fix(core): attach table generations only to failed reads that read records

[nickruigrok]

Follows up GRA-243 (#394). Fixes GRA-422.

StoreHost.#withGenerations attached the table's generation to every data error a read raised, including data.access_denied from readableTable, raised before any record is read. A handler that caught the refusal then depended on that table: while other callers kept committing to it, readConsistently reran it and answered query.concurrent_change instead of the fallback, or instead of the refusal itself.

Now the host hands the read a counted view of SQLite (RecordSql, exec only) and attaches the generation only when the read ran a statement before it failed. Errors raised before reading (access denied, unknown table or index, invalid query, an index SQLite refused) carry none; errors after reading (not_unique, result_limit, scan_limit, conflict, cursor_expired on a vanished anchor) still carry it, so the store-reader guarantee from #394 holds.

Tests, in workerd through the real store (apps/core/test/store-reader.test.ts):

• A handler catching data.access_denied while another caller commits to that table each run answers its fallback in one run.
• An uncaught refusal, with a commit to its table after it, fails with data.access_denied in one run.
• A read through an index a damaged store lacks, with a commit to its table after it, fails with data.index_required in one run: the read counts as having read only once SQLite accepted the statement.
• Existing "a read that fails after reading" (not_unique, then count across a commit) still reruns.

Mutation checks: attaching generations regardless of readRecords fails both new tests; never setting readRecords fails the not_unique rerun test and the "failed read's error" test; marking the read before exec instead of after fails the index_required test.

Accepted edge, noted in pagePlans: a cursor carrying only the record ID reads its anchor first, so a later data.index_required on a damaged store carries a generation and may rerun.

[nickruigrok]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

The PR attaches table generations to failed reads only after SQLite accepts a record statement.

• Failed reads count a table only after SQLite accepts a statement.

Acknowledged by nickruigrok: a cursor carrying only a record ID reads its anchor first. A later missing-index refusal therefore keeps its generation and may rerun; this damaged-store edge is intentionally accepted.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read request] --> B{SQLite accepts a record statement?}
  B -->|No| C[Data error without generations]
  B -->|Yes| D{Read succeeds?}
  D -->|No| E[Data error with table generation]
  D -->|Yes| F[Answer with table generation]
  E --> G[Reader checks for changes]
  F --> G
  C --> H[No dependency added]

Loading

_{Reviews (1) · Last reviewed commit: "fix(core): attach table generations only..." · Reviewed by Greptile}