[LeeroyHannigan]

What

extenddb_storage::ReadOptions { consistent_read } is passed as the last parameter of DataEngine::get_item, query and scan. Before this change the engine read the client's ConsistentRead for capacity accounting and dropped it; no backend could see it.

The engine passes the client's value on GetItem, Query and Scan (false when the member is absent), each table's own KeysAndAttributes.ConsistentRead on BatchGetItem, and true on the export scan, because an export reflects every write acknowledged before the export time. A read through a global secondary index reaches storage with false: the engine refuses ConsistentRead: true on a GSI before any storage call, on Query and on Scan, as the service does. A local secondary index read carries the client's value. transact_get_items is unchanged; the service has no consistency flag there and the reads reflect every acknowledged write.

The struct is #[non_exhaustive] with Default and const fn new(bool), following the VectorSearch parameter-struct precedent: a later per-read option is added as a field, the three signatures do not change again, and a Copy field that owns its data breaks no backend outside the workspace. The doc comment states the contract by what the read returns: with true the read reflects every write acknowledged before it started; with false it may miss recently acknowledged writes. A backend that serves every read from the copy that took the write meets both by ignoring the value; a backend with followers can serve false from a follower; a quorum backend needs read and write levels that intersect for true.

The SQLite, PostgreSQL, MongoDB and Cassandra backends accept the value and do not route on it. Each get_item carries a doc comment stating what that backend does with the flag today and what a routing change would need: SQLite holds one copy; PostgreSQL serves item reads and writes from the same data_pool; MongoDB refuses a non-primary read preference in the connection string, so every read goes to the primary; Cassandra reads at the driver default ONE and commits its base-row writes at ONE, so true is not honoured above replication factor 1 until both move to LOCAL_QUORUM. That Cassandra gap predates this change and is filed as its own issue.

Why

A backend on a database with more than one copy of the data (a MongoDB replica set, PostgreSQL with a streaming replica, a Cassandra keyspace) can serve ConsistentRead: false from a copy that lags and must serve ConsistentRead: true from one that does not. Without the flag at the storage layer the backend cannot tell the two reads apart, and an application that depends on ConsistentRead: true cannot be shown the difference against ExtendDB. ADR-0024 records the decision and the options considered.

Stacking

This branch is on main and is independent of the other open changes. It touches batch_get_item.rs, which #536 also edits; whichever lands second rebases, and the overlap is the call that passes the per-table value.

Testing done

Eleven engine tests run the handlers over a storage double that records every read with the options it received: GetItem with true, false and absent; Query and Scan with the three shapes on the table and on a local secondary index; BatchGetItem with one table asking for a consistent read and another sending false in one round and nothing in the other; a GSI Query and a GSI Scan reaching storage eventually consistent, and each refused before storage with the service's message when the client asks for true; the export handler, into a temp root removed by a Drop guard, scanning every page consistent. Negative controls, each on a clean committed tree and restored after: the batch handler treating a present false as consistent, every index Query reaching storage eventually consistent, the GSI Scan refusal disabled, and the export passing the default each fail the one test named for them; passing the default on GetItem, Query or Scan, passing true for every batch table, and the double dropping the index name each fail their test too.

The four backends' integration test call sites pass ReadOptions::default(). The PostgreSQL storage-level suite (the five test binaries CI runs: 90 tests) passed against a local PostgreSQL 16. The MongoDB and Cassandra suites run in CI; their changes are the added parameter at each call site and compile under clippy with all targets.

cargo +1.97.0 fmt --all -- --check
cargo +1.97.0 clippy --all-targets -- -D warnings
cargo +1.97.0 test -p extenddb-storage -p extenddb-engine -p extenddb-storage-sqlite -p extenddb-server -p extenddb-app   # 685 passed
EXTENDDB_TEST_PG_CONNECTION_STRING=... cargo +1.97.0 test -p extenddb-storage-postgres --test vector_control_plane --test put_create_race --test twi_conflict --test stream_shard_retention --test backup_restore   # 90 passed

Checklist

• I have read CONTRIBUTING.md
• All tests pass (cargo test --workspace --lib; the integration suites run in CI)
• Code is formatted (cargo fmt --check)
• Clippy is clean (cargo clippy --all-targets -- -D warnings)
• I have added or updated tests for new functionality
• I have updated documentation if behavior changed
• Breaking changes are noted below (if any)
• If this changes the wire protocol, Storage trait, auth model, on-disk
  format, or public CLI surface, an RFC has been accepted or is linked
  below. Otherwise, an ADR captures the decision (link below).

ADR / RFC: ADR-0024, read consistency reaches storage as a ReadOptions parameter. RFC-0002 records that the team maintains all backends and that Storage trait changes land across all of them at once, which this change does. The storage design (04-component-storage.md) describes the type under DataEngine and marks its PostgreSQL read replica section as a proposal; the high availability design (11-high-availability.md) gains status notes on section 8 and Stage 1, which this change completes in a different shape; the storage extension manual gains a Read options bullet under DataEngine.

Breaking changes

DataEngine::get_item, query and scan gain a required last parameter, opts: ReadOptions. A backend outside this workspace stops compiling until it adds the parameter; a backend that holds one copy of the data adds it and ignores it. No wire body, status, header or capacity number changes for any client.

---

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache License 2.0 and I agree to the Developer Certificate of
Origin (DCO). See CONTRIBUTING.md for details.