query-db: requestSnapshot caller abort leaves sole fetch live and publishes late rows #2162

Bug

Aborting the signal passed to a public subscription.requestSnapshot({ signal }) leaves a sole Query-backed acquisition active. Its provider fetch stays live, the returned load promise fulfills, and a row returned afterward becomes visible.

Reproduction

On PR #2158 at 28f9ed6aa, the cancels the final public snapshot acquisition on caller abort witness in packages/query-db-collection/tests/load-subset-lifecycle-oracle.test.ts uses a held provider result. After the caller aborts, the observed result is:

transport signal aborted: false
load promise: fulfilled
Collection rows: [{ id: "late" }]

The expected result is an aborted sole transport, a rejected load, and no late row. This is a public requestSnapshot path, not a direct _sync.loadSubset call.

Contract and repair boundary

The Collection sync-adapter guide requires request-scoped commits to honor the request abort signal. A shared physical Query must remain live while another acquisition owns it, so abort handling must distinguish the caller's acquisition from the Query's remaining owners. A direct attempt to unload on every acquisition-signal abort broke three existing cleanup/peer histories: Core also aborts that signal during ordinary release, before invoking unloadSubset.

The load-subset lifecycle oracle should cover both sole and peer owners at the caller-abort cut, plus abort after commit acceptance. The existing held-fetch peer tests abort and explicitly unload together, so they do not isolate caller abort. Keep the sole-owner witness as an expected failure until the ownership boundary is repaired.