@prisma-next/family-sql 0.12.0-dev.17 → 0.12.0-dev.2

package/src/core/schema-verify/verify-sql-schema.ts

@@ -6,14 +6,12 @@
  * by migration planners and other tools that need to compare schema states.
  */
 
-import type { ColumnDefault, Contract, ControlPolicy } from '@prisma-next/contract/types';
-import { effectiveControlPolicy } from '@prisma-next/contract/types';
+import type { ColumnDefault, Contract } from '@prisma-next/contract/types';
 import type { TargetBoundComponentDescriptor } from '@prisma-next/framework-components/components';
 import type {
   OperationContext,
   SchemaIssue,
   SchemaVerificationNode,
-  VerificationStatus,
   VerifyDatabaseSchemaResult,
 } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
@@ -31,8 +29,6 @@ import { canonicalStringify } from '@prisma-next/utils/canonical-stringify';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { extractCodecControlHooks } from '../assembly';
 import type { CodecControlHooks } from '../migrations/types';
-import { emitIssueAndNodeUnderControlPolicy } from './control-verify-emit';
-import { verifierDisposition } from './verifier-disposition';
 import {
   arraysEqual,
   computeCounts,
@@ -42,8 +38,6 @@ import {
   verifyUniqueConstraints,
 } from './verify-helpers';
 
-export type ColumnsCompatible = (declared: string, live: string) => boolean;
-
 /**
  * Function type for normalizing raw database default expressions into ColumnDefault.
  * Target-specific implementations handle database dialect differences.
@@ -107,11 +101,6 @@ export interface VerifySqlSchemaOptions {
     enumType: PostgresEnumStorageEntry,
     namespaceId: string,
   ) => readonly string[] | null;
-  /**
-   * Target-supplied compatible-shape relation for `external` column type checks.
-   * Defaults to exact string equality when omitted.
-   */
-  readonly columnsCompatible?: ColumnsCompatible;
 }
 
 /**
@@ -134,7 +123,6 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
     normalizeDefault,
     normalizeNativeType,
     resolveExistingEnumValues,
-    columnsCompatible,
   } = options;
   const startTime = Date.now();
 
@@ -171,7 +159,6 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
     storageTypes,
     ...ifDefined('normalizeDefault', normalizeDefault),
     ...ifDefined('normalizeNativeType', normalizeNativeType),
-    ...ifDefined('columnsCompatible', columnsCompatible),
   });
 
   validateFrameworkComponentsForExtensions(contract, options.frameworkComponents);
@@ -184,39 +171,24 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
   // namespace coordinate — a bare-name aggregation would collapse them
   // (last-write-wins) and verify only one.
   const typeNodes: SchemaVerificationNode[] = [];
-  // Storage-type findings dispatch through the same control policy as tables
-  // and columns: each issue's disposition (fail / warn / suppress) is resolved
-  // from the type's effective control so an `external`/`observed` enum no longer
-  // hard-fails on value drift. `suppress` drops the issue entirely; the node
-  // status is the worst surviving disposition.
   const pushTypeNode = (
     typeName: string,
     contractPath: string,
     typeIssues: readonly SchemaIssue[],
-    controlPolicy: ControlPolicy,
   ): void => {
-    let status: VerificationStatus = 'pass';
-    let code = '';
-    let emitted = 0;
-    for (const issue of typeIssues) {
-      const disposition = verifierDisposition(controlPolicy, issue.kind);
-      if (disposition === 'suppress') continue;
-      issues.push(issue);
-      emitted += 1;
-      if (code === '') code = issue.kind;
-      if (disposition === 'fail') {
-        status = 'fail';
-      } else if (disposition === 'warn' && status !== 'fail') {
-        status = 'warn';
-      }
+    if (typeIssues.length > 0) {
+      issues.push(...typeIssues);
     }
     typeNodes.push({
-      status,
+      status: typeIssues.length > 0 ? 'fail' : 'pass',
       kind: 'storageType',
       name: `type ${typeName}`,
       contractPath,
-      code: status === 'pass' ? '' : code,
-      message: emitted > 0 ? `${emitted} issue${emitted === 1 ? '' : 's'}` : '',
+      code: typeIssues.length > 0 ? (typeIssues[0]?.kind ?? '') : '',
+      message:
+        typeIssues.length > 0
+          ? `${typeIssues.length} issue${typeIssues.length === 1 ? '' : 's'}`
+          : '',
       expected: undefined,
       actual: undefined,
       children: [],
@@ -237,7 +209,6 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
           resolveExistingEnumValues,
           namespaceId: UNBOUND_NAMESPACE_ID,
         }),
-        effectiveControlPolicy(typeInstance.control, contract.defaultControl),
       );
     } else if (isStorageTypeInstance(typeInstance)) {
       const hook = codecHooks.get(typeInstance.codecId);
@@ -245,7 +216,6 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
         typeName,
         `storage.types.${typeName}`,
         hook?.verifyType ? hook.verifyType({ typeName, typeInstance, schema }) : [],
-        effectiveControlPolicy(undefined, contract.defaultControl),
       );
     }
   }
@@ -268,17 +238,12 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
           resolveExistingEnumValues,
           namespaceId: nsId,
         }),
-        effectiveControlPolicy(entry.control, contract.defaultControl),
       );
     }
   }
 
   if (typeNodes.length > 0) {
-    const typesStatus: VerificationStatus = typeNodes.some((n) => n.status === 'fail')
-      ? 'fail'
-      : typeNodes.some((n) => n.status === 'warn')
-        ? 'warn'
-        : 'pass';
+    const typesStatus = typeNodes.some((n) => n.status === 'fail') ? 'fail' : 'pass';
     rootChildren.push({
       status: typesStatus,
       kind: 'storageTypes',
@@ -338,6 +303,8 @@ export function verifySqlSchema(options: VerifySqlSchemaOptions): VerifyDatabase
   };
 }
 
+type VerificationStatus = 'pass' | 'warn' | 'fail';
+
 /**
  * Native verification walk for `PostgresEnumStorageEntry` instances (no codec hook).
  *
@@ -419,7 +386,6 @@ function verifySchemaTables(options: {
   storageTypes: Readonly<Record<string, StorageTypeInstance | PostgresEnumStorageEntry>>;
   normalizeDefault?: DefaultNormalizer;
   normalizeNativeType?: NativeTypeNormalizer;
-  columnsCompatible?: ColumnsCompatible;
 }): { issues: SchemaIssue[]; rootChildren: SchemaVerificationNode[] } {
   const {
     contract,
@@ -430,9 +396,7 @@ function verifySchemaTables(options: {
     storageTypes,
     normalizeDefault,
     normalizeNativeType,
-    columnsCompatible,
   } = options;
-  const contractDefaultControl = contract.defaultControl;
   const issues: SchemaIssue[] = [];
   const rootChildren: SchemaVerificationNode[] = [];
   const schemaTables = schema.tables;
@@ -450,37 +414,27 @@ function verifySchemaTables(options: {
         );
       }
       const contractTable = contractTableRaw;
-      const tableControlPolicy = effectiveControlPolicy(
-        contractTable.control,
-        contractDefaultControl,
-      );
       const schemaTable = schemaTables[tableName];
       const tablePath = `storage.namespaces.${namespaceId}.tables.${tableName}`;
 
       if (!schemaTable) {
-        const issue: SchemaIssue = {
+        issues.push({
           kind: 'missing_table',
           table: tableName,
           namespaceId,
           message: `Table "${tableName}" is missing from database`,
-        };
-        emitIssueAndNodeUnderControlPolicy(
-          tableControlPolicy,
-          issue,
-          {
-            status: 'fail',
-            kind: 'table',
-            name: `table ${tableName}`,
-            contractPath: tablePath,
-            code: 'missing_table',
-            message: `Table "${tableName}" is missing`,
-            expected: undefined,
-            actual: undefined,
-            children: [],
-          },
-          issues,
-          rootChildren,
-        );
+        });
+        rootChildren.push({
+          status: 'fail',
+          kind: 'table',
+          name: `table ${tableName}`,
+          contractPath: tablePath,
+          code: 'missing_table',
+          message: `Table "${tableName}" is missing`,
+          expected: undefined,
+          actual: undefined,
+          children: [],
+        });
         continue;
       }
 
@@ -490,7 +444,6 @@ function verifySchemaTables(options: {
         tableName,
         namespaceId,
         tablePath,
-        tableControlPolicy,
         issues,
         strict,
         typeMetadataRegistry,
@@ -498,7 +451,6 @@ function verifySchemaTables(options: {
         storageTypes,
         ...ifDefined('normalizeDefault', normalizeDefault),
         ...ifDefined('normalizeNativeType', normalizeNativeType),
-        ...ifDefined('columnsCompatible', columnsCompatible),
       });
       rootChildren.push(buildTableNode(tableName, tablePath, tableChildren));
     }
@@ -510,29 +462,26 @@ function verifySchemaTables(options: {
         (namespaceId) => contract.storage.namespaces[namespaceId]?.tables[tableName] !== undefined,
       );
       if (!claimed) {
-        const extraTableControlPolicy = effectiveControlPolicy(undefined, contractDefaultControl);
-        const issue: SchemaIssue = {
+        // `namespaceId` is intentionally absent: an extra table exists in the
+        // live database but is not claimed by any contract namespace, so there
+        // is no contract coordinate to stamp here. Planners that consume this
+        // issue must handle the unstamped case (drop / quarantine by name).
+        issues.push({
           kind: 'extra_table',
           table: tableName,
           message: `Extra table "${tableName}" found in database (not in contract)`,
-        };
-        emitIssueAndNodeUnderControlPolicy(
-          extraTableControlPolicy,
-          issue,
-          {
-            status: 'fail',
-            kind: 'table',
-            name: `table ${tableName}`,
-            contractPath: `storage.namespaces.*.tables.${tableName}`,
-            code: 'extra_table',
-            message: `Extra table "${tableName}" found`,
-            expected: undefined,
-            actual: undefined,
-            children: [],
-          },
-          issues,
-          rootChildren,
-        );
+        });
+        rootChildren.push({
+          status: 'fail',
+          kind: 'table',
+          name: `table ${tableName}`,
+          contractPath: `storage.namespaces.*.tables.${tableName}`,
+          code: 'extra_table',
+          message: `Extra table "${tableName}" found`,
+          expected: undefined,
+          actual: undefined,
+          children: [],
+        });
       }
     }
   }
@@ -546,7 +495,6 @@ function verifyTableChildren(options: {
   tableName: string;
   namespaceId: string;
   tablePath: string;
-  tableControlPolicy: ControlPolicy;
   issues: SchemaIssue[];
   strict: boolean;
   typeMetadataRegistry: ReadonlyMap<string, { nativeType?: string }>;
@@ -554,7 +502,6 @@ function verifyTableChildren(options: {
   storageTypes: Readonly<Record<string, StorageTypeInstance | PostgresEnumStorageEntry>>;
   normalizeDefault?: DefaultNormalizer;
   normalizeNativeType?: NativeTypeNormalizer;
-  columnsCompatible?: ColumnsCompatible;
 }): SchemaVerificationNode[] {
   const {
     contractTable,
@@ -562,7 +509,6 @@ function verifyTableChildren(options: {
     tableName,
     namespaceId,
     tablePath,
-    tableControlPolicy,
     issues,
     strict,
     typeMetadataRegistry,
@@ -570,7 +516,6 @@ function verifyTableChildren(options: {
     storageTypes,
     normalizeDefault,
     normalizeNativeType,
-    columnsCompatible,
   } = options;
   const tableChildren: SchemaVerificationNode[] = [];
   const columnNodes = collectContractColumnNodes({
@@ -579,7 +524,6 @@ function verifyTableChildren(options: {
     tableName,
     namespaceId,
     tablePath,
-    tableControlPolicy,
     issues,
     strict,
     typeMetadataRegistry,
@@ -587,7 +531,6 @@ function verifyTableChildren(options: {
     storageTypes,
     ...ifDefined('normalizeDefault', normalizeDefault),
     ...ifDefined('normalizeNativeType', normalizeNativeType),
-    ...ifDefined('columnsCompatible', columnsCompatible),
   });
   if (columnNodes.length > 0) {
     tableChildren.push(buildColumnsNode(tablePath, columnNodes));
@@ -599,7 +542,6 @@ function verifyTableChildren(options: {
       tableName,
       namespaceId,
       tablePath,
-      tableControlPolicy,
       issues,
       columnNodes,
     });
@@ -611,7 +553,6 @@ function verifyTableChildren(options: {
       schemaTable.primaryKey,
       tableName,
       namespaceId,
-      tableControlPolicy,
       issues,
     );
     if (pkStatus === 'fail') {
@@ -626,18 +567,6 @@ function verifyTableChildren(options: {
         actual: schemaTable.primaryKey,
         children: [],
       });
-    } else if (pkStatus === 'warn') {
-      tableChildren.push({
-        status: 'warn',
-        kind: 'primaryKey',
-        name: `primary key: ${contractTable.primaryKey.columns.join(', ')}`,
-        contractPath: `${tablePath}.primaryKey`,
-        code: 'primary_key_mismatch',
-        message: 'Primary key mismatch',
-        expected: contractTable.primaryKey,
-        actual: schemaTable.primaryKey,
-        children: [],
-      });
     } else {
       tableChildren.push({
         status: 'pass',
@@ -652,29 +581,23 @@ function verifyTableChildren(options: {
       });
     }
   } else if (schemaTable.primaryKey && strict) {
-    const issue: SchemaIssue = {
+    issues.push({
       kind: 'extra_primary_key',
       table: tableName,
       namespaceId,
       message: 'Extra primary key found in database (not in contract)',
-    };
-    emitIssueAndNodeUnderControlPolicy(
-      tableControlPolicy,
-      issue,
-      {
-        status: 'fail',
-        kind: 'primaryKey',
-        name: `primary key: ${schemaTable.primaryKey.columns.join(', ')}`,
-        contractPath: `${tablePath}.primaryKey`,
-        code: 'extra_primary_key',
-        message: 'Extra primary key found',
-        expected: undefined,
-        actual: schemaTable.primaryKey,
-        children: [],
-      },
-      issues,
-      tableChildren,
-    );
+    });
+    tableChildren.push({
+      status: 'fail',
+      kind: 'primaryKey',
+      name: `primary key: ${schemaTable.primaryKey.columns.join(', ')}`,
+      contractPath: `${tablePath}.primaryKey`,
+      code: 'extra_primary_key',
+      message: 'Extra primary key found',
+      expected: undefined,
+      actual: schemaTable.primaryKey,
+      children: [],
+    });
   }
 
   // Verify FK constraints only for FKs with constraint: true.
@@ -688,7 +611,6 @@ function verifyTableChildren(options: {
       tableName,
       namespaceId,
       tablePath,
-      tableControlPolicy,
       issues,
       strict,
     );
@@ -702,7 +624,6 @@ function verifyTableChildren(options: {
     tableName,
     namespaceId,
     tablePath,
-    tableControlPolicy,
     issues,
     strict,
   );
@@ -727,7 +648,6 @@ function verifyTableChildren(options: {
     tableName,
     namespaceId,
     tablePath,
-    tableControlPolicy,
     issues,
     strict,
   );
@@ -742,7 +662,6 @@ function collectContractColumnNodes(options: {
   tableName: string;
   namespaceId: string;
   tablePath: string;
-  tableControlPolicy: ControlPolicy;
   issues: SchemaIssue[];
   strict: boolean;
   typeMetadataRegistry: ReadonlyMap<string, { nativeType?: string }>;
@@ -750,7 +669,6 @@ function collectContractColumnNodes(options: {
   storageTypes: Readonly<Record<string, StorageTypeInstance | PostgresEnumStorageEntry>>;
   normalizeDefault?: DefaultNormalizer;
   normalizeNativeType?: NativeTypeNormalizer;
-  columnsCompatible?: ColumnsCompatible;
 }): SchemaVerificationNode[] {
   const {
     contractTable,
@@ -758,7 +676,6 @@ function collectContractColumnNodes(options: {
     tableName,
     namespaceId,
     tablePath,
-    tableControlPolicy,
     issues,
     strict,
     typeMetadataRegistry,
@@ -766,7 +683,6 @@ function collectContractColumnNodes(options: {
     storageTypes,
     normalizeDefault,
     normalizeNativeType,
-    columnsCompatible,
   } = options;
   const columnNodes: SchemaVerificationNode[] = [];
 
@@ -775,30 +691,24 @@ function collectContractColumnNodes(options: {
     const columnPath = `${tablePath}.columns.${columnName}`;
 
     if (!schemaColumn) {
-      const issue: SchemaIssue = {
+      issues.push({
         kind: 'missing_column',
         table: tableName,
         namespaceId,
         column: columnName,
         message: `Column "${tableName}"."${columnName}" is missing from database`,
-      };
-      emitIssueAndNodeUnderControlPolicy(
-        tableControlPolicy,
-        issue,
-        {
-          status: 'fail',
-          kind: 'column',
-          name: `${columnName}: missing`,
-          contractPath: columnPath,
-          code: 'missing_column',
-          message: `Column "${columnName}" is missing`,
-          expected: undefined,
-          actual: undefined,
-          children: [],
-        },
-        issues,
-        columnNodes,
-      );
+      });
+      columnNodes.push({
+        status: 'fail',
+        kind: 'column',
+        name: `${columnName}: missing`,
+        contractPath: columnPath,
+        code: 'missing_column',
+        message: `Column "${columnName}" is missing`,
+        expected: undefined,
+        actual: undefined,
+        children: [],
+      });
       continue;
     }
 
@@ -810,7 +720,6 @@ function collectContractColumnNodes(options: {
         contractColumn,
         schemaColumn,
         columnPath,
-        tableControlPolicy,
         issues,
         strict,
         typeMetadataRegistry,
@@ -818,7 +727,6 @@ function collectContractColumnNodes(options: {
         storageTypes,
         ...ifDefined('normalizeDefault', normalizeDefault),
         ...ifDefined('normalizeNativeType', normalizeNativeType),
-        ...ifDefined('columnsCompatible', columnsCompatible),
       }),
     );
   }
@@ -832,46 +740,31 @@ function appendExtraColumnNodes(options: {
   tableName: string;
   namespaceId: string;
   tablePath: string;
-  tableControlPolicy: ControlPolicy;
   issues: SchemaIssue[];
   columnNodes: SchemaVerificationNode[];
 }): void {
-  const {
-    contractTable,
-    schemaTable,
-    tableName,
-    namespaceId,
-    tablePath,
-    tableControlPolicy,
-    issues,
-    columnNodes,
-  } = options;
+  const { contractTable, schemaTable, tableName, namespaceId, tablePath, issues, columnNodes } =
+    options;
   for (const [columnName, { nativeType }] of Object.entries(schemaTable.columns)) {
     if (!contractTable.columns[columnName]) {
-      const issue: SchemaIssue = {
+      issues.push({
         kind: 'extra_column',
         table: tableName,
         namespaceId,
         column: columnName,
         message: `Extra column "${tableName}"."${columnName}" found in database (not in contract)`,
-      };
-      emitIssueAndNodeUnderControlPolicy(
-        tableControlPolicy,
-        issue,
-        {
-          status: 'fail',
-          kind: 'column',
-          name: `${columnName}: extra`,
-          contractPath: `${tablePath}.columns.${columnName}`,
-          code: 'extra_column',
-          message: `Extra column "${columnName}" found`,
-          expected: undefined,
-          actual: nativeType,
-          children: [],
-        },
-        issues,
-        columnNodes,
-      );
+      });
+      columnNodes.push({
+        status: 'fail',
+        kind: 'column',
+        name: `${columnName}: extra`,
+        contractPath: `${tablePath}.columns.${columnName}`,
+        code: 'extra_column',
+        message: `Extra column "${columnName}" found`,
+        expected: undefined,
+        actual: nativeType,
+        children: [],
+      });
     }
   }
 }
@@ -883,7 +776,6 @@ function verifyColumn(options: {
   contractColumn: StorageTable['columns'][string];
   schemaColumn: SqlSchemaIR['tables'][string]['columns'][string];
   columnPath: string;
-  tableControlPolicy: ControlPolicy;
   issues: SchemaIssue[];
   strict: boolean;
   typeMetadataRegistry: ReadonlyMap<string, { nativeType?: string }>;
@@ -891,7 +783,6 @@ function verifyColumn(options: {
   storageTypes: Readonly<Record<string, StorageTypeInstance | PostgresEnumStorageEntry>>;
   normalizeDefault?: DefaultNormalizer;
   normalizeNativeType?: NativeTypeNormalizer;
-  columnsCompatible?: ColumnsCompatible;
 }): SchemaVerificationNode {
   const {
     tableName,
@@ -900,14 +791,12 @@ function verifyColumn(options: {
     contractColumn,
     schemaColumn,
     columnPath,
-    tableControlPolicy,
     issues,
     strict,
     codecHooks,
     storageTypes,
     normalizeDefault,
     normalizeNativeType,
-    columnsCompatible,
   } = options;
   const columnChildren: SchemaVerificationNode[] = [];
   let columnStatus: VerificationStatus = 'pass';
@@ -923,14 +812,8 @@ function verifyColumn(options: {
   const schemaNativeType =
     normalizeNativeType?.(schemaColumn.nativeType) ?? schemaColumn.nativeType;
 
-  const typesMatch =
-    contractNativeType === schemaNativeType ||
-    (tableControlPolicy === 'external' &&
-      (columnsCompatible?.(contractNativeType, schemaNativeType) ??
-        contractNativeType === schemaNativeType));
-
-  if (!typesMatch) {
-    const issue: SchemaIssue = {
+  if (contractNativeType !== schemaNativeType) {
+    issues.push({
       kind: 'type_mismatch',
       table: tableName,
       namespaceId,
@@ -938,23 +821,19 @@ function verifyColumn(options: {
       expected: contractNativeType,
       actual: schemaNativeType,
       message: `Column "${tableName}"."${columnName}" has type mismatch: expected "${contractNativeType}", got "${schemaNativeType}"`,
-    };
-    const disposition = verifierDisposition(tableControlPolicy, issue.kind);
-    if (disposition !== 'suppress') {
-      issues.push(issue);
-      columnChildren.push({
-        status: disposition,
-        kind: 'type',
-        name: 'type',
-        contractPath: `${columnPath}.nativeType`,
-        code: 'type_mismatch',
-        message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
-        expected: contractNativeType,
-        actual: schemaNativeType,
-        children: [],
-      });
-      columnStatus = disposition;
-    }
+    });
+    columnChildren.push({
+      status: 'fail',
+      kind: 'type',
+      name: 'type',
+      contractPath: `${columnPath}.nativeType`,
+      code: 'type_mismatch',
+      message: `Type mismatch: expected ${contractNativeType}, got ${schemaNativeType}`,
+      expected: contractNativeType,
+      actual: schemaNativeType,
+      children: [],
+    });
+    columnStatus = 'fail';
   }
 
   if (resolvedContractColumn.codecId) {
@@ -990,7 +869,7 @@ function verifyColumn(options: {
   }
 
   if (contractColumn.nullable !== schemaColumn.nullable) {
-    const issue: SchemaIssue = {
+    issues.push({
       kind: 'nullability_mismatch',
       table: tableName,
       namespaceId,
@@ -998,52 +877,44 @@ function verifyColumn(options: {
       expected: String(contractColumn.nullable),
       actual: String(schemaColumn.nullable),
       message: `Column "${tableName}"."${columnName}" has nullability mismatch: expected ${contractColumn.nullable ? 'nullable' : 'not null'}, got ${schemaColumn.nullable ? 'nullable' : 'not null'}`,
-    };
-    const disposition = verifierDisposition(tableControlPolicy, issue.kind);
-    if (disposition !== 'suppress') {
-      issues.push(issue);
-      columnChildren.push({
-        status: disposition,
-        kind: 'nullability',
-        name: 'nullability',
-        contractPath: `${columnPath}.nullable`,
-        code: 'nullability_mismatch',
-        message: `Nullability mismatch: expected ${contractColumn.nullable ? 'nullable' : 'not null'}, got ${schemaColumn.nullable ? 'nullable' : 'not null'}`,
-        expected: contractColumn.nullable,
-        actual: schemaColumn.nullable,
-        children: [],
-      });
-      columnStatus = disposition;
-    }
+    });
+    columnChildren.push({
+      status: 'fail',
+      kind: 'nullability',
+      name: 'nullability',
+      contractPath: `${columnPath}.nullable`,
+      code: 'nullability_mismatch',
+      message: `Nullability mismatch: expected ${contractColumn.nullable ? 'nullable' : 'not null'}, got ${schemaColumn.nullable ? 'nullable' : 'not null'}`,
+      expected: contractColumn.nullable,
+      actual: schemaColumn.nullable,
+      children: [],
+    });
+    columnStatus = 'fail';
   }
 
   if (contractColumn.default) {
     if (!schemaColumn.default) {
       const defaultDescription = describeColumnDefault(contractColumn.default);
-      const issue: SchemaIssue = {
+      issues.push({
         kind: 'default_missing',
         table: tableName,
         namespaceId,
         column: columnName,
         expected: defaultDescription,
         message: `Column "${tableName}"."${columnName}" should have default ${defaultDescription} but database has no default`,
-      };
-      const disposition = verifierDisposition(tableControlPolicy, issue.kind);
-      if (disposition !== 'suppress') {
-        issues.push(issue);
-        columnChildren.push({
-          status: disposition,
-          kind: 'default',
-          name: 'default',
-          contractPath: `${columnPath}.default`,
-          code: 'default_missing',
-          message: `Default missing: expected ${defaultDescription}`,
-          expected: defaultDescription,
-          actual: undefined,
-          children: [],
-        });
-        columnStatus = disposition;
-      }
+      });
+      columnChildren.push({
+        status: 'fail',
+        kind: 'default',
+        name: 'default',
+        contractPath: `${columnPath}.default`,
+        code: 'default_missing',
+        message: `Default missing: expected ${defaultDescription}`,
+        expected: defaultDescription,
+        actual: undefined,
+        children: [],
+      });
+      columnStatus = 'fail';
     } else if (
       !columnDefaultsEqual(
         contractColumn.default,
@@ -1053,8 +924,9 @@ function verifyColumn(options: {
       )
     ) {
       const expectedDescription = describeColumnDefault(contractColumn.default);
+      // schemaColumn.default is now a raw string, describe it as-is
       const actualDescription = schemaColumn.default;
-      const issue: SchemaIssue = {
+      issues.push({
         kind: 'default_mismatch',
         table: tableName,
         namespaceId,
@@ -1062,49 +934,41 @@ function verifyColumn(options: {
         expected: expectedDescription,
         actual: actualDescription,
         message: `Column "${tableName}"."${columnName}" has default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
-      };
-      const disposition = verifierDisposition(tableControlPolicy, issue.kind);
-      if (disposition !== 'suppress') {
-        issues.push(issue);
-        columnChildren.push({
-          status: disposition,
-          kind: 'default',
-          name: 'default',
-          contractPath: `${columnPath}.default`,
-          code: 'default_mismatch',
-          message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
-          expected: expectedDescription,
-          actual: actualDescription,
-          children: [],
-        });
-        columnStatus = disposition;
-      }
+      });
+      columnChildren.push({
+        status: 'fail',
+        kind: 'default',
+        name: 'default',
+        contractPath: `${columnPath}.default`,
+        code: 'default_mismatch',
+        message: `Default mismatch: expected ${expectedDescription}, got ${actualDescription}`,
+        expected: expectedDescription,
+        actual: actualDescription,
+        children: [],
+      });
+      columnStatus = 'fail';
     }
   } else if (strict && schemaColumn.default) {
-    const issue: SchemaIssue = {
+    issues.push({
       kind: 'extra_default',
       table: tableName,
       namespaceId,
       column: columnName,
       actual: schemaColumn.default,
       message: `Column "${tableName}"."${columnName}" has default ${schemaColumn.default} in database but contract specifies no default`,
-    };
-    const disposition = verifierDisposition(tableControlPolicy, issue.kind);
-    if (disposition !== 'suppress') {
-      issues.push(issue);
-      columnChildren.push({
-        status: disposition,
-        kind: 'default',
-        name: 'default',
-        contractPath: `${columnPath}.default`,
-        code: 'extra_default',
-        message: `Extra default: ${schemaColumn.default}`,
-        expected: undefined,
-        actual: schemaColumn.default,
-        children: [],
-      });
-      columnStatus = disposition;
-    }
+    });
+    columnChildren.push({
+      status: 'fail',
+      kind: 'default',
+      name: 'default',
+      contractPath: `${columnPath}.default`,
+      code: 'extra_default',
+      message: `Extra default: ${schemaColumn.default}`,
+      expected: undefined,
+      actual: schemaColumn.default,
+      children: [],
+    });
+    columnStatus = 'fail';
   }
 
   // Single-pass aggregation for better performance