plan/spec: the operator corpus goes green

102/102. PLAN's M3 row now names both corpora as the gate, because neither the
pinned crud suite nor e2e3/e2e4 can see this work: the eight operators are
barely in the pinned corpus and `$push`'s modifiers are not in it at all.

§6 records what the corpus found that was nobody's operator -- an upsert never
reporting the `_id` it generated -- and the three things left open on purpose:
`$bit`, a multi-field `$sort` key inside `$push`, and the 64-path bound on the
conflict check.

Full matrix at this commit: 247/247 unit tests in ReleaseFast and ReleaseSafe,
83/83 fuzz, operators 102/0, positional 51/0, aggregation 70/0, pinned crud
218/73/196 unmoved, e2e and crash-fuzz green.

PLAN.md

@@ -467,7 +467,7 @@ answers, and the trade is only acceptable because the lie is removed first.
 | M1 | **Cursors + wire polish** | getMore / killCursors / batchSize; server-side cursor state with idle timeout; sessions plumbing (lsid accepted) as drivers send it; hello advertisement updates; **`moreToCome` on requests** (see the bug below); command-monitoring assertions in the spec runner | crud spec suite green; e2e green |
 | M2 | **The `aggregate` command surface** | `$out` and `$merge` (7 of the 13 failures), and refusing every pipeline construct the engine does not implement instead of answering `0` (amendment A6). The other 6 failures are blocked on M2.5, M4 and M8 — see `docs/M2_DESIGN_REVIEW.md` §7 | `aggregate-*.json`: 0 fail among the 7 reachable cases |
 | M2.5 | **The aggregation engine** | expression evaluator, per-stage document iterator, the accumulators, `$unwind`; `$lookup`/`$facet` explicitly out of the first cut (amendment A6) | a purpose-built stage corpus, every expectation measured against mongod |
-| M3 | **Update operators + index types** | `distinct` (**done**); positional paths refused rather than destructive (**done**); `$`/`$[]`/`$[<ident>]` + `arrayFilters` implemented (**done**); then $setOnInsert, $addToSet, $mul, $min/$max, $pop, $pullAll, $currentDate, pipeline updates; partial + hashed indexes | `tests/spec/positional/` 0 fail (51 cases, recorded from mongod — **green**; the named gate could not see this work, see below); remaining crud coverage; e2e3/e2e4 green |
+| M3 | **Update operators + index types** | `distinct` (**done**); positional paths refused rather than destructive (**done**); `$`/`$[]`/`$[<ident>]` + `arrayFilters` (**done**); $setOnInsert, $addToSet, $mul, $min/$max, $pop, $pullAll, $currentDate + `$push`'s modifiers (**done**); then pipeline updates; partial + hashed indexes | `tests/spec/positional/` 0 fail (51 cases) and `tests/spec/operators/` 0 fail (102 cases), both recorded from mongod — **green**; the named gate could not see either, see below; remaining crud coverage; e2e3/e2e4 green |
 | M4 | **Sessions + transactions** | logical sessions, snapshot isolation on the mmap engine, write concern at commit | sessions + transactions spec suites green |
 | M5 | **Change streams** | change feed + resume tokens (likely log-seq based), getMore integration | change-streams spec suite green |
 | M6 | **Admin/ops commands** | dbStats, collStats, serverStatus, ping, buildInfo, listDatabases filters, dropDatabase durability (log it) | mongosh UX smoke; e2e green |
@@ -1123,6 +1123,28 @@ has to be its own commit with its own re-recorded scorecard.
     agrees. Worth one commit, and it needs its own measurements first: the
     padding case (`y.3.b` past the end) is a *legal* creation on mongod, so
     the fix is not "refuse a non-document element".
+- **M3's second corpus is `tests/spec/operators/`.** The eight operators PLAN
+  §3 names all answered `bad update` with code 2, one message for every
+  question — and `$push`'s `$slice`, `$position` and `$sort` were parsed,
+  accepted and *dropped*. `{$each: [3, 4], $slice: -3}` appended both values,
+  sliced nothing and answered ok: 1 with modifiedCount: 1, which is the same
+  class of wrong answer the positional operators were. 102 cases, recorded red
+  at 18/84 and driven green.
+
+  It found one thing that was nobody's operator: **an upsert never reported the
+  `_id` it generated**. `Engine.insert` writes a generated `_id` into the bytes
+  and leaves the caller's tree without it, so `upsertedId` came back null and
+  `findOneAndUpdate` with `returnDocument: after` returned a document with no
+  `_id` — the only name the client has for a document it has never seen. Fixed
+  in `build_upsert_doc`; the pinned crud corpus never noticed because its
+  upsert cases match `upsertedId` loosely.
+
+  Left open, measured and deliberate: `$bit` is not implemented (mongod has it,
+  no driver in `tests/` sends it, and it is not in the M3 row); `$sort` inside
+  `$push` accepts only a one-field key document, where mongod allows several;
+  and the conflict check stops after 64 distinct paths in one update rather
+  than refusing a legal wide update.
+
 - **M3 update operators** — open. `distinct` landed first because it was a
   whole missing command with no dependencies, and measuring it turned up three
   things worth keeping, none of which are `distinct`'s to fix: