@intentius/chant-lexicon-sql 0.116.0 → 0.117.0

package/src/postgres/live/describe-resources.ts

@@ -41,15 +41,30 @@ interface Bound {
  */
 export function declaredAddress(entity: { type: string; props: Record<string, unknown> }, defaultSchema: string): { schema?: string; name: string; signature?: string } {
   const name = String(entity.props.name ?? "");
-  if (entity.type === POSTGRES_ENTITY_TYPES.schema || entity.type === POSTGRES_ENTITY_TYPES.extension) return { name };
+  if (entity.type === POSTGRES_ENTITY_TYPES.schema || entity.type === POSTGRES_ENTITY_TYPES.extension || entity.type === POSTGRES_ENTITY_TYPES.role) return { name };
   const schema = typeof entity.props.schema === "string" ? entity.props.schema : identValue(defaultSchema);
-  if (entity.type === POSTGRES_ENTITY_TYPES.function || entity.type === POSTGRES_ENTITY_TYPES.procedure || entity.type === POSTGRES_ENTITY_TYPES.trigger) {
+  if (entity.type === POSTGRES_ENTITY_TYPES.function || entity.type === POSTGRES_ENTITY_TYPES.procedure || entity.type === POSTGRES_ENTITY_TYPES.trigger || entity.type === POSTGRES_ENTITY_TYPES.policy) {
     const signature = canonicalPgObject(entity.type, entity.props, defaultSchema).signature;
     return { schema, name, ...(signature !== undefined ? { signature } : {}) };
   }
   return { schema, name };
 }
 
+/**
+ * Why an access declaration is not observed one by one: a grant or default
+ * privileges, which `chant sql plan` compares as the access they add up to;
+ * a policy or role where the profile does not manage access.
+ */
+export function accessUnobserved(type: string, managed: boolean): { reason: "unsupported-kind" | "filtered"; detail: string } | undefined {
+  if (type === POSTGRES_ENTITY_TYPES.grant || type === POSTGRES_ENTITY_TYPES.defaultPrivileges) {
+    return { reason: "unsupported-kind", detail: "a grant is compared as the privileges the declarations add up to, by chant sql plan and the applier, not one statement at a time" };
+  }
+  if (!managed && (type === POSTGRES_ENTITY_TYPES.policy || type === POSTGRES_ENTITY_TYPES.role)) {
+    return { reason: "filtered", detail: "access is not managed in this environment (sql.profiles.<env>.access)" };
+  }
+  return undefined;
+}
+
 /** A schema scope for the catalog read: the profile's schemas, else every schema the declarations name and the default one. */
 export function scopeFor(target: PostgresTarget, entities: ReadonlyArray<{ type: string; props: Record<string, unknown> }>): string[] | undefined {
   if (target.schemas) return target.schemas;
@@ -68,7 +83,14 @@ function adapter(options: BindOptions & { owned?: boolean; declared: DeclaredEnt
     async bind() {
       const { target, client } = await bindPostgres(options);
       try {
-        const live = markProviderOwned(await readLiveSchema(client, { schemas: scopeFor(target, options.declared.filter((d) => d.type.startsWith("Postgres::"))) }), target.provider);
+        const live = markProviderOwned(
+          await readLiveSchema(client, {
+            schemas: scopeFor(target, options.declared.filter((d) => d.type.startsWith("Postgres::"))),
+            access: target.access === true,
+            roles: options.declared.filter((d) => d.type === POSTGRES_ENTITY_TYPES.role).map((d) => String(d.props.name)),
+          }),
+          target.provider,
+        );
         return { target, byKey: new Map(live.map((o) => [liveKey(o.type, o.schema, o.name, o.signature), o])) };
       } finally {
         await client.end();
@@ -77,6 +99,8 @@ function adapter(options: BindOptions & { owned?: boolean; declared: DeclaredEnt
     classifyBindFailure: (err) => classifyPostgresFailure(err),
     async read({ target, byKey }, entity): Promise<EntityObservation> {
       if (!entity.type.startsWith("Postgres::")) return { unobserved: { reason: "unsupported-kind", detail: entity.type } };
+      const why = accessUnobserved(entity.type, target.access === true);
+      if (why) return { unobserved: why };
       const { schema, name, signature } = declaredAddress(entity, target.defaultSchema);
       const queried = `${redactUrl(target.endpoint.url)} ${schema ? `${schema}.` : ""}${name}${signature ?? ""}`;
       const live = byKey.get(liveKey(entity.type, schema, name, signature));

package/src/postgres/migrate/migrate.test.ts

@@ -72,7 +72,30 @@ describe("PostgresMigrationOp", () => {
     expect(Object.keys(g.approval.context)).toEqual(["verifiedRows", "mismatched"]);
   });
 
+  test('gates: "outer" leaves out both approval gates and the Contract phase, and keeps the verification (#3687)', () => {
+    const props = propsOf({ ...BASE, gates: "outer" });
+    expect(props.phases.map((p) => p.name)).toEqual(["Build", "Plan", "Expand", "Dual write", "Backfill", "Carry over", "Verify", "Switch", "Retain"]);
+    expect(props.phases.flatMap((p) => p.steps).filter((s) => s.kind === "gate")).toEqual([]);
+    const fns = props.phases.flatMap((p) => p.steps).map((s) => (s as { fn?: string }).fn);
+    expect(fns.indexOf("postgresMigrationVerify")).toBeLessThan(fns.indexOf("postgresMigrationSwitch"));
+    expect(fns).not.toContain("postgresMigrationContract");
+    expect(props.onFailure?.map((p) => p.steps.map((s) => (s as { fn?: string }).fn))).toEqual([["postgresMigrationCompensate"]]);
+    expect(props.overview).toContain("the caller's approval");
+  });
+
+  test('onFailure: "keep" has no onFailure and tells every step so (#3687)', () => {
+    const props = propsOf({ ...BASE, onFailure: "keep" });
+    expect(props.onFailure).toBeUndefined();
+    const steps = props.phases.flatMap((p) => p.steps).filter((s) => s.kind === "activity" && (s as { fn: string }).fn.startsWith("postgresMigration")) as Array<{ args: Record<string, unknown> }>;
+    expect(steps).toHaveLength(9);
+    for (const s of steps) expect(s.args.keepOnFailure).toBe(true);
+    expect(props.phases.map((p) => p.name)).toContain("Approve");
+    expect((propsOf(BASE).phases[1]!.steps[0] as { args: Record<string, unknown> }).args).not.toHaveProperty("keepOnFailure");
+  });
+
   test("bad configuration fails when the Op is built", () => {
+    expect(() => PostgresMigrationOp({ ...BASE, gates: "none" as never })).toThrow(/gates must be/);
+    expect(() => PostgresMigrationOp({ ...BASE, onFailure: "retry" as never })).toThrow(/onFailure must be/);
     expect(() => PostgresMigrationOp({ ...BASE, table: "app.users; DROP" })).toThrow(/table must be/);
     expect(() => PostgresMigrationOp({ ...BASE, column: "" })).toThrow(/column must be/);
     expect(() => PostgresMigrationOp({ ...BASE, batchSize: 0 })).toThrow(/batchSize/);
@@ -95,7 +118,7 @@ describe("PostgresMigrationOp", () => {
       ownershipEnv: "prod",
       build: false,
     };
-    for (const config of [BASE, full, { ...BASE, replicationLag: false as const }]) {
+    for (const config of [BASE, full, { ...BASE, replicationLag: false as const }, { ...BASE, gates: "outer" as const, onFailure: "keep" as const }]) {
       const props = propsOf(config);
       expect(validateActivitySteps(props, merged)).toEqual([]);
       expect(validateStepOutputRefs(props, merged)).toEqual([]);

package/src/postgres/migrate/op.ts

@@ -35,6 +35,12 @@
  * machine) is not a failure, runs no onFailure, and the next run resumes the
  * backfill from its receipts; a step that fails runs onFailure, and the next
  * run starts again from a new column.
+ *
+ * `gates: "outer"` (#3687) leaves out both approval gates and the Contract
+ * phase, for a caller that runs the Op under an approval of its own: the run
+ * goes from Plan to Retain, verification included. `onFailure: "keep"`
+ * leaves out the onFailure, so a failed run's next run resumes the backfill
+ * from its receipts instead of starting again.
  */
 
 import { Op, activity, gate, phase, stepOutput, type GateApproval } from "@intentius/chant/op";
@@ -98,6 +104,27 @@ export interface PostgresMigrationOpConfig {
   stack?: string;
   /** Ownership env. Default: `ownership.env` in `chant.config.ts`. */
   ownershipEnv?: string;
+  /**
+   * Whose approval the switch and the contract wait for. `"own"` (the
+   * default): the Op's two gates. `"outer"`: an approval the caller already
+   * holds for a larger change that runs this Op as one of its steps. The
+   * switch gate, the contract gate and the Contract phase are left out, so
+   * the Op ends at Retain with the old column kept until its retention date.
+   * Drop it after that date, or run the Op with `"own"`: its switch gate has
+   * nothing left to switch, and its contract gate binds that old column. The
+   * verification still runs, and any difference fails the run with nothing
+   * switched.
+   */
+  gates?: "own" | "outer";
+  /**
+   * What a failed run does with what the expand added. `"drop"` (the
+   * default): onFailure drops the new column, the dual-write trigger and the
+   * receipts, and the next run starts again from a new column. `"keep"`:
+   * there is no onFailure, and the next run resumes the backfill from its
+   * per-batch receipts. To start again instead, run the Op once with
+   * `"drop"`.
+   */
+  onFailure?: "drop" | "keep";
 }
 
 export interface PostgresMigrationOpResources {
@@ -119,6 +146,8 @@ export interface PostgresMigrationArgs {
   stack?: string;
   ownershipEnv?: string;
   cwd?: string;
+  /** A failed run keeps what the expand added (`onFailure: "keep"`): a refusal says how to start again. */
+  keepOnFailure?: boolean;
 }
 
 const IDENT = /^[A-Za-z_][A-Za-z0-9_$]*$|^"(?:[^"]|"")+"$/;
@@ -134,6 +163,14 @@ export function PostgresMigrationOp(config: PostgresMigrationOpConfig): Postgres
   }
   if (config.replicationLag) for (const d of [config.replicationLag.max, config.replicationLag.wait]) if (d !== undefined) parseDuration(d);
   if (config.retain !== undefined) parseDuration(config.retain);
+  if (config.gates !== undefined && config.gates !== "own" && config.gates !== "outer") {
+    throw new Error(`PostgresMigrationOp "${config.name}": gates must be "own" or "outer"`);
+  }
+  if (config.onFailure !== undefined && config.onFailure !== "drop" && config.onFailure !== "keep") {
+    throw new Error(`PostgresMigrationOp "${config.name}": onFailure must be "drop" or "keep"`);
+  }
+  const outer = config.gates === "outer";
+  const keep = config.onFailure === "keep";
 
   const args: PostgresMigrationArgs = {
     table: config.table,
@@ -149,6 +186,7 @@ export function PostgresMigrationOp(config: PostgresMigrationOpConfig): Postgres
     ...(config.stack ? { stack: config.stack } : {}),
     ...(config.ownershipEnv ? { ownershipEnv: config.ownershipEnv } : {}),
     ...(config.path && config.path !== "." ? { cwd: config.path } : {}),
+    ...(keep ? { keepOnFailure: true } : {}),
   };
   const a = args as unknown as Record<string, unknown>;
   const switchGate = config.gate?.gate ?? `approve-${config.name}`;
@@ -159,6 +197,33 @@ export function PostgresMigrationOp(config: PostgresMigrationOpConfig): Postgres
   const step = (fn: string, extra: Partial<StepDefinition & { id: string; outcomeAttribute: unknown; profile: string; timeout: string }> = {}): StepDefinition =>
     ({ ...activity(fn, a), ...extra }) as StepDefinition;
 
+  // The switch waits for this gate, unless the caller holds the approval (`gates: "outer"`).
+  const approve = phase("Approve", [
+    gate(switchGate, {
+      ...(config.gate?.timeout ? { timeout: config.gate.timeout } : {}),
+      plan: stepOutput("verify", "planDigest"),
+      description:
+        config.gate?.description ??
+        `Approve switching ${what} on ${config.env}: the run record's Verification line has what this approval binds; for a rename, readers move to the new name once it is switched`,
+      ...(config.gate?.approval
+        ? {
+            approval: {
+              ...config.gate.approval,
+              ...(policy
+                ? {
+                    context: {
+                      verifiedRows: stepOutput("verify", "rows"),
+                      mismatched: stepOutput("verify", "mismatched"),
+                      ...config.gate.approval.context,
+                    },
+                  }
+                : {}),
+            },
+          }
+        : {}),
+    }),
+  ]);
+
   const phases = [
     ...(config.build === false ? [] : [phase("Build", [activity("chantBuild", { path: config.path ?? "." })])]),
     phase("Plan", [step("postgresMigrationPlan", { id: "plan", outcomeAttribute: [{ name: "MigrationState", from: "state" }, { name: "Change", from: "change" }] })]),
@@ -194,49 +259,29 @@ export function PostgresMigrationOp(config: PostgresMigrationOpConfig): Postgres
         ],
       }),
     ]),
-    phase("Approve", [
-      gate(switchGate, {
-        ...(config.gate?.timeout ? { timeout: config.gate.timeout } : {}),
-        plan: stepOutput("verify", "planDigest"),
-        description:
-          config.gate?.description ??
-          `Approve switching ${what} on ${config.env}: the run record's Verification line has what this approval binds; for a rename, readers move to the new name once it is switched`,
-        ...(config.gate?.approval
-          ? {
-              approval: {
-                ...config.gate.approval,
-                ...(policy
-                  ? {
-                      context: {
-                        verifiedRows: stepOutput("verify", "rows"),
-                        mismatched: stepOutput("verify", "mismatched"),
-                        ...config.gate.approval.context,
-                      },
-                    }
-                  : {}),
-              },
-            }
-          : {}),
-      }),
-    ]),
+    ...(outer ? [] : [approve]),
     phase("Switch", [step("postgresMigrationSwitch", { timeout: "6h", outcomeAttribute: [{ name: "OldColumn", from: "oldColumn" }] })]),
     phase("Retain", [step("postgresMigrationRetain", { id: "retain", outcomeAttribute: { name: "RetainUntil", from: "retainUntil" } })]),
-    phase("Approve contract", [
-      gate(contractGate, {
-        ...(config.contractGate?.timeout ? { timeout: config.contractGate.timeout } : {}),
-        plan: stepOutput("retain", "contractDigest"),
-        description: config.contractGate?.description ?? `Approve dropping the old column of ${what} once its retention has passed and no reader uses it`,
-      }),
-    ]),
-    phase("Contract", [step("postgresMigrationContract", { outcomeAttribute: { name: "Dropped", from: "dropped" } })]),
+    ...(outer
+      ? []
+      : [
+          phase("Approve contract", [
+            gate(contractGate, {
+              ...(config.contractGate?.timeout ? { timeout: config.contractGate.timeout } : {}),
+              plan: stepOutput("retain", "contractDigest"),
+              description: config.contractGate?.description ?? `Approve dropping the old column of ${what} once its retention has passed and no reader uses it`,
+            }),
+          ]),
+          phase("Contract", [step("postgresMigrationContract", { outcomeAttribute: { name: "Dropped", from: "dropped" } })]),
+        ]),
   ];
 
   const op = Op({
     name: config.name,
-    overview: `Migrate ${what} on ${config.env} as expand and contract: new column, dual write, backfill, verify, gated switch, gated contract`,
+    overview: `Migrate ${what} on ${config.env} as expand and contract: new column, dual write, backfill, verify, ${outer ? "switch under the caller's approval" : "gated switch, gated contract"}`,
     labels: { Migration: "true", Env: config.env, Table: config.table, Column: config.column },
     phases,
-    onFailure: [phase("Compensate", [step("postgresMigrationCompensate")])],
+    ...(keep ? {} : { onFailure: [phase("Compensate", [step("postgresMigrationCompensate")])] }),
   });
   return { op };
 }

package/src/postgres/migrate/outer.e2e.test.ts

@@ -0,0 +1,163 @@
+/**
+ * `PostgresMigrationOp` under an outer approval with what the expand added
+ * kept on failure (#3687): a backfill that fails part way leaves the new
+ * column, its dual write and its receipts; the next run skips the batches
+ * already filled, verifies and switches with no gate, and keeps the old
+ * column; a later run with the Op's own gates stops at its gates. A refusal
+ * says how to start again, since nothing drops what was kept.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (a `postgres://user@host:port/db`
+ * URL, with `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, such as
+ * the one `chant emulator up --lexicon sql` starts. Without it, a throwaway
+ * server at the pin, skipped cleanly when Docker is not available. The test
+ * writes only to the schema `chant_e2e_3687`, dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { OpRunFailure } from "@intentius/chant/op";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import * as m from "../../op/activities/postgres-migration";
+import type { PostgresMigrationArgs, PostgresMigrationOpConfig } from "./op";
+import { ApprovingLedger, runMigrationOp, runOutcome } from "../testing/migration";
+import { POSTGRES_RECEIPTS_TABLE } from "./receipts";
+
+const S = "chant_e2e_3687";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-outer-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await admin?.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`).catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+function writeBuild(file: string, objects: Obj[]): string {
+  writeFileSync(join(dir, file), JSON.stringify({ dialect: "postgres", postgresMajor: 18, applyOrder: objects.map((o) => o.export), objects: objects.map((o) => ({ dependsOn: [], ...o })) }));
+  return file;
+}
+
+const MARKER = { stack: "e2e3687", env: "test" };
+const profile = () => ({
+  config: { ownership: MARKER, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+const deps = (extra: Partial<m.PostgresMigrationDeps> = {}): m.PostgresMigrationDeps => ({ ...profile(), log: () => undefined, ...extra });
+const apply = (file: string) => postgresApply({ buildPath: join(dir, file), environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+const one = async <T>(sql: string): Promise<T> => (await admin.query<T>(sql))[0]!;
+const columnsOf = async (table: string) =>
+  (await admin.query<{ name: string }>(`SELECT attname AS name FROM pg_attribute WHERE attrelid = '${table}'::regclass AND attnum > 0 AND NOT attisdropped ORDER BY attnum`)).map((r) => r.name);
+const receipts = async () => (await one<{ n: number }>(`SELECT count(*)::int AS n FROM ${S}.${POSTGRES_RECEIPTS_TABLE} WHERE address LIKE 'e2e3687/test/migrate/${S}.events.kind/%' AND address NOT LIKE '%/batches'`)).n;
+
+describe.skipIf(!enabled)("under an outer approval, a failed migration keeps its new column and the rerun resumes (#3687)", () => {
+  const SCHEMA: Obj = { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` };
+  const V1: Obj = { export: "events", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.events (id bigint PRIMARY KEY, kind varchar(20) NOT NULL)` };
+  const V2: Obj = { ...V1, ddl: `CREATE TABLE ${S}.events (id bigint PRIMARY KEY, kind varchar(10) NOT NULL)` };
+  const config = (): PostgresMigrationOpConfig => ({
+    name: "migrate-events-kind",
+    env: "e2e",
+    table: `${S}.events`,
+    column: "kind",
+    build: false,
+    path: dir,
+    output: "events-v2.json",
+    retain: "0s",
+    batchSize: 100,
+    stack: MARKER.stack,
+    ownershipEnv: MARKER.env,
+    gates: "outer",
+    onFailure: "keep",
+  });
+  const args = (): PostgresMigrationArgs => ({ table: `${S}.events`, column: "kind", buildPath: "events-v2.json", environment: "e2e", batchSize: 100, stack: MARKER.stack, ownershipEnv: MARKER.env, cwd: dir });
+
+  test("the failed run keeps the new column and its receipts; the rerun skips what was filled, switches without a gate and keeps the old column", async () => {
+    await apply(writeBuild("events-v1.json", [SCHEMA, V1]));
+    await admin.query(`INSERT INTO ${S}.events SELECT g, CASE WHEN g % 2 = 0 THEN 'click' ELSE 'view' END FROM generate_series(0, 599) g`);
+    writeBuild("events-v2.json", [SCHEMA, V2]);
+
+    // A refusal says how to start again when nothing drops what was kept; without keepOnFailure it does not.
+    await expect(m.postgresMigrationBackfill({ ...args(), keepOnFailure: true }, undefined, deps())).rejects.toThrow(
+      /the Expand phase adds it\. This migration keeps what the expand added on failure \(onFailure: "keep"\), so nothing drops it: to start again from a new column, run the Op once with onFailure: "drop"/,
+    );
+    await expect(m.postgresMigrationBackfill(args(), undefined, deps())).rejects.not.toThrow(/onFailure: "keep"/);
+
+    // Every attempt of the backfill step fails after its batch: three attempts, three batches filled, then the run fails.
+    let filled = 0;
+    const ledger = new ApprovingLedger();
+    const failure = await runMigrationOp(config(), ledger.port, () =>
+      deps({
+        backfill: {
+          afterBatch: () => {
+            filled++;
+            throw new Error(`the backfill failed after ${filled} batch(es)`);
+          },
+        },
+      }),
+    ).then(
+      () => undefined,
+      (e: unknown) => e,
+    );
+    expect(failure).toBeInstanceOf(OpRunFailure);
+    const records = (failure as OpRunFailure).result.records;
+    expect(records.find((x) => x.fn === "postgresMigrationBackfill")?.error).toMatch(/the backfill failed after 3 batch/);
+    // No onFailure ran: the new column, the dual write and the receipts are there.
+    expect(records.find((x) => x.fn === "postgresMigrationCompensate")).toBeUndefined();
+    expect(await columnsOf(`${S}.events`)).toEqual(["id", "kind", "kind__chant_new"]);
+    expect(await one(`SELECT count(*)::int AS n FROM pg_trigger WHERE tgrelid = '${S}.events'::regclass AND tgname = 'kind__chant_sync'`)).toEqual({ n: 1 });
+    expect(await one(`SELECT count(*)::int AS n FROM ${S}.events WHERE kind__chant_new IS NOT NULL`)).toEqual({ n: 300 });
+    expect(await receipts()).toBe(3);
+
+    // The rerun resumes: three batches skipped by receipt, three filled, verified and switched, with no gate.
+    const r = await runMigrationOp(config(), ledger.port, () => deps());
+    expect(r.status).toBe("ok");
+    expect(ledger.port.appended).toEqual([]);
+    expect(runOutcome(r, "Skipped")).toBe(3);
+    expect(runOutcome(r, "Filled")).toBe(3);
+    expect(runOutcome(r, "VerifiedRows")).toBe(600);
+    expect(r.records.map((x) => x.fn)).not.toContain("postgresMigrationContract");
+    expect(await one(`SELECT format_type(atttypid, atttypmod) AS t FROM pg_attribute WHERE attrelid = '${S}.events'::regclass AND attname = 'kind'`)).toEqual({ t: "character varying(10)" });
+    // The old column is kept: dropping it is a run with the Op's own gates.
+    expect(await columnsOf(`${S}.events`)).toEqual(["id", "kind__chant_old", "kind"]);
+
+    // Run with its own gates, the Op has nothing left to switch, and its contract gate binds that old column.
+    const own = new ApprovingLedger();
+    const first = await runMigrationOp({ ...config(), gates: "own" }, own.port, () => deps());
+    expect(first.status).toBe("gated");
+    expect(first.gate).toMatchObject({ gate: "approve-migrate-events-kind" });
+    expect(runOutcome(first, "MigrationState")).toBe("switched");
+    own.approveLast();
+    const second = await runMigrationOp({ ...config(), gates: "own" }, own.port, () => deps());
+    expect(second.status).toBe("gated");
+    expect(second.gate).toMatchObject({ gate: "approve-migrate-events-kind-contract" });
+    expect(await columnsOf(`${S}.events`)).toEqual(["id", "kind__chant_old", "kind"]);
+  }, 300_000);
+});