@intentius/chant-lexicon-sql 0.117.0 → 0.118.1

package/src/migration-statements.test.ts

@@ -150,6 +150,31 @@ const PG_AFTER = build("postgres", [APP, USERS_V2, EMAIL_IDX, ORDERS_RENAMED], {
 describe("Postgres", () => {
   const doc = diffStatements(PG_BEFORE, PG_AFTER, { marker: MARKER, env: "prod" });
 
+  test("a unique index on a table that exists carries its duplicate count, one on a new table none (#3686)", () => {
+    const unique: Obj = { export: "usersNick", type: "Postgres::Index", dependsOn: ["users"], ddl: "CREATE UNIQUE INDEX CONCURRENTLY users_nick_key ON app.users (nick) WHERE nick <> ''" };
+    const d = diffStatements(build("postgres", [APP, USERS]), build("postgres", [APP, USERS, unique]));
+    const built = d.steps.find((s): s is StatementStep => s.kind === "statement" && s.sql.startsWith("CREATE UNIQUE INDEX"));
+    expect(built?.precheck).toEqual({
+      sql: "SELECT (SELECT count(*) FROM (SELECT 1 FROM app.users WHERE nick IS NOT NULL AND (nick <> '') GROUP BY nick HAVING count(*) > 1) AS duplicates) AS n",
+      detail: "values of (nick) held by more than one row, which a unique index fails on",
+    });
+    expect(renderStatements(d)).toContain(`-- pre-check, must return 0 (values of (nick) held by more than one row, which a unique index fails on): ${built!.precheck!.sql}`);
+    const fresh = diffStatements(build("postgres", [APP]), build("postgres", [APP, USERS, unique]));
+    expect(fresh.steps.some((s) => s.kind === "statement" && s.precheck !== undefined)).toBe(false);
+  });
+
+  test("SET NOT NULL renders as its four statements, the first with the NULL count (#3686)", () => {
+    const d = diffStatements(build("postgres", [APP, USERS]), build("postgres", [APP, { ...USERS, ddl: USERS.ddl.replace("nick text", "nick text NOT NULL") }]));
+    const st = d.steps.filter((s): s is StatementStep => s.kind === "statement");
+    expect(st.map((s) => [s.sql, s.rule, s.class])).toEqual([
+      ["ALTER TABLE app.users ADD CONSTRAINT nick__chant_nn CHECK (nick IS NOT NULL) NOT VALID", "SQLPG217", "metadata"],
+      ["ALTER TABLE app.users VALIDATE CONSTRAINT nick__chant_nn", "SQLPG220", "validate"],
+      ["ALTER TABLE app.users ALTER COLUMN nick SET NOT NULL", "SQLPG210", "metadata"],
+      ["ALTER TABLE app.users DROP CONSTRAINT nick__chant_nn", "SQLPG223", "metadata"],
+    ]);
+    expect(st[0]!.precheck?.sql).toBe("SELECT count(*) AS n FROM app.users WHERE nick IS NULL");
+  });
+
   test("the statements are ordered, each with its change's rule and class and whether it may run in a transaction", () => {
     expect(doc).toMatchObject({ dialect: "postgres", defaultSchema: "public", major: 18 });
     expect(doc.steps.filter((s): s is StatementStep => s.kind === "statement").map((s) => [s.object, s.sql, s.rule, s.class, s.transactional])).toEqual([

package/src/migration-statements.ts

@@ -234,6 +234,7 @@ function postgresStatements(beforeJson: string, afterJson: string, options: Diff
         class: s.class,
         transactional: s.transactional,
         ...(s.rule === "SQLPG204" || isDestructive(entry.changes, s.rule) ? { destructive: true } : {}),
+        ...(s.precheck ? { precheck: { sql: s.precheck.sql, detail: s.precheck.detail } } : {}),
       });
     }
   }

package/src/op/activities/clickhouse-rebuild.ts

@@ -71,6 +71,7 @@ export async function rebuildRun(args: ClickHouseRebuildArgs, signal: AbortSigna
     retainMs: parseDuration(args.retain ?? "7d"),
     ...(args.mutationTimeout ? { mutationTimeoutMs: parseDuration(args.mutationTimeout) } : {}),
     ...(args.replicaTimeout ? { replicaTimeoutMs: parseDuration(args.replicaTimeout) } : {}),
+    ...(args.cutoverTimeout ? { cutoverTimeoutMs: parseDuration(args.cutoverTimeout) } : {}),
     log: deps.log ?? ((line: string) => console.log(line)),
     ...(signal ? { signal } : {}),
     ...(runId ? { runId } : {}),

package/src/op/activity-contracts.ts

@@ -31,6 +31,7 @@ const rebuildArgs = z.strictObject({
   retain: z.string().optional(),
   mutationTimeout: z.string().optional(),
   replicaTimeout: z.string().optional(),
+  cutoverTimeout: z.string().optional(),
   stack: z.string().optional(),
   ownershipEnv: z.string().optional(),
   cwd: z.string().optional(),

package/src/plugin.ts

@@ -18,7 +18,7 @@ import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
 import { sqlMcpResources, sqlMcpTools } from "./mcp";
 import { sqlConfigSchema } from "./config";
-import { ClickHouseSqlParser } from "./clickhouse/import/parser";
+import { SqlFileParser, dialectOption } from "./import-parser";
 import { sqlTemplateGenerator } from "./import-generator";
 import { sqlCommands } from "./clickhouse/plan/commands";
 import { sqlDeepNormalizationHooks } from "./clickhouse/plan/deep";
@@ -97,18 +97,20 @@ export const sqlPlugin: LexiconPlugin = {
         isTag: true,
         description: "A CREATE VIEW or CREATE MATERIALIZED VIEW, parsed into a view entity with its lineage",
       },
+      { name: "dictionary", isTag: true, description: "A ClickHouse CREATE DICTIONARY, parsed into a dictionary entity with its attributes, key, source and layout" },
+      { name: "user", isTag: true, description: "A ClickHouse CREATE USER, parsed into a user entity; its password is the environment's" },
       { name: "schema", isTag: true, description: "A Postgres CREATE SCHEMA, parsed into a schema entity" },
       { name: "index", isTag: true, description: "A Postgres CREATE INDEX, parsed into an index entity" },
       { name: "sequence", isTag: true, description: "A Postgres CREATE SEQUENCE, parsed into a sequence entity" },
       { name: "type", isTag: true, description: "A Postgres CREATE TYPE ... AS ENUM, parsed into an enum entity" },
       { name: "domain", isTag: true, description: "A Postgres CREATE DOMAIN, parsed into a domain entity" },
       { name: "extension", isTag: true, description: "A Postgres CREATE EXTENSION, parsed into an extension entity" },
-      { name: "func", isTag: true, description: "A Postgres CREATE FUNCTION, parsed into a function entity with its body kept verbatim" },
+      { name: "func", isTag: true, description: "A Postgres CREATE FUNCTION, parsed into a function entity with its body kept verbatim, or a ClickHouse CREATE FUNCTION (a named lambda)" },
       { name: "procedure", isTag: true, description: "A Postgres CREATE PROCEDURE, parsed into a procedure entity with its body kept verbatim" },
       { name: "trigger", isTag: true, description: "A Postgres CREATE TRIGGER, parsed into a trigger entity on its table" },
-      { name: "policy", isTag: true, description: "A Postgres CREATE POLICY, parsed into a row-level security policy on its table" },
-      { name: "role", isTag: true, description: "A Postgres CREATE ROLE without a password or memberships, parsed into a role entity" },
-      { name: "grant", isTag: true, description: "A Postgres GRANT, REVOKE or ALTER DEFAULT PRIVILEGES, parsed into the privileges it declares" },
+      { name: "policy", isTag: true, description: "A Postgres CREATE POLICY, parsed into a row-level security policy on its table, or a ClickHouse CREATE ROW POLICY" },
+      { name: "role", isTag: true, description: "A Postgres CREATE ROLE without a password or memberships, parsed into a role entity, or a ClickHouse CREATE ROLE" },
+      { name: "grant", isTag: true, description: "A Postgres GRANT, REVOKE or ALTER DEFAULT PRIVILEGES, parsed into the privileges it declares, or a ClickHouse GRANT of privileges or roles" },
       {
         name: "literal",
         isTag: false,
@@ -155,9 +157,28 @@ export const sqlPlugin: LexiconPlugin = {
     return sqlMcpResources();
   },
 
-  /** `chant import schema.sql`: a file of ClickHouse CREATE statements. */
-  templateParser() {
-    return new ClickHouseSqlParser();
+  /** `chant import schema.sql`: a file of Postgres or ClickHouse DDL (`./import-parser.ts`). */
+  templateParser(options) {
+    return new SqlFileParser(dialectOption(options));
+  },
+
+  parserOptions() {
+    return [
+      {
+        name: "dialect",
+        type: "string" as const,
+        description: "the DDL's dialect, clickhouse or postgres; read off its statements when omitted",
+      },
+    ];
+  },
+
+  /**
+   * The `.sql` files in the source directory, read into declarations beside
+   * the tagged templates (`./files/build-root.ts`, #3646).
+   */
+  async buildRoots(ctx) {
+    const { sqlFilesBuildRoot } = await import("./files/build-root");
+    return sqlFilesBuildRoot(ctx);
   },
 
   /** One generator for both dialects: each IR resource's type says whose declarations it is. */

package/src/postgres/apply/constraint-sequences.e2e.test.ts

@@ -0,0 +1,179 @@
+/**
+ * A CHECK or a foreign key added to a table that exists, against a live
+ * server (#3703).
+ *
+ * - The applier adds each one NOT VALID, then validates it in a transaction
+ *   of its own, and both end valid.
+ * - Step by step, each statement's transaction held open: a concurrent
+ *   writer is not blocked while VALIDATE reads the 200,000 rows, and the
+ *   probe is shown to detect locks by being blocked during the NOT VALID add.
+ * - A run that stopped after the NOT VALID add resumes at VALIDATE.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (with
+ * `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, else a throwaway
+ * server at the pin, skipped when Docker is not available. The test writes
+ * only to the schema `chant_e2e_3703`, dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import pg from "pg";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { diffStatements, type StatementStep } from "../../migration-statements";
+
+const S = "chant_e2e_3703";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-constraints-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await admin?.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`).catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const doc = (objects: Obj[]) => ({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) });
+const schema: Obj = { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` };
+const parents: Obj = { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` };
+/** `items` with the constraints named in `with` declared. */
+const items = (...with_: Array<"pos" | "fk" | "small">): Obj => ({
+  export: "items",
+  type: "Postgres::Table",
+  dependsOn: ["app", "parents"],
+  ddl: [
+    `CREATE TABLE ${S}.items (id bigint PRIMARY KEY, n int, parent bigint`,
+    with_.includes("pos") ? ", CONSTRAINT items_n_pos CHECK (n > 0)" : "",
+    with_.includes("fk") ? `, CONSTRAINT items_parent_fkey FOREIGN KEY (parent) REFERENCES ${S}.parents (id)` : "",
+    with_.includes("small") ? ", CONSTRAINT items_n_small CHECK (n < 1000000)" : "",
+    ")",
+  ].join(""),
+});
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify(doc(objects)));
+  return path;
+}
+
+const profile = () => ({
+  config: { ownership: { stack: "e2e3703", env: "test" }, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+const apply = (path: string) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+const validated = async (name: string) =>
+  (await admin.query<{ v: boolean }>(`SELECT convalidated AS v FROM pg_constraint WHERE conrelid = '${S}.items'::regclass AND conname = '${name}'`))[0]?.v;
+
+/** A raw node-postgres session, for holding a transaction open. */
+async function session(): Promise<pg.Client> {
+  const url = new URL(endpoint.url);
+  if (endpoint.password !== undefined) url.password = encodeURIComponent(endpoint.password);
+  const c = new pg.Client({ connectionString: url.toString() });
+  c.on("error", () => undefined);
+  await c.connect();
+  return c;
+}
+
+describe.skipIf(!enabled)("a CHECK and a foreign key added NOT VALID, then validated, on a live server", () => {
+  beforeAll(async () => {
+    const first = await apply(writeBuild("v1.json", [schema, parents, items()]));
+    expect(first.failed).toEqual([]);
+    await admin.query(`INSERT INTO ${S}.parents SELECT g FROM generate_series(1, 200000) g`);
+    await admin.query(`INSERT INTO ${S}.items (id, n, parent) SELECT g, g, g FROM generate_series(1, 200000) g`);
+  }, 120_000);
+
+  test("the applier sends ADD ... NOT VALID, then VALIDATE in a transaction of its own, and both end valid", async () => {
+    const out = await apply(writeBuild("v2.json", [schema, parents, items("pos", "fk")]));
+    expect(out.failed).toEqual([]);
+    const mine = out.statements.filter((s) => /items_n_pos|items_parent_fkey/.test(s.sql));
+    expect(mine.map((s) => [s.sql, s.class])).toEqual([
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT items_n_pos CHECK (n > 0) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_n_pos`, "validate"],
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT items_parent_fkey FOREIGN KEY (parent) REFERENCES ${S}.parents (id) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_parent_fkey`, "validate"],
+    ]);
+    const [addCheck, validateCheck, addFk, validateFk] = mine.map((s) => s.transaction);
+    expect(validateCheck).not.toBe(addCheck);
+    expect(validateCheck).not.toBe(addFk);
+    expect(validateFk).not.toBe(addFk);
+    expect(await validated("items_n_pos")).toBe(true);
+    expect(await validated("items_parent_fkey")).toBe(true);
+  }, 120_000);
+
+  test("a concurrent writer is not blocked while VALIDATE reads the table", async () => {
+    await admin.query(`ALTER TABLE ${S}.items DROP CONSTRAINT items_parent_fkey`);
+    const before = doc([schema, parents, items("pos")]);
+    const steps = diffStatements(before, doc([schema, parents, items("pos", "fk", "small")])).steps.filter((s): s is StatementStep => s.kind === "statement");
+    expect(steps.map((s) => [s.rule, s.class])).toEqual([
+      ["SQLPG217", "metadata"],
+      ["SQLPG220", "validate"],
+      ["SQLPG217", "metadata"],
+      ["SQLPG220", "validate"],
+    ]);
+    for (const s of steps.filter((s) => s.precheck)) expect((await admin.query<{ n: string }>(s.precheck!.sql))[0]!.n, s.sql).toBe("0");
+
+    const applier = await session();
+    const writer = await session();
+    try {
+      await writer.query("SET lock_timeout = '300ms'");
+      let id = 1_000_000;
+      for (const s of steps) {
+        await applier.query("BEGIN");
+        await applier.query(s.sql);
+        // The applier's transaction is open: does a write to the table wait for it?
+        const blocked = await writer.query(`INSERT INTO ${S}.items (id, n, parent) VALUES (${id++}, 1, 1)`).then(
+          () => false,
+          (e: { code?: string }) => e.code === "55P03",
+        );
+        await applier.query("COMMIT");
+        // VALIDATE reads every row, and the writer goes on.
+        if (s.class === "validate") expect(blocked, s.sql).toBe(false);
+        // The probe sees a lock: the NOT VALID add does hold the writer while its transaction is open.
+        else expect(blocked, s.sql).toBe(true);
+      }
+    } finally {
+      await applier.end();
+      await writer.end();
+    }
+    expect(await validated("items_parent_fkey")).toBe(true);
+    expect(await validated("items_n_small")).toBe(true);
+  }, 120_000);
+
+  test("a run that stopped after the NOT VALID add resumes at VALIDATE", async () => {
+    await admin.query(`ALTER TABLE ${S}.items DROP CONSTRAINT items_n_small`);
+    // The run stopped after its first statement.
+    await admin.query(`ALTER TABLE ${S}.items ADD CONSTRAINT items_n_small CHECK (n < 1000000) NOT VALID`);
+    expect(await validated("items_n_small")).toBe(false);
+    const out = await apply(writeBuild("v3.json", [schema, parents, items("pos", "fk", "small")]));
+    expect(out.failed).toEqual([]);
+    expect(out.statements.filter((s) => s.sql.includes("items_n_small")).map((s) => [s.sql, s.class])).toEqual([[`ALTER TABLE ${S}.items VALIDATE CONSTRAINT items_n_small`, "validate"]]);
+    expect(await validated("items_n_small")).toBe(true);
+  }, 120_000);
+});

package/src/postgres/apply/safe-sequences.e2e.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Lock-safe SET NOT NULL and the pre-checks against a live server (#3686).
+ *
+ * - The applier makes SET NOT NULL as a NOT VALID check, its validation in a
+ *   transaction of its own, SET NOT NULL and the check dropped, and leaves no
+ *   check behind.
+ * - Step by step, each statement's transaction held open: a concurrent
+ *   writer is not blocked while the validation reads the table, and SET NOT
+ *   NULL is proven by the check without a scan (the server says so at
+ *   DEBUG1).
+ * - Each kind of pre-check runs on the server and counts what its statement
+ *   would fail on: NULLs, duplicates, rows a check refuses, orphans.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (with
+ * `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, else a throwaway
+ * server at the pin, skipped when Docker is not available. The test writes
+ * only to the schema `chant_e2e_3686`, dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import pg from "pg";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { diffStatements, type StatementStep } from "../../migration-statements";
+
+const S = "chant_e2e_3686";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-safe-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await admin?.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`).catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const doc = (objects: Obj[]) => ({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) });
+const schema: Obj = { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` };
+const items = (cols: { a?: boolean; b?: boolean }): Obj => ({
+  export: "items",
+  type: "Postgres::Table",
+  dependsOn: ["app"],
+  ddl: `CREATE TABLE ${S}.items (id bigint PRIMARY KEY, a text${cols.a ? " NOT NULL" : ""}, b text${cols.b ? " NOT NULL" : ""}, c text, parent bigint)`,
+});
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify(doc(objects)));
+  return path;
+}
+
+const profile = () => ({
+  config: { ownership: { stack: "e2e3686", env: "test" }, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+const apply = (path: string) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+
+/** A raw node-postgres session, for holding a transaction open and reading the server's notices. */
+async function session(): Promise<pg.Client> {
+  const url = new URL(endpoint.url);
+  if (endpoint.password !== undefined) url.password = encodeURIComponent(endpoint.password);
+  const c = new pg.Client({ connectionString: url.toString() });
+  c.on("error", () => undefined);
+  await c.connect();
+  return c;
+}
+
+describe.skipIf(!enabled)("lock-safe SET NOT NULL on a live server", () => {
+  beforeAll(async () => {
+    const first = await apply(writeBuild("v1.json", [schema, items({})]));
+    expect(first.failed).toEqual([]);
+    await admin.query(`INSERT INTO ${S}.items (id, a, b, c, parent) SELECT g, 'a', 'b', CASE WHEN g = 7 THEN NULL ELSE 'c' END, g FROM generate_series(1, 200000) g`);
+  }, 120_000);
+
+  test("the applier sends the four statements, validating in a transaction of its own, and leaves no check", async () => {
+    const out = await apply(writeBuild("v2.json", [schema, items({ a: true })]));
+    expect(out.failed).toEqual([]);
+    const mine = out.statements.filter((s) => s.sql.includes("a__chant_nn") || s.sql.includes("COLUMN a "));
+    expect(mine.map((s) => [s.sql, s.class])).toEqual([
+      [`ALTER TABLE ${S}.items ADD CONSTRAINT a__chant_nn CHECK (a IS NOT NULL) NOT VALID`, "metadata"],
+      [`ALTER TABLE ${S}.items VALIDATE CONSTRAINT a__chant_nn`, "validate"],
+      [`ALTER TABLE ${S}.items ALTER COLUMN a SET NOT NULL`, "metadata"],
+      [`ALTER TABLE ${S}.items DROP CONSTRAINT a__chant_nn`, "metadata"],
+    ]);
+    const [add, validate, set] = mine.map((s) => s.transaction);
+    expect(validate).not.toBe(add);
+    expect(validate).not.toBe(set);
+    const [col] = await admin.query<{ notnull: boolean }>(`SELECT attnotnull AS notnull FROM pg_attribute WHERE attrelid = '${S}.items'::regclass AND attname = 'a'`);
+    expect(col?.notnull).toBe(true);
+    expect(await admin.query(`SELECT 1 FROM pg_constraint WHERE conrelid = '${S}.items'::regclass AND conname = 'a__chant_nn'`)).toEqual([]);
+  }, 120_000);
+
+  test("a concurrent writer is not blocked while the table is validated, and SET NOT NULL does not scan", async () => {
+    const d = diffStatements(doc([schema, items({ a: true })]), doc([schema, items({ a: true, b: true })]));
+    const steps = d.steps.filter((s): s is StatementStep => s.kind === "statement");
+    expect(steps.map((s) => s.class)).toEqual(["metadata", "validate", "metadata", "metadata"]);
+    expect((await admin.query<{ n: string }>(steps[0]!.precheck!.sql))[0]!.n).toBe("0");
+
+    const applier = await session();
+    const writer = await session();
+    const notices: string[] = [];
+    applier.on("notice", (n) => notices.push(n.message ?? ""));
+    try {
+      await writer.query("SET lock_timeout = '300ms'");
+      let id = 1_000_000;
+      for (const s of steps) {
+        await applier.query("BEGIN");
+        await applier.query(s.sql.includes("SET NOT NULL") ? "SET LOCAL client_min_messages = debug1" : "SET LOCAL client_min_messages = notice");
+        await applier.query(s.sql);
+        // The applier's transaction is open: does a write to the table wait for it?
+        const blocked = await writer.query(`INSERT INTO ${S}.items (id, a, b, c) VALUES (${id++}, 'a', 'b', 'c')`).then(
+          () => false,
+          (e: { code?: string }) => e.code === "55P03",
+        );
+        await applier.query("COMMIT");
+        if (s.class === "validate") expect(blocked, s.sql).toBe(false);
+        // The probe sees a lock: the brief catalog change does hold the writer while its transaction is open.
+        if (s.rule === "SQLPG217") expect(blocked, s.sql).toBe(true);
+      }
+    } finally {
+      await applier.end();
+      await writer.end();
+    }
+    expect(notices.some((m) => /sufficient to prove that it does not contain nulls/.test(m))).toBe(true);
+  }, 120_000);
+
+  test("each pre-check counts what its statement would fail on", async () => {
+    // c is NULL in one row; a holds one value in every row; one row has id 7; parent 1 is not a parent.
+    await admin.query(`CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)`);
+    await admin.query(`INSERT INTO ${S}.parents SELECT g FROM generate_series(2, 200000) g`);
+    const after = (ddl: string, extra: Obj[] = []) => doc([schema, { ...items({ a: true, b: true }), ddl }, ...extra]);
+    const before = doc([schema, items({ a: true, b: true }), { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` }]);
+    const base = items({ a: true, b: true }).ddl;
+    const parents: Obj = { export: "parents", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.parents (id bigint PRIMARY KEY)` };
+    const cases: Array<[string, ReturnType<typeof doc>, string]> = [
+      ["SET NOT NULL", after(base.replace("c text", "c text NOT NULL"), [parents]), "1"],
+      ["UNIQUE", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT items_a_key UNIQUE (a))"), [parents]), "1"],
+      ["UNIQUE over id", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT items_id_key UNIQUE (id))"), [parents]), "0"],
+      ["CHECK", after(base.replace(", parent bigint)", ", parent bigint, CONSTRAINT not_seven CHECK (id <> 7))"), [parents]), "1"],
+      ["FOREIGN KEY", after(base.replace("parent bigint", `parent bigint CONSTRAINT items_parent_fkey REFERENCES ${S}.parents (id)`), [parents]), "1"],
+    ];
+    for (const [what, next, n] of cases) {
+      const step = diffStatements(before, next).steps.find((s): s is StatementStep => s.kind === "statement" && s.precheck !== undefined);
+      expect(step, what).toBeDefined();
+      expect((await admin.query<{ n: string }>(step!.precheck!.sql))[0]!.n, what).toBe(n);
+    }
+  }, 120_000);
+});