Ordered window starts two full-source reads after a signalling refetch with a NaN boundary #2221

Summary

An ordered live query issues two full-source reads after one signalling refetch. The law in the ordered-work oracle allows one. The window is descending with nulls: first, an anti-joined marker filters it, and one source row has a NaN rank, so the bounded boundary cannot be expressed.

The failure is on main. #2194 does not cause it. It changes the oracle's generator, so the seed reproduces only with the oracle file from #2194.

Law

The ordered-work oracle (packages/db/tests/query/ordered-work-oracle.property.test.ts) checks this rule: after a signalling refetch, the loader starts at most one full-source request. #2194 makes the law skip a bounded read that ends on a null or NaN rank, because ARCHITECTURE.md sends that boundary to the full-source fallback. Here the loader starts two full-source requests, not one.

Reproduce

1. Check out main (tested at 501b481).
2. Copy packages/db/tests/query/ordered-work-oracle.property.test.ts and packages/db/tests/oracle-config.ts from the ordered-loader-ledger branch (fix(db): keep overlapping ordered requests loading and release what they supersede #2194).
3. From packages/db, run:

TANSTACK_DB_ORACLE_SEED=-1142653059 npx vitest run --coverage.enabled=false \
  tests/query/ordered-work-oracle.property.test.ts \
  -t "keeps rows and per-change work bounded"

Result:

AssertionError: full-source requests after a signalling refetch at step 2: expected 2 to be 1

Counterexample:

{"path":"on-demand","provider":"refetch-signal","latency":"immediate","cancellation":"cooperative","peer":false,"filter":"anti-joined","via":"marker","indexed":false,"direction":"desc","nulls":"first","terms":1,"limit":2,"offset":0,"initial":[{"id":0,"rank":0,"eligible":true},{"id":2,"rank":NaN,"eligible":true},{"id":1,"rank":0,"eligible":false}],"history":[{"type":"delete-visible"},{"type":"move","offset":0,"limit":1}]}

Open question

The cause is not known yet. There are two possible causes:

• The exemption in the law is too narrow for a NaN rank at the start of a descending, nulls: first order.
• The loader starts a second full-source read that it does not need.

A fix must decide which one, with ARCHITECTURE.md as the authority, before it changes the law or the loader.

This issue was written by Isaac.