@intentius/chant-lexicon-sql 0.116.0 → 0.118.0

package/src/postgres/apply/apply.ts

@@ -84,6 +84,9 @@ import type { PgChangeClass } from "../plan/rules";
 import type { CanonicalKind } from "../plan/normalize";
 import { quoteIdent } from "../keywords";
 import { planPgStatements, scansRows, type DeclaredPgObject, type PgDropStatement, type PgStep } from "./statements";
+import { ACCESS_KINDS, ACCESS_MANAGED_KINDS } from "../plan/normalize";
+import { declaredAccess, diffAccess, targetKey } from "../access/acl";
+import { readLiveAccess } from "../access/live";
 
 /** The timeouts a statement runs with, in milliseconds; 0 is no limit. */
 export interface PostgresApplyTimeouts {
@@ -144,9 +147,9 @@ export class PostgresApplyError extends SqlApplyError<PostgresApplyOutcome> {
  * (`app.touch()`), a trigger's with its table (`touch ON app.users`).
  */
 export const refName = (o: { kind: CanonicalKind; schema?: string; name: string; signature?: string }): string =>
-  o.kind === "trigger"
+  o.kind === "trigger" || o.kind === "policy"
     ? `${o.name}${o.signature ?? ""}`
-    : o.kind === "schema" || o.kind === "extension" || o.schema === undefined
+    : o.kind === "schema" || o.kind === "extension" || o.kind === "role" || o.schema === undefined
       ? o.name
       : `${o.schema}.${o.name}${o.kind === "function" || o.kind === "procedure" ? (o.signature ?? "") : ""}`;
 
@@ -259,7 +262,21 @@ export async function applyPostgres(
   });
   const normalizedByKey = new Map(plan.declared.map((o) => [o.key, o.canonical]));
   const liveRawByKey = new Map(plan.liveObjects.map((o) => [qualifiedKey(liveCanonicalAddress(o)), o]));
-  const objects = declared.map((original) => ({ ...original, canonical: { ...original.canonical, ...normalizedByKey.get(original.key) } }));
+  const managed = target.access === true;
+  // Access declarations a profile does not manage are not applied; grants and default privileges run after every object, as access.
+  for (const o of declared) {
+    if (!managed && ACCESS_MANAGED_KINDS.has(o.canonical.kind)) {
+      outcome.notAttempted.push({
+        kind: o.type,
+        name: o.name,
+        reason: "filtered",
+        detail: `access is not managed in this environment: set sql.profiles.<env>.access to plan and apply policies, roles, grants and row-level security`,
+      });
+    }
+  }
+  const objects = declared
+    .filter((o) => !ACCESS_KINDS.has(o.canonical.kind) && (managed || !ACCESS_MANAGED_KINDS.has(o.canonical.kind)))
+    .map((original) => ({ ...original, canonical: { ...original.canonical, ...normalizedByKey.get(original.key) } }));
   const matchedLive = new Set<string>();
   for (const m of matchPgObjects(plan.live, plan.declared)) if (m.kind === "matched") matchedLive.add(m.after.key);
 
@@ -275,6 +292,7 @@ export async function applyPostgres(
     allowDestructive: opts.prune === true,
     carriesMarker: (_live, key) => carriesMarker(liveRawByKey.get(key)?.comment, opts.marker),
     extensionComment: (name) => extensionComments.get(name),
+    access: managed,
     ...(opts.marker ? { marker: opts.marker } : {}),
   });
 
@@ -436,11 +454,102 @@ export async function applyPostgres(
   }
   await commit();
 
+  if (managed) await applyAccess(client, declared, onServer, exportNames, { ...opts, major: plan.major ?? opts.major ?? POSTGRES_LATEST_MAJOR, ...(plan.scope ? { schemas: plan.scope } : {}) }, timeouts, outcome, log);
+
   if (opts.prune) await prune(client, statements.drops, liveRawByKey, opts, timeouts, outcome, log);
   if (outcome.failed.length > 0) throw new PostgresApplyError(outcome);
   return outcome;
 }
 
+/**
+ * Access, after every object (#3681): the privileges and default privileges
+ * the declarations add up to, against what the server holds now that the
+ * objects exist, made in one transaction. A grant or default-privileges
+ * declaration is `updated` when a statement ran for it and `unchanged`
+ * otherwise; a privilege nothing declares is revoked under the object's name.
+ */
+async function applyAccess(
+  client: PostgresClient,
+  declared: readonly DeclaredPgObject[],
+  onServer: ReadonlySet<string>,
+  exportNames: ReadonlySet<string>,
+  opts: PostgresApplyOptions & { major: number; schemas?: string[] },
+  timeouts: PostgresApplyTimeouts,
+  outcome: PostgresApplyOutcome,
+  log: (line: string) => void,
+): Promise<void> {
+  const decls = declared.filter((o) => ACCESS_KINDS.has(o.canonical.kind));
+  const ref = (o: DeclaredPgObject) => ({ kind: o.type, name: o.canonical.name });
+  const ready: DeclaredPgObject[] = [];
+  for (const o of decls) {
+    const missing = missingDependencies(o.exportName, o.dependsOn, exportNames, onServer);
+    if (missing.length > 0) outcome.notAttempted.push({ ...ref(o), reason: "dependency-failed", detail: dependencyFailedDetail(missing) });
+    else ready.push(o);
+  }
+  const skipped = new Set(decls.filter((o) => !ready.includes(o)).map((o) => o.exportName));
+  const [me] = await client.query<{ self: string }>("SELECT current_user AS self");
+  const want = declaredAccess(
+    declared.filter((o) => !skipped.has(o.exportName)).map((o) => ({ key: o.exportName, canonical: o.canonical })),
+    { major: opts.major, ...(me?.self ? { self: me.self } : {}) },
+  );
+  const have = await readLiveAccess(client, want.targets, {
+    ...(opts.schemas ? { schemas: opts.schemas } : {}),
+    forRoles: want.forRoles,
+    declaredDefaults: want.targets.filter((t) => t.kind === "default"),
+  });
+  // A target that is not on the server (its object failed) is left for the next apply.
+  const changes = diffAccess(have.state, want.state, want.exportsOf).filter(
+    (c) => c.target.kind === "default" || have.present.has(targetKey(c.target.kind === "column" ? { kind: "table", name: c.target.name } : c.target)),
+  );
+  const ranFor = new Map<string, string[]>();
+  if (changes.length > 0) {
+    const t = { lockTimeoutMs: timeouts.lockTimeoutMs, statementTimeoutMs: timeouts.statementTimeoutMs };
+    const number = outcome.transactions.length;
+    const members = new Set<string>();
+    log("BEGIN");
+    await client.query("BEGIN");
+    try {
+      for (const set of [`SET LOCAL lock_timeout = ${ms(t.lockTimeoutMs)}`, `SET LOCAL statement_timeout = ${ms(t.statementTimeoutMs)}`]) {
+        log(set);
+        await client.query(set);
+      }
+      for (const c of changes) {
+        const object = c.exports[0] !== undefined ? (declared.find((o) => o.exportName === c.exports[0])?.canonical.name ?? c.change.object) : c.change.object.slice(4);
+        members.add(object);
+        for (const sql of c.sql) {
+          opts.signal?.throwIfAborted();
+          log(sql);
+          outcome.statements.push({ object, sql, class: c.change.class, ...t, transaction: number });
+          await client.query(sql);
+          for (const e of c.exports) ranFor.set(e, [...(ranFor.get(e) ?? []), sql]);
+        }
+      }
+      log("COMMIT");
+      await client.query("COMMIT");
+      outcome.transactions.push({ objects: [...members], result: "committed" });
+    } catch (err) {
+      if (opts.signal?.aborted) {
+        await client.query("ROLLBACK").catch(() => undefined);
+        throw err;
+      }
+      const error = errorText(err, t);
+      const failedAt = outcome.statements[outcome.statements.length - 1]?.sql ?? "BEGIN";
+      log("ROLLBACK");
+      await client.query("ROLLBACK").catch(() => undefined);
+      outcome.transactions.push({ objects: [...members], result: "rolled-back", failedAt: { sql: failedAt, error } });
+      for (const o of ready) {
+        if (changes.some((c) => c.exports.includes(o.exportName))) outcome.failed.push({ ...ref(o), error: `${error}, in the access transaction at ${failedAt}`, statements: [] });
+        else outcome.applied.push({ ...ref(o), action: "unchanged", statements: [] });
+      }
+      return;
+    }
+  }
+  for (const o of ready) {
+    const ran = ranFor.get(o.exportName) ?? [];
+    outcome.applied.push({ ...ref(o), action: ran.length > 0 ? "updated" : "unchanged", statements: ran });
+  }
+}
+
 /** The address a live object is keyed by in the diff. */
 function liveCanonicalAddress(o: LivePgObject): { kind: CanonicalKind; schema?: string; name: string; signature?: string } {
   const kind = (
@@ -457,11 +566,15 @@ function liveCanonicalAddress(o: LivePgObject): { kind: CanonicalKind; schema?:
       "Postgres::Function": "function",
       "Postgres::Procedure": "procedure",
       "Postgres::Trigger": "trigger",
+      "Postgres::Policy": "policy",
+      "Postgres::Role": "role",
+      "Postgres::Grant": "grant",
+      "Postgres::DefaultPrivileges": "defaultPrivileges",
     } as const
   )[o.type];
   return {
     kind,
-    ...(o.schema !== undefined && kind !== "schema" && kind !== "extension" ? { schema: o.schema } : {}),
+    ...(o.schema !== undefined && kind !== "schema" && kind !== "extension" && kind !== "role" ? { schema: o.schema } : {}),
     name: o.name,
     ...(o.signature !== undefined ? { signature: o.signature } : {}),
   };

package/src/postgres/apply/constraint-sequences.e2e.test.ts

@@ -0,0 +1,179 @@
+/**
+ * A CHECK or a foreign key added to a table that exists, against a live
+ * server (#3703).
+ *
+ * - The applier adds each one NOT VALID, then validates it in a transaction
+ *   of its own, and both end valid.
+ * - Step by step, each statement's transaction held open: a concurrent
+ *   writer is not blocked while VALIDATE reads the 200,000 rows, and the
+ *   probe is shown to detect locks by being blocked during the NOT VALID add.
+ * - A run that stopped after the NOT VALID add resumes at VALIDATE.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (with
+ * `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, else a throwaway
+ * server at the pin, skipped when Docker is not available. The test writes
+ * only to the schema `chant_e2e_3703`, dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import pg from "pg";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { diffStatements, type StatementStep } from "../../migration-statements";
+
+const S = "chant_e2e_3703";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-constraints-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await admin?.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`).catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const doc = (objects: Obj[]) => ({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) });
+const schema: Obj = { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` };
+const parents: Obj = { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` };
+/** `items` with the constraints named in `with` declared. */
+const items = (...with_: Array<"pos" | "fk" | "small">): Obj => ({
+  export: "items",
+  type: "Postgres::Table",
+  dependsOn: ["app", "parents"],
+  ddl: [
+    `CREATE TABLE ${S}.items (id bigint PRIMARY KEY, n int, parent bigint`,
+    with_.includes("pos") ? ", CONSTRAINT items_n_pos CHECK (n > 0)" : "",
+    with_.includes("fk") ? `, CONSTRAINT items_parent_fkey FOREIGN KEY (parent) REFERENCES ${S}.parents (id)` : "",
+    with_.includes("small") ? ", CONSTRAINT items_n_small CHECK (n < 1000000)" : "",
+    ")",
+  ].join(""),
+});
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify(doc(objects)));
+  return path;
+}
+
+const profile = () => ({
+  config: { ownership: { stack: "e2e3703", env: "test" }, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+const apply = (path: string) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+const validated = async (name: string) =>
+  (await admin.query<{ v: boolean }>(`SELECT convalidated AS v FROM pg_constraint WHERE conrelid = '${S}.items'::regclass AND conname = '${name}'`))[0]?.v;
+
+/** A raw node-postgres session, for holding a transaction open. */
+async function session(): Promise<pg.Client> {
+  const url = new URL(endpoint.url);
+  if (endpoint.password !== undefined) url.password = encodeURIComponent(endpoint.password);
+  const c = new pg.Client({ connectionString: url.toString() });
+  c.on("error", () => undefined);
+  await c.connect();
+  return c;
+}
+
+describe.skipIf(!enabled)("a CHECK and a foreign key added NOT VALID, then validated, on a live server", () => {
+  beforeAll(async () => {
+    const first = await apply(writeBuild("v1.json", [schema, parents, items()]));
+    expect(first.failed).toEqual([]);
+    await admin.query(`INSERT INTO ${S}.parents SELECT g FROM generate_series(1, 200000) g`);
+    await admin.query(`INSERT INTO ${S}.items (id, n, parent) SELECT g, g, g FROM generate_series(1, 200000) g`);
+  }, 120_000);
+
+  test("the applier sends ADD ... NOT VALID, then VALIDATE in a transaction of its own, and both end valid", async () => {
+    const out = await apply(writeBuild("v2.json", [schema, parents, items("pos", "fk")]));
+    expect(out.failed).toEqual([]);
+    const mine = out.statements.filter((s) => /items_n_pos|items_parent_fkey/.test(s.sql));
+    expect(mine.map((s) => [s.sql, s.class])).toEqual([
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT items_n_pos CHECK (n > 0) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_n_pos`, "validate"],
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT items_parent_fkey FOREIGN KEY (parent) REFERENCES ${S}.parents (id) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_parent_fkey`, "validate"],
+    ]);
+    const [addCheck, validateCheck, addFk, validateFk] = mine.map((s) => s.transaction);
+    expect(validateCheck).not.toBe(addCheck);
+    expect(validateCheck).not.toBe(addFk);
+    expect(validateFk).not.toBe(addFk);
+    expect(await validated("items_n_pos")).toBe(true);
+    expect(await validated("items_parent_fkey")).toBe(true);
+  }, 120_000);
+
+  test("a concurrent writer is not blocked while VALIDATE reads the table", async () => {
+    await admin.query(`ALTER TABLE ${S}.items DROP CONSTRAINT items_parent_fkey`);
+    const before = doc([schema, parents, items("pos")]);
+    const steps = diffStatements(before, doc([schema, parents, items("pos", "fk", "small")])).steps.filter((s): s is StatementStep => s.kind === "statement");
+    expect(steps.map((s) => [s.rule, s.class])).toEqual([
+      ["SQLPG217", "metadata"],
+      ["SQLPG220", "validate"],
+      ["SQLPG217", "metadata"],
+      ["SQLPG220", "validate"],
+    ]);
+    for (const s of steps.filter((s) => s.precheck)) expect((await admin.query<{ n: string }>(s.precheck!.sql))[0]!.n, s.sql).toBe("0");
+
+    const applier = await session();
+    const writer = await session();
+    try {
+      await writer.query("SET lock_timeout = '300ms'");
+      let id = 1_000_000;
+      for (const s of steps) {
+        await applier.query("BEGIN");
+        await applier.query(s.sql);
+        // The applier's transaction is open: does a write to the table wait for it?
+        const blocked = await writer.query(`INSERT INTO ${S}.items (id, n, parent) VALUES (${id++}, 1, 1)`).then(
+          () => false,
+          (e: { code?: string }) => e.code === "55P03",
+        );
+        await applier.query("COMMIT");
+        // VALIDATE reads every row, and the writer goes on.
+        if (s.class === "validate") expect(blocked, s.sql).toBe(false);
+        // The probe sees a lock: the NOT VALID add does hold the writer while its transaction is open.
+        else expect(blocked, s.sql).toBe(true);
+      }
+    } finally {
+      await applier.end();
+      await writer.end();
+    }
+    expect(await validated("items_parent_fkey")).toBe(true);
+    expect(await validated("items_n_small")).toBe(true);
+  }, 120_000);
+
+  test("a run that stopped after the NOT VALID add resumes at VALIDATE", async () => {
+    await admin.query(`ALTER TABLE ${S}.items DROP CONSTRAINT items_n_small`);
+    // The run stopped after its first statement.
+    await admin.query(`ALTER TABLE ${S}.items ADD CONSTRAINT items_n_small CHECK (n < 1000000) NOT VALID`);
+    expect(await validated("items_n_small")).toBe(false);
+    const out = await apply(writeBuild("v3.json", [schema, parents, items("pos", "fk", "small")]));
+    expect(out.failed).toEqual([]);
+    expect(out.statements.filter((s) => s.sql.includes("items_n_small")).map((s) => [s.sql, s.class])).toEqual([[`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_n_small`, "validate"]]);
+    expect(await validated("items_n_small")).toBe(true);
+  }, 120_000);
+});

package/src/postgres/apply/safe-sequences.e2e.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Lock-safe SET NOT NULL and the pre-checks against a live server (#3686).
+ *
+ * - The applier makes SET NOT NULL as a NOT VALID check, its validation in a
+ *   transaction of its own, SET NOT NULL and the check dropped, and leaves no
+ *   check behind.
+ * - Step by step, each statement's transaction held open: a concurrent
+ *   writer is not blocked while the validation reads the table, and SET NOT
+ *   NULL is proven by the check without a scan (the server says so at
+ *   DEBUG1).
+ * - Each kind of pre-check runs on the server and counts what its statement
+ *   would fail on: NULLs, duplicates, rows a check refuses, orphans.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (with
+ * `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, else a throwaway
+ * server at the pin, skipped when Docker is not available. The test writes
+ * only to the schema `chant_e2e_3686`, dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import pg from "pg";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { diffStatements, type StatementStep } from "../../migration-statements";
+
+const S = "chant_e2e_3686";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-safe-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await admin?.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`).catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const doc = (objects: Obj[]) => ({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) });
+const schema: Obj = { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` };
+const items = (cols: { a?: boolean; b?: boolean }): Obj => ({
+  export: "items",
+  type: "Postgres::Table",
+  dependsOn: ["app"],
+  ddl: `CREATE TABLE ${S}.items (id bigint PRIMARY KEY, a text${cols.a ? " NOT NULL" : ""}, b text${cols.b ? " NOT NULL" : ""}, c text, parent bigint)`,
+});
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify(doc(objects)));
+  return path;
+}
+
+const profile = () => ({
+  config: { ownership: { stack: "e2e3686", env: "test" }, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+const apply = (path: string) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+
+/** A raw node-postgres session, for holding a transaction open and reading the server's notices. */
+async function session(): Promise<pg.Client> {
+  const url = new URL(endpoint.url);
+  if (endpoint.password !== undefined) url.password = encodeURIComponent(endpoint.password);
+  const c = new pg.Client({ connectionString: url.toString() });
+  c.on("error", () => undefined);
+  await c.connect();
+  return c;
+}
+
+describe.skipIf(!enabled)("lock-safe SET NOT NULL on a live server", () => {
+  beforeAll(async () => {
+    const first = await apply(writeBuild("v1.json", [schema, items({})]));
+    expect(first.failed).toEqual([]);
+    await admin.query(`INSERT INTO ${S}.items (id, a, b, c, parent) SELECT g, 'a', 'b', CASE WHEN g = 7 THEN NULL ELSE 'c' END, g FROM generate_series(1, 200000) g`);
+  }, 120_000);
+
+  test("the applier sends the four statements, validating in a transaction of its own, and leaves no check", async () => {
+    const out = await apply(writeBuild("v2.json", [schema, items({ a: true })]));
+    expect(out.failed).toEqual([]);
+    const mine = out.statements.filter((s) => s.sql.includes("a__chant_nn") || s.sql.includes("COLUMN a "));
+    expect(mine.map((s) => [s.sql, s.class])).toEqual([
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT a__chant_nn CHECK (a IS NOT NULL) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT a__chant_nn`, "validate"],
+      [`ALTER TABLE ${S}.items ALTER COLUMN a SET NOT NULL`, "metadata"],
+      [`ALTER TABLE ${S}.items DROP CONSTRAINT a__chant_nn`, "metadata"],
+    ]);
+    const [add, validate, set] = mine.map((s) => s.transaction);
+    expect(validate).not.toBe(add);
+    expect(validate).not.toBe(set);
+    const [col] = await admin.query<{ notnull: boolean }>(`SELECT attnotnull AS notnull FROM pg_attribute WHERE attrelid = '${S}.items'::regclass AND attname = 'a'`);
+    expect(col?.notnull).toBe(true);
+    expect(await admin.query(`SELECT 1 FROM pg_constraint WHERE conrelid = '${S}.items'::regclass AND conname = 'a__chant_nn'`)).toEqual([]);
+  }, 120_000);
+
+  test("a concurrent writer is not blocked while the table is validated, and SET NOT NULL does not scan", async () => {
+    const d = diffStatements(doc([schema, items({ a: true })]), doc([schema, items({ a: true, b: true })]));
+    const steps = d.steps.filter((s): s is StatementStep => s.kind === "statement");
+    expect(steps.map((s) => s.class)).toEqual(["metadata", "validate", "metadata", "metadata"]);
+    expect((await admin.query<{ n: string }>(steps[0]!.precheck!.sql))[0]!.n).toBe("0");
+
+    const applier = await session();
+    const writer = await session();
+    const notices: string[] = [];
+    applier.on("notice", (n) => notices.push(n.message ?? ""));
+    try {
+      await writer.query("SET lock_timeout = '300ms'");
+      let id = 1_000_000;
+      for (const s of steps) {
+        await applier.query("BEGIN");
+        await applier.query(s.sql.includes("SET NOT NULL") ? "SET LOCAL client_min_messages = debug1" : "SET LOCAL client_min_messages = notice");
+        await applier.query(s.sql);
+        // The applier's transaction is open: does a write to the table wait for it?
+        const blocked = await writer.query(`INSERT INTO ${S}.items (id, a, b, c) VALUES (${id++}, 'a', 'b', 'c')`).then(
+          () => false,
+          (e: { code?: string }) => e.code === "55P03",
+        );
+        await applier.query("COMMIT");
+        if (s.class === "validate") expect(blocked, s.sql).toBe(false);
+        // The probe sees a lock: the brief catalog change does hold the writer while its transaction is open.
+        if (s.rule === "SQLPG217") expect(blocked, s.sql).toBe(true);
+      }
+    } finally {
+      await applier.end();
+      await writer.end();
+    }
+    expect(notices.some((m) => /sufficient to prove that it does not contain nulls/.test(m))).toBe(true);
+  }, 120_000);
+
+  test("each pre-check counts what its statement would fail on", async () => {
+    // c is NULL in one row; a holds one value in every row; one row has id 7; parent 1 is not a parent.
+    await admin.query(`CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)`);
+    await admin.query(`INSERT INTO ${S}.parents SELECT g FROM generate_series(2, 200000) g`);
+    const after = (ddl: string, extra: Obj[] = []) => doc([schema, { ...items({ a: true, b: true }), ddl }, ...extra]);
+    const before = doc([schema, items({ a: true, b: true }), { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` }]);
+    const base = items({ a: true, b: true }).ddl;
+    const parents: Obj = { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` };
+    const cases: Array<[string, ReturnType<typeof doc>, string]> = [
+      ["SET NOT NULL", after(base.replace("c text", "c text NOT NULL"), [parents]), "1"],
+      ["UNIQUE", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT items_a_key UNIQUE (a))"), [parents]), "1"],
+      ["UNIQUE over id", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT items_id_key UNIQUE (id))"), [parents]), "0"],
+      ["CHECK", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT not_seven CHECK (id <> 7))"), [parents]), "1"],
+      ["FOREIGN KEY", after(base.replace("parent bigint", `parent bigint CONSTRAINT items_parent_fkey REFERENCES ${S}.parents (id)`), [parents]), "1"],
+    ];
+    for (const [what, next, n] of cases) {
+      const step = diffStatements(before, next).steps.find((s): s is StatementStep => s.kind === "statement" && s.precheck !== undefined);
+      expect(step, what).toBeDefined();
+      expect((await admin.query<{ n: string }>(step!.precheck!.sql))[0]!.n, what).toBe(n);
+    }
+  }, 120_000);
+});