PR #2079: alias scope review at ad5e0108b

This audit evaluates the ten source-order claims in the external review of ad5e0108be85d221d4061a303da8fac47ce2d312. The repair is a follow-up diff on that head. The authority is packages/db/src/query/live/ARCHITECTURE.md §Identity and law 1: aliases are lexical, captured references retain their source, and compilation addresses Collection inputs by SourceId. The primary executable owner is packages/db/tests/query/includes-alias-shadowing-oracle.test.ts; the generated scope campaign is includes-oracle.property.test.ts.

Law, experiment, inference

Law and authority	What the owner previously proved	Decisive experiment	Inference and repair
A captured source and a child source remain distinct under ancestor shadowing (§Identity, law 1; items 01–05).	Existing direct, QueryRef, union, grouping, and spread cases covered selected placements, but did not combine an inner FROM alias with a later outer join, merge a joined QueryRef's inherited parent context beside a same-named local child, combine two same-name spreads, spread a grandparent's whole row, or select a captured alias directly.	At the public live Collection row after preload, the original implementation returned zero rows for an eager self-join, lost the child's title in a joined include, dropped parent spread fields, and read a child's row for direct parent selection. Renamed controls distinguished name collisions from ordinary joins. An adjacent unmatched LEFT join read the parent ID as the missing joined ID.	The missing dimensions were sibling source placement, matched and unmatched joined sides, simultaneous spread keys, whole-alias depth, and direct alias selection. The repair resolves the lazy source by ID, retains the local row when joining inherited context and clears a missing joined alias, makes temporary spread keys unique, collects binding-bearing whole-row refs, and lowers direct alias selection to its expression.
A keyed lazy demand reaches the exact lexical Collection source (§Identity and law 12; item 06).	The prior finite demand cases covered direct and wrapped includes, but not the outer join's self-join target with an inner source of the same alias and Collection.	The eager self-join was RED at the first public row. Replacing exact source resolution with the old recursive alias search in a temporary hostile mutant made that same assertion fail; the renamed control passed.	Alias text selected the inner source before the outer joined source. The target now follows a binding-aware ref to a SourceId. Other lazy join topologies remain an owner gap.
An include cannot reuse one builder's source declaration across ancestor and descendant scopes (§Identity, law 1; item 10).	Existing direct, QueryRef, union, and nested-include rejection cells exercise this rule; sibling reuse remains legal.	The reported new Query().from({ x: base }) still embeds base and its ancestor source declaration, so it must reject.	The guard is correct under the approved API rule. Error 233 now says to start the child from the Collection rather than pass the ancestor builder.

The new finite model joins plain source rows by role and applies ordinary object spread order. It does not use binding IDs, alias maps, compiler metadata, or the optimizer to predict rows. The driver builds public Query plans, preloads live Collections, and compares values and multiplicity at initial publication and the named source writes. The self-join crosses eager and controlled on-demand sync; the joined child and spread cases have a renamed control. The direct alias case crosses shadowed and renamed children. These are bounded witnesses, not a claim that every alias-scope path is closed.

The original implementation's public-row failures were captured before the production edits in /private/tmp/pr2079-selfjoin.log, /private/tmp/pr2079-join-red2.log, and /private/tmp/pr2079-red2.log. The first merge repair still failed the adjacent unmatched LEFT join's initial public-row comparison: joinedId was 1 instead of undefined. Clearing the absent joined alias passed initial, insertion, and deletion checkpoints. The source-ID hostile mutant failed the eager self-join public-row assertion in /private/tmp/pr2079-alias-mutant.log. The review's particular on-demand self-join failure did not reproduce with the finite source adapter: the on-demand cell passed before and after the repair. This does not refute a different provider schedule.

Lossless review ledger

The source review labels two items “7”; IDs 07 and 08 below preserve their source order.

ID	Claim and technical verdict	PR action	Durable value and destination
01	Inner FROM/outer JOIN alias reuse returns empty rows. Confirmed for the eager public path; the claimed on-demand failure was not reproduced with this controlled adapter. The flat alias maps are a plausible mechanism, but the demonstrated wrong target was recursive alias lookup.	Fixed-now for the reproduced topology using exact source resolution. No general alias-scope closure claim.	Self-join and renamed controls, eager/on-demand cells, source write: primary alias oracle. Other join-subquery and provider schedules: coverage map.
02	Joined parent context overwrites a same-name local child. Confirmed at the initial row; a renamed child passed. An unmatched LEFT join exposed the inverse error: the parent ID appeared as the absent joined ID.	Fixed-now by preserving local main-row aliases, adding the actual joined source, and clearing it when absent.	Child title after preload and update; missing/present/missing joined side: primary alias oracle.
03	Captured and local spread sentinels collide. Confirmed at the first child row; a renamed child passed.	Fixed-now using unique temporary keys and deterministic select-local rekeying.	Both fields after parent/child writes and repeated-build identity: primary alias oracle.
04	Grandchild whole-row spread loses a grandparent. Confirmed at the first public row.	Fixed-now by collecting binding-bearing single-segment external refs.	Grandparent row after preload and update: primary alias oracle.
05	Direct .select(() => capturedParent) reads the child. Confirmed under shadowing; renamed child returned missing data.	Fixed-now by retaining the captured expression under the spread sentinel.	Shadowed/renamed initial and post-write rows: primary alias oracle.
06	Lazy target search can choose the nested source by alias text. Confirmed as the wrong target behind 01's eager trace. The broad claim about all subscription shapes is unproved.	Fixed-now for this target path with binding-aware traversal and exact SourceId.	Primary alias oracle and lazy-target unit; other lazy topologies: coverage map.
07	A user-declared pure wrapper is retained and costs another stage. Structurally true.	Accepted-design for now: flattening its distinct binding would violate the approved identity rule; no binding-preserving flattening design is established.	The wrapper identity cell remains in the primary oracle. A future optimizer design must prove both identity and work.
08	Local refs perform parent-context metadata checks per row. Confirmed by the compiled closure and the earlier two-row/two-ref spy (four lookups); no elapsed-time or throughput conclusion follows.	Design-decision: whether a compile-time local/parent split earns its code and compatibility cost needs a work target. No correctness law is violated.	Performance opportunity in this record; compiler/evaluators.ts is the implementation owner.
09	Full-tree cache comparison and function-form misses. Confirmed: a temporary same-source work probe recorded two compiled entries for a shared structured child and three for the same child with fnWhere (including the outer query). The existing cache comparison test shows function-form plans return false.	Design-decision: whether to add an identity-safe function-form equivalence and how to bound comparison work. Reusing plans by path alone previously conflated lexical bindings.	Cache tests and compiler/query-equivalence.ts; preserve this work count before changing equivalence.
10	A fresh wrapper around an ancestor builder is rejected. Refuted as a product bug by the explicit ancestor/descendant source-declaration rule. The old error wording was misleading.	Accepted-design for the guard; fixed-now for error 233's instruction.	Existing rejection oracle and updated error fixture/docs.

Items 07–09 are work observations. No elapsed-time contract was inferred from them, and none justifies weakening source identity or cache equivalence.

Oracle guide audit

ORC-001: The architecture's lexical-binding and source-ID rules authorize the expected rows and demand target. The owner comments and this record bound the finite histories and excluded paths.
ORC-002: Expected rows come from plain source-role joins and JavaScript spread order, independent of the compiler's alias and binding machinery.
ORC-003: The executable owner states the law before mechanics and places the model, legal axes, public driver, and checkpoint explanations beside the tests. The new lazy-target unit is supporting code, not a second oracle.
ORC-004: The new cells are a finite matrix, not a new generated property. The eager/on-demand and shadowed/renamed controls ablate source mode and alias collision. The source IDs, two-level and three-level nesting, and initial/post-write cuts bound range. Same-scope duplicate aliases remain invalid in the existing validation owner. The unchanged generated campaign retains its own reconstruction, ablation, range, and exclusion audit.
ORC-005: createLiveQueryCollection and public toArray reach the claimed paths. Row comparisons preserve missing values and multiplicity; the lazy demand owner also compares provider requests.
ORC-006: The original implementation failed the new first-row comparisons for 01–05. The alias-only hostile mutant failed 01's public-row assertion, not a setup or timeout gate. No mutant is claimed for every additional topology.
ORC-007: The new cells are finite, so fixed/random campaign and replay obligations do not trigger for them. The existing generated owner still runs its fixed and random scope campaign.
ORC-008: The new models recompute from plain Maps or fixed rows; they do not add a stateful reference machine.
ORC-009: “Parent,” “child,” “manager,” and “joined source” denote source roles. Model rows do not encode production binding IDs or SourceId; those identify the production source implementing each role.
ORC-010: withHistoryCleanup retains the primary mismatch and cleans live queries and Collections. The RED evidence is assertion failure at the stated row cut. The tests do not shrink histories.
ORC-011: No named model/production shared semantic classifier remains: the role model never resolves aliases. Renamed-query controls add a separate metamorphic comparison, but do not replace the plain row model.
ORC-012: This exact-head record provides each applicable outcome and the non-applicable trigger reasons. It claims bounded repairs, not closure of the entire alias-scope class.
ORC-013: Shadowed and renamed controls distinguish lexical role from alias text; the alias-only mutant proves the public comparison detects the wrong boundary on the eager self-join. The on-demand schedule claim remains bounded to the controlled fixture.
ORC-014: Controlled on-demand sources establish this adapter's preload and write cuts only. A real-provider receiving witness for the review's on-demand schedule remains with the alias-scope coverage owner.

Remaining boundary

The covered contract × history × path × observation is lexical source identity for the finite self-join, joined include, two-spread, grandchild spread, and direct-alias selection histories at their public-row cuts, plus exact source-ID lazy targeting for the eager self-join. The coverage map retains arbitrary join-subquery topologies, deeper captured refs, RIGHT/FULL joins, temporal demand, and real-provider scheduling. Flat alias-keyed metadata remains in the compiler; the tested lazy path no longer relies on its alias-only target search. This record does not claim that every remaining metadata consumer is safe.

The reviewer found five real public-row errors and a related source-target error, with small distinguishing examples. That is high technical signal. The broad attribution to flat alias maps was incomplete, the on-demand claim was not reproduced in this fixture, and item 10's proposed guard removal conflicts with the approved contract. The performance items correctly identify work but do not establish a performance budget or safe replacement.

For reviewer quality, this is a hire recommendation: the review found several distinct public failures that the existing suite missed and supplied useful renamed controls. The reviewer should check approved API rules before proposing guard removal, and use work counts rather than timing claims for performance findings.

Verification of the repair diff

The bounded alias and lazy-target suite passed after the unmatched-join addition. The complete query runtime run passed 108 files and 4,490 tests with Vitest's integrated type check disabled; the separate TypeScript project check passed. The earlier integrated run passed 4,717 test assertions but could not write Vitest's temporary type-build file through a read-only dependency symlink. This is a tool-location failure, not an assertion failure.
The production error-message oracle passed 19 tests. The generated error-doc check, ESLint, Prettier, and git diff --check passed.
The final source simplification and unmatched-join fix were followed by the full query run above. The temporary cache work probe was removed; it is evidence of work, not a permanent performance law.