fix: recover join leaves poisoned by internal __bsl_jk_ temporaries

[hussainsultan]

The failure

A 6-table banking model (accounts + customers/bureau via join_one, transactions/balances/statements via join_many) over Snowflake-backed into_backend sources failed every read-back after cataloging:

Round-trip could not recover the left join table 'accounts': its dimension 'customer_id' does not resolve against the recovered table.

The model built cleanly and cataloged cleanly — it was only unusable at first from_tagged. Rebuilding the same model with globally unique physical column names round-tripped fine, which pointed at collisions.

Root cause (two ingredients)

1. Seamed leaves force whole-projection recovery. When a join leaf is an into_backend seam, its expression holds more than one relation (RemoteTable placeholder + payload), so _reconstruct_table cannot walk to a single base relation and keeps the lowered leaf projection as the model's table.
2. BSL's own lowering renamed the keys in that projection. With join-key names colliding across legs (customer_id in 3 tables, account_id in 4), SemanticJoinOp.to_untagged renames left predicate columns to __bsl_jk_<name> temporaries (the _RenamedResolver workaround for ibis ambiguous-deref). The recovered leaf then has __bsl_jk_customer_id but no customer_id, and _validate_join_leaf (correctly) raises.

Plain leaves (deferred reads, memtables, single DatabaseTables) recover via their base relation and never see the temporaries — which is why simple repros pass and only seamed + colliding models fail.

The fix

_strip_internal_join_temps inverts the reserved temporaries on the recovered leaf table, restoring the schema the model was authored against. Conservative by construction:

• only exact-prefix __bsl_jk_<name> columns whose original name is free are inverted;
• the __bsl_jk_<name>_N overflow spelling (a user column literally named __bsl_jk_<name> existed) is left alone rather than risk corrupting that user column.

Verified against the original failing field artifact: the broken catalog entry (91 dimensions, 75 measures) now fully recovers via .ls.builder and its queries lower.

Tests

test_xorq_join_leaf_recovery.py builds the collision model over memtable into_backend seams:

• round-trip recovery exposes all leaf dims/measures (fails on main, passes here);
• cross-leg query lowers against original names + one in-budget execution;
• user look-alike __bsl_jk_x column survives untouched.

Full suite: 1748 passed, 1 skipped, 11 xfailed, 4 xpassed.

Not addressed here (xorq-side): in-process into_backend seams only support a bounded number of reads per plan — cross-leg aggregates over seams can silently return empty/NaN or raise "Maximum number of readers". That predates this fix and reproduces on the never-serialized model too.

🤖 Generated with Claude Code

Second commit: leaf recovery preserves authored deferred shaping

155dcaf generalizes the fix from inverting one rename artifact to the underlying principle: recovery must not discard what the author wrote.

• _reconstruct_table previously walked every leaf to its bare base relation, so a model built dimensional-modeling style — conformed dimension/fact views shaped as deferred xorq expressions (.mutate(is_open=close_date.isnull())), thin semantic layer of names + simple reductions on top — failed round-trip at the first derived column. That forced all derivation logic into measure/dimension lambdas, the one layer with no authoring-time validation.
• Now a leaf that is a pure per-row chain over exactly one relation (no Aggregate, no JoinChain) is returned as-is: the chain IS the model's table. Query entries still dig under their aggregates; memtable leaves keep their conversion; preserved chains still get __bsl_jk_ temporaries inverted.
• _validate_join_leaf now quotes the underlying exception — a measure using an API this ibis lacks (the Column.filter field incident: AttributeError: 'StringColumn' object has no attribute 'filter' surfaced as a round-trip failure) names the real error and the fix direction instead of unconditionally blaming pre-aggregation.
• Known gap, marked strict-xfail: a lowered query entry over a shaped view still base-walks — query-time injected mutates and authored shaping are indistinguishable in the lowered tree; needs a lowering-time base-boundary marker (follow-up).

Verified: shaped single-table, shaped star joins, and full xorq build→load_expr→.ls.builder disk round-trips all recover and compute correct values. Suite: 1749 passed, 12 xfailed.