[dbccpage]

The streaming workbench previously mutated cochains even when its decision said to preserve or refuse an event. It now applies only accepted repairs, respects relation and predicate scope, validates active before-images against maintained boundary fields, handles empty/new/moving groups, and exposes per-region state and quantile receipts. Untracked status changes cannot invalidate later valid deletes. Applied repair receipts include per-region revenue and count deltas, including both sides of group moves; unapplied events have no repair payload.

Quantile insertion, deletion, split/merge, and invariant verification use exact half-open comparisons on stored float bounds. Adjacent representable values, including around zero, are tested in both input orders. Bucket identifiers are never used as membership evidence.

SQLite lowering preserves scalar storage types rather than stringifying values, and Python rejects missing/null required FD fields consistently with the SQL guards. docs/CORRECTNESS_SCOPE.md records supported input domains and remaining batch/runtime boundaries.

Validation at 8833e4c: 232 tests passed on Python 3.12 (34.36s) and Python 3.14 (29.32s); git diff --check passed. Forty additional regressions cover the three review findings, including independently replaying emitted grouped deltas and checking bucket membership through insertion/removal and rebalancing. The targeted suite reproduced all three defects before the implementation fixes. Hosted CI passed all five jobs on stacked PR #19 at 83300e4 (which includes correctness commit 8833e4c): Python 3.10/3.14 on Linux/Windows and isolated sdist-to-wheel installation. CI run.