Ordered loader can drop the debt of an invalidation that arrives while a finished repair releases its leases #2222

Summary

A review of #2194 reported a possible defect in OrderedSourceLoader.finishOrderedPrefixRepair() (packages/db/src/query/live/ordered-source-loader.ts). No test reproduces it yet.

When a bounded repair finishes, the loader releases the leases that the repair superseded. Then it moves the work slot to idle with debt none. A release can run adapter code. That code can deliver an ordering invalidation, for example a loadedSubsets:invalidated report or an order-changing update. Then invalidateSourceOrdering() moves the ordering epoch while the repair still owns the work slot. The debt is already bounded, so it stays bounded. The final move then sets the debt to none.

Expected

An ordering invalidation that arrives during the release pass gets a bounded repair (ARCHITECTURE.md, "Ordered requests, continuation, and recovery").

Possible result

The loader drops the debt of the newer invalidation. The window can keep wrong rows until some other change invalidates the ordering.

Next step

Before a change, add a witness that fails. The request-authority oracle in packages/db/tests/query/ordered-source-loader-state-oracle.test.ts has release callbacks that reenter the loader. A release callback that calls invalidateSourceOrdering() during the repair's retirement pass reaches this history. Its progress law requires the next pass to issue a read.

A possible change: before the final move, compare the chain's epoch with the current ordering epoch, and keep the debt if the epoch moved.

This issue was written by Isaac.