*}</code> public read tree</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the evaluator matches the production Storage Rules Test API verdict-for-verdict on all 8 cases (owner-scoped size-bounded upload, immutable-content-type update, list grant, public recursive read). <code>oracle:rules-storage-metadata-verbs-and-arithmetic</code> — replayed by <code>packages/pyric/test/storage/rules-oracle-conformance.test.ts</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the evaluator matches the production Storage Rules Test API verdict-for-verdict on all 8 cases (owner-scoped size-bounded upload, immutable-content-type update, list grant, public recursive read). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-metadata-verbs-and-arithmetic.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-metadata-verbs-and-arithmetic</code></a> — replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L75" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/storage/rules-oracle-conformance.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>resource</code> on a create where no object exists: the create-if-absent guard <code>allow create: if resource == null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production raises a null-value error when <code>resource</code> is referenced on a create where no object exists, including <code>resource == null</code>, so the expression denies. The evaluator now represents the missing binding as a Rules error rather than a usable null. <code>oracle:rules-storage-verbs-umbrella-granular</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam.</div></div>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production raises a null-value error when <code>resource</code> is referenced on a create where no object exists, including <code>resource == null</code>, so the expression denies. The evaluator now represents the missing binding as a Rules error rather than a usable null. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-verbs-umbrella-granular.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-verbs-umbrella-granular</code></a> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Ternary <code>?:</code> — branch selection, error-in-condition deny, and <code>error || true</code> absorption</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves the evaluator selects ternary branches by condition, denies when the CONDITION errors (even with identical <code>true</code> branches — production errors the whole conditional rather than falling through to a branch), and still absorbs the same error through <code>|| true</code>. <code>oracle:rules-storage-ternary-and-error-absorption</code> matches production verdict-for-verdict on all 5 cases. A division-by-zero in the condition previously yielded JS Infinity (no error) and false-ALLOWed the erroring-condition case; zero divisors now error-and-deny.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves the evaluator selects ternary branches by condition, denies when the CONDITION errors (even with identical <code>true</code> branches — production errors the whole conditional rather than falling through to a branch), and still absorbs the same error through <code>|| true</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-ternary-and-error-absorption.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-ternary-and-error-absorption</code></a> matches production verdict-for-verdict on all 5 cases. A division-by-zero in the condition previously yielded JS Infinity (no error) and false-ALLOWed the erroring-condition case; zero divisors now error-and-deny. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>in</code> on list literals (membership) and on maps (OWN-key membership) — prototype names (<code>toString</code>/<code>constructor</code>/<code>hasOwnProperty</code>) are never keys</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves <code>in</code> tests list membership and map OWN keys only — <code>'toString' in metadata</code> is false unless the map literally carries that key, for both custom-metadata maps and map literals. <code>oracle:rules-storage-in-membership-and-proto-keys</code> matches production verdict-for-verdict on all 8 cases. Pre-fix the evaluator used JS <code>in</code>, which walks the prototype chain and false-ALLOWed the proto-key cases (the same bug class the Firestore simulator fixed under RULES-B7); the own-key check now guards it, pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves <code>in</code> tests list membership and map OWN keys only — <code>'toString' in metadata</code> is false unless the map literally carries that key, for both custom-metadata maps and map literals. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-in-membership-and-proto-keys.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-in-membership-and-proto-keys</code></a> matches production verdict-for-verdict on all 8 cases. Pre-fix the evaluator used JS <code>in</code>, which walks the prototype chain and false-ALLOWed the proto-key cases (the same bug class the Firestore simulator fixed under RULES-B7); the own-key check now guards it, pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>is</code> type tests over the storage bindings (<code>size is int</code>, <code>contentType is string</code>, <code>metadata is map</code>, <code>split() is list</code>) and int/float LITERAL typing (<code>1.0 is float</code>, <code>1 is int</code>, cross checks false)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): the evaluator now adopts the simulator's RULES-B5 float model — a <code>RulesFloat</code> wrapper tags float values (a numeric literal written with a decimal point converts to one) while a bare JS number means int — so <code>1.0 is float</code> / <code>!(1.0 is int)</code> type by literal form exactly as production does. <code>oracle:rules-storage-type-checks-is</code> now matches production verdict-for-verdict on all 3 cases with no knownGap abstentions. The prior same-day row recorded the value-typed divergence; that gap is closed.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): the evaluator now adopts the simulator's RULES-B5 float model — a <code>RulesFloat</code> wrapper tags float values (a numeric literal written with a decimal point converts to one) while a bare JS number means int — so <code>1.0 is float</code> / <code>!(1.0 is int)</code> type by literal form exactly as production does. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-type-checks-is.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-type-checks-is</code></a> now matches production verdict-for-verdict on all 3 cases with no knownGap abstentions. The prior same-day row recorded the value-typed divergence; that gap is closed. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">List/map literals, range-slice access <code>[i:j]</code> on lists and strings (out-of-range bounds ERROR, no JS clamp), and structural <code>==</code> on lists</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves slices evaluate on <code>split()</code> lists and on strings, that an out-of-range slice END errors and denies (production does NOT clamp to length the way JS <code>.slice()</code> does — same semantics the Firestore capture pinned in rules-firestore-range-slice-list-and-string), and that a slice compares equal to a list literal structurally. <code>oracle:rules-storage-list-map-literals-and-slice</code> matches production verdict-for-verdict on all 6 cases. Pre-fix the evaluator clamped bounds JS-style and compared lists by reference identity; both fixed and pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves slices evaluate on <code>split()</code> lists and on strings, that an out-of-range slice END errors and denies (production does NOT clamp to length the way JS <code>.slice()</code> does — same semantics the Firestore capture pinned in rules-firestore-range-slice-list-and-string), and that a slice compares equal to a list literal structurally. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-list-map-literals-and-slice.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-list-map-literals-and-slice</code></a> matches production verdict-for-verdict on all 6 cases. Pre-fix the evaluator clamped bounds JS-style and compared lists by reference identity; both fixed and pinned by <code>unit:storage/sandbox/rules-values.test.ts</code> JS-semantics guards. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Float literals, <code>%</code>, unary minus, float division, negative-dividend modulo (<code>-7 % 2 == -1</code>), and TRUNCATING int division (<code>10 / 4 == 2</code>, <code>-7 / 2 == -3</code>)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): with the RULES-B5 float model adopted from the simulator, int ÷ int truncates toward zero, float division stays float (re-tagged), and int-op-float promotes to float. <code>oracle:rules-storage-float-modulo-unary-minus</code> now matches production verdict-for-verdict on all 6 cases with no knownGap abstentions. An int zero divisor errors-and-denies; a float zero divisor follows the simulator's CEL-pinned ±Infinity/NaN. The prior same-day row recorded the truncation divergence; that gap is closed.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ROW CORRECTED, 2026-07-17 (same day): with the RULES-B5 float model adopted from the simulator, int ÷ int truncates toward zero, float division stays float (re-tagged), and int-op-float promotes to float. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-float-modulo-unary-minus.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-float-modulo-unary-minus</code></a> now matches production verdict-for-verdict on all 6 cases with no knownGap abstentions. An int zero divisor errors-and-denies; a float zero divisor follows the simulator's CEL-pinned ±Infinity/NaN. The prior same-day row recorded the truncation divergence; that gap is closed. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Function declarations at GLOBAL scope (above <code>service</code>) and SERVICE scope (inside <code>service</code>, outside any match), with inner-shadows-outer resolution</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves production accepts functions declared at global and service scope and resolves a match-scope function over a same-named global (inner shadows outer). <code>oracle:rules-storage-function-scopes-and-shadowing</code> matches production verdict-for-verdict on all 5 cases. The shared grammar previously rejected both placements at parse (PR #333 grammar fix); the storage evaluator attaches global- and service-scope functions to the root match block, which the capture proves is verdict-equivalent to production's scoping for this surface.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-17: production capture proves production accepts functions declared at global and service scope and resolves a match-scope function over a same-named global (inner shadows outer). <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-function-scopes-and-shadowing.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-function-scopes-and-shadowing</code></a> matches production verdict-for-verdict on all 5 cases. The shared grammar previously rejected both placements at parse (PR #333 grammar fix); the storage evaluator attaches global- and service-scope functions to the root match block, which the capture proves is verdict-equivalent to production's scoping for this surface. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>2+modules</code> Storage rules resolve through service-aware contracts: the common <code>auth</code> and <code>membership</code> exports are admitted and retain their production auth, claim, map-membership, and role semantics; Firestore-only helpers are rejected before evaluation</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20; paired proof added 2026-07-21: one targeted production Rules Test API capture proves the exact six bundled function bodies (<code>isAuthenticated</code>, <code>isOwner</code>, <code>hasClaim</code>, <code>hasClaimRole</code>, <code>isMemberOf</code>, <code>hasRole</code>) under <code>firebase.storage</code>, matching the local evaluator verdict-for-verdict on 12 allow/deny cases. <code>oracle:rules-storage-common-auth-membership</code> supplies the Storage answer key; Firestore Rules row #189 independently captures the same exact bodies under <code>cloud.firestore</code> (12 matching verdicts). A separately authored, explicitly reconstructed normalized-AST digest locks the captured Storage corpus bodies, and the source-lock test requires the Firestore corpus and shipped modules to remain AST-identical. Resolver tests separately prove <code>2+modules</code> lowers these imports to plain v2 and fails closed with <code>INCOMPATIBLE_FUNCTION</code> for a Firestore-only export and for a transitive helper that reads <code>resource.data</code>; the Storage service integration test proves normal setup invokes that checked resolver.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20; paired proof added 2026-07-21: one targeted production Rules Test API capture proves the exact six bundled function bodies (<code>isAuthenticated</code>, <code>isOwner</code>, <code>hasClaim</code>, <code>hasClaimRole</code>, <code>isMemberOf</code>, <code>hasRole</code>) under <code>firebase.storage</code>, matching the local evaluator verdict-for-verdict on 12 allow/deny cases. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-common-auth-membership.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-common-auth-membership</code></a> supplies the Storage answer key; Firestore Rules row #189 independently captures the same exact bodies under <code>cloud.firestore</code> (12 matching verdicts). A separately authored, explicitly reconstructed normalized-AST digest locks the captured Storage corpus bodies, and the source-lock test requires the Firestore corpus and shipped modules to remain AST-identical. Resolver tests separately prove <code>2+modules</code> lowers these imports to plain v2 and fails closed with <code>INCOMPATIBLE_FUNCTION</code> for a Firestore-only export and for a transitive helper that reads <code>resource.data</code>; the Storage service integration test proves normal setup invokes that checked resolver. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/test/src/storage-stdlib-source-lock.test.ts#L73" target="_blank" rel="noopener noreferrer"><code>storage-stdlib-source-lock.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/modules/resolver.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>resolver.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/enforce.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>enforce.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Storage-native upload primitives at security boundaries: inclusive byte maximums, exact and whole-string MIME checks, metadata-only updates with unchanged bytes/owner, string path wildcards, generation/metageneration identity, and strict creation-time windows</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20: <code>oracle:rules-storage-upload-primitives-boundaries</code> captures 26 production cases in one Rules Test API request. The local evaluator matches every case scoped to this row: size 0/exact/+1, MIME exact/case/parameter and regex anchoring, metadata update invariants, filename wildcard typing, exact/absent generation identity, and request.time just before/at/after a strict 60-second boundary plus a future timeCreated fixture. Metadata collection methods and missing request.resource are separated into divergence rows #127/#128 rather than contaminating this credit.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-20: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-upload-primitives-boundaries.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-upload-primitives-boundaries</code></a> captures 26 production cases in one Rules Test API request. The local evaluator matches every case scoped to this row: size 0/exact/+1, MIME exact/case/parameter and regex anchoring, metadata update invariants, filename wildcard typing, exact/absent generation identity, and request.time just before/at/after a strict 60-second boundary plus a future timeCreated fixture. Metadata collection methods and missing request.resource are separated into divergence rows #127/#128 rather than contaminating this credit. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Storage custom-metadata collection methods: <code>Map.keys().hasAll()</code> for required-key policy and <code>Map.get(key, default)</code> for an absent key</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: the Storage evaluator now implements own-key <code>Map.keys()</code>, structural <code>hasAll()</code>, and string-key <code>Map.get(key, default)</code>. <code>oracle:rules-storage-upload-primitives-boundaries</code> replays the production required-key and absent-key-default cases directly with no divergence pin; public-seam unit cases cover both admitted forms.</div></div>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: the Storage evaluator now implements own-key <code>Map.keys()</code>, structural <code>hasAll()</code>, and string-key <code>Map.get(key, default)</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-upload-primitives-boundaries.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-upload-primitives-boundaries</code></a> replays the production required-key and absent-key-default cases directly with no divergence pin; public-seam unit cases cover both admitted forms. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior"><code>request.resource</code> on delete where no incoming object exists: <code>request.resource == null</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production errors when <code>request.resource</code> is absent on delete, including a direct null comparison. The evaluator now carries the absent incoming binding as a Rules error. <code>oracle:rules-storage-upload-primitives-boundaries</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam.</div></div>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: production errors when <code>request.resource</code> is absent on delete, including a direct null comparison. The evaluator now carries the absent incoming binding as a Rules error. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-upload-primitives-boundaries.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-upload-primitives-boundaries</code></a> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-evaluator.test.ts</code> covers the evaluator seam. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Mocked Storage-to-Firestore lookup evaluation: get/exists return and missing-field errors, repeated and same-resolved-path calls, get+exists composition, and lazy <code>||</code>/<code>&amp;&amp;</code>/ternary branches with hosted function-call diagnostics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <code>oracle:rules-storage-firestore-lookup-budget</code> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit.</div></div>
+<div class="compat-evidence"><div class="compat-probe">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-firestore-lookup-budget.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-firestore-lookup-budget</code></a> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L71" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Anonymous <code>request.auth != null</code> used as a ternary condition before a cross-service lookup</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: anonymous <code>request.auth</code> is now represented as an absent-property Rules error, so a ternary condition denies before selecting either lookup branch, matching hosted diagnostics. <code>oracle:rules-storage-firestore-lookup-budget</code> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-methods.test.ts</code> covers the lookup evaluator seam.</div></div>
+<div class="compat-evidence"><div class="compat-probe">GAP CLOSED, 2026-07-21: anonymous <code>request.auth</code> is now represented as an absent-property Rules error, so a ternary condition denies before selecting either lookup branch, matching hosted diagnostics. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-firestore-lookup-budget.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-firestore-lookup-budget</code></a> replays the captured DENY directly with no divergence pin; <code>unit:storage/sandbox/rules-methods.test.ts</code> covers the lookup evaluator seam. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L71" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Real-resource Storage-to-Firestore contract: at most two distinct document paths per evaluation with repeated-path caching; typed document data and missing-document errors; default-database-only and owning-project isolation; lazy/helper/let composition; and independence from Firestore client rules</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: four deploy-observe-restore captures establish the real-resource contract beyond Rules Test API mocks: <code>oracle:stdlib-realstorage-p3-lookup-budget-iam-enabled</code>, <code>oracle:stdlib-realstorage-p3-advanced-iam-enabled</code>, <code>oracle:stdlib-realstorage-p3-named-database</code>, and <code>oracle:stdlib-realstorage-p3-project-isolation</code>. <code>unit:conformance/storage-stdlib-real-replay.test.ts</code> executes the locally decidable lookup matrices and locks reviewed reconstructions of their normalized probe code; the lock records state whether the digest covers an injected block or a canonical synthetic wrapper. The surrounding deployed base rules were not retained, so no full-source digest is claimed for these historical captures. Future rigs emit both probe-block and full deployed-rules-file digests. <code>unit:storage/enforce.test.ts</code> proves the normal enforcement seam reads only its owning sandbox and bypasses Firestore client rules. The separate consistency capture remains bounded characterization and is not promoted into a latency guarantee.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: four deploy-observe-restore captures establish the real-resource contract beyond Rules Test API mocks: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/stdlib-realstorage-p3-lookup-budget-iam-enabled.json" target="_blank" rel="noopener noreferrer"><code>oracle:stdlib-realstorage-p3-lookup-budget-iam-enabled</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/stdlib-realstorage-p3-advanced-iam-enabled.json" target="_blank" rel="noopener noreferrer"><code>oracle:stdlib-realstorage-p3-advanced-iam-enabled</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/stdlib-realstorage-p3-named-database.json" target="_blank" rel="noopener noreferrer"><code>oracle:stdlib-realstorage-p3-named-database</code></a>, and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/stdlib-realstorage-p3-project-isolation.json" target="_blank" rel="noopener noreferrer"><code>oracle:stdlib-realstorage-p3-project-isolation</code></a>. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/test/src/storage-stdlib-real-replay.test.ts#L90" target="_blank" rel="noopener noreferrer"><code>unit:conformance/storage-stdlib-real-replay.test.ts</code></a> executes the locally decidable lookup matrices and locks reviewed reconstructions of their normalized probe code; the lock records state whether the digest covers an injected block or a canonical synthetic wrapper. The surrounding deployed base rules were not retained, so no full-source digest is claimed for these historical captures. Future rigs emit both probe-block and full deployed-rules-file digests. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/enforce.test.ts#L368" target="_blank" rel="noopener noreferrer"><code>unit:storage/enforce.test.ts</code></a> proves the normal enforcement seam reads only its owning sandbox and bypasses Firestore client rules. The separate consistency capture remains bounded characterization and is not promoted into a latency guarantee.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">The service-scoped <code>storage/uploads</code>, <code>storage/metadata</code>, <code>storage/objects</code>, and <code>storage/time</code> modules resolve through <code>2+modules</code> and preserve their production upload-bound, MIME, metadata, operation-identity, and strict timestamp-window semantics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded Rules Test API batch captures 15 verdicts for the exact 13 deployable function bodies in the four shipped modules (<code>oracle:rules-storage-stdlib-storage-modules</code>). A separately authored, explicitly reconstructed normalized-AST digest locks the captured corpus bodies, and the source-lock test requires the shipped modules to remain AST-identical. The generic Storage stdlib fixture runner and oracle replay execute those bodies locally; resolver tests prove the modules are admitted only for <code>firebase.storage</code>, lower to plain v2, and fail closed under Firestore. The module surface intentionally excludes the advanced integrity, metadata-diff, and cross-service lookup candidates.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-21: one bounded Rules Test API batch captures 15 verdicts for the exact 13 deployable function bodies in the four shipped modules (<a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-stdlib-storage-modules.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-stdlib-storage-modules</code></a>). A separately authored, explicitly reconstructed normalized-AST digest locks the captured corpus bodies, and the source-lock test requires the shipped modules to remain AST-identical. The generic Storage stdlib fixture runner and oracle replay execute those bodies locally; resolver tests prove the modules are admitted only for <code>firebase.storage</code>, lower to plain v2, and fail closed under Firestore. The module surface intentionally excludes the advanced integrity, metadata-diff, and cross-service lookup candidates. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/test/src/storage-stdlib-source-lock.test.ts#L53" target="_blank" rel="noopener noreferrer"><code>storage-stdlib-source-lock.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/stdlib-cases.test.ts#L5" target="_blank" rel="noopener noreferrer"><code>stdlib-cases.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/stdlib.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>stdlib.test.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -277,63 +285,63 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>auth != null</code> gate on <code>.read</code>/<code>.write</code> — authed ops allow, signed-out ops deny</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r1-auth-only</code> — production verdicts captured by deploy-observe-restore against the live oracle database (RTDB has no server-side rules test API), replayed verdict-for-verdict against the in-process simulator by <code>packages/pyric/test/rules/rtdb/rules-conformance.test.ts</code>; all 4 cases match production.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r1-auth-only.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r1-auth-only</code></a> — production verdicts captured by deploy-observe-restore against the live oracle database (RTDB has no server-side rules test API), replayed verdict-for-verdict against the in-process simulator by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/rules/rtdb/rules-conformance.test.ts</code></a>; all 4 cases match production.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>$uid</code> path-variable ownership (<code>$uid === auth.uid</code>) — the owner path allows, a foreign uid and an anonymous request deny</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r2-own-uid</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict against the in-process simulator; all 5 cases match production, so the simulator binds the path variable against <code>auth.uid</code> exactly as production does.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r2-own-uid.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r2-own-uid</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict against the in-process simulator; all 5 cases match production, so the simulator binds the path variable against <code>auth.uid</code> exactly as production does. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Write-rule CASCADE — a truthy ancestor <code>.write</code> grants the write regardless of a deeper <code>!data.exists()</code> rule, so the populated-path write ALLOWS</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r3-data-exists</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict. Production ALLOWS the write to the populated path even though the child rule is <code>!data.exists()</code>: the ancestor <code>.write: auth != null</code> already granted it, and RTDB never consults a deeper rule to revoke a grant. All 3 cases match; the simulator models the same cascade.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r3-data-exists.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r3-data-exists</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict. Production ALLOWS the write to the populated path even though the child rule is <code>!data.exists()</code>: the ancestor <code>.write: auth != null</code> already granted it, and RTDB never consults a deeper rule to revoke a grant. All 3 cases match; the simulator models the same cascade. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>.validate</code> VETO — a failing child <code>.validate</code> denies a write the <code>.write</code> rule would otherwise permit (validate does not cascade and cannot be overridden)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r4-validate-structure</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; both cases match production. This row was the corpus's one historical simulator-vs-production divergence: at the 2026-05-18 agreement capture the simulator ALLOWED the missing-body write because it did not veto on the child <code>.validate</code>. The simulator now denies it, and this fresh capture re-confirms production's DENY, so the divergence is RESOLVED and needs no pin.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r4-validate-structure.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r4-validate-structure</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; both cases match production. This row was the corpus's one historical simulator-vs-production divergence: at the 2026-05-18 agreement capture the simulator ALLOWED the missing-body write because it did not veto on the child <code>.validate</code>. The simulator now denies it, and this fresh capture re-confirms production's DENY, so the divergence is RESOLVED and needs no pin. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Cascade is GRANT-ONLY — a root <code>.read: true</code> grants every descendant read (authed and anonymous), and a deeper <code>.write: false</code> cannot revoke a truthy ancestor <code>.write</code> grant</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r5-cascade-root-grant</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 4 cases ALLOW in production, including the write to a node whose own <code>.write</code> is literal <code>false</code>. The simulator reproduces grant-only cascade rather than treating the deeper <code>false</code> as a veto.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r5-cascade-root-grant.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r5-cascade-root-grant</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 4 cases ALLOW in production, including the write to a node whose own <code>.write</code> is literal <code>false</code>. The simulator reproduces grant-only cascade rather than treating the deeper <code>false</code> as a veto. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Literal <code>.read</code>/<code>.write: false</code> — the deny-all baseline denies every op, authed or anonymous, read or write</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r6-deny-everything</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 3 cases DENY in production and in the simulator.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r6-deny-everything.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r6-deny-everything</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 3 cases DENY in production and in the simulator. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Nested path variable in an expression (<code>$sessionId === auth.uid</code>) — the matching session allows, a mismatched session denies, and an unmatched anonymous op denies with no matching rule</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r7-pathvar-binding</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 4 cases match. The simulator binds the nested variable identically and returns NO_MATCHING_RULE (read as deny) where production denies for want of a rule.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r7-pathvar-binding.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r7-pathvar-binding</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict; all 4 cases match. The simulator binds the nested variable identically and returns NO_MATCHING_RULE (read as deny) where production denies for want of a rule. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>newData</code> is projected at the RULE node, not the written path — a root <code>.write</code> reading <code>newData.hasChildren(['owner'])</code> sees <code>{item:{...}}</code> for a write one level deeper, so the predicate is false and the write DENIES</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r8-combined-check</code> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict. Production DENIES all three writes, including the "matching owner" case whose <code>owner</code> field lives under <code>/item</code> rather than at the rule node; only the auth-gated read allows. All 4 cases match, so the simulator projects <code>newData</code> at the same node production does — rule placement relative to the written path decides the outcome.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r8-combined-check.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r8-combined-check</code></a> — production verdicts captured by deploy-observe-restore, replayed verdict-for-verdict. Production DENIES all three writes, including the "matching owner" case whose <code>owner</code> field lives under <code>/item</code> rather than at the rule node; only the auth-gated read allows. All 4 cases match, so the simulator projects <code>newData</code> at the same node production does — rule placement relative to the written path decides the outcome. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Arithmetic and comparison operators in quota rules — <code>+</code> <code>-</code> <code>*</code> <code>/</code> <code>%</code>, <code>&gt;</code> <code>&gt;=</code> <code>&lt;</code> <code>&lt;=</code>, <code>!==</code>, loose <code>==</code>, <code>||</code>, the ternary, and unary minus</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator evaluates every arithmetic and ordering operator as production does, across increment-only counters, doubling and halving deltas, a parity check, inclusive and exclusive range caps, a negative sentinel, loose equality against zero, a disjunction, and a ternary tier bound. <code>oracle:rules-rtdb-r9-quota-arithmetic</code> matches production verdict-for-verdict on all 23 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator evaluates every arithmetic and ordering operator as production does, across increment-only counters, doubling and halving deltas, a parity check, inclusive and exclusive range caps, a negative sentinel, loose equality against zero, a disjunction, and a ternary tier bound. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r9-quota-arithmetic.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r9-quota-arithmetic</code></a> matches production verdict-for-verdict on all 23 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">Snapshot structure and type guards — <code>hasChild</code>, <code>parent()</code>, <code>isString</code>, <code>isNumber</code>, <code>isBoolean</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the type predicates and the <code>parent()</code> path climb as production does, including RTDB's rule that a child <code>.validate</code> runs only for children PRESENT in <code>newData</code> — the name-without-age write is denied by that field's own parent guard, not by the absent sibling's type rule, which never runs. <code>oracle:rules-rtdb-r10-snapshot-type-guards</code> matches production verdict-for-verdict on all 7 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the type predicates and the <code>parent()</code> path climb as production does, including RTDB's rule that a child <code>.validate</code> runs only for children PRESENT in <code>newData</code> — the name-without-age write is denied by that field's own parent guard, not by the absent sibling's type rule, which never runs. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r10-snapshot-type-guards.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r10-snapshot-type-guards</code></a> matches production verdict-for-verdict on all 7 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">String methods on a snapshot value — <code>beginsWith</code>, <code>contains</code>, <code>endsWith</code>, <code>matches</code> with a regex literal, <code>.length</code>, <code>toLowerCase</code>, <code>toUpperCase</code>, and replace-ALL <code>replace</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves <code>String.replace</code> substitutes EVERY occurrence of the substring, not only the first — production ALLOWS the write whose rule is <code>newData.val().replace('_', '-') === 'a-b-c'</code> for the value <code>a_b_c</code>, which holds only under replace-all. The simulator delegated to JavaScript's <code>String.prototype.replace</code>, which given a string pattern substitutes only the first occurrence, and DENIED that write; the substitution now replaces every occurrence and the two-underscore case guards the regression. The same capture proves <code>toUpperCase</code> is a valid production rule method that the simulator's validator previously rejected outright as unknown. <code>oracle:rules-rtdb-r11-string-validation</code> matches production verdict-for-verdict on all 18 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves <code>String.replace</code> substitutes EVERY occurrence of the substring, not only the first — production ALLOWS the write whose rule is <code>newData.val().replace('_', '-') === 'a-b-c'</code> for the value <code>a_b_c</code>, which holds only under replace-all. The simulator delegated to JavaScript's <code>String.prototype.replace</code>, which given a string pattern substitutes only the first occurrence, and DENIED that write; the substitution now replaces every occurrence and the two-underscore case guards the regression. The same capture proves <code>toUpperCase</code> is a valid production rule method that the simulator's validator previously rejected outright as unknown. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r11-string-validation.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r11-string-validation</code></a> matches production verdict-for-verdict on all 18 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L12" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>now</code> (the server evaluation clock) and <code>auth.token</code> claims, read both dotted (<code>auth.token.firebase.sign_in_provider</code>) and subscripted (<code>auth.token['firebase']['sign_in_provider']</code>)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the server clock and the decoded ID-token claims as production does, through both access forms. The subscript's receiver is load-bearing: production's rules compiler ACCEPTS <code>auth.token[...]</code>, a map indexed by key, but REJECTS the same subscript applied to a snapshot value — <code>newData.val()['kind']</code> fails to compile with "No such method/property" — so <code>[]</code> is a map accessor, not a general indexing operator. <code>oracle:rules-rtdb-r12-server-time-and-token</code> matches production verdict-for-verdict on all 7 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the server clock and the decoded ID-token claims as production does, through both access forms. The subscript's receiver is load-bearing: production's rules compiler ACCEPTS <code>auth.token[...]</code>, a map indexed by key, but REJECTS the same subscript applied to a snapshot value — <code>newData.val()['kind']</code> fails to compile with "No such method/property" — so <code>[]</code> is a map accessor, not a general indexing operator. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r12-server-time-and-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r12-server-time-and-token</code></a> matches production verdict-for-verdict on all 7 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L31" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>getPriority()</code> on a plain <code>set</code> (an unset priority reads null) and the <code>.indexOn</code> query-planner directive</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves a plain <code>set</code> leaves a node's priority unset, so <code>getPriority()</code> reports null in production exactly as the simulator does, and that a ruleset carrying <code>.indexOn</code> deploys and evaluates with every verdict intact. The scope is exactly that: <code>.indexOn</code> never changes an allow/deny verdict, so the twin evidences only that production's compiler accepts and deploys the directive, and it says nothing about query behavior. A NON-null priority stays unverified because writing one requires <code>setWithPriority</code>, outside the corpus op vocabulary of read and set. <code>oracle:rules-rtdb-r13-priority-and-index-directive</code> matches production verdict-for-verdict on all 4 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves a plain <code>set</code> leaves a node's priority unset, so <code>getPriority()</code> reports null in production exactly as the simulator does, and that a ruleset carrying <code>.indexOn</code> deploys and evaluates with every verdict intact. The scope is exactly that: <code>.indexOn</code> never changes an allow/deny verdict, so the twin evidences only that production's compiler accepts and deploys the directive, and it says nothing about query behavior. A NON-null priority stays unverified because writing one requires <code>setWithPriority</code>, outside the corpus op vocabulary of read and set. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r13-priority-and-index-directive.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r13-priority-and-index-directive</code></a> matches production verdict-for-verdict on all 4 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior">The <code>root</code> binding — <code>root.child(...).exists()</code> resolved against the database root</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the <code>root</code> binding and reports a missing child as absent exactly as production does. The scope is bounded by the rig: the capture runner mounts the scenario subtree under a per-run randomly-named namespace while the replay suite mounts it at the root, so a rule naming any PRESENT path through <code>root</code> would address a different node on each side and diverge for harness reasons. Only a sentinel key absent under BOTH roots is mount-invariant, so that is what this row verifies; a populated <code>root</code> lookup remains unverified and needs a rig that can seed outside the scenario subtree and mount both sides at the same depth. <code>oracle:rules-rtdb-r14-root-lookup</code> matches production verdict-for-verdict on all 3 cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe">NEW ROW, 2026-07-12: production capture proves the simulator resolves the <code>root</code> binding and reports a missing child as absent exactly as production does. The scope is bounded by the rig: the capture runner mounts the scenario subtree under a per-run randomly-named namespace while the replay suite mounts it at the root, so a rule naming any PRESENT path through <code>root</code> would address a different node on each side and diverge for harness reasons. Only a sentinel key absent under BOTH roots is mount-invariant, so that is what this row verifies; a populated <code>root</code> lookup remains unverified and needs a rig that can seed outside the scenario subtree and mount both sides at the same depth. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r14-root-lookup.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r14-root-lookup</code></a> matches production verdict-for-verdict on all 3 cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L31" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules simulator</code><span class="compat-sub"><span class="compat-behavior"><code>.validate</code> reaches ancestors of the written path — each applicable rule is evaluated against the merged post-write value at its own location</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><code>oracle:rules-rtdb-r15-validate-ancestor-scope</code> — production DENIES a deep write that leaves its validated ancestor without the required child, while the same write under a rule-free ancestor ALLOWS and the write ALLOWS once the ancestor requirement is seeded. The simulator now walks validation from the root through the write location against the merged post-write tree and matches all 5 captured production cases.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/rtdb-rules/rules-rtdb-r15-validate-ancestor-scope.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-rtdb-r15-validate-ancestor-scope</code></a> — production DENIES a deep write that leaves its validated ancestor without the required child, while the same write under a rule-free ancestor ALLOWS and the write ALLOWS once the ancestor requirement is seeded. The simulator now walks validation from the root through the write location against the merged post-write tree and matches all 5 captured production cases. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/rtdb/rules-conformance.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>rules-conformance.test.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -345,5 +353,5 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 
 <div class="compat-list">
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules</code><span class="compat-sub"><span class="compat-behavior">Mocked Storage-to-Firestore lookup evaluation: get/exists return and missing-field errors, repeated and same-resolved-path calls, get+exists composition, and lazy <code>||</code>/<code>&amp;&amp;</code>/ternary branches with hosted function-call diagnostics</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <code>oracle:rules-storage-firestore-lookup-budget</code> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit.</div></div></details>
+<div class="compat-evidence"><div class="compat-note">DOCUMENTED MOCK-ORACLE DIVERGENCE, 2026-07-21: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-rules/rules-storage-firestore-lookup-budget.json" target="_blank" rel="noopener noreferrer"><code>oracle:rules-storage-firestore-lookup-budget</code></a> matches the local evaluator on 13 of 14 cases and hosted diagnostics prove lazy branches omit lookup calls. The one mismatch is intentional and pinned on both sides: the Rules Test API ALLOWs three distinct mocked exists calls, while the evaluator DENYs the third distinct path to match the separately captured real-resource production contract in row #131. This row remains diverged because its mocked observation is not verdict-identical; it supplies no budget credit. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/rules-oracle-conformance.test.ts#L71" target="_blank" rel="noopener noreferrer"><code>rules-oracle-conformance.test.ts</code></a>)</div></div></details>
 </div>