pub async fn run_atomic_unit(
access: &dyn SqlAccess,
plans: Vec<AtomicOpPlan>,
) -> Result<AtomicRunOutcome, AtomicRunnerError>Expand description
Run plans as ONE atomic unit (ADR-099 D1 commit pass): open a single
SqlAccess::atomic_unit, apply every plan’s statements under a named
SAVEPOINT (adr099_atomic_op_<n>), and commit all or roll back all.
This is the seam the atomic-unit suspend-free invariant governs (see
the module doc comment above). The closure built here drives only
AtomicOpPlan::plan_statements — plain DML — against the writer
atomic_unit hands it; it issues no transaction control of its own
(BEGIN/COMMIT/ROLLBACK are owned entirely by atomic_unit, exactly
like the existing execute_batch contract) beyond the per-op
SAVEPOINT/RELEASE/ROLLBACK TO statements, which are themselves
synchronous DML from SQLite’s perspective, not transaction boundaries the
storage layer needs to track.
On the first op whose plan fails (a guard mismatch or a genuine SQL
error), this function does not propagate a generic storage error for
that case: it unwinds just that op’s own SAVEPOINT (best-effort — the
outer atomic_unit transaction is rolled back in full regardless, per
ADR-099 D1) and returns Ok(AtomicRunOutcome::RolledBack { .. }) naming
the failing op and why. AtomicRunnerError is reserved for a failure
of the atomic_unit seam itself — the storage layer refusing or being
unable to run the call at all.