fix(sql): re-qualify derived-table output so joins don't cross-product (#66)

A join over two derived tables (`FROM (SELECT …) a JOIN (SELECT …) b ON
a.k = b.k`) silently degenerated to a cross product: the `SubqueryAlias`
arm dropped the alias, so the derived output columns had no qualifier and
both `a.k`/`b.k` fell back to the first bare `k` (col 0) — `k = k`, always
true.

Fix: the derived-table arm now re-qualifies the inner projection's output
columns with the alias. A new optional `Project.qualifier` (L2 + L3) stamps
the alias onto each output column during schema derivation; the common case
(the SELECT list already lowered to a Projection) is retagged in place with
no extra node, and the `SELECT *` / non-Projection case is wrapped in an
identity re-qualifying projection built from the sub-plan's field names.

Verified: `(SELECT k,v FROM m) a JOIN (SELECT k,v FROM n) b ON a.k=b.k` now
lowers the predicate to `Column(0) = Column(2)` (distinct), not
`Column(0) = Column(0)`. Two regression tests added (explicit-columns +
`SELECT *`); existing derived-table + join tests unchanged. Full workspace
suite green; clippy --all-targets clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: zz_y

crates/frontend-sql/src/sql/mod.rs

@@ -114,13 +114,44 @@ impl<'a> SqlLowerer<'a> {
                     // A *derived table* / inline view — `FROM (SELECT …) t`, the
                     // SQL counterpart of PromQL function nesting (an aggregate
                     // over an aggregate, a filter over a derived aggregate, …).
-                    // Lower the inner plan recursively; `lower_plan` already
-                    // handles every node a sub-`SELECT` can produce. The alias is
-                    // dropped — a qualified outer reference (`t.col`) resolves by
-                    // bare name against the derived output schema, the same
-                    // `Qualified → bare-name` fallback the converter's column
-                    // resolution already applies for joins (issue #27).
-                    other => self.lower_plan(other),
+                    // Lower the inner plan, then re-qualify its output columns
+                    // with the alias so `t.col` resolves to *this* relation — and,
+                    // critically, so a join over two derived tables disambiguates
+                    // its keys instead of both binding to the first bare-name
+                    // match (issue #66). The inner column *names* are unchanged;
+                    // only the qualifier is stamped.
+                    other => {
+                        let alias_name = alias.alias.to_string();
+                        match self.lower_plan(other)? {
+                            // The derived SELECT list already lowered to a
+                            // Projection — stamp the alias onto it, no extra node.
+                            L2::Project { cols, input, .. } => Ok(L2::Project {
+                                cols,
+                                qualifier: Some(alias_name),
+                                input,
+                            }),
+                            // Otherwise (e.g. `SELECT *` unwrapped to a scan) wrap
+                            // in an identity projection that re-qualifies each
+                            // output column. Names come from the sub-plan's schema.
+                            inner => {
+                                let cols = alias
+                                    .input
+                                    .schema()
+                                    .fields()
+                                    .iter()
+                                    .map(|f| L2ProjectItem {
+                                        alias: Some(f.name().clone()),
+                                        expr: L2Expr::Column(ColumnRef::Named(f.name().clone())),
+                                    })
+                                    .collect();
+                                Ok(L2::Project {
+                                    cols,
+                                    qualifier: Some(alias_name),
+                                    input: Box::new(inner),
+                                })
+                            }
+                        }
+                    }
                 }
             }
             other => Err(LoweringError::UnsupportedFeature(format!(
@@ -300,7 +331,11 @@ impl<'a> SqlLowerer<'a> {
                 _ => df_expr_to_l2(e).map(|expr| L2ProjectItem { expr, alias: None }),
             })
             .collect::<Result<Vec<_>, _>>()?;
-        Ok(L2::Project { cols, input })
+        Ok(L2::Project {
+            cols,
+            qualifier: None,
+            input,
+        })
     }
 
     fn lower_aggregate(&self, agg: &logical_expr::Aggregate) -> Result<L2, LoweringError> {

crates/frontend-sql/tests/sql_lowering.rs

@@ -327,6 +327,42 @@ async fn join_predicate_disambiguates_shared_column_name() {
     );
 }
 
+#[tokio::test]
+async fn derived_table_join_disambiguates_via_alias() {
+    // Issue #66: a join over two *derived tables* must bind its keys to distinct
+    // positions. Before the fix the derived output columns lost their qualifier,
+    // so `a.service` and `b.service` both fell back to the first bare `service`
+    // (col 0) — `service = service`, always true → a silent cross product.
+    // Concatenated: a[service,region] ++ b[service,region] → a.service=0, b.service=2.
+    let qe = lower(
+        "SELECT a.region, b.region \
+         FROM (SELECT service, region FROM hosts) a \
+         JOIN (SELECT service, region FROM hosts) b ON a.service = b.service",
+    )
+    .await;
+    let join = find_join(&qe).expect("expected a Join in the tree");
+    assert_eq!(
+        join_eq_columns(join),
+        [0, 2],
+        "derived-table join keys must bind to distinct positions, not both to the first `service`"
+    );
+}
+
+#[tokio::test]
+async fn derived_table_select_star_join_disambiguates_via_alias() {
+    // Same as above but `SELECT *` derived tables (the non-Projection path that
+    // wraps the inner plan in an identity re-qualifying projection).
+    let qe = lower(
+        "SELECT a.region, b.region \
+         FROM (SELECT * FROM hosts) a JOIN (SELECT * FROM hosts) b \
+         ON a.service = b.service",
+    )
+    .await;
+    let join = find_join(&qe).expect("expected a Join in the tree");
+    let [l, r] = join_eq_columns(join);
+    assert_ne!(l, r, "SELECT * derived-table join keys must not collapse to one column");
+}
+
 #[tokio::test]
 async fn self_join_disambiguates_via_aliases() {
     // A self-join shares *every* column name; the alias qualifiers (`a`/`b`) are

crates/ir/src/intent_algebra/query_expr.rs

@@ -272,6 +272,11 @@ pub enum QueryExpr {
     /// π — column projection.
     Project {
         cols: Vec<ProjectItem>,
+        /// Re-qualifies every output column with this table alias (a derived
+        /// table / inline view). `None` for an ordinary SELECT list. See
+        /// [`relational::QueryExpr::Project`](super::relational).
+        #[serde(default)]
+        qualifier: Option<String>,
         child: Box<QueryExpr>,
     },
 
@@ -515,7 +520,7 @@ impl QueryExpr {
             // is the explicit alias or a derived default. Projection may drop
             // the grouping/time columns, so unique_keys reset and time_index
             // is re-found by name.
-            QueryExpr::Project { cols, child } => {
+            QueryExpr::Project { cols, qualifier, child } => {
                 let in_schema = child.output_schema_in(scope)?;
                 let columns: Vec<Column> = cols
                     .iter()
@@ -526,7 +531,14 @@ impl QueryExpr {
                             .alias
                             .clone()
                             .unwrap_or_else(|| default_proj_name(&item.expr, i, &in_schema));
-                        Column::new(name, dtype, nullable)
+                        let c = Column::new(name, dtype, nullable);
+                        // A derived table re-qualifies its output columns with
+                        // its alias, so `t.col` (and a join over two derived
+                        // tables) resolves to the right relation.
+                        match qualifier {
+                            Some(q) => c.with_table(q),
+                            None => c,
+                        }
                     })
                     .collect();
                 let time_index = columns.iter().position(|c| c.name == "ts");
@@ -787,6 +799,7 @@ mod tests {
             vec![vec![0, 1]],
         );
         let q = QueryExpr::Project {
+            qualifier: None,
             cols: vec![
                 // bare column passthrough keeps its (schema) name + type: host=col 1
                 ProjectItem {
@@ -962,6 +975,7 @@ mod tests {
             vec![],
         );
         let q = QueryExpr::Project {
+            qualifier: None,
             cols: vec![
                 // value=col 1, ts=col 0
                 ProjectItem {

crates/l2/src/lower.rs

@@ -228,7 +228,11 @@ pub fn convert(
 
         // π — resolve each project item's expression to positional against the
         // child's schema.
-        LQueryExpr::Project { cols, input } => {
+        LQueryExpr::Project {
+            cols,
+            qualifier,
+            input,
+        } => {
             let child = convert(input, fallback, acc)?;
             let child_schema = child.output_schema()?;
             let cols = cols
@@ -242,6 +246,7 @@ pub fn convert(
                 .collect::<Result<Vec<_>, _>>()?;
             CQueryExpr::Project {
                 cols,
+                qualifier: qualifier.clone(),
                 child: Box::new(child),
             }
         }

crates/l2/src/relational.rs

@@ -143,8 +143,14 @@ pub enum QueryExpr {
 
     /// π — projection / SELECT list (SQL). Column refs in `cols` resolve by
     /// name against the child schema during conversion.
+    ///
+    /// `qualifier` re-qualifies every output column with a table alias — set for
+    /// a derived table / inline view (`FROM (SELECT …) t`), so an outer `t.col`
+    /// reference resolves to *this* relation and a join over two derived tables
+    /// disambiguates its keys. `None` for an ordinary SELECT list.
     Project {
         cols: Vec<L2ProjectItem>,
+        qualifier: Option<String>,
         input: Box<QueryExpr>,
     },