Ordered loader keeps no handle to release a failed request from before a cursor reset #2223

Summary

A review of #2194 reported a possible lease leak in OrderedSourceLoader (packages/db/src/query/live/ordered-source-loader.ts). No test reproduces it yet.

A request that the loader issued before a cursor reset is dead after the reset. If a dead request succeeds, the loader records its lease in settledFiniteAcquisitions and later retires it. If a dead request fails, the failure handler returns before it records the lease in failedAcquisitions. Then the loader keeps no handle that can release the lease.

Expected

The loader or the truncate replay releases each acquisition exactly once (ARCHITECTURE.md, acquisition release rules).

Possible result

The subscription keeps the failed demand for replay, and the replay acquires it again. Nothing releases that demand until the subscription ends, so each later truncate replays it again. This causes more provider load and a leaked lease.

Next step

Before a change, add a witness that fails. The request-authority oracle in packages/db/tests/query/ordered-source-loader-state-oracle.test.ts does not judge requests issued before a truncate, because the replay owns them. A witness must decide which component owns a failed dead request's lease. It can be a named history: a page in flight, a truncate, a failure of the page, and then more truncates. It counts the releases for that demand.

This issue was written by Isaac.