@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/serve/site-ui/docs/firestore-compat.md

@@ -19,6 +19,7 @@
 <div class="compat-key">
 <span class="compat-key-item"><span class="compat-dot" data-status="ok"></span><strong>Conforming</strong> — sandbox matches prod, locked by a passing probe</span>
 <span class="compat-key-item"><span class="compat-dot" data-status="diverged"></span><strong>Diverged (documented)</strong> — intentional difference with a written reason</span>
+<span class="compat-key-item"><span class="compat-dot" data-status="bug"></span><strong>Bug</strong> — should match prod but doesn't; failing probe pins it</span>
 </div>
 
 ## `getFirestore(target)` — initializer
@@ -53,12 +54,12 @@
 
 ## Named databases
 
-In production `getFirestore(app, databaseId)` selects a named database with its own documents, and rules see that id in the `database` path variable. Pyric models one database per app, `(default)`.
+In production `getFirestore(app, databaseId)` selects a named database with its own documents, and rules see that id in the `database` path variable. Pyric models one database per app, `(default)`. When `firebase.json` declares `firestore` as an array, pyric serves the `(default)` entry's rules and prints a startup warning for each named entry.
 
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app, databaseId)</code><span class="compat-sub"><span class="compat-behavior">In the sandbox, <code>getFirestore(app, databaseId)</code> ignores the database id and returns the app's <code>(default)</code> handle, so documents written under one id are read under every other id.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> asserts two database ids return the <code>(default)</code> handle and that a document written under one id reads back under another.</div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> asserts two database ids return the <code>(default)</code> handle and that a document written under one id reads back under another. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-absent.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-absent</code></a>)</div>
 <div class="compat-note">every database id resolves to (default)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
@@ -68,12 +69,12 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">pyric-admin getFirestore(app, databaseId)</code><span class="compat-sub"><span class="compat-behavior"><code>pyric-admin</code> <code>getFirestore</code> takes no database id; a second argument is ignored and the handle reads and writes <code>(default)</code>. The Admin SDK's <code>getFirestore(app, databaseId)</code> selects the named database.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/firestore/named-database.test.ts</code></a> writes through <code>getFirestore(app, 'reports')</code> and reads the document through <code>getFirestore(app)</code> and <code>getFirestore(app, 'archive')</code>.</div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/firestore/named-database.test.ts</code></a> writes through <code>getFirestore(app, 'reports')</code> and reads the document through <code>getFirestore(app)</code> and <code>getFirestore(app, 'archive')</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-admin-mixing.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-admin-mixing</code></a>)</div>
 <div class="compat-note">no database id parameter; every call resolves to (default)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules <code>match /databases/{database}/documents</code></code><span class="compat-sub"><span class="compat-behavior">Rules evaluate the <code>database</code> path variable as <code>(default)</code> for every request, whatever database id the handle was created with. Production binds the named database's id.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> writes through a handle created for <code>reports</code>: a rule requiring <code>database == '(default)'</code> allows the write and a rule requiring <code>database == 'reports'</code> denies it.</div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> writes through a handle created for <code>reports</code>: a rule requiring <code>database == '(default)'</code> allows the write and a rule requiring <code>database == 'reports'</code> denies it. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-rules-api.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-rules-api</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-cross-database.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-cross-database</code></a>)</div>
 <div class="compat-note"><code>database</code> is always (default)</div></div>
 </details>
 </div>
@@ -107,7 +108,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Path constructors</code><span class="compat-sub"><span class="compat-behavior"><code>collectionGroup(db, id)</code> returns a query spanning every collection with that id; <code>onSnapshot</code> on it delivers the initial snapshot and every later write to a collection with that id at any depth</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> ("gathers documents across every parent collection"). UPDATED, 2026-10-07: oracle <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-collection-group-listener.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-collection-group-listener.json</code></a>, captured with the Web SDK against temporarily deployed production rules that were restored afterwards. Under <code>match /{path=**}/&lt;id&gt;/{id}</code>, a listener on <code>collectionGroup(db, id)</code> fired once with the existing document, once with <code>added</code> for a write in a subcollection with that id, once with <code>added</code> for a write in the root collection with that id, and not at all for a write in a sibling collection; a listener on a collection id that only a concrete match governs received <code>permission-denied</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L986" target="_blank" rel="noopener noreferrer"><code>unit:firestore/oracle-conformance.test.ts</code></a> replays the capture in the sandbox; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/collection-group-rules.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:firestore/collection-group-rules.test.ts</code></a> pins the same sequence, the denial routed to the error callback, and query constraints on the listener; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/collection-group-listener.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>cli:serve/worker/collection-group-listener.test.ts</code></a> pins the same delivery and denial through the worker bridge.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> ("gathers documents across every parent collection"). UPDATED, 2026-10-07: oracle <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-collection-group-listener.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-collection-group-listener.json</code></a>, captured with the Web SDK against temporarily deployed production rules that were restored afterwards. Under <code>match /{path=**}/&lt;id&gt;/{id}</code>, a listener on <code>collectionGroup(db, id)</code> fired once with the existing document, once with <code>added</code> for a write in a subcollection with that id, once with <code>added</code> for a write in the root collection with that id, and not at all for a write in a sibling collection; a listener on a collection id that only a concrete match governs received <code>permission-denied</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L1002" target="_blank" rel="noopener noreferrer"><code>unit:firestore/oracle-conformance.test.ts</code></a> replays the capture in the sandbox; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/collection-group-rules.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>unit:firestore/collection-group-rules.test.ts</code></a> pins the same sequence, the denial routed to the error callback, and query constraints on the listener; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/collection-group-listener.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>cli:serve/worker/collection-group-listener.test.ts</code></a> pins the same delivery and denial through the worker bridge.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Path constructors</code><span class="compat-sub"><span class="compat-behavior">Unknown ref (not produced by this package) → <code>TypeError</code> with "unrecognized reference"</span></span></span></summary>
@@ -144,7 +145,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDoc(ref)</code><span class="compat-sub"><span class="compat-behavior">Rules-denied modular writes throw a <code>FirebaseError('permission-denied')</code>, matching the production error class and code</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-rules-denied-error.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-rules-denied-error.json</code></a>: prod throws a <code>FirebaseError</code> (name + constructor name both <code>FirebaseError</code>), <code>.code === 'permission-denied'</code>, and the value is an <code>instanceof FirebaseError</code> and <code>Error</code>. <code>oracle:firestore#21</code> replays the same denied modular write against the sandbox and asserts that complete class shape. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L637" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-rules-denied-error.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-rules-denied-error.json</code></a>: prod throws a <code>FirebaseError</code> (name + constructor name both <code>FirebaseError</code>), <code>.code === 'permission-denied'</code>, and the value is an <code>instanceof FirebaseError</code> and <code>Error</code>. <code>oracle:firestore#21</code> replays the same denied modular write against the sandbox and asserts that complete class shape. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L653" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -153,7 +154,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDocs(query)</code><span class="compat-sub"><span class="compat-behavior">Returns <code>QuerySnapshot</code> with <code>size</code>, <code>empty</code>, <code>docs</code> (<code>QueryDocumentSnapshot[]</code>)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L23" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a>, <code>playground:firestore-query</code> (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L49" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L23" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a>, <code>playground:firestore-query</code> (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L50" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDocs(query)</code><span class="compat-sub"><span class="compat-behavior"><code>QuerySnapshot.forEach(callback, thisArg)</code> calls <code>callback.call(thisArg, doc)</code> once per document, in query order, with the document alone, and <code>DocumentSnapshot.get(fieldPath)</code> returns the stored field at a dotted string or <code>FieldPath</code> (<code>undefined</code> when absent), for <code>getDocs</code> (with or without a converter, and the empty <code>getDocsFromCache</code> miss), <code>getDoc</code> and listener snapshots, in the in-page sandbox and through the served worker client, which the client SDKs in a Node host server process use.</span></span></span></summary>
@@ -214,7 +215,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">setDoc(ref, data[, options])</code><span class="compat-sub"><span class="compat-behavior">Rules-denied <code>setDoc</code> throws a <code>FirebaseError</code> with code <code>permission-denied</code>, matching production</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> ("getDoc denies when rules reject"), <code>playground:rules-data-validation</code>, oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-denied-error-code.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-write-denied-error-code.json</code></a> (prod <code>setDoc</code> on a denied path throws a <code>FirebaseError</code> with <code>.code === 'permission-denied'</code>, <code>.message === '7 PERMISSION_DENIED: Missing or insufficient permissions.'</code>, <code>instanceof Error</code>); <code>oracle:firestore#32</code> pins the sandbox error shape (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L625" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> ("getDoc denies when rules reject"), <code>playground:rules-data-validation</code>, oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-denied-error-code.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-write-denied-error-code.json</code></a> (prod <code>setDoc</code> on a denied path throws a <code>FirebaseError</code> with <code>.code === 'permission-denied'</code>, <code>.message === '7 PERMISSION_DENIED: Missing or insufficient permissions.'</code>, <code>instanceof Error</code>); <code>oracle:firestore#32</code> pins the sandbox error shape (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L641" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -281,7 +282,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">addDoc(coll, data)</code><span class="compat-sub"><span class="compat-behavior">Auto-id format — production and sandbox mint 20-character IDs from <code>[A-Za-z0-9]</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-adddoc-autoid-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-adddoc-autoid-format.json</code></a> records production's 20-character alphanumeric shape; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L194" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/oracle-conformance.test.ts</code></a> generates 25 sandbox IDs and checks both invariants against that observation.</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-adddoc-autoid-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-adddoc-autoid-format.json</code></a> records production's 20-character alphanumeric shape; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L210" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/oracle-conformance.test.ts</code></a> generates 25 sandbox IDs and checks both invariants against that observation.</div></div>
 </details>
 </div>
 
@@ -379,7 +380,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Query construction</code><span class="compat-sub"><span class="compat-behavior"><code>limitToLast(n)</code> returns the trailing n documents in an ordered result; without <code>orderBy</code>, it throws a <code>FirestoreError</code> with production's <code>unimplemented</code> code</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-limittolast-preconditions.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-limittolast-preconditions.json</code></a>: production's no-orderBy precondition throws code <code>unimplemented</code>, while ordered trailing-window semantics return <code>["b"]</code>. <code>oracle:firestore#61</code> replays both claims. Cursor composition + descending: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/upstream-query-probes.test.ts#L10" target="_blank" rel="noopener noreferrer"><code>unit:upstream-query-probes.test.ts</code></a>; cursor/empty-snapshot preconditions: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L562" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> + <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/admin-compat/cursors.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>unit:admin-compat/cursors.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L340" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-limittolast-preconditions.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-limittolast-preconditions.json</code></a>: production's no-orderBy precondition throws code <code>unimplemented</code>, while ordered trailing-window semantics return <code>["b"]</code>. <code>oracle:firestore#61</code> replays both claims. Cursor composition + descending: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/upstream-query-probes.test.ts#L10" target="_blank" rel="noopener noreferrer"><code>unit:upstream-query-probes.test.ts</code></a>; cursor/empty-snapshot preconditions: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L562" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a> + <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/admin-compat/cursors.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>unit:admin-compat/cursors.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L356" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Query construction</code><span class="compat-sub"><span class="compat-behavior">Composite filters AND with other constraints — <code>query(coll, or(...), orderBy(...), limit(...))</code></span></span></span></summary>
@@ -448,8 +449,8 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L793" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a></div></div>
 </details>
 <details class="compat-row" data-status="ok">
-<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Aggregates</code><span class="compat-sub"><span class="compat-behavior"><code>getAggregateFromServer(query, spec)</code> returns <code>{ data: () =&gt; Record&lt;alias, number|null&gt; }</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L809" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a>; collectionGroup + nested paths: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/upstream-write-aggregate-probes.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>unit:upstream-write-aggregate-probes.test.ts</code></a></div></div>
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Aggregates</code><span class="compat-sub"><span class="compat-behavior"><code>getAggregateFromServer(query, spec)</code> returns <code>{ data: () =&gt; Record&lt;alias, number|null&gt; }</code> in the in-page sandbox, on a served page and in a registered Node process</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">In-page: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L809" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-target.test.ts</code></a>; collectionGroup + nested paths: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/upstream-write-aggregate-probes.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>unit:upstream-write-aggregate-probes.test.ts</code></a>. Production: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> key <code>countOnly</code> (<code>{ n: 4 }</code>), replayed through the served surface export and through the worker client and host in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>unit:cli/serve/worker/oracle-captures/firestore-served-surface.test.ts</code></a>; that scenario's other keys are pinned under FL-27, FL-28 and FL-30. A served page and a registered Node process aggregate over the host in <code>test/apps/client-sdk-under-register</code>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Aggregates</code><span class="compat-sub"><span class="compat-behavior"><code>count()</code> / <code>sum(field)</code> / <code>average(field)</code> compose under one spec — <code>field</code> may be a dotted nested path</span></span></span></summary>
@@ -535,7 +536,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">runTransaction(db, fn)</code><span class="compat-sub"><span class="compat-behavior">Retry behavior — a read-document conflict reruns the callback against fresh data; <code>maxAttempts</code> bounds persistent contention</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-contention-retries.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-transaction-contention-retries.json</code></a> — two production Web SDK clients force one retry (<code>[0, 40]</code>, final <code>42</code>) and persistent contention with <code>maxAttempts: 2</code> runs exactly twice then throws <code>failed-precondition</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L671" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/oracle-conformance.test.ts</code></a> replays both cases through the sandbox. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L37" target="_blank" rel="noopener noreferrer"><code>sandbox-target.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-contention-retries.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-transaction-contention-retries.json</code></a> — two production Web SDK clients force one retry (<code>[0, 40]</code>, final <code>42</code>) and persistent contention with <code>maxAttempts: 2</code> runs exactly twice then throws <code>failed-precondition</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L687" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/oracle-conformance.test.ts</code></a> replays both cases through the sandbox. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox-target.test.ts#L37" target="_blank" rel="noopener noreferrer"><code>sandbox-target.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">runTransaction(db, fn)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>FirebaseError('permission-denied')</code> on rule denial inside the transaction (the inner write's denial — not a generic <code>aborted</code>). Sandbox throws <code>FirestoreCompatError</code> with the same <code>code: 'permission-denied'</code></span></span></span></summary>
@@ -659,11 +660,11 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Equality helpers</code><span class="compat-sub"><span class="compat-behavior"><code>queryEqual(a, b)</code> structurally compares collection and collection-group scope, filter/order/limit/cursor constraint structure, converter identity, and construction-time Firestore value snapshots for both equality and execution without re-observing caller objects. Snapshots cover maps/arrays, scalar objects, references (including raw and converted <code>addDoc()</code> results), and vectors; normalize Date to Timestamp; preserve the distinction between -0 and 0; compare snapshot and explicit bounds for all four cursor overloads by value without invoking snapshot converters, including across live-target rebuilds; reject undefined, bigint, nested arrays for ordinary and array-membership operands, and recursively nested cross-database references during query construction; and preserve Firebase's nested-array allowance for <code>in</code>/<code>not-in</code> candidate lists.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-queryequal-structural.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-queryequal-structural.json</code></a>: collection and collection-group scope, order sequence/direction, limits, composite filters, cursor values/inclusivity, converters, and Firestore operands all distinguish equal from changed queries as production does. The capture executes mutable maps, Timestamp, Bytes, GeoPoint, DocumentReference (including raw and converted <code>addDoc()</code> results), and Vector queries; proves Bytes/Vector source-array mutation cannot change existing or new queries; proves all four snapshot cursor overloads compare with explicit bounds and execute twice without invoking a consumer converter; and locks recursive foreign-reference rejection, Date/Timestamp normalization, and -0 handling. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-nested-array-validation.json" target="_blank" rel="noopener noreferrer"><code>firestore-query-nested-array-validation.json</code></a> separately pins the production SDK's client-side rejection of nested arrays without implying a cloud round trip. The replay forces live-target identity rebuilds for every snapshot cursor overload. <code>oracle:firestore#116</code> replays every claimed fact. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L1167" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/equality.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>equality.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-queryequal-structural.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-queryequal-structural.json</code></a>: collection and collection-group scope, order sequence/direction, limits, composite filters, cursor values/inclusivity, converters, and Firestore operands all distinguish equal from changed queries as production does. The capture executes mutable maps, Timestamp, Bytes, GeoPoint, DocumentReference (including raw and converted <code>addDoc()</code> results), and Vector queries; proves Bytes/Vector source-array mutation cannot change existing or new queries; proves all four snapshot cursor overloads compare with explicit bounds and execute twice without invoking a consumer converter; and locks recursive foreign-reference rejection, Date/Timestamp normalization, and -0 handling. <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-nested-array-validation.json" target="_blank" rel="noopener noreferrer"><code>firestore-query-nested-array-validation.json</code></a> separately pins the production SDK's client-side rejection of nested arrays without implying a cloud round trip. The replay forces live-target identity rebuilds for every snapshot cursor overload. <code>oracle:firestore#116</code> replays every claimed fact. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L1183" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/equality.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>equality.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Equality helpers</code><span class="compat-sub"><span class="compat-behavior"><code>snapshotEqual(a, b)</code> follows production snapshot state. A query's first one-shot read differs from the next identical read, then repeated settled reads (including an independently built equivalent query) compare structurally until query state changes and settles again. Listener snapshots compare query, documents, changes, and metadata. Document snapshots compare path, existence, Firestore-typed data, converter identity, and snapshot kind, so two gets of the same document are equal while a query-child snapshot and a direct get are distinct; scalar-shaped plain maps remain distinct from Timestamp, reference, GeoPoint, and Vector values.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-snapshotequal-structural.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-snapshotequal-structural.json</code></a>: sequential and equivalent-query reads prove the initial-to-settled transition; a changed result restarts that transition; listener sensitivity cases vary query, documents/change history, and metadata-only state; direct document cases vary path, existence, data, converter, and snapshot kind; and four collision probes distinguish scalar-shaped maps from their Timestamp, reference, GeoPoint, and Vector counterparts. <code>oracle:firestore#117</code> replays every reachable fact. JSON reconstruction remains raw characterization only because Pyric does not expose that separate API. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L1574" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/equality.test.ts#L16" target="_blank" rel="noopener noreferrer"><code>equality.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-snapshotequal-structural.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-snapshotequal-structural.json</code></a>: sequential and equivalent-query reads prove the initial-to-settled transition; a changed result restarts that transition; listener sensitivity cases vary query, documents/change history, and metadata-only state; direct document cases vary path, existence, data, converter, and snapshot kind; and four collision probes distinguish scalar-shaped maps from their Timestamp, reference, GeoPoint, and Vector counterparts. <code>oracle:firestore#117</code> replays every reachable fact. JSON reconstruction remains raw characterization only because Pyric does not expose that separate API. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L1590" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/equality.test.ts#L16" target="_blank" rel="noopener noreferrer"><code>equality.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Equality helpers</code><span class="compat-sub"><span class="compat-behavior">Cross-flavor <code>refEqual</code> via <code>QuerySnapshot.docs[i].ref</code> works</span></span></span></summary>
@@ -693,29 +694,32 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 ## Offline / persistence / network family (continued)
 
 <div class="compat-list">
-<details class="compat-row" data-status="ok">
-<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">enableIndexedDbPersistence</code><span class="compat-sub"><span class="compat-behavior">Resolves before Firestore starts and rejects with <code>failed-precondition</code> after any operation has started the service</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused lifecycle coverage. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">enableIndexedDbPersistence</code><span class="compat-sub"><span class="compat-behavior">Resolves before Firestore starts and rejects with <code>failed-precondition</code> after any operation has started the service</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused lifecycle coverage. Served planes: an accepted no-op that resolves after first use (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div>
+<div class="compat-note">an accepted no-op on the served planes (FP-9)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">enableMultiTabIndexedDbPersistence</code><span class="compat-sub"><span class="compat-behavior">Enables multi-client shared persistence before first use, permits two clients to opt in, and rejects initialization after a client has started with <code>failed-precondition</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> exercises fresh, after-use, and two-client initialization; replayed through public APIs by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused persistence tests. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> exercises fresh, after-use, and two-client initialization; replayed through public APIs by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused persistence tests. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">clearIndexedDbPersistence</code><span class="compat-sub"><span class="compat-behavior">Maps to <code>Sandbox.clearPersistence()</code> — actually wipes the persisted blob (honest, not a no-op); already a no-op when persistence was never enabled</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:firestore/persistence-network.test.ts</code></a></div></div>
 </details>
-<details class="compat-row" data-status="ok">
-<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">enableNetwork / disableNetwork</code><span class="compat-sub"><span class="compat-behavior">Disabling network exposes local mutations with cache/pending-write metadata while holding write acknowledgement until network is re-enabled</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused network coverage. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">enableNetwork / disableNetwork</code><span class="compat-sub"><span class="compat-behavior">Disabling network exposes local mutations with cache/pending-write metadata while holding write acknowledgement until network is re-enabled</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused network coverage. Served planes: accepted no-ops, so an offline write commits at once (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div>
+<div class="compat-note">an accepted no-op on the served planes (FP-9)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">waitForPendingWrites</code><span class="compat-sub"><span class="compat-behavior">Waits for outstanding offline write acknowledgements and resolves when network re-enable drains them</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused pending-write coverage. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused pending-write coverage. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>)</div></div>
 </details>
-<details class="compat-row" data-status="ok">
-<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">terminate</code><span class="compat-sub"><span class="compat-behavior">Terminates only the selected Firestore service instance: held refs reject with <code>failed-precondition</code>, owned listeners stop, and sibling Firestore or Auth services remain usable</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-browser-lifecycle.json</code></a> records <code>failed-precondition</code> on the terminated instance while Auth and a sibling Firestore instance continue. Replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; focused ownership coverage in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/terminate.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>terminate.test.ts</code></a>.</div></div>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">terminate</code><span class="compat-sub"><span class="compat-behavior">Terminates only the selected Firestore service instance: held refs reject with <code>failed-precondition</code>, owned listeners stop, and sibling Firestore or Auth services remain usable</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-browser-lifecycle.json</code></a> records <code>failed-precondition</code> on the terminated instance while Auth and a sibling Firestore instance continue. Replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; focused ownership coverage in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/terminate.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>terminate.test.ts</code></a>. SharedWorker: a no-op, so held refs keep working (FP-9).</div>
+<div class="compat-note">a no-op over the SharedWorker (FP-9)</div></div>
 </details>
 </div>
 
@@ -738,9 +742,10 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDocFromServer / getDocsFromServer</code><span class="compat-sub"><span class="compat-behavior">Delegates to <code>getDoc</code> / <code>getDocs</code> in the sandbox mirror — the sandbox store IS the authoritative source, so there is no separate server round-trip to force and no observable divergence from the default read</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L12" target="_blank" rel="noopener noreferrer"><code>unit:firestore/tier1-cache-init-align.test.ts</code></a></div></div>
 </details>
-<details class="compat-row" data-status="ok">
-<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDocFromCache / getDocsFromCache</code><span class="compat-sub"><span class="compat-behavior">Explicit cache reads distinguish cold and warm state: cold document reads reject with <code>unavailable</code>, cold queries return empty, and server/default reads populate subsequent cache reads</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> captures cold and warm document and query cache behavior; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> replays it through public APIs. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>tier1-cache-init-align.test.ts</code></a>)</div></div>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDocFromCache / getDocsFromCache</code><span class="compat-sub"><span class="compat-behavior">Explicit cache reads distinguish cold and warm state: cold document reads reject with <code>unavailable</code>, cold queries return empty, and server/default reads populate subsequent cache reads</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> captures cold and warm document and query cache behavior; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> replays it through public APIs. Served planes: reads the store, so a cold read resolves (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>tier1-cache-init-align.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div>
+<div class="compat-note">reads the store on the served planes (FP-9)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">setLogLevel</code><span class="compat-sub"><span class="compat-behavior">Accepted no-op. The sandbox has no modular-SDK-style logger to wire a level into. It uses host-level <code>console</code> logging directly, gated by <code>pyric sandbox</code>'s own flags, not this call</span></span></span></summary>
@@ -749,7 +754,7 @@ In production `getFirestore(app, databaseId)` selects a named database with its
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">onSnapshotsInSync</code><span class="compat-sub"><span class="compat-behavior">Emits an initial in-sync signal, batches another signal after snapshot listener delivery, and stops after unsubscribe</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> records initial sync, write snapshot, then sync; replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L721" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused listener tests. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>tier1-cache-init-align.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> records initial sync, write snapshot, then sync; replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused listener tests. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>tier1-cache-init-align.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Runtime ES Classes / Constructor Tokens</code><span class="compat-sub"><span class="compat-behavior">Exports ES classes and constructor tokens matching structural type handles for instanceof checks and prototype inheritance</span></span></span></summary>
@@ -842,7 +847,7 @@ on a compiled ruleset share one parse per ruleset source, and the next
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><span class="compat-behavior">A single-document write exposes <code>request.resource.data</code> as the document the write stores. <code>updateDoc(ref, {'board.c1r1': 'x'})</code> shows rules a nested <code>board.c1r1</code> beside the existing <code>board</code> keys, not a top-level field named <code>"board.c1r1"</code>; a dotted <code>deleteField()</code> removes the nested leaf; <code>setDoc(ref, data, {merge: true})</code> deep-merges a nested map and keeps its sibling keys, and <code>{mergeFields}</code> writes only the listed paths. The field-and-value form carries each field path as literal segments: <code>updateDoc(ref, new FieldPath('a.b'), 'x')</code> writes a top-level field <code>'a.b'</code>, <code>new FieldPath('board', 'c1.r1')</code> writes a dotted key inside <code>board</code>, and a dotted string field is a nested path, through <code>updateDoc</code>, <code>WriteBatch.update</code>, <code>Transaction.update</code>, the Admin-shaped <code>update</code>, and the served worker. <code>resource.data</code> is unchanged by the projection.</span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-request-resource.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-request-resource</code></a> (captured 2026-10-07 against deployed production rules with the Web SDK, stable across two runs). Each case is one client write to a seeded document, and each predicate over <code>request.resource.data</code> or <code>request.resource.data.diff(resource.data)</code> is a separate guarded rule, so the allow or deny of the write reads out what production built. Production exposes the stored document: <code>updateDoc(ref, {'board.c1r1': 'x'})</code> gives <code>request.resource.data.board.c1r1 == 'x'</code> with <code>board.c2r2</code> and the top-level fields kept, no <code>'board.c1r1'</code> key, and <code>affectedKeys()</code> and <code>changedKeys()</code> equal to <code>['board']</code>; a dotted <code>deleteField()</code> removes only the nested leaf; <code>setDoc</code> with <code>merge</code> deep-merges (<code>affectedKeys()</code> is <code>['board', 'extra']</code>); <code>mergeFields</code> writes only the listed path; <code>updateDoc(ref, {board: {c1r1: 'x'}})</code> replaces the whole <code>board</code> map; non-merge <code>setDoc</code> drops the unlisted top-level field (<code>removedKeys()</code> is <code>['keep']</code>); <code>resource.data</code> is unchanged by the write; the field-and-value form <code>updateDoc(ref, new FieldPath('a.b'), 'x')</code> writes a literal top-level key <code>'a.b'</code> (<code>'a.b' in request.resource.data</code>, <code>!('a' in request.resource.data)</code>, <code>affectedKeys() == ['a.b']</code>) and <code>new FieldPath('board', 'c1.r1')</code> writes a literal dotted key inside <code>board</code> (<code>affectedKeys() == ['board']</code>). The sandbox replays every verdict, the literal-dot field-path cases included (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L41" target="_blank" rel="noopener noreferrer"><code>unit:firestore/oracle-conformance.test.ts</code></a>, 58 predicates over 10 writes). Update field paths travel as segment vectors: the served worker protocol and the remote Admin arm carry <code>fields: [{ path: string[], value }]</code>, and inside the engine an update payload is keyed by a Pyric-internal encoding that backtick-quotes a segment containing <code>.</code>. That encoding stays in the engine: request events, write events, errors and denial context carry the update's fields as nested maps plus <code>updateMask</code> (its field paths as segment vectors), and replay rebuilds the update from the two. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/remote/remote-firestore.test.ts#L37" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/remote/remote-firestore.test.ts</code></a> covers the remote Admin arm. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/update-field-paths.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:firestore/update-field-paths.test.ts</code></a> covers <code>updateDoc</code>, <code>WriteBatch.update</code>, <code>Transaction.update</code>, a transform and <code>deleteField()</code> at a literal-dot path, and the Admin-shaped <code>DocumentReference.update</code>, <code>WriteBatch.update</code> and <code>Transaction.update</code>; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/update-field-paths.test.ts#L5" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/update-field-paths.test.ts</code></a> covers the served worker, including rules that read the literal key. Argument validation is client-side SDK code with no server round trip, so its messages follow the Web SDK <code>parseUpdateVarargs</code> / <code>fieldPathFromArgument</code> and the Admin SDK <code>WriteBatch.update</code> sources: an odd field-and-value count, an empty segment, a reserved character, a non-string field, and an <code>undefined</code> value each throw the SDK's message. The Rules Test API takes <code>request.resource</code> as input and cannot show any of this, so the capture uses a client write. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox/rules-test-case.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:firestore/sandbox/rules-test-case.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/local-environment.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:sandbox/firestore/simulator/local-environment.test.ts</code></a>, and <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/project-after-state.test.ts#L12" target="_blank" rel="noopener noreferrer"><code>unit:sandbox/firestore/simulator/project-after-state.test.ts</code></a> pin the local projection.</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-request-resource.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-request-resource</code></a> (captured 2026-10-07 against deployed production rules with the Web SDK, stable across two runs). Each case is one client write to a seeded document, and each predicate over <code>request.resource.data</code> or <code>request.resource.data.diff(resource.data)</code> is a separate guarded rule, so the allow or deny of the write reads out what production built. Production exposes the stored document: <code>updateDoc(ref, {'board.c1r1': 'x'})</code> gives <code>request.resource.data.board.c1r1 == 'x'</code> with <code>board.c2r2</code> and the top-level fields kept, no <code>'board.c1r1'</code> key, and <code>affectedKeys()</code> and <code>changedKeys()</code> equal to <code>['board']</code>; a dotted <code>deleteField()</code> removes only the nested leaf; <code>setDoc</code> with <code>merge</code> deep-merges (<code>affectedKeys()</code> is <code>['board', 'extra']</code>); <code>mergeFields</code> writes only the listed path; <code>updateDoc(ref, {board: {c1r1: 'x'}})</code> replaces the whole <code>board</code> map; non-merge <code>setDoc</code> drops the unlisted top-level field (<code>removedKeys()</code> is <code>['keep']</code>); <code>resource.data</code> is unchanged by the write; the field-and-value form <code>updateDoc(ref, new FieldPath('a.b'), 'x')</code> writes a literal top-level key <code>'a.b'</code> (<code>'a.b' in request.resource.data</code>, <code>!('a' in request.resource.data)</code>, <code>affectedKeys() == ['a.b']</code>) and <code>new FieldPath('board', 'c1.r1')</code> writes a literal dotted key inside <code>board</code> (<code>affectedKeys() == ['board']</code>). The sandbox replays every verdict, the literal-dot field-path cases included (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L42" target="_blank" rel="noopener noreferrer"><code>unit:firestore/oracle-conformance.test.ts</code></a>, 58 predicates over 10 writes). Update field paths travel as segment vectors: the served worker protocol and the remote Admin arm carry <code>fields: [{ path: string[], value }]</code>, and inside the engine an update payload is keyed by a Pyric-internal encoding that backtick-quotes a segment containing <code>.</code>. That encoding stays in the engine: request events, write events, errors and denial context carry the update's fields as nested maps plus <code>updateMask</code> (its field paths as segment vectors), and replay rebuilds the update from the two. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/remote/remote-firestore.test.ts#L37" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/remote/remote-firestore.test.ts</code></a> covers the remote Admin arm. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/update-field-paths.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:firestore/update-field-paths.test.ts</code></a> covers <code>updateDoc</code>, <code>WriteBatch.update</code>, <code>Transaction.update</code>, a transform and <code>deleteField()</code> at a literal-dot path, and the Admin-shaped <code>DocumentReference.update</code>, <code>WriteBatch.update</code> and <code>Transaction.update</code>; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/update-field-paths.test.ts#L5" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/update-field-paths.test.ts</code></a> covers the served worker, including rules that read the literal key. Argument validation is client-side SDK code with no server round trip, so its messages follow the Web SDK <code>parseUpdateVarargs</code> / <code>fieldPathFromArgument</code> and the Admin SDK <code>WriteBatch.update</code> sources: an odd field-and-value count, an empty segment, a reserved character, a non-string field, and an <code>undefined</code> value each throw the SDK's message. The Rules Test API takes <code>request.resource</code> as input and cannot show any of this, so the capture uses a client write. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox/rules-test-case.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:firestore/sandbox/rules-test-case.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/local-environment.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:sandbox/firestore/simulator/local-environment.test.ts</code></a>, and <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/sandbox/firestore/simulator/project-after-state.test.ts#L12" target="_blank" rel="noopener noreferrer"><code>unit:sandbox/firestore/simulator/project-after-state.test.ts</code></a> pin the local projection.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><span class="compat-behavior">Int/float distinction (<code>1.5 is int</code>→false, <code>1 is float</code>→false, <code>1.0 is float</code>→true) + integer division (<code>10 / 4 == 2</code>) + int div/mod-by-zero ERRORS (RULES-B5); strict <code>int('12abc')</code>/<code>float('abc')</code> parsing (RULES-B6 rest); <code>bool()</code> is not a Firestore rules function, so <code>bool('true')</code> is "Function not found error: Name: [bool]" and denies; <code>string(1.0)</code>→"1.0" (RULES-B12 rest)</span></span></summary>
@@ -881,7 +886,7 @@ A server process started with `node --import @pyric/cli/register` and `PYRIC_SAN
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/firestore</code> in a server process reads and writes the host's documents under its rules as the process's signed-in user. An open listener keeps the process up; a finished write releases it at once. A CommonJS <code>require('firebase/firestore')</code> resolves the same client. An app whose options differ from the host's gets each call rejected with <code>app/multiple-configs-not-supported</code>, and nothing throws past the call. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a write the page and firebase-admin read, a CommonJS require, an app with other options rejected per call, and that a listener holds the process while a finished write does not. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L201" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a write the page and firebase-admin read, a CommonJS require, an app with other options rejected per call, and that a listener holds the process while a finished write does not. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L201" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
 <div class="compat-note">a finished write releases the process at once, where production holds it until the write stream's 60 s idle timeout; one configuration per runtime</div></div>
 </details>
 </div>
@@ -903,6 +908,73 @@ Modules Vite loads for server rendering under `vite dev` with `pyric()` (`server
 </details>
 </div>
 
+## Behavior checked against production captures
+
+Each row cites a production capture from the SDK behavior hunt. A `bug` row states production's behavior and pyric's; its test holds both answers until the fix lands.
+
+<div class="compat-list">
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAggregateFromServer(query, { n: count(), s: sum(field) })</code><span class="compat-sub"><span class="compat-behavior">Production: when count() is paired with sum(y), count includes only the docs that have y (3 of 4). Pyric counts every doc in the query (4). FL-27.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> key <code>countAndSumY</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">sum(field) / average(field) over NaN or Infinity</code><span class="compat-sub"><span class="compat-behavior">Production: sum and average over a field holding NaN return NaN, and over Infinity return Infinity. Pyric skips the non-finite values (sum 3 and average 1.5; sum 1 and average 1). FL-28.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> keys <code>nan</code> and <code>inf</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDocs / getAggregateFromServer on a shape that needs a composite index</code><span class="compat-sub"><span class="compat-behavior">Production fails a query or multi-field aggregation that needs a missing composite index with <code>failed-precondition</code>. Pyric runs it by design; only the served dev chip signals it, and two-range, OR and aggregate shapes get no signal. FL-30.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-composite-index-required.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-composite-index-required</code></a> (four shapes and two controls) and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> keys <code>multi</code> and <code>nullField</code>. Decided 2026-10-27: fix where production is clear; until then this row says they differ. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-composite-index-required.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-composite-index-required.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">where(field, 'in' | 'not-in' | 'array-contains-any', values) / or(...)</code><span class="compat-sub"><span class="compat-behavior">Production: getDocs fails with <code>invalid-argument</code> for <code>in</code> with 31 values, <code>not-in</code> with 11, <code>array-contains-any</code> with 31, or() with 31 branches, and 36 terms after normalization; 30 and 10 values succeed. Pyric runs every one. FL-29.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-disjunction-limits.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-disjunction-limits</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-disjunction-limits.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-disjunction-limits.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">where(field, '==' | '!=', 0) with a -0 value stored</code><span class="compat-sub"><span class="compat-behavior">-0 equals 0 in <code>==</code> and <code>!=</code> but not in <code>in</code>, as in production. FL-31.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-negative-zero.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-negative-zero</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-non-finite-number-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-non-finite-number-roundtrip</code></a> key <code>eq0</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-negative-zero.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-negative-zero.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-non-finite-number-roundtrip.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-non-finite-number-roundtrip.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">onSnapshot: per-doc metadata.hasPendingWrites on the local-write echo</code><span class="compat-sub"><span class="compat-behavior">Production: the echo of a local write reports <code>hasPendingWrites</code> true on the doc, for a doc listener and for the doc inside a query snapshot, and only on the written doc. Pyric reports false on the doc. FL-20.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-listener-local-write-metadata.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-listener-local-write-metadata</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-doc-pending-writes.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-doc-pending-writes</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-listener-local-write-metadata.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-listener-local-write-metadata.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-doc-pending-writes.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-doc-pending-writes.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">QuerySnapshot.docChanges({ includeMetadataChanges: true }) on the ack snapshot</code><span class="compat-sub"><span class="compat-behavior">Production: the snapshot that acknowledges a local write lists the doc as <code>modified</code> with <code>hasPendingWrites</code> false. Pyric's list is empty. FL-21.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-listener-local-write-metadata.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-listener-local-write-metadata</code></a> key <code>qMeta</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-listener-local-write-metadata.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-listener-local-write-metadata.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">setDoc past the documented write limits</code><span class="compat-sub"><span class="compat-behavior">Production fails with <code>invalid-argument</code> past its write limits (1 MiB docs, reserved or 1,501-byte ids and field names, 501 transforms, 26 nested maps); pyric stores them. FW-14.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-server-limits.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-server-limits</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-map-depth-limit.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-map-depth-limit</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-write-server-limits.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-write-server-limits.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-write-map-depth-limit.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-write-map-depth-limit.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">writeBatch / runTransaction: delete then update of one doc</code><span class="compat-sub"><span class="compat-behavior">A batch or transaction that deletes and then updates one doc fails with <code>invalid-argument</code> and leaves the doc unchanged, as production does. Set then update and update then delete commit. Only the error text differs. The capture refuted hunt finding FW-19.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-delete-then-update-same-commit.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-delete-then-update-same-commit</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-delete-then-update-same-commit.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-delete-then-update-same-commit.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">runTransaction when the update function swallows a read-after-write error</code><span class="compat-sub"><span class="compat-behavior">Production: runTransaction rejects <code>invalid-argument</code> and writes nothing, even when the update function catches the read-after-write error and returns. Pyric resolves with the returned value and commits the write. FW-6.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-client-checks.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-transaction-client-checks</code></a> key <code>swallowedReadAfterWrite</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-transaction-client-checks.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-transaction-client-checks.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">runTransaction error codes</code><span class="compat-sub"><span class="compat-behavior">Production fails read-after-write and update-after-missing-read with <code>invalid-argument</code>; pyric gives <code>failed-precondition</code> and <code>not-found</code>. FW-7.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-client-checks.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-transaction-client-checks</code></a> keys <code>readAfterWrite</code> and <code>updateAfterReadMissing</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-transaction-client-checks.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-transaction-client-checks.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">serverTimestamp() read from the pending local echo</code><span class="compat-sub"><span class="compat-behavior">Production's pending serverTimestamp echo is pending and reads null, or the estimate or prior value by option; pyric reads a resolved Timestamp. FW-10; also #1355.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-servertimestamp-pending-echo.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-servertimestamp-pending-echo</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-servertimestamp-pending-echo.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-servertimestamp-pending-echo.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">setDoc that the rules deny, made while the network is disabled</code><span class="compat-sub"><span class="compat-behavior">Production keeps a denied offline write pending with a local event, then rejects after reconnect; pyric rejects at once. FW-17.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-offline-denied-write.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-offline-denied-write</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-offline-denied-write.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-offline-denied-write.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">NaN, Infinity, -Infinity and -0 on the served planes</code><span class="compat-sub"><span class="compat-behavior">Production keeps NaN, Infinity, -Infinity and -0 on a server read, and <code>== NaN</code> matches only the NaN doc. The in-page sandbox agrees. On the SharedWorker and Node host planes they read back as null and 0. FP-1.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-non-finite-number-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-non-finite-number-roundtrip</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-non-finite-number-roundtrip.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-non-finite-number-roundtrip.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-non-finite-number-roundtrip.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-non-finite-number-roundtrip.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">QueryDocumentSnapshot.metadata.hasPendingWrites on the served planes</code><span class="compat-sub"><span class="compat-behavior">Production: only the doc with a pending write reports <code>hasPendingWrites</code> true. The served planes report each doc's own value from the in-page engine, which reports false on the written doc (FL-20), and they skip the first snapshot from the cache (#1355). FP-5 is fixed.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-doc-pending-writes.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-doc-pending-writes</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-query-doc-pending-writes.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-doc-pending-writes.test.ts</code></a>)</div></div>
+</details>
+</div>
+
 ## Current gaps
 
 ### Documented divergences
@@ -911,31 +983,72 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 
 <div class="compat-list">
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app, databaseId)</code><span class="compat-sub"><span class="compat-behavior">In the sandbox, <code>getFirestore(app, databaseId)</code> ignores the database id and returns the app's <code>(default)</code> handle, so documents written under one id are read under every other id.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> asserts two database ids return the <code>(default)</code> handle and that a document written under one id reads back under another.</div></div></details>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> asserts two database ids return the <code>(default)</code> handle and that a document written under one id reads back under another. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-absent.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-absent</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app, databaseId) (served mode)</code><span class="compat-sub"><span class="compat-behavior">The served <code>firebase/firestore</code> entry ignores the database id: the worker path returns the app's one handle and the in-page fallback delegates to the sandbox <code>getFirestore(app)</code>. The worker protocol carries no database id.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/composite-filters-served-entry.test.ts#L26" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/composite-filters-served-entry.test.ts</code></a> imports the served entry over a worker host, asserts <code>getFirestore(app, 'reports')</code> returns the app's handle, and reads the <code>(default)</code> documents through it.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">pyric-admin getFirestore(app, databaseId)</code><span class="compat-sub"><span class="compat-behavior"><code>pyric-admin</code> <code>getFirestore</code> takes no database id; a second argument is ignored and the handle reads and writes <code>(default)</code>. The Admin SDK's <code>getFirestore(app, databaseId)</code> selects the named database.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/firestore/named-database.test.ts</code></a> writes through <code>getFirestore(app, 'reports')</code> and reads the document through <code>getFirestore(app)</code> and <code>getFirestore(app, 'archive')</code>.</div></div></details>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/firestore/named-database.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/pyric-admin/test/firestore/named-database.test.ts</code></a> writes through <code>getFirestore(app, 'reports')</code> and reads the document through <code>getFirestore(app)</code> and <code>getFirestore(app, 'archive')</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-admin-mixing.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-admin-mixing</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Rules `match /databases/{database}/documents`</code><span class="compat-sub"><span class="compat-behavior">Rules evaluate the <code>database</code> path variable as <code>(default)</code> for every request, whatever database id the handle was created with. Production binds the named database's id.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> writes through a handle created for <code>reports</code>: a rule requiring <code>database == '(default)'</code> allows the write and a rule requiring <code>database == 'reports'</code> denies it.</div></div></details>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/named-database.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/pyric/test/firestore/named-database.test.ts</code></a> writes through a handle created for <code>reports</code>: a rule requiring <code>database == '(default)'</code> allows the write and a rule requiring <code>database == 'reports'</code> denies it. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-rules-api.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-rules-api</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-named-database-cross-database.json" target="_blank" rel="noopener noreferrer"><code>firestore-named-database-cross-database</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDocs(query)</code><span class="compat-sub"><span class="compat-behavior">Query-proof scope remains conservative. Equality and finite scalar in filters can pin candidate fields; array-contains proves the corresponding membership fact, not the whole array. Helpers and positive OR branches reduce to sufficient, candidate-independent residuals. Every finite combination (up to 30) must pass auth, query limits, and any lookup whose path is pinned by the query. Unpinned fields, candidate identity, dynamic document-dependent collections, unbounded range guarantees, and unsupported syntax remain deny-only gaps. Queries are never authorized by filtering stored rows. A collection-group query is authorized only by a top-level <code>list</code> or <code>read</code> rule at <code>match /{path=**}/&lt;collectionId&gt;/{id}</code> or <code>match /{document=**}</code> whose condition reads no path binding; any other shape, including a match nested in <code>match /{document=**}</code>, denies the query. This expanded local support has unit evidence and upstream documented semantics, but no new hosted observation.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Local query support: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/query-proof-application.test.ts#L10" target="_blank" rel="noopener noreferrer"><code>unit:firestore/query-proof-application.test.ts</code></a> covers finite membership, guardian array membership, pinned lookup paths, auth and limit controls, and adversarial array/lookup cases. Upstream semantics: firebase.google.com/docs/firestore/security/rules-query and firebase.google.com/docs/firestore/query-data/queries. Local diagnostic contract (#583): <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/query-proof-diagnostics.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:firestore/query-proof-diagnostics.test.ts</code></a> pins dynamic membership rejection, fallback attribution, constraint/residual distinctions, modular listener context, captured lifecycle errors, and immutable operation-summary proof metadata; this adds no production observation. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/rules/simulator/query-proof.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:rules/simulator/query-proof.test.ts</code></a> (function-inlining provable cases; full-accounting rejections for mixed equality + <code>in</code>/<code>get</code>/<code>hasOnly</code>/range/<code>is</code> shapes in inline and helper form; fail-closed classifier probes: bracket-access <code>resource['data']</code>, <code>exists()</code> keyed by <code>resource.data</code> through path-literal segments, slice access, <code>resource.id</code>, and an unrecognized node shape), <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/query-proof-enforcement.test.ts#L19" target="_blank" rel="noopener noreferrer"><code>unit:firestore/query-proof-enforcement.test.ts</code></a> (seeded end-to-end denials of the demonstrated attacks: forbidden-field absence check in member and bracket form, banned-owner <code>exists()</code> lookup, slice conjunct, each returning zero documents). Collection-group scope: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/collection-group-rules.test.ts#L18" target="_blank" rel="noopener noreferrer"><code>unit:firestore/collection-group-rules.test.ts</code></a> authorizes <code>getDocs(collectionGroup(db, 'items'))</code> under <code>match /{path=**}/items/{id}</code>, proves a data-gated rule from the query's equality, and denies under a rule for another collection id, a rule that reads the recursive binding, and concrete collection rules; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/sandbox/collection-group-rule-proof.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>unit:firestore/sandbox/collection-group-rule-proof.test.ts</code></a> pins the projection. Upstream semantics: firebase.google.com/docs/firestore/security/rules-query#secure_and_query_documents_based_on_collection_groups. No hosted collection-group query is captured; the production matcher verdicts for the same rule shape, from the Rules Test API, live in <code>oracle:rules-firestore-hierarchical-match-cascade</code>.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Query construction</code><span class="compat-sub"><span class="compat-behavior">Index validation against <code>firestore.indexes.json</code> — sandbox uses <code>LocalEnvironment</code>'s lint pass; prod has its own server-side validation</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">divergence: sandbox can mis-pass a query that prod would reject at the server with <code>failed-precondition</code> if no index exists</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Aggregates</code><span class="compat-sub"><span class="compat-behavior">Aggregates count documents server-side without paying read cost per doc in prod; sandbox computes locally (no cost model)</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">divergence: cost behavior differs, observable shape identical. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-count-aggregate-shape.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-count-aggregate-shape.json</code></a> — <code>getCountFromServer().data()</code> returns <code>{ count: &lt;number&gt; }</code> (single key, no other fields). Empty query returns <code>count: 0</code> (not <code>null</code>/<code>undefined</code>); seeded 3 docs returns <code>count: 3</code>; filtered query honors the <code>where</code> constraint (<code>count: 2</code>).</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">enableIndexedDbPersistence</code><span class="compat-sub"><span class="compat-behavior">Resolves before Firestore starts and rejects with <code>failed-precondition</code> after any operation has started the service</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused lifecycle coverage. Served planes: an accepted no-op that resolves after first use (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">enableNetwork / disableNetwork</code><span class="compat-sub"><span class="compat-behavior">Disabling network exposes local mutations with cache/pending-write metadata while holding write acknowledgement until network is re-enabled</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a>; replayed through the public modular API by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> and focused network coverage. Served planes: accepted no-ops, so an offline write commits at once (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/persistence-network.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>persistence-network.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">terminate</code><span class="compat-sub"><span class="compat-behavior">Terminates only the selected Firestore service instance: held refs reject with <code>failed-precondition</code>, owned listeners stop, and sibling Firestore or Auth services remain usable</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/firestore/firestore-browser-lifecycle.json</code></a> records <code>failed-precondition</code> on the terminated instance while Auth and a sibling Firestore instance continue. Replayed by <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; focused ownership coverage in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/terminate.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>terminate.test.ts</code></a>. SharedWorker: a no-op, so held refs keep working (FP-9).</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">initializeFirestore</code><span class="compat-sub"><span class="compat-behavior">Delegates to sandbox <code>getFirestore(app)</code> and returns the same handle. Accepts the <code>settings</code> argument (so the explicit-init pattern doesn't crash at import) but no-ops the cache/network settings — persistence is always on</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:firestore/tier1-cache-init-align.test.ts</code></a></div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">persistentLocalCache / memoryLocalCache / persistentSingleTabManager / persistentMultipleTabManager / memoryEagerGarbageCollector / memoryLruGarbageCollector</code><span class="compat-sub"><span class="compat-behavior">Config token accepted, inert — each returns a small tagged object so identity/usage doesn't crash. Persistence is the sandbox default; there is no cache tier left to configure</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L8" target="_blank" rel="noopener noreferrer"><code>unit:firestore/tier1-cache-init-align.test.ts</code></a></div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDocFromCache / getDocsFromCache</code><span class="compat-sub"><span class="compat-behavior">Explicit cache reads distinguish cold and warm state: cold document reads reject with <code>unavailable</code>, cold queries return empty, and server/default reads populate subsequent cache reads</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Real Chromium: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-browser-lifecycle.json" target="_blank" rel="noopener noreferrer"><code>firestore-browser-lifecycle.json</code></a> captures cold and warm document and query cache behavior; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-conformance.test.ts#L737" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a> replays it through public APIs. Served planes: reads the store, so a cold read resolves (FP-9). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>tier1-cache-init-align.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-served-surface.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>firestore-served-surface.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">setLogLevel</code><span class="compat-sub"><span class="compat-behavior">Accepted no-op. The sandbox has no modular-SDK-style logger to wire a level into. It uses host-level <code>console</code> logging directly, gated by <code>pyric sandbox</code>'s own flags, not this call</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/tier1-cache-init-align.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>unit:firestore/tier1-cache-init-align.test.ts</code></a></div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Writes and reads in flight at a hosted connection drop (web hosted client)</code><span class="compat-sub"><span class="compat-behavior">A Firestore write (<code>setDoc</code>, <code>updateDoc</code>, <code>deleteDoc</code>, a batch <code>commit</code>) or read (<code>getDoc</code>, <code>getDocs</code>) the web hosted client's socket had taken when it dropped fails once with <code>unavailable</code> and the message "The hosted sandbox connection was lost. Requests already sent may have completed; check state before retrying." It is not sent again. In production the Firestore Web SDK keeps a write in its mutation queue and sends it again on the next write stream until the backend acknowledges it, and answers a <code>getDoc</code> from its local cache, with <code>fromCache</code>, or fails it with <code>unavailable</code> when the document is not cached.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production behavior read from <code>@firebase/firestore</code> 4.14.1, as recorded in ADR-0019 ("Reads and writes are treated alike, unlike production"). <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts#L412" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts</code></a> drops a real loopback socket with <code>setDoc</code>, <code>getDoc</code> and <code>batchCommit</code> in flight and asserts each fails once with that message and reaches the host once. The Realtime Database follows its SDK here instead (row <code>rtdb-modular#HD1</code>, #1088).</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/firestore</code> in a server process reads and writes the host's documents under its rules as the process's signed-in user. An open listener keeps the process up; a finished write releases it at once. A CommonJS <code>require('firebase/firestore')</code> resolves the same client. An app whose options differ from the host's gets each call rejected with <code>app/multiple-configs-not-supported</code>, and nothing throws past the call. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a write the page and firebase-admin read, a CommonJS require, an app with other options rejected per call, and that a listener holds the process while a finished write does not. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L201" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a write the page and firebase-admin read, a CommonJS require, an app with other options rejected per call, and that a listener holds the process while a finished write does not. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L201" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getFirestore(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/firestore</code> in a server-rendered module reads and writes the host's documents under its rules as the SSR session's user: a write the rules deny for that user fails with <code>permission-denied</code>. <code>ssrLoadModule</code>, the environment runner and every <code>ssr.noExternal</code> setting share one app and one session. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> writes and reads the SSR user's own document, is denied another user's, reads the writes back with <code>firebase-admin</code> in SSR and in a process on the host, with each externalization setting, and refuses on a SharedWorker dev server. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L36" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">firebase-admin/firestore in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase-admin/firestore</code> in a server-rendered module reads and writes the dev server host's documents as admin, past the rules, as a <code>firebase-admin</code> process on the host does. On a SharedWorker dev server its first call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> reads a document the rules let only the SSR user read with <code>firebase-admin</code> in SSR through both loaders and with each externalization setting. On main (ba2c0bf0a) <code>firebase-admin</code> in SSR was the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app/ambient-init.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>ambient-init.test.ts</code></a> pins the ambient binding. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDocs / getAggregateFromServer on a shape that needs a composite index</code><span class="compat-sub"><span class="compat-behavior">Production fails a query or multi-field aggregation that needs a missing composite index with <code>failed-precondition</code>. Pyric runs it by design; only the served dev chip signals it, and two-range, OR and aggregate shapes get no signal. FL-30.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-composite-index-required.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-composite-index-required</code></a> (four shapes and two controls) and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> keys <code>multi</code> and <code>nullField</code>. Decided 2026-10-27: fix where production is clear; until then this row says they differ. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-composite-index-required.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-composite-index-required.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div></details>
+</div>
+
+### Bugs
+
+Behavior that should match production Firebase but currently does not.
+
+<div class="compat-list">
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAggregateFromServer(query, { n: count(), s: sum(field) })</code><span class="compat-sub"><span class="compat-behavior">Production: when count() is paired with sum(y), count includes only the docs that have y (3 of 4). Pyric counts every doc in the query (4). FL-27.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> key <code>countAndSumY</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">sum(field) / average(field) over NaN or Infinity</code><span class="compat-sub"><span class="compat-behavior">Production: sum and average over a field holding NaN return NaN, and over Infinity return Infinity. Pyric skips the non-finite values (sum 3 and average 1.5; sum 1 and average 1). FL-28.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-aggregate-field-semantics.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-aggregate-field-semantics</code></a> keys <code>nan</code> and <code>inf</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-aggregate-field-semantics.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-aggregate-field-semantics.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">where(field, 'in' | 'not-in' | 'array-contains-any', values) / or(...)</code><span class="compat-sub"><span class="compat-behavior">Production: getDocs fails with <code>invalid-argument</code> for <code>in</code> with 31 values, <code>not-in</code> with 11, <code>array-contains-any</code> with 31, or() with 31 branches, and 36 terms after normalization; 30 and 10 values succeed. Pyric runs every one. FL-29.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-disjunction-limits.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-disjunction-limits</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-disjunction-limits.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-disjunction-limits.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">onSnapshot: per-doc metadata.hasPendingWrites on the local-write echo</code><span class="compat-sub"><span class="compat-behavior">Production: the echo of a local write reports <code>hasPendingWrites</code> true on the doc, for a doc listener and for the doc inside a query snapshot, and only on the written doc. Pyric reports false on the doc. FL-20.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-listener-local-write-metadata.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-listener-local-write-metadata</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-doc-pending-writes.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-doc-pending-writes</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-listener-local-write-metadata.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-listener-local-write-metadata.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-query-doc-pending-writes.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-doc-pending-writes.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">QuerySnapshot.docChanges({ includeMetadataChanges: true }) on the ack snapshot</code><span class="compat-sub"><span class="compat-behavior">Production: the snapshot that acknowledges a local write lists the doc as <code>modified</code> with <code>hasPendingWrites</code> false. Pyric's list is empty. FL-21.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-listener-local-write-metadata.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-listener-local-write-metadata</code></a> key <code>qMeta</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-listener-local-write-metadata.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-listener-local-write-metadata.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">setDoc past the documented write limits</code><span class="compat-sub"><span class="compat-behavior">Production fails with <code>invalid-argument</code> past its write limits (1 MiB docs, reserved or 1,501-byte ids and field names, 501 transforms, 26 nested maps); pyric stores them. FW-14.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-server-limits.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-server-limits</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-write-map-depth-limit.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-write-map-depth-limit</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-write-server-limits.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-write-server-limits.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-write-map-depth-limit.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-write-map-depth-limit.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">runTransaction when the update function swallows a read-after-write error</code><span class="compat-sub"><span class="compat-behavior">Production: runTransaction rejects <code>invalid-argument</code> and writes nothing, even when the update function catches the read-after-write error and returns. Pyric resolves with the returned value and commits the write. FW-6.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-client-checks.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-transaction-client-checks</code></a> key <code>swallowedReadAfterWrite</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-transaction-client-checks.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-transaction-client-checks.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">runTransaction error codes</code><span class="compat-sub"><span class="compat-behavior">Production fails read-after-write and update-after-missing-read with <code>invalid-argument</code>; pyric gives <code>failed-precondition</code> and <code>not-found</code>. FW-7.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-transaction-client-checks.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-transaction-client-checks</code></a> keys <code>readAfterWrite</code> and <code>updateAfterReadMissing</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-transaction-client-checks.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-transaction-client-checks.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">serverTimestamp() read from the pending local echo</code><span class="compat-sub"><span class="compat-behavior">Production's pending serverTimestamp echo is pending and reads null, or the estimate or prior value by option; pyric reads a resolved Timestamp. FW-10; also #1355.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-servertimestamp-pending-echo.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-servertimestamp-pending-echo</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-servertimestamp-pending-echo.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-servertimestamp-pending-echo.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">setDoc that the rules deny, made while the network is disabled</code><span class="compat-sub"><span class="compat-behavior">Production keeps a denied offline write pending with a local event, then rejects after reconnect; pyric rejects at once. FW-17.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-offline-denied-write.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-offline-denied-write</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-offline-denied-write.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-offline-denied-write.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">NaN, Infinity, -Infinity and -0 on the served planes</code><span class="compat-sub"><span class="compat-behavior">Production keeps NaN, Infinity, -Infinity and -0 on a server read, and <code>== NaN</code> matches only the NaN doc. The in-page sandbox agrees. On the SharedWorker and Node host planes they read back as null and 0. FP-1.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-non-finite-number-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-non-finite-number-roundtrip</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-non-finite-number-roundtrip.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-non-finite-number-roundtrip.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/firestore/oracle-captures/firestore-non-finite-number-roundtrip.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-non-finite-number-roundtrip.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">QueryDocumentSnapshot.metadata.hasPendingWrites on the served planes</code><span class="compat-sub"><span class="compat-behavior">Production: only the doc with a pending write reports <code>hasPendingWrites</code> true. The served planes report each doc's own value from the in-page engine, which reports false on the written doc (FL-20), and they skip the first snapshot from the cache (#1355). FP-5 is fixed.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/firestore/firestore-query-doc-pending-writes.json" target="_blank" rel="noopener noreferrer"><code>oracle:firestore-query-doc-pending-writes</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/oracle-captures/firestore-query-doc-pending-writes.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>firestore-query-doc-pending-writes.test.ts</code></a>)</div></div></details>
 </div>