Query DB loses or retains rows across reentrant final-owner cleanup #2160

Contract

When Query DB releases the final acquisition lease, it must not retain that lease's row ownership. If a public callback synchronously starts a new acquisition during cleanup, the new acquisition must keep its own rows until its lease is released. A fulfilled subset load must have its applied row visible.

Reproductions

Three public histories fail against e392ab2d0 on PR #2158. They are in packages/query-db-collection/tests/load-subset-lifecycle-oracle.test.ts as expected-failure tests.

1. getKey unsubscribes the final owner while a result is being applied. Its load rejects and the row is absent. A later, distinct filtered acquisition gets its row, but that row remains visible after the later acquisition unloads. This leaves hidden ownership.
2. A wrapping sync holds a result commit. Releasing the final owner aborts the commit signal; its abort listener synchronously acquires a new owner. The new load fulfills, but its row is absent.
3. A Query-cache observerRemoved listener synchronously acquires a new owner during cleanup. Its load fulfills, but its row is absent.

The tests exercise real Collection subscriptions, requestSnapshot, Query Core observers, and public Collection rows. On the pushed implementation, all three fail at their named row assertions. The test fixture's filtered response satisfies its group = 'g' predicate.

Suggested acceptance boundary

Make each of these histories pass without leaving a row after its final owner unloads. Keep the first caller's canceled load rejected and the reentrant caller's successful load tied to an applied row. A local attempt to defer acquisitions while a Query was retiring fixed the getKey and observerRemoved witnesses but still lost the row in the abort-listener witness, so that attempt is not part of PR #2158.