test: close remaining oracle contract and native execution gaps

[KyleAMathews]

Scope

Follow-up to the bounded oracle repair in #1808 / #1816. Preserve current contracts and useful tests. This is not a mandate to convert all ordinary tests or to add a universal model. Offline persistence/execution policy is owned by #1659.

Contract decisions

• Effect self-disposal. External disposal waits for in-flight handlers. Synchronous disposal inside a handler is allowed. A handler returning independent pending work and a handler awaiting its own disposal are different histories: waiting for the former can deadlock the latter. Choose the public rule before applying the candidate wait. Preserve abort, source release, shared disposal outcome and no post-disposal publications. Existing disposal behavior remains unchanged in test: strengthen oracle contracts and fix exposed boundary bugs #1816.
• Proxy native mutation and symbol writes. Decide Date/typed-array mutator and end-to-end symbol-key support versus a clear rejection. Existing standard live Map/Set iteration and supported detachment must remain. Compare actual stored rows, not just a helper result, and do not erase native edits through cloning. Audit IDs A05 R8/R10.

Real provider and host evidence

• Eight progressive cells: initial explicit snapshot/atomic transition, snapshot loading/swap, multiple snapshot predicates, incremental after swap, predicates during/after snapshot, snapshot dedupe, txid before/after swap, and cleanup/restart during snapshot. Electric's ready hook is after application and cannot prove the pre-publication phase. Use a conforming installed-SDK source gate before application and the original write's actual transaction identity. TrailBase supplies no progressive capability; an early-return pass is not evidence. Preserve existing partial witnesses and make unsupported capabilities explicit.
• 24 Electric move registrations: reconcile exact case execution and content/cleanup results from the service CI artifacts. The current PR's successful E2E job is evidence for the job, not proof of every callback-phase claim. Existing finite helper probes are not service framing evidence.
• Native host matrix: distinguish Node SQLite/PowerSync SDK, browser shims, Capacitor/Tauri app builds and actual device/host runs. The 113-law persisted manifest intentionally excludes progressive/move suites. Expo's native-mode skipped branch and unresolved app-specific type/build/runtime cells need explicit owners and receipts; do not infer them from shared registration tests.

Optional mechanics, after correctness boundaries

• Separate costly guarded-replay subprocess checks into a named campaign while keeping a real default execution smoke and false-target controls. Do not reintroduce progress starvation; yield only between completed histories/tests.
• Evaluate shared Capacitor/Tauri test-runner code only with both host builds and semantic/result-transport controls preserved. Identical text alone is not enough evidence.
• Optional cancellation/readiness corruption calibration, proxy construction-work budgets, and conditional full-payload top-K checks where a new promise requires them. Existing intentionally ID-only laws remain valid.
• An earlier review suggested consolidating three cleanup helpers without naming them. Recover exact targets before deciding; do not merge ownership semantics blindly.

Acceptance

For each selected item: contract source, legal distinguishing history, independently computed observation, real receiving path, positive reach and fault control, exact replay, cleanup evidence, explicit environment and run cost. Keep design decisions separate from reproduced defects. No deletion without a replacement law/path map.