fix(rivetkit): wrap onMigrate in savepoints

[NathanFlurry]

Stack Context

This PR updates RivetKit SQLite migration handling.

What?

• Wrap raw SQL and Drizzle onMigrate work in a SQLite savepoint.
• Roll back the savepoint when onMigrate throws.
• Remove the dead writeMode API from active SQLite surfaces and examples.
• Document that onMigrate is atomic because it runs inside a savepoint.

Why?

writeMode no longer routes anything specially, so onMigrate was not atomic by default. A savepoint gives migrations transaction semantics without using a top-level BEGIN, which keeps the wrapper nestable with SQLite's transaction model.

Verification

• pnpm run check-types
• pnpm vitest run src/common/database/mod.test.ts src/common/database/native-database.test.ts
• git diff --check

[NathanFlurry]

• fix(rivetkit): wrap onMigrate in savepoints #4960 : 2 dependent PRs (#4962 , #4963 ) 👈 (View in Graphite)
• fix(pegboard): align drain grace defaults with stop threshold #4958 : 1 other dependent PR (#4966 )
• fix(rivetkit): preserve bridge error messages #4959
• fix(rivetkit): fire abort signal on shutdown finalize #4957
• fix(rivetkit): use startup kv preload #4956
• fix(client): flatten skipReadyWait option #4955
• ci(publish): add manual preview publish flow #4954
• fix(depot): add ltx decode diagnostics #4953
• fix(universaldb): preserve plain set values #4952
• fix(universaldb): align versionstamp operand encoding #4951
• fix(rivetkit): export database provider types #4950
• wip: kitchen sink agentic loop finish #4949
• chore(rivetkit): note duplicate admission logic #4948
• test(rivetkit): cover bypass fetch header forwarding #4947
• feat(kitchen-sink): add actor probe controls #4946
• fix(gateway): split actor response wait errors #4945
• fix(guard): handle bypass preflight before query parse #4944
• feat(kitchen-sink): add mock agent event log copy #4943
• fix(kitchen-sink): default mock agent to local endpoint #4942
• test(rivetkit): enable driver lifecycle regressions #4941
• test(rivetkit): verify cached websocket db refs exceed grace #4940
• fix(rivetkit-core): keep sleeping actors reachable during grace #4939
• test(rivetkit): cover async websocket close db access #4938
• fix(rivetkit): keep actors awake until keepAwake work finishes #4937
• fix(rivetkit): persist native onSleep state on errors #4936
• fix(rivetkit-core): allow dispatch during sleep grace #4935
• fix(rivetkit): make duplicate sleep requests idempotent #4934
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

Review: fix(rivetkit): wrap onMigrate in savepoints

Overview

This PR replaces the dead writeMode API with a proper SQLite savepoint around onMigrate in both the raw SQL (mod.ts) and Drizzle (drizzle.ts) database providers. The change is correct and well-motivated: writeMode was a no-op wrapper that gave false atomicity guarantees, and a real SAVEPOINT is the right SQLite primitive for nestable transaction semantics.

---

Issues

Duplicate withMigrationSavepoint implementation

The function is copy-pasted verbatim into both mod.ts and drizzle.ts. Any future bugfix must be applied to both files. Extract it into a shared internal utility (e.g. src/common/database/savepoint.ts) and import it from both.

Original error lost when ROLLBACK itself fails

In the catch block in both files, if ROLLBACK TO SAVEPOINT throws, the new error propagates through finally and the original error from the user migration callback is silently swallowed. A bare catch on the rollback call preserves the original:

} catch (error) {
    try {
        await client.execute("ROLLBACK TO SAVEPOINT __rivet_on_migrate");
    } catch {
        // rollback failed; original error is still re-thrown below
    } finally {
        await client.execute("RELEASE SAVEPOINT __rivet_on_migrate");
    }
    throw error;
}

Missing Drizzle test coverage

mod.test.ts gets both a success test and a rollback test for raw SQL. The Drizzle withMigrationSavepoint is identical code but has no analogous coverage, especially for the rollback path and the new early-return guard (if (!migrations && !onMigrate) return).

---

Observations (no action required)

• The hardcoded savepoint name __rivet_on_migrate is fine. Worth noting that user migration code using the exact same name would conflict, but that is an acceptable risk.
• The early-return guard added to the Drizzle path (if (!migrations && !onMigrate) return) is a nice optimization. The raw SQL path already has an equivalent if (onMigrate) guard, so no SAVEPOINT is opened unnecessarily in either case.
• Removing writeMode from SqliteDatabase is a breaking API change for callers of ctx.sql.writeMode(...). If writeMode was ever documented as public API, a changelog entry may be warranted.
• The ROLLBACK TO SAVEPOINT followed by RELEASE SAVEPOINT sequence is correct SQLite semantics: rollback rewinds without popping the savepoint stack; release then pops it.

---

Summary

The core logic is correct and the removal of the defunct writeMode API is welcome. Two items worth addressing before merge: extract the duplicated withMigrationSavepoint helper into a shared file, and ensure the original migration error is preserved when the ROLLBACK statement itself fails.