fix(exec): eagerly reject a bad column in a window OVER PARTITION BY / ORDER BY

A bad column reference in a window `OVER` clause's `PARTITION BY` / `ORDER BY`
(or a named `WINDOW …` definition) is a prepare-time `no such column` in SQLite,
raised even over an empty or fully-filtered table. graphite's eager column
validators bailed on any window query, and the VDBE window execution path
bypasses them too, so this was resolved only lazily, per row — missed when no
row is reached.

A window partition/order term binds strictly to a base column of the `FROM`
(never an output alias — `PARTITION BY <alias>` is `no such column` in SQLite),
so the new `validate_window_over_columns` resolves each term against the source
schema (metadata only, no row scan) with no alias-scope subtlety. It gathers
every window spec — the `WINDOW`-clause definitions plus each window function's
inline `OVER` spec in the projection and top-level `ORDER BY` — and is wired into
both `run_core`'s validator block and the `run_select_vdbe` window path (which
otherwise bypasses it). Conservatively limited to plain base-table / view
sources. Verified vs sqlite3 3.50.4 (`tests/eager_window_over_columns.rs`).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

ROADMAP.md

@@ -1518,8 +1518,9 @@ reasonable order:
    pass for lazy-validation gaps is **essentially done**: a 2026-07 exhaustive
    differential sweep (subqueries, derived tables, CTEs, USING/NATURAL, GROUP BY /
    HAVING, ORDER-BY subqueries, compound arms, DML/RETURNING/upsert, INDEX/CHECK
-   expr — all over empty/filtered input) found only one residual, the FROM-less
-   multi-row `VALUES`-in-`IN` case, now closed too. Only compound bodies with
+   expr — all over empty/filtered input) found three residuals, all now closed: the
+   FROM-less multi-row `VALUES`-in-`IN` case, the LHS of a nested `IN (SELECT)`, and
+   window `OVER` `PARTITION BY` / `ORDER BY` columns. Only compound bodies with
    per-arm `FROM`s remain deliberately lazy.
 6. **`EXPLAIN QUERY PLAN` fidelity (Track B) — essentially closed.** The whole B9
    cluster shipped in 2026-07 (B9a incl. the seekable-`IN` render, B9c–B9g, the B9d

src/exec/mod.rs

@@ -1434,6 +1434,11 @@ impl Connection {
                 for (_, spec) in &sel.window_defs {
                     reject_window_in_windowspec(spec)?;
                 }
+                // A bad column in a window `PARTITION BY` / `ORDER BY` is a
+                // prepare-time `no such column` in SQLite, but this path bypasses
+                // `run_core`'s eager validators, so re-check it here (else the query
+                // would run and silently return rows over an empty/filtered input).
+                self.validate_window_over_columns(sel)?;
             }
             return self.run_window_vdbe(sel);
         }
@@ -20014,6 +20019,7 @@ impl Connection {
         if self.outer_scope.borrow().is_empty() {
             self.validate_nested_ambiguity(sel, &columns)?;
             self.validate_columns_exist(sel, &columns)?;
+            self.validate_window_over_columns(sel)?;
             self.validate_derived_columns(sel, &columns)?;
             self.validate_join_derived_columns(sel)?;
             // A column reference inside an expression-position subquery body that
@@ -21023,6 +21029,102 @@ impl Connection {
         }
     }
 
+    /// Eager `no such column` check for the `PARTITION BY` / `ORDER BY` terms of a
+    /// window `OVER` clause (and named `WINDOW …` definition).
+    /// [`Self::validate_columns_exist`] bails on any window query, so its column
+    /// references were resolved only lazily and missed over an empty/filtered
+    /// input. A window partition/order term binds strictly to a base column of the
+    /// `FROM` (never an output alias — `PARTITION BY <alias>` is `no such column`
+    /// in SQLite), so it resolves against the scanned source `columns` exactly like
+    /// the base-column targets. Conservatively limited to plain base-table / view
+    /// sources (a subquery / TVF / vtab / `NATURAL`/`USING` source bails, never a
+    /// false positive).
+    fn validate_window_over_columns(&self, sel: &Select) -> Result<()> {
+        if !window::has_window(sel) {
+            return Ok(());
+        }
+        let Some(from) = &sel.from else { return Ok(()) };
+        let mut srcs = alloc::vec![&from.first];
+        for j in &from.joins {
+            if j.natural || !j.using.is_empty() {
+                return Ok(());
+            }
+            srcs.push(&j.table);
+        }
+        // Resolve the base column set from schema metadata (no row scan, so the
+        // check is cheap even when the VDBE window path calls it before executing).
+        // Any source that can't be resolved from metadata alone — a subquery, TVF,
+        // schema-qualified, or virtual table — bails the whole check (never a false
+        // positive).
+        let mut columns: Vec<ColumnInfo> = Vec::new();
+        for s in &srcs {
+            if s.subquery.is_some()
+                || s.tvf_args.is_some()
+                || s.schema.is_some()
+                || s.name.is_empty()
+            {
+                return Ok(());
+            }
+            let Some(cols) = self.source_columns_of(s) else {
+                return Ok(());
+            };
+            let label = s.alias.clone().unwrap_or_else(|| s.name.clone());
+            for (name, _) in cols {
+                columns.push(ColumnInfo {
+                    name,
+                    table: label.clone(),
+                    schema: None,
+                    affinity: eval::Affinity::Blob,
+                    collation: crate::value::Collation::Binary,
+                    hidden: false,
+                });
+            }
+        }
+        let columns = &columns[..];
+        // Every window spec in play: the `WINDOW`-clause definitions plus each
+        // window function's inline `OVER (…)` spec found in the projection or the
+        // top-level `ORDER BY`. `window::visit` stops at nested subqueries (they
+        // validate their own specs), so only this query level is gathered.
+        let mut specs: Vec<WindowSpec> = sel.window_defs.iter().map(|(_, s)| s.clone()).collect();
+        let gather = |e: &Expr, specs: &mut Vec<WindowSpec>| {
+            window::visit(e, &mut |m| {
+                if let Expr::Function {
+                    over: Some(spec), ..
+                } = m
+                {
+                    specs.push(spec.clone());
+                }
+            });
+        };
+        for rc in &sel.columns {
+            if let ResultColumn::Expr { expr, .. } = rc {
+                gather(expr, &mut specs);
+            }
+        }
+        for t in &sel.order_by {
+            gather(&t.expr, &mut specs);
+        }
+        let mut parts: Vec<&Expr> = Vec::new();
+        for spec in &specs {
+            windowspec_parts(spec, &mut parts);
+        }
+        let mut missing: Option<Error> = None;
+        for e in parts {
+            if missing.is_some() {
+                break;
+            }
+            walk_shallow_columns(e, &mut |schema, table, column, quoted| {
+                if missing.is_none() && !column_resolves_scoped(columns, schema, table, column) {
+                    missing = Some(eval::no_such_column(schema, table, column, quoted));
+                }
+            });
+        }
+        match missing {
+            Some(e) => Err(e),
+            None => Ok(()),
+        }
+    }
+
     /// Eager `no such column` check for a query whose *sole* `FROM` source is a
     /// derived table (a parenthesized subquery), the counterpart of
     /// [`Self::validate_columns_exist`] for a case that one bails on. SQLite

tests/eager_window_over_columns.rs

@@ -0,0 +1,66 @@
+//! A bad column reference in a window `OVER` clause's `PARTITION BY` / `ORDER BY`
+//! (or a named `WINDOW …` definition) is a prepare-time `no such column` in
+//! SQLite — raised even over an empty or fully-filtered table. graphite's eager
+//! column validators bailed on any window query, and the VDBE window path also
+//! bypasses them, so this was caught only lazily. A window partition/order term
+//! binds strictly to a base column of the `FROM` (never an output alias), so it
+//! resolves against the source schema. Verified against sqlite3 3.50.4.
+
+#![cfg(feature = "std")]
+
+use std::process::Command;
+
+fn sqlite3_available() -> bool {
+    Command::new("sqlite3").arg("--version").output().is_ok()
+}
+
+fn rejects(bin: &str, base: &str, sql: &str) -> bool {
+    let full = format!("{base} {sql}");
+    let out = Command::new(bin)
+        .arg(":memory:")
+        .arg(&full)
+        .output()
+        .unwrap();
+    let mut s = String::from_utf8_lossy(&out.stdout).into_owned();
+    s.push_str(&String::from_utf8_lossy(&out.stderr));
+    s.to_lowercase().contains("error")
+}
+
+#[test]
+fn window_over_column_validation_matches_sqlite() {
+    if !sqlite3_available() {
+        eprintln!("sqlite3 CLI not found; skipping");
+        return;
+    }
+    let g = env!("CARGO_BIN_EXE_graphitesql");
+    let empty = "CREATE TABLE t(a, b);";
+    let full = "CREATE TABLE t(a, b); INSERT INTO t VALUES(1, 2), (3, 4);\
+                CREATE TABLE u(c, d); INSERT INTO u VALUES(1, 9);";
+    let cases = [
+        // Bad column in an OVER clause → rejected (empty table, so caught eagerly).
+        (empty, "SELECT sum(a) OVER (PARTITION BY zzz) FROM t"),
+        (empty, "SELECT sum(a) OVER (ORDER BY zzz) FROM t"),
+        (empty, "SELECT sum(a) OVER (PARTITION BY a ORDER BY zzz) FROM t"),
+        (empty, "SELECT sum(a) OVER w FROM t WINDOW w AS (PARTITION BY zzz)"),
+        (empty, "SELECT 1 + sum(a) OVER (PARTITION BY zzz) FROM t"),
+        // An output alias is NOT a valid window partition/order term.
+        (full, "SELECT a AS x, sum(b) OVER (PARTITION BY x) FROM t"),
+        // Valid — must not be a false positive.
+        (full, "SELECT sum(a) OVER (PARTITION BY b ORDER BY a) FROM t"),
+        (full, "SELECT sum(a) OVER (PARTITION BY a + 0) FROM t"),
+        (full, "SELECT sum(b) OVER (PARTITION BY rowid) FROM t"),
+        (full, "SELECT sum(b) OVER w FROM t WINDOW w AS (ORDER BY a)"),
+        (
+            full,
+            "SELECT t.a, sum(d) OVER (PARTITION BY t.b) FROM t JOIN u ON t.a = u.c",
+        ),
+        (full, "SELECT row_number() OVER (ORDER BY a), a FROM t ORDER BY a"),
+    ];
+    for (base, q) in cases {
+        assert_eq!(
+            rejects("sqlite3", base, q),
+            rejects(g, base, q),
+            "reject-parity for `{q}`"
+        );
+    }
+}