Optional expiry for persisted demand coverage #2211

Problem

The persisted demand coverage proposal (#2102, item 1) lets the persisted wrapper settle an on-demand load from SQLite when that exact demand finished loading in an earlier session. Coverage stays valid until its persisted cache generation ends, or until a later load of the same demand settles.

After a demand is released, its source stops sending changes for it. A deleted or moved row keeps appearing in that demand's offline result until the demand loads again online. For many offline-first apps, the last complete result is the right answer. Others may want a bound on how old a covered result can be before the app stops trusting it offline.

Query DB already has this control for its own retention: persistedGcTime keeps a released Query's persisted rows for a TTL or until revalidated (#1380, #1400).

Proposal

Add an optional expiry to persisted demand coverage. Its shape should follow persistedGcTime:

• a finite duration measured from when the covered load settled, or from when the demand was released (to be decided);
• an "until revalidated" value, which is the default and today's proposed behavior.

An expired demand counts as uncovered. It waits for the network and is reported the same way as any uncovered demand.

Not doing yet

Do not implement this until a user asks for it. The default (valid until revalidated or until the generation ends) needs no option. This issue records the design so the coverage record keeps room for a timestamp.

Design notes

• Store the settlement time with the coverage record now, so that expiry can be added later without a storage migration.
• Decide whether Query DB's persistedGcTime should drive this expiry for Query Collections, or stay a separate row-retention control.
• An oracle law would add a clock to the persisted-readiness model: a covered demand settles from SQLite only while its coverage is unexpired at the load's start.

Related: #2102, #1380, #1955.