School Advanced Scenarios in Seven Runtimes

For business-oriented examples, continue with Order workflows and its dated native execution receipts. The Order model revisions and their runtime qualifications are separate from the School results below, which remain the executable regression baseline.

The advanced suite extends the basic School example with the same model, five schools and one acceptance oracle. Every language has a complete native executable and a source-synchronized guide.

Recorded on 2026-10-27: 7/7 builds, 238/238 scenario assertions, and 7/7 complete SQLite checkpoint checks passed. All seven runtime suites pass every assertion. Java and Swift use published runtimes. Go and TypeScript keep their WORKSPACE PASS — RELEASE PENDING markers. Rust, Python and .NET now also require qualified workspace pagination fixes and remain RELEASE PENDING. The expanded qualified receipt records source identities, actual package resolution and database results. The previous 210/210 pagination receipt, previous 161/161 consistency receipt, previous 77/77 workspace receipt and earlier 76/77 receipt preserve the published TypeScript 0.3.1 failure. Workspace success does not upgrade that published-runtime result.

Each runtime now executes 34 scenarios: the previous 30 plus four transaction and concurrency checks per runtime. The model and five-school fixture are unchanged. Current Assist discovery and a zero-error, zero-warning model evaluation are recorded in the discovery ledger.

One dataset and oracle

The model retains Platform ID 1 and SchoolType constants PRIMARY (1001) and SECONDARY (1002). No model fields were added for these scenarios. The fixture supplies:

School	Type	Capacity	Active
Riverside Primary School	PRIMARY	800	Yes
North Primary School	PRIMARY	300	Yes
West Primary School	PRIMARY	500	Yes
Lakeside Secondary School	SECONDARY	1200	Yes
Hill Secondary School	SECONDARY	500	No

All schools share the fixture's address and establishment date. Each native program creates them through generated new-entity methods and audited saves. The expected results are independent of those implementations.

Check	Required result
Filtered page	Active, capacity at least 500: total 3; offset 1, limit 2 gives Riverside then West.
Loaded relations	Riverside → PRIMARY and Campus Learning Platform.
Group analytics	PRIMARY: count 3, sum 1600, average 533.3333333333334; SECONDARY: count 2, sum 1700, average 850.
Relation metrics	The same counts and sums on the two SchoolType parent records.
Two Facets	With only Riverside matched: include-all types PRIMARY: 1, SECONDARY: 0; matched-only PRIMARY: 1; platform count 1.
Per-parent Top-N	PRIMARY: Riverside, West; SECONDARY: Lakeside, Hill. Both requests are bounded; capacity descending and ID ascending break ties.
Audited update	Riverside changes to capacity 950, version 1 → 2.
Stale write	A separately loaded version-1 copy cannot overwrite capacity with 999.
Update readback	A fresh process reads capacity 950, version 2.
Soft delete	Hill disappears from normal queries and remains stored at version -2.
Deleted-row readback	A fresh process sees zero normal rows and exactly one deleted-only row.

Coverage priorities

The shared scenario catalog maps every assertion to a phase and documents the remaining gaps. This round adds observed continuous-cursor and retained-ID plans to the existing result checks.

Priority	Added scenario	Required result
P0	Positive, negative and two-level relation predicates	Match PRIMARY: North, Riverside, West; exclude it: Hill, Lakeside. Matching through SchoolType → Platform preserves the three primary results.
P0	Filtered child lists	Both parents remain. PRIMARY has an empty inactive list; SECONDARY has Hill.
P0	Blank query intent	A blank comment and a blank purpose each reject execution with an intent-related diagnostic.
P0	Groups after deletion	PRIMARY: 3 rows, sum 1750; SECONDARY: 1 row, sum 1200.
P0	Relation metrics after deletion	Counts and sums match the surviving School rows.
P0	Facets after deletion	Type counts 3 and 1; platform count 4, even though the page contains only Lakeside and Riverside.
P0	Ordinary children after deletion	PRIMARY: Riverside, West; SECONDARY: Lakeside.
P0	Deleted-only child lists	Both live parents remain: PRIMARY has an empty list, SECONDARY has Hill.
P1	Multiple pages and tied values	Page size 2 yields Lakeside/Riverside, Hill/West, North, then an empty page. Capacity descending, name ascending and ID ascending define the order; all four totals are 5.
P1	No-match page	Empty rows and exact total 0 with a nonzero offset.
P1	No-match Facets	Include-all retains both zero-count types; matched-only and platform Facets are empty.
P1	Filtered groups	Active capacity ≥ 500: PRIMARY count 2/sum 1300/average 650; SECONDARY count 1/sum 1200/average 1200.
P1	Continuous pages in ascending ID order	Read offsets 0, 2 and 4 in one trusted context. The first page uses OFFSET; the next two report CURSOR_SEEK without duplicates or omissions.
P1	Continuous pages in descending ID order	Traverse the same five Schools in reverse ID order and observe two CURSOR_SEEK plans.
P1	Continuous cursor miss and recovery	Start at offset 2 without a cursor: observe CACHE_MISS, then reuse its boundary at offset 4.
P1	Retained ID-set random page jumps	Build at offset 4, then jump to 0, 2 and 6. Preserve capacity/name/ID order, exact total 5 and ID_SET_HIT even for the empty tail.
P1	Retained empty ID set	Run the same unmatched predicate twice. Retain the empty set, report total 0 and transition from ID_SET_BUILD to ID_SET_HIT.
P1	ID-set safety-limit fallback	Set maxIds to 3 for five matching Schools. Observe LIMIT_EXCEEDED with a retained-count lower bound of 4; ordinary counted pagination still returns the correct page and exact total 5.
P1	ID-set predicate isolation	Use one namespace with capacity thresholds 500, 1000 and 500. Distinct predicates build separate sets; returning to 500 hits its original set with exact total 4.

These paths pass in all seven qualified runtimes. The remaining priorities have no School acceptance result yet:

Priority	Remaining coverage	Why this receipt is insufficient
P2	Pagination lifecycle and scope boundaries	TTL expiry, invalidation, store failure, concurrent construction, snapshot mutations and tenant/policy isolation are not yet shared School scenarios. Runtime-specific tests cover only some of these paths.
P2	Transaction lifecycle and stress	Cancellation, injected provider/commit faults, create/delete rollback and sustained concurrency stress need separate evidence.
P1	Value / loaded Null / NotLoaded projection contract	This non-null fixture covers loaded empty children, but does not compare null-only defaults and unselected fields across runtimes.
P2	Trusted tenant, identity and field policies	Blank intent rejection does not certify authorization or hard-limit enforcement.
P2	PostgreSQL/MySQL, migrations and browser/TFP	All recorded native executions use local SQLite.

Run it

Use the site checkout and the baseline toolchain prerequisites. The runner requires cargo-teaql 2.0.14, Python 3 for independent SQLite checks, and the selected language's native toolchain. It generates unchanged domain libraries, captures model evaluation and scoped Assist, installs the maintained application entry point, and builds the native application.

node scripts/school-examples.mjs --suite advanced --language java \
  --output artifacts/school-advanced/java-run

Select one language or omit --language for all seven. For the qualified Go result, select its source explicitly using the workspace setup:

node scripts/school-examples.mjs --suite advanced \
  --go-runtime ../teaql-golang --typescript-runtime ../teaql-ts \
  --rust-runtime ../teaql-rs-pagination --python-runtime ../teaql-python-pagination \
  --dotnet-runtime ../teaql-dotnet-pagination \
  --output artifacts/school-advanced/all-seven

Prepare the exact TypeScript workspace fix from the site checkout before that run:

git clone https://github.com/teaql/teaql-ts.git ../teaql-ts
git -C ../teaql-ts checkout e87b5d843a1bc2ae5f677f402b6b3177a7d40b50
git -C ../teaql-ts apply "$PWD/static/examples/school/advanced/runtime-fixes/typescript-deleted-rows.patch"

The expanded Go suite also needs the relation-isolation patch on the Go workspace base pinned by the baseline setup:

git -C ../teaql-golang apply "$PWD/static/examples/school/advanced/runtime-fixes/go-relation-query-isolation.patch"
git -C ../teaql-golang apply "$PWD/static/examples/school/advanced/runtime-fixes/go-id-set-observation.patch"

The recorded patch contains the runtime fix and eight SQLite regression cases. The runner installs the workspace's locked dependencies, builds and packs it, then installs the tarball under the generated teaql-ts dependency name without changing the generated manifest or domain library. It verifies the actual Node resolution, source commit, dirty state, source fingerprint, archive hash and installed package hash. Tracked dist/ products are fingerprinted separately from source. Use --typescript-runtime again when resuming; omission never silently selects local source. The package still reports version 0.3.1, so its source qualification is essential.

Prepare the additional pagination fixes on their recorded bases. These explicit workspace overrides are necessary for the 34-scenario result:

git clone https://github.com/teaql/teaql-rs.git ../teaql-rs-pagination
git -C ../teaql-rs-pagination checkout 12e3de7d99b6de16646bd353df7d52299743f176
git -C ../teaql-rs-pagination apply "$PWD/static/examples/school/advanced/runtime-fixes/rust-continuous-observation.patch"
git clone https://github.com/teaql/teaql-python.git ../teaql-python-pagination
git -C ../teaql-python-pagination checkout f216497a51aa5fb4eea0c2894c680ca8acad7904
git -C ../teaql-python-pagination apply "$PWD/static/examples/school/advanced/runtime-fixes/python-continuous-pagination.patch"
git clone https://github.com/teaql/teaql-dotnet.git ../teaql-dotnet-pagination
git -C ../teaql-dotnet-pagination checkout f3658d320215f5655aacdb7f028da42499649c8d
git -C ../teaql-dotnet-pagination apply "$PWD/static/examples/school/advanced/runtime-fixes/dotnet-continuous-pagination.patch"

The Rust override uses an external Cargo patch configuration and records all resolved TeaQL crate paths plus the binary hash. Python builds a wheel and compares every installed package file with the archive. .NET packs an isolated NuGet feed and compares the application runtime DLLs with those packages. Generated manifests stay unchanged; each receipt also records the source commit, dirty state and fingerprint. A version number alone does not qualify these builds.

Keep the same suite and runtime selection when resuming with --stage build or --stage verify. Generation requires a new output directory. Agents should follow the current Agent Kit provenance and scoped-Assist workflow, including TEAQL_SKILL_DIR when stamping the model through this runner. Generated domain source is never used for API discovery or patched to pass the checks.

Native guides and recorded outcomes

Runtime	Recorded runtime source	Scenario assertions	Guide and complete application
Java	Published 1.555-RELEASE	34/34 PASS	Guide · SchoolCheck.java
Rust	Workspace 12e3de7 + recorded pagination patch	34/34 WORKSPACE PASS — RELEASE PENDING	Guide · main.rs
TypeScript	Workspace e87b5d843a1bc2ae5f677f402b6b3177a7d40b50 + recorded deletion fix	34/34 WORKSPACE PASS — RELEASE PENDING	Guide · main.ts
Python	Workspace f216497 + recorded pagination patch	34/34 WORKSPACE PASS — RELEASE PENDING	Guide · main.py
Go	Workspace aed59b7babb30008e22a95f1234785d57f1797d2 + relation-isolation and ID-set observation patches	34/34 WORKSPACE PASS — RELEASE PENDING	Guide · main.go
C# / .NET	Workspace f3658d3 + recorded pagination patch	34/34 WORKSPACE PASS — RELEASE PENDING	Guide · Program.cs
Swift	Published 0.3.1	34/34 PASS	Guide · main.swift

Consistency corrections captured by these examples

• Result containers differ. Java grouped queries use aggregation(context).toList(). Rust relation metrics use typed lists and underscore-prefixed read-only aliases. .NET analytic records contain TeaQL Value wrappers, read through TryF64() and TryText(). The examples normalize these values only at the reporting boundary.
• Group keys are explicit. This TypeScript pair returns schoolType; Python, Go, .NET and Swift use school_type. Do not assume a group alias rewrites the returned key in every language.
• Top-N uses two parents. A single Platform could not detect a global limit incorrectly applied across all parents. The two SchoolTypes now catch that failure. SQLite may use bounded probes; a partition/window-only claim is unwarranted.
• Error text is not uniform. Java has ConcurrentModifyException. Python and .NET 0.3.1 report missing authoritative persisted state after the stale update affects zero rows. Both the thrown error and the unchanged persisted capacity are checked.
• Rust rejects blank intent during async execution. The negative example captures the generated panic at a Tokio task boundary and checks its diagnostic. Ordinary application queries still supply both comment and purpose.
• Go filtered child probes needed isolation. A shallow copy reused the existing AND predicate. With an inactive-child filter, the second probe gained both school_type = 1001 and school_type = 1002 and returned no Hill. The workspace fix uses the existing deep query clone; no application query or expected result was weakened. The original SQL failure and regression failure remain available.
• Assist coverage was incomplete. Local generator changes add seven-language relation count/SUM/AVG and bounded child guidance, Go forward child selectors, analytic result terminals and the required Swift Facet argument label. Generator regression tests pass locally; these Assist changes are pending deployment. Their status is separate from each runtime package's execution result.

Workspace fix and pending releases

TypeScript @teaql/teaql 0.3.1 stores Hill's tombstone correctly, but its SQL runtime unconditionally appends version > 0. The generated deleted-only request already asks for version <= -1, so the combined predicate returns no rows. The retained native SQL log shows both predicates and the actual {visible: 0, deleted: 0} result.

The workspace fix respects an explicit version condition at the current query level instead of appending a contradictory live-row condition. Queries without an explicit version condition retain the default version > 0. The same rule applies to membership subqueries, and a child's version filter cannot disable its parent's default visibility.

The expected deleted count remains 1. The qualified workspace now returns {visible: 0, deleted: 1} and passes the unchanged oracle after restart. Its runtime test record reports 612 tests passed and 6 live-database tests skipped because their external database URLs were not configured. The deletion-specific tests cover lists, counts, streams, relation loads, positive/negative subqueries and scope isolation.

This fix is not a published release. Keep TypeScript marked WORKSPACE PASS — RELEASE PENDING until the default command, without --typescript-runtime, passes against a newly released dependency. The earlier failure receipt and SQL log remain unchanged.

Go's separate WORKSPACE PASS — RELEASE PENDING qualification remains in force: published v0.3.1 lacks the generator's internal-ID APIs. This expanded run also requires the recorded relation-isolation and ID-set observation patches on base aed59b7. Its runtime regression record captures the failing-before/passing-after SQLite tests, including both parent orders, repeated execution, empty child lists and window/probe strategies. The receipt records the dirty source fingerprint and actual module resolution.

Pagination fixes and release status

The pagination patch manifest and runtime regression record retain the exact sources and test evidence. The first verification failures and .NET published-package diagnostic remain available.

Runtime	Gap repaired for this round
Rust	Registering a cursor after a nonzero-offset miss overwrote CACHE_MISS with FIRST_PAGE. The observation now retains the original fallback reason.
Python	The query accepted continuous-page options but SQLite did not execute a cursor plan. The runtime now retains bounded expiring cursors, seeks by ID, and exposes fallback observations. Count helpers also preserve ID-set overflow metadata.
.NET	Continuous-page methods were aliases for retained-ID pagination. They now have separate cursor state, ID seeking and observations. Count helpers preserve ID-set fallback metadata.
Go	An exact count after ID-set overflow replaced LIMIT_EXCEEDED with an aggregate-shape fallback. The original row plan and lower-bound count now survive.

All four fixes are WORKSPACE PASS — RELEASE PENDING. TypeScript's existing pending deletion fix remains required by the complete advanced suite. Java and Swift pass this round on their recorded published packages. These results are semantic SQLite checks, not performance benchmarks or a claim that all published packages pass.

The new local pagination Assist is tested for all seven languages and remains pending generator deployment.

Atomic rollback and concurrent writes

New scenario	Required evidence
Transaction commit	Platform name and School capacity 810 persist together at version 2.
Stale-child rollback	Independently commit School capacity 801/version 2. The stale graph writes Platform before its School conflict; rollback restores every Platform field and retains the competing School revision.
Concurrent same School	Two native processes both load version 1 before a shared barrier releases them. Exactly one commits; one rejects an optimistic conflict. Persist the actual winner's 811 or 822 at version 2.
Concurrent different Schools	Synchronized processes update Riverside and North; both commit 811 and 822 at version 2 without changing other records.

Every case uses a fresh SQLite backup of the same seeded School database. The read-only oracle checks complete before/after snapshots, including unchanged relations, IDs, creation times and all unrelated rows. Busy/locked errors fail verification and cannot stand in for an optimistic conflict. These four cases add 28 assertions, bringing the seven-runtime suite to 238/238.

Rust uses its public typed transaction scope and calls transaction.save_audited for both entities. Saving only the parent after modifying a loaded child clone does not save that clone; the first attempt is retained. Other runtimes use the loaded Platform graph's audited cascade. The seven-language composition Assist is locally tested and remains pending generator deployment. No additional runtime patch was needed for these four cases; all existing release-pending markers remain.

What the verification checks

The phases are bootstrap twice, seed, query, update, read-update, delete and read-delete. Each launches a new process; all 20 query scenarios and all six post-delete read scenarios are isolated so one failure cannot hide another. Native output contains actual result values, which the runner compares with the shared oracle. An error returns a nonzero exit code and preserves passing siblings, failing results and unrun cases.

The independent SQLite checker opens the database read-only. It checks integrity, foreign keys, exact business values, root and constant idempotence, versions, timestamps and tombstones. The runner also compares complete snapshots: reads must not mutate rows, updates must not affect other schools, and identity and creation time must survive. All seven runtimes pass these eight baseline checkpoints and four isolated mutation database checks in the recorded run, including TypeScript's stored tombstone and successful workspace readback.

This evidence covers SQLite, stale-child atomic rollback and two-process optimistic concurrency. Other providers, sustained concurrency stress, cancellation and provider/commit fault injection, browser/TFP paths, pagination lifecycle and tenant/policy isolation, migrations and access-policy integration remain outside this suite. The expanded CI matrix runs both basic and advanced suites for all seven runtimes and retains failure artifacts. The TypeScript advanced job checks out the recorded base, applies the recorded fix, and explicitly selects that workspace; its basic job still tests the published package. The Go advanced job applies both recorded Go patches and runs its runtime regression tests. The Rust, Python and .NET advanced jobs also select the recorded patched workspaces; their basic jobs continue to test published dependencies. No remote CI run is claimed here.

Keep documentation and evidence aligned

The scenario pages and advanced excerpts are synchronized from the executable sources. After changing an application, rebuild and rerun the affected runtime, refresh the expanded receipt, then regenerate the pages. The earlier 161/161 consistency and 77/77 workspace receipts and published failure receipt are retained separately. Checks reject source drift, missing runtime applications and missing query intent or audit reasons.

node scripts/write-school-advanced-evidence.mjs artifacts/school-advanced/2026-10-27
npm run sync:school-docs
npm run check:school-docs
npm run test:school-evidence