Transform value after reading from DB (e.g., decrypt). Row reads pass the row's primary-key value as rowId so a read failure can name the record (single-column reads via readColumn may omit it).