perf(planner): read a covering index for a no-seek WHERE scan

When a query's `WHERE` seeks no index (no equality/range on any index's leading
column), SQLite still reads from a covering secondary index if one holds every
column the query references — both projected and `WHERE`-tested — and is narrower
than the table, filtering in the index (`SCAN t USING COVERING INDEX <ix>`)
rather than scanning the table. graphite previously declined any covering scan
once a `WHERE` was present.

`covering_scan` now handles the `WHERE` case, gated so it never steals the
`SEARCH` path: it applies only when `eqp_access` would render a bare `SCAN`
(i.e. no seek). This keeps the plan renderer and the executor in lockstep — the
EQP chain consults `covering_scan` before the seek renderer, while the executor
reaches it only after its own seek attempts fail. Column coverage already
includes the `WHERE` clause, and the same strictly-narrower width test applies.
The covered scan's row order (index order) matches SQLite. Verified plan and rows
against sqlite3 3.50.4 (`tests/eqp_covering_scan_where.rs`), including seekable
`WHERE`s correctly staying `SEARCH`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

src/exec/mod.rs

@@ -17895,12 +17895,28 @@ impl Connection {
         if t.subquery.is_some() || t.tvf_args.is_some() || t.schema.is_some() {
             return None;
         }
-        if sel.where_clause.is_some() || window::has_window(sel) || meta.without_rowid {
+        if window::has_window(sel) || meta.without_rowid {
             return None;
         }
         if self.lookup_cte(&t.name, None).is_some() || self.is_view(&t.name) {
             return None;
         }
+        // A `WHERE` that *seeks* an index is a `SEARCH`, owned by the `eqp_access`
+        // seek path (which runs after this in both the EQP chain and the executor).
+        // A covering *full* scan applies only when no seek does — `eqp_access`
+        // renders exactly a bare `SCAN {label}` in that case, so gate on it. (The
+        // executor reaches here only after its own seek attempts fail, so this keeps
+        // the two in lockstep.) A covering index must also hold every `WHERE` column,
+        // which `query_cols_covered` already checks below.
+        if let Some(w) = &sel.where_clause {
+            let label = t.alias.as_deref().unwrap_or(&t.name);
+            let acc = self
+                .eqp_access(label, &t.name, meta, Some(w), Some(sel), params)
+                .ok()?;
+            if acc != alloc::format!("SCAN {label}") {
+                return None;
+            }
+        }
         // If the ORDER BY is already satisfied by a scan's natural order — the
         // rowid order of a table scan (`rowid_ordered_scan`) or an index walk
         // (`order_index_scan`) — leave it alone. A covering scan reads in index

tests/eqp_covering_scan_where.rs

@@ -0,0 +1,66 @@
+//! A no-seek `WHERE` scan reads from a *covering* index when one index holds
+//! every column the query references (both projected and `WHERE`-tested) and is
+//! narrower than the table: SQLite reads and filters in the index
+//! (`SCAN t USING COVERING INDEX <ix>`) rather than the table. A `WHERE` that
+//! *seeks* an index (an equality/range on the index's leading column) is a
+//! `SEARCH` and is left to that path. Verified (plan and rows) vs sqlite3 3.50.4.
+
+#![cfg(feature = "std")]
+
+use std::process::Command;
+
+fn sqlite3_available() -> bool {
+    Command::new("sqlite3").arg("--version").output().is_ok()
+}
+
+fn plan(bin: &str, base: &str, sql: &str) -> String {
+    let full = format!("{base} EXPLAIN QUERY PLAN {sql}");
+    let out = Command::new(bin).arg(":memory:").arg(&full).output().unwrap();
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter(|l| !l.trim().is_empty() && !l.starts_with("QUERY PLAN"))
+        .map(|l| l.trim_start_matches(|c: char| " |`*+_-".contains(c)))
+        .collect::<Vec<_>>()
+        .join("#")
+}
+
+fn rows(bin: &str, base: &str, sql: &str) -> String {
+    let out = Command::new(bin)
+        .arg(":memory:")
+        .arg(format!("{base} {sql}"))
+        .output()
+        .unwrap();
+    String::from_utf8_lossy(&out.stdout).into_owned()
+}
+
+const BASE: &str = "CREATE TABLE t(a INTEGER PRIMARY KEY, b, c, d, e);\
+    CREATE INDEX tbc ON t(b,c); CREATE INDEX td ON t(d);\
+    INSERT INTO t VALUES(1,5,50,7,'x'),(2,3,30,9,'y'),(3,9,90,8,'z');";
+
+#[test]
+fn covering_scan_where_matches_sqlite() {
+    if !sqlite3_available() {
+        eprintln!("sqlite3 CLI not found; skipping");
+        return;
+    }
+    let g = env!("CARGO_BIN_EXE_graphitesql");
+    for q in [
+        // Non-seekable WHERE fully covered by tbc → covering scan.
+        "SELECT b FROM t WHERE c > 40",
+        "SELECT b FROM t WHERE c = 50",
+        "SELECT b, c FROM t WHERE c > 40",
+        "SELECT b FROM t WHERE c BETWEEN 30 AND 60",
+        "SELECT b FROM t WHERE c IN (30, 90)",
+        "SELECT count(*) FROM t WHERE c > 40",
+        "SELECT b FROM t WHERE c > 40 OR c < 10",
+        // Seekable WHERE → SEARCH, not a covering full scan.
+        "SELECT b FROM t WHERE b = 5",
+        "SELECT b FROM t WHERE c > 40 AND b < 9",
+        "SELECT b FROM t WHERE c > 40 AND d = 7",
+        // Not covered (d in tbc? no) → plain scan.
+        "SELECT b FROM t WHERE e > 0",
+    ] {
+        assert_eq!(plan("sqlite3", BASE, q), plan(g, BASE, q), "plan `{q}`");
+        assert_eq!(rows("sqlite3", BASE, q), rows(g, BASE, q), "rows `{q}`");
+    }
+}