@workerstack/database 0.22.0 → 0.23.0

package/src/migrate/core/pg-replay-commit.ts

@@ -2,12 +2,14 @@
  * The replay's transactions and the reads around them (pg-replay.ts): a file's or comb's own
  * statement's transaction, refused before its COMMIT when this backend's counts show it wrote past
  * its database, and the server's shared catalogs read as committed around it and around
- * every bare statement, a change there the file's when it is to an object the file names;
+ * every bare statement, a change there the file's when it is to the replay's own database, or to an
+ * object the file names beside a statement that can run code comb cannot read;
  * a `txmode none` file's statement in a transaction of its own first, bare only when
  * Postgres runs it outside a block alone.
  */
 import { adopt, bareAgain, type Run } from "./pg-replay-roles.ts"
-import { added, type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
+import { type Hidden, runsHidden } from "./pg-replay-hidden.ts"
+import { type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
 import {
 	type Change,
 	catalogsOf,
@@ -31,12 +33,13 @@ async function begin(run: Run): Promise<void> {
 }
 
 /**
- * Where a replayed transaction or bare statement is: its file's name and the names it spells, the
- * statement, if bare, and what a refusal stops; told each role the transaction adds that the replay
- * adopts
+ * Where a replayed transaction or bare statement is: its file's name and the names it spells, what
+ * its statements so far can run that comb cannot read (`hidden`), the statement, if bare, and what a
+ * refusal stops; told each role the transaction adds that the replay adopts
  */
 type At = {
 	adopted?: ((role: string) => void) | undefined
+	hidden: Hidden
 	name: string
 	names: ReadonlySet<string>
 	sent: string | undefined
@@ -46,52 +49,52 @@ type At = {
 /* the words that name devUrl's role in a file, as namesIn folds them: CURRENT_USER and its kin */
 const SESSION_ROLE = ["current_role", "current_user", "session_user", "user"]
 
+/** The objects the file `names`, devUrl's role among them where it names that by keyword */
+function spelled(run: Run, names: ReadonlySet<string>): Set<string> {
+	const its = new Set(names)
+	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
+	return its
+}
+
 /**
- * The server's shared catalogs read as committed against the last read: a change since to an object
- * the file `name` names (`names`), while `sent` or the whole file ran, is refused, and a role or
- * database it added is the cleanup's; a change to any other is another session's. The
- * replay's own database is the file's whatever it spells, as only this replay runs in it, and is
- * the cleanup's too. `read` is that read when the caller took it
+ * The server's shared catalogs read as committed against the last read: a change since to the
+ * replay's own database, or to what it holds, is the file's, as only this replay runs in it, and the
+ * cleanup drops it. A change to an object the file names is the file's when its statements so far
+ * can run code comb cannot read (pg-replay-hidden.ts), the one way a change past the database gets by
+ * the counts, and is refused, but no cleanup drops it: Postgres keeps no creator for a role or a
+ * database, and another session may have made it. A change to any other object, or beside statements
+ * that run only what their parse says, is another session's. `read` is that read when the caller took it
  */
 async function window(run: Run, at: At, read?: Snapshot): Promise<void> {
-	strayed(run, at, read ?? (await snapshot(run.admin)))
+	const now = read ?? (await snapshot(run.admin))
+	strayed(run, { ...at, hid: await hides(run, at, now) }, now)
 }
 
+/* whether a change in `now` to an object the file names may be the file's, as its statements can run code comb cannot read */
+const hides = (run: Run, { hidden, names }: At, now: Snapshot): boolean | Promise<boolean> =>
+	snapshotChanges(run.seen, now, spelled(run, names)).length > 0 && runsHidden(run.sql, hidden)
+
 /**
  * window's verdict on `now`, the server's shared catalogs as committed after the file or `sent`,
- * against the last read; kept apart from window's await, as v8 miscounts a branch after an await
+ * against the last read, the objects the file names counted when it `hid` code comb cannot read;
+ * kept apart from window's await, as v8 miscounts a branch after an await
  */
-function strayed(run: Run, { name, names, sent, stops }: At, now: Snapshot): void {
-	const its = new Set([...names, run.database])
-	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
-	const changes = snapshotChanges(run.seen, now, its)
-	const { databases, roles, slots } = added(run.seen, now, its)
+function strayed(run: Run, { hid, name, names, sent, stops }: At & { hid: boolean }, now: Snapshot): void {
+	const replays = new Set([run.database])
+	const changes = snapshotChanges(run.seen, now, hid ? new Set([...spelled(run, names), ...replays]) : replays)
+	const own = new Set(snapshotChanges(run.seen, now, replays))
 	const within = subscriptionsIn(run.seen, now, run.database)
 	run.seen = now
 	if (changes.length === 0) return
-	run.strays.databases.push(...databases)
-	run.strays.roles.push(...roles)
-	run.strays.slots.push(...slots)
-	const own = `database ${run.database} `
-	const strays = [
-		...roles.map((role) => `role ${role}`),
-		...databases.map((database) => `database ${database} unless a session is in it`),
-		...slots.map((slot) => `replication slot ${slot} unless a session holds it`),
-	]
-	const replays =
-		changes.some((change) => change.startsWith(own)) || within.length > 0
+	const dropped =
+		own.size > 0
 			? `; comb drops the database it replays in${within.length === 0 ? "" : `, and ${within.join(", ")} in it`}`
 			: ""
-	const dropped = `${strays.length === 0 ? "" : `; comb drops ${strays.join(", ")}, which the file added`}${replays}`
-	/* the read is committed, so a change it shows to an object the file did not add stays */
-	const dropping = new Set([
-		...roles.map((role) => `role ${role} added`),
-		...databases.map((d) => `database ${d} added`),
-		...slots.map((slot) => `replication slot ${slot} added`),
-		...within.map((subject) => `${subject} added`),
-	])
-	const kept = changes.filter((change) => !dropping.has(change) && !change.startsWith(own))
-	const left = kept.length === 0 ? "" : `; devUrl's server keeps ${kept.join(", ")}, which comb cannot undo`
+	const kept = changes.filter((change) => !own.has(change))
+	const left =
+		kept.length === 0
+			? ""
+			: `; comb leaves ${kept.join(", ")} on devUrl's server, as another session may have made ${kept.length === 1 ? "that change" : "those changes"}: undo there each that is the file's`
 	throw new ReplayFailed(
 		`${name}: devUrl's server changed past the database the replay runs in while ${sent === undefined ? "the file" : JSON.stringify(sent)} ran: ${changes.join(", ")}. A change made there, from inside a DO block, a function, EXECUTE or CALL, or over a second connection such as dblink's, apply would make on the target's server, so comb refuses the file; write the change as a statement of its own, which the replay leaves out and apply runs${dropped}${left}; ${stops}`,
 	)

package/src/migrate/core/pg-replay-drops.ts

@@ -4,8 +4,8 @@
  * which the next replay or apply sweeps. Postgres drops no database that holds a subscription or a
  * logical slot, so both go first, and only from the replay databases it drops: a subscription from
  * a session in its database, the only one that can name it. A drop that fails never decides the
- * verdict, and is said, never left unsaid: what it left, dev's error, and whether a later sweep takes it, as a
- * stray of a refused window carries no tag a sweep finds. The replay database is dropped WITH
+ * verdict, and is said, never left unsaid: what it left and dev's error, which a later sweep takes. The
+ * replay database is dropped WITH
  * (FORCE), so a backend that came in after the cleanup ended the others cannot hold it.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
@@ -24,14 +24,11 @@ async function settle(step: () => Promise<unknown>): Promise<void> {
 	}
 }
 
-/** What a drop that failed left on devUrl's server, a database, role or slot by name, and whether a later sweep takes it */
-type Left = { swept: boolean; what: string }
-
-/** How a drop that failed is said: what it `left`, with dev's error */
-type Leave = (left: Left, error: unknown) => void
+/** How a drop that failed is said: what it left on devUrl's server, a database, role or slot by name, with dev's error */
+type Leave = (left: string, error: unknown) => void
 
 /** `drop` run, a failure `leave`d: cleaning up never replaces the replay's verdict, and never leaves something unsaid */
-async function dropOr(leave: Leave, left: Left, drop: () => Promise<unknown>): Promise<void> {
+async function dropOr(leave: Leave, left: string, drop: () => Promise<unknown>): Promise<void> {
 	try {
 		await drop()
 	} catch (error) {
@@ -45,9 +42,9 @@ type Drops = { into: (database: string) => Sql; leave: Leave }
 
 /** A `leave` that prints, `failed` naming devUrl in dev's error */
 function leaving(print: (line: string) => void, failed: Parameters<typeof failureOf>[1]): Leave {
-	return ({ swept, what }, error) =>
+	return (left, error) =>
 		print(
-			`comb could not drop ${what}, which a replay left on devUrl's server: ${failureOf(error, failed)}; ${swept ? "the next check or apply that reaches that server drops it" : "drop it there"}`,
+			`comb could not drop ${left}, which a replay left on devUrl's server: ${failureOf(error, failed)}; the next check or apply that reaches that server drops it`,
 		)
 }
 
@@ -80,14 +77,13 @@ async function emptyDatabase(admin: Sql, database: string, { into, leave }: Drop
 	if (subscriptions.length > 0) {
 		const sql = into(database)
 		try {
-			for (const name of subscriptions)
-				await dropOr(leave, { swept: true, what: `subscription ${name}` }, () => dropSubscription(sql, name))
+			for (const name of subscriptions) await dropOr(leave, `subscription ${name}`, () => dropSubscription(sql, name))
 		} finally {
 			await settle(() => sql.end({ timeout: 0 }))
 		}
 	}
 	for (const slot of (holds?.["slots"] ?? []) as string[])
-		await dropOr(leave, { swept: true, what: `replication slot ${slot}` }, () => dropSlot(admin, slot))
+		await dropOr(leave, `replication slot ${slot}`, () => dropSlot(admin, slot))
 }
 
 /**
@@ -132,11 +128,9 @@ async function sweep(admin: Sql, now: number, drops: Drops): Promise<void> {
 		await settle(() => emptyDatabase(admin, name, drops))
 		/* Postgres drops no template, which a committing DO can make the replay's database */
 		if (template) await settle(() => admin.unsafe(`ALTER DATABASE ${sqlIdentifier(name)} IS_TEMPLATE false`, []))
-		await dropOr(leave, { swept: true, what: `database ${name}` }, () =>
-			admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
+		await dropOr(leave, `database ${name}`, () => admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []))
 	}
-	for (const role of roles) await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropRole(admin, role))
+	for (const role of roles) await dropOr(leave, `role ${role}`, () => dropRole(admin, role))
 }
 
 /* why comb loads postgres.js in an apply */
@@ -196,10 +190,10 @@ async function sweepDev(
 
 /**
  * `run`'s cleanup, each drop that fails `leave`d: its connection closed, a query in flight with it,
- * any backend still in its database ended, the slots a refused window added, which a drop waits on,
- * the database's subscriptions and slots, which keep it from its drop, the database made no
- * template and dropped, forcing out a backend that came in since, each role it made, and that
- * window's roles and idle databases, which no sweep takes
+ * any backend still in its database ended, the database's subscriptions and slots, which keep it
+ * from its drop, the database made no template and dropped, forcing out a backend that came in
+ * since, and each role it made or adopted. It drops nothing else a refused window saw, as Postgres
+ * keeps no creator for a role, a database or a slot, and another session may have made it
  */
 async function cleanUp(run: Run, drops: Drops): Promise<void> {
 	const { leave } = drops
@@ -210,21 +204,12 @@ async function cleanUp(run: Run, drops: Drops): Promise<void> {
 			[run.database],
 		),
 	)
-	for (const slot of run.strays.slots)
-		await dropOr(leave, { swept: false, what: `replication slot ${slot}` }, () => dropSlot(run.admin, slot))
 	await settle(() => emptyDatabase(run.admin, run.database, drops))
 	await settle(() => run.admin.unsafe(`ALTER DATABASE ${run.database} IS_TEMPLATE false`, []))
-	await dropOr(leave, { swept: true, what: `database ${run.database}` }, () =>
+	await dropOr(leave, `database ${run.database}`, () =>
 		run.admin.unsafe(`DROP DATABASE IF EXISTS ${run.database} WITH (FORCE)`, []),
 	)
-	for (const role of run.created)
-		await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropMade(run.admin, role))
-	for (const name of run.strays.databases)
-		await dropOr(leave, { swept: false, what: `database ${name}` }, () =>
-			run.admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
-	for (const role of run.strays.roles)
-		await dropOr(leave, { swept: false, what: `role ${role}` }, () => dropRole(run.admin, role))
+	for (const role of run.created) await dropOr(leave, `role ${role}`, () => dropMade(run.admin, role))
 }
 
 export { cleanUp, type Drops, dropMade, dropOr, dropRole, dropSlot, type Leave, leaving, settle, sweep, sweepDev }

package/src/migrate/core/pg-replay-hidden.ts

@@ -0,0 +1,75 @@
+/**
+ * Whether the statements a replay's window covers can run code comb cannot read, the only way one
+ * makes a change past its database that this backend's counts miss (pg-replay-commit.ts): a DO
+ * block, a CALL, an EXECUTE, or a call of a function outside pg_catalog, dblink's among them. A
+ * statement whose tree holds none of those runs only what its parse says, and BEYOND and SERVER_CALLS
+ * (pg-outside-transaction.ts, pg-server-calls.ts) leave out every such statement that reaches past
+ * the database, so a change the server's read shows beside it is another session's. A function
+ * called by a bare name is pg_catalog's only where the replay's database holds no other of that name,
+ * as an overload in a schema on the search path can take the call, and the file makes none of it.
+ * Code Postgres runs for a statement on its own, a trigger, a default, an operator or a cast that
+ * calls a function an earlier file defines, is no call in the tree, so it is not read here; what it
+ * writes in the replay's transaction its counts still see.
+ */
+import type { Sql } from "./pg-replay-database.ts"
+
+/**
+ * What the statements so far can run that comb cannot read: `code` when one surely can, the
+ * functions they call by a bare name (`calls`), which may be pg_catalog's, and those the file makes
+ * (`made`). A file's every later window counts what one ran, as a change a DO block makes in the
+ * file's own block commits at its COMMIT
+ */
+type Hidden = { calls: Set<string>; code: boolean; made: Set<string> }
+
+/** Nothing run yet */
+const nothingHidden = (): Hidden => ({ calls: new Set(), code: false, made: new Set() })
+
+// lookup-table: the statements that run code the parse does not hold: a DO block's body, a procedure, a prepared statement
+const RUNS_CODE: ReadonlySet<string> = /* @__PURE__ */ new Set(["CallStmt", "DoStmt", "ExecuteStmt"])
+
+/** The name parts of a FuncCall's or a CREATE FUNCTION's `funcname`, each a String node, the name last */
+const partsOf = (funcname: unknown): string[] =>
+	(funcname as Array<{ String: { sval: string } }>).map((part) => part.String.sval)
+
+/** `tree`, a parse tree or a part of one, read `into` */
+function readTree(tree: unknown, into: Hidden): void {
+	if (tree === null || typeof tree !== "object") return
+	for (const [key, value] of Object.entries(tree)) {
+		if (RUNS_CODE.has(key)) into.code = true
+		else if (key === "FuncCall" || key === "CreateFunctionStmt") {
+			const parts = partsOf((value as { funcname: unknown }).funcname)
+			/* a funcname holds its name at least */
+			const name = parts.at(-1) as string
+			if (key === "CreateFunctionStmt") into.made.add(name)
+			else if (parts.length === 1) into.calls.add(name)
+			else if (parts.length > 2 || parts[0] !== "pg_catalog") into.code = true
+		}
+		readTree(value, into)
+	}
+}
+
+/** A statement the replay runs, read `into`: one the parser cannot read may run anything */
+function readStatement(tree: unknown, into: Hidden): void {
+	if (tree === undefined) into.code = true
+	else readTree(tree, into)
+}
+
+/* of the functions a JSON array names, whether one is no pg_catalog function, or also one outside it */
+const NOT_CATALOG = `SELECT EXISTS (
+  SELECT FROM jsonb_array_elements_text($1::text::jsonb) f(name)
+  WHERE NOT EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace = 'pg_catalog'::regnamespace)
+    OR EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace <> 'pg_catalog'::regnamespace)
+) AS hidden`
+
+/**
+ * Whether what `hidden` holds can run code comb cannot read, a bare name resolved on `sql`, the
+ * replay's connection, which sees what its open transaction made
+ */
+async function runsHidden(sql: Sql, { calls, code, made }: Hidden): Promise<boolean> {
+	if (code || [...calls].some((name) => made.has(name))) return true
+	if (calls.size === 0) return false
+	const rows = await sql.unsafe(NOT_CATALOG, [JSON.stringify([...calls])])
+	return rows.some((row) => row["hidden"] === true)
+}
+
+export { type Hidden, nothingHidden, readStatement, runsHidden }

package/src/migrate/core/pg-replay-roles.ts

@@ -18,7 +18,7 @@
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { codeOf, literal, type Sql, TAG } from "./pg-replay-database.ts"
 import { addWrites, catalogsOf, counts, type Rows, subjectRows, type Writes, writesSince } from "./pg-server-writes.ts"
-import type { Snapshot, Strays } from "./pg-server-snapshot.ts"
+import type { Snapshot } from "./pg-server-snapshot.ts"
 import { flag } from "./pg-nodes.ts"
 
 /**
@@ -26,8 +26,7 @@ import { flag } from "./pg-nodes.ts"
  * that owns it, its role (`role`, which CURRENT_USER and its kin name in a file), whether that role
  * is a superuser, which reads pg_authid, whether it has CREATEROLE (`createrole`), and the roles it made; the
  * open transaction's own writes, comb's CREATE ROLEs', with the rows they left; the shared catalogs
- * as last read committed (`seen`), and the roles, databases and replication slots a refused window
- * added (`strays`), which the cleanup drops
+ * as last read committed (`seen`)
  */
 type Run = {
 	admin: Sql
@@ -39,7 +38,6 @@ type Run = {
 	role: string
 	seen: Snapshot
 	sql: Sql
-	strays: Strays
 	/** the tablespaces it left out the CREATE of, which a statement then runs in pg_default instead */
 	tablespaces: Set<string>
 	superuser: boolean

package/src/migrate/core/pg-replay.ts

@@ -3,11 +3,10 @@
  * catalog query: Postgres, not a model of it, decides what a cascade, a rename or a
  * move leaves, and the two sides compare as one read of two databases.
  *
- * The replay runs as Atlas applies: each file on a session of its own, as apply
- * gives each file an Atlas call, and in a transaction of its own, a `--
- * atlas:txmode none` file statement by statement, each in a transaction of its own first and bare,
- * as Atlas sends it, where Postgres runs it only so, in a database
- * made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
+ * The replay runs as Atlas applies: each file on a session of its own, as apply gives each file an
+ * Atlas call, and in a transaction of its own, a `-- atlas:txmode none` file statement by statement,
+ * each in a transaction of its own first and bare, as Atlas sends it, where Postgres runs it only
+ * so, in a database made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
  * filled Postgres's lock table and left a seed's deferred trigger events pending, and devUrl's own
  * database lent the history what it held. Committed, a statement whose scope is the server or
  * another database would outlive the replay on devUrl's server, the target's own when they share
@@ -29,19 +28,19 @@
  * Bare runs only a statement a block refuses (an outside-only class, a DO block or CALL that
  * commits), one only a block runs (a LOCK, a SAVEPOINT, a cursor not held) and the file's own
  * block, and a change one makes past its database has committed when the read sees it: the refusal
- * names what devUrl's server keeps. The read is the server's, another session's work in it too, so
- * a change there is the file's only when the role, database or other object it is to is one the
- * file names: a name it spells, unquoted and folded as Postgres folds it, quoted and exact, or
- * inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts). That change
- * is refused, naming it, and a role it added is dropped with the cleanup, as is a database it added
- * that no session is in; a change to any other object is another session's and passes. A name the
- * file builds at run time, by concatenation, from a query, or in a function another file defines,
- * is none it spells, so comb neither refuses nor drops that change. A role's password reads from
- * pg_authid alone, so a password a bare statement changes is seen by a superuser's devUrl only.
+ * names what devUrl's server keeps. The read is the server's, another session's work in it too, and
+ * Postgres keeps no creator for a role or a database, so a change there is the file's only beside a
+ * statement that can run code comb cannot read (pg-replay-hidden.ts), and only when it is to an
+ * object the file names: a name it spells, unquoted and folded as Postgres folds it, quoted and
+ * exact, or inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts).
+ * That change is refused, naming it, and left, as another session may have made it; any other is
+ * another session's and passes. A name the file builds at run time, by concatenation, from a query,
+ * or in a function another file defines, is none it spells, so comb does not refuse that change. A
+ * role's password reads from pg_authid alone, so a bare statement's is seen by a superuser's only.
  *
- * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the
- * replay's cleanup first, once, and then ends the process as the signal would; a run
- * killed past it is swept by the next replay or apply on the server.
+ * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the replay's
+ * cleanup first, once, and then ends the process as the signal would; a run killed past it is swept
+ * by the next replay or apply on the server.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { type PgTarget, refuseUrlProblems } from "./atlas-target.ts"
@@ -65,6 +64,7 @@ import { prepareSnapshot, snapshot } from "./pg-server-snapshot.ts"
 import { refuseUncounted } from "./pg-server-writes.ts"
 import { pgRead } from "./pg-split.ts"
 import { namesIn } from "./sql-code.ts"
+import { nothingHidden, readStatement } from "./pg-replay-hidden.ts"
 
 /** A history file as baseline reads it */
 type HistoryFile = { name: string; sql: string }
@@ -92,12 +92,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 	const inFile = !outsideTransaction(text)
 	const file = {
 		adopted: (role: string) => replay.adopted?.(name, role),
+		hidden: nothingHidden(),
 		name,
 		names: namesIn(text),
 		stops: replay.stops,
 	}
 	const statements = pgRead(text).statements.map(({ sent, tree }) => ({
 		sent,
+		tree,
 		...(tree === undefined ? { node: {}, type: "" } : (([type, node]) => ({ node, type }))(nodeOf(tree))),
 	}))
 	const locks = lockReader(
@@ -110,13 +112,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 		await begin(run)
 		await locks.began()
 	}
-	for (const [index, { node, sent, type }] of statements.entries()) {
+	for (const [index, { node, sent, tree, type }] of statements.entries()) {
 		const beyond = (await runsOnMade(run, type, node)) ? undefined : beyondDatabase(type, node)
 		if (beyond !== undefined) {
 			leaveOutTablespace(run.tablespaces, type, node)
 			replay.leftOut(name, sent, beyond)
 			continue
 		}
+		readStatement(tree, file.hidden)
 		await locks.next(index, type, node)
 		const send = () => runStatement(run, { name, node, sent, type }, replay)
 		if (inFile) await send()
@@ -206,7 +209,6 @@ async function opening(
 		owner,
 		seen: new Map(),
 		sql: open(),
-		strays: { databases: [], roles: [], slots: [] },
 		tablespaces: new Set(),
 		...(await devRoleOf(admin)),
 	}

package/src/migrate/core/pg-server-snapshot.ts

@@ -2,8 +2,9 @@
  * The server's shared catalogs read as committed, in one query: what a bare
  * statement changed, which no transaction counts, and what a second connection committed, which this
  * backend's counts never see (pg-server-writes.ts). The read is the server's, another session's work
- * in it too, so each row carries the names of the objects it is about, and a change is a file's only
- * when one is a name the file spells (namesIn in sql-code.ts). A replay's own rows are left out, but
+ * in it too, so each row carries the names of the objects it is about: a change is a file's when it
+ * is to the replay's own database, or to a name the file spells (namesIn in sql-code.ts) beside a
+ * statement that can run code comb cannot read (pg-replay-hidden.ts). A replay's own rows are left out, but
  * for the fields of its own database's row that keep the cleanup from dropping it, which only that
  * replay changes. Beside the catalogs, the server's replication slots, which no catalog
  * holds.
@@ -142,27 +143,6 @@ function snapshotChanges(before: Snapshot, after: Snapshot, names?: ReadonlySet<
 	return changes
 }
 
-/** What the cleanup drops, by the noun its subject starts with */
-type Strays = { databases: string[]; roles: string[]; slots: string[] }
-
-// lookup-table: the nouns of what a file adds that the cleanup drops, by where it keeps them
-const DROPPED: ReadonlyArray<[keyof Strays, string]> = [
-	["databases", "database "],
-	["roles", "role "],
-	["slots", "replication slot "],
-]
-
-/** The roles, databases and replication slots named in `names` that `after` holds and `before` does not */
-function added(before: Snapshot, after: Snapshot, names: ReadonlySet<string>): Strays {
-	const out: Strays = { databases: [], roles: [], slots: [] }
-	for (const subject of after.keys()) {
-		if (before.has(subject) || !about(subject, { after, before }, names)) continue
-		const [where, noun] = DROPPED.find(([, prefix]) => subject.startsWith(prefix)) ?? []
-		if (where !== undefined) out[where].push(subject.slice(noun?.length))
-	}
-	return out
-}
-
 /** The subscriptions `after` holds in `database` and `before` does not, by subject: its drop takes them */
 const subscriptionsIn = (before: Snapshot, after: Snapshot, database: string): string[] =>
 	[...after]
@@ -171,4 +151,4 @@ const subscriptionsIn = (before: Snapshot, after: Snapshot, database: string): s
 		)
 		.map(([subject]) => subject)
 
-export { added, prepareSnapshot, type Snapshot, snapshot, snapshotChanges, type Strays, subscriptionsIn }
+export { prepareSnapshot, type Snapshot, snapshot, snapshotChanges, subscriptionsIn }

package/src/migrate/core/proof-readers.ts

@@ -0,0 +1,80 @@
+/**
+ * What a file leaves unable to run: SQLite's DROP TABLE and DROP VIEW check no view or trigger that names what they
+ * drop, and SQLite, D1 and libsql resolve those names only when a statement runs. So a file can apply and leave every
+ * read of a view, or every write a trigger fires on, failing. After a file applies to the proof's copy, each view and
+ * trigger that survives it and names an object the file dropped or changed is compiled: a view's read, a trigger's
+ * own write on its table or view (trigger-write.mjs). SQLite resolves a name only by name, and the copy holds every
+ * reader that names a table a file reaches (proof-scope.ts), so this finds every reader the file breaks.
+ */
+import type { LocalDb } from "../drivers/local-db.ts"
+import type { LiveObject } from "./proof-copy.ts"
+import { referencesOf } from "./proof-scope.ts"
+import { asciiFold } from "./sql-code.ts"
+import { quote, triggerEvent, writeOf } from "./trigger-write.mjs"
+
+/** The copy's schema, each object by type and folded name */
+function schemaOf(db: LocalDb): Map<string, LiveObject> {
+	const rows = db.all("SELECT type, name, sql, tbl_name FROM main.sqlite_master WHERE sql IS NOT NULL")
+	return new Map(
+		rows.map((row) => {
+			const object = {
+				name: String(row["name"]),
+				sql: String(row["sql"]),
+				table: String(row["tbl_name"]),
+				type: String(row["type"]),
+			}
+			return [`${object.type} ${asciiFold(object.name)}`, object]
+		}),
+	)
+}
+
+/** SQLite's error compiling `sql`, or undefined */
+function compileError(db: LocalDb, sql: string): string | undefined {
+	try {
+		db.all(`EXPLAIN ${sql}`)
+		return undefined
+	} catch (error) {
+		// reason: what SQLite refuses to compile is the finding
+		return (error as Error).message
+	}
+}
+
+/** Why `reader`, a view or a trigger, fails on `db`, or undefined */
+function brokenRead(db: LocalDb, reader: LiveObject): string | undefined {
+	if (reader.type === "view") {
+		const error = compileError(db, `SELECT * FROM ${quote(reader.name)}`)
+		return error === undefined ? undefined : `view ${reader.name} cannot be read: ${error}`
+	}
+	const event = triggerEvent(reader.sql)
+	const columns = db
+		.all(`PRAGMA main.table_xinfo(${quote(reader.table)})`)
+		.filter((row) => row["hidden"] === 0)
+		.map((row) => String(row["name"]))
+	const error = compileError(db, writeOf(reader.table, event, columns))
+	return error === undefined
+		? undefined
+		: `every ${event} on ${reader.table} fails, as a trigger it fires cannot compile: ${error}`
+}
+
+/**
+ * Throws when a file that turned the copy's schema `before` into `db`'s leaves a view or trigger unable to run,
+ * naming it and SQLite's error: no approval overrides, since every read or write through it would fail
+ */
+function refuseBrokenReaders(db: LocalDb, before: ReadonlyMap<string, LiveObject>): void {
+	const after = schemaOf(db)
+	const touched = new Set(
+		[...before]
+			.filter(([key, object]) => after.get(key)?.sql !== object.sql)
+			.map(([, object]) => asciiFold(object.name)),
+	)
+	if (touched.size === 0) return
+	for (const reader of after.values()) {
+		if (reader.type !== "view" && reader.type !== "trigger") continue
+		if (![...referencesOf(reader)].some((name) => touched.has(name))) continue
+		const broken = brokenRead(db, reader)
+		if (broken !== undefined)
+			throw new Error(`after this file, ${broken}; drop or change it in this file, or keep what it uses`)
+	}
+}
+
+export { refuseBrokenReaders, schemaOf }

package/src/migrate/core/proof-run.ts

@@ -12,7 +12,8 @@
  * Seeded rows cannot meet every predicate a file holds, so what each statement writes is read from
  * SQLite itself as it runs (proof-engine.ts): an update of a column that was there before, a
  * delete, a trigger fired or a temp shadow is unsafe whichever rows it meets, and a backfill of the
- * file's own columns is cautious. A file the copy cannot run is unproven, and unproven is unsafe.
+ * file's own columns is cautious. A file the copy cannot run is unproven, and unproven is unsafe. A
+ * file that leaves a view or trigger unable to run is refused outright (proof-readers.ts).
  */
 import { isMirror, mirrorFindings, mirrorRows } from "./proof-mirror.ts"
 import { type LocalDb, openScratch, type ScratchEngine } from "../drivers/local-db.ts"
@@ -21,6 +22,7 @@ import { notEngineTables } from "./engine-tables.ts"
 import { compare, type Shape } from "./proof-compare.ts"
 import { type Copy, copyOf, buildCopy, creatable, jsonColumns, type LiveObject, liveObjects } from "./proof-copy.ts"
 import { applyToCopy, engineFindings } from "./proof-engine.ts"
+import { refuseBrokenReaders, schemaOf } from "./proof-readers.ts"
 import { quote } from "./proof-seed.ts"
 import { observable } from "./proof-scope.ts"
 import { asciiFold } from "./sql-code.ts"
@@ -174,7 +176,10 @@ function snapshotAfter(db: Copy["db"]): Map<string, Shape> | string {
 	}
 }
 
-/** The proof of a file that applied as `run`, from the copy's tables and mirrored rows before it and its tables after */
+/**
+ * The proof of file `name`, which applied as `run`, from the copy's tables, mirrored rows and schema before it and its
+ * tables after; throws, naming the file, when it leaves a view or trigger unable to run, which no approval overrides
+ */
 function appliedProof(
 	copy: Copy,
 	run: ReturnType<typeof applyToCopy>,
@@ -182,8 +187,17 @@ function appliedProof(
 		after,
 		before,
 		mirrors,
-	}: { after: Map<string, Shape>; before: Map<string, Shape>; mirrors: ReturnType<typeof mirrorRows> },
+		name,
+		schema,
+	}: {
+		after: Map<string, Shape>
+		before: Map<string, Shape>
+		mirrors: ReturnType<typeof mirrorRows>
+		name: string
+		schema: ReturnType<typeof schemaOf>
+	},
 ): Proof {
+	named(name, () => refuseBrokenReaders(copy.db, schema))
 	const found = compare(copy.db, new Map([...before].filter(([table]) => !copy.unproven.has(table))), after)
 	const steps = engineFindings(run.steps, run.start)
 	return {
@@ -228,7 +242,7 @@ async function provePending(
 				proofs.set(name, failedProof(copy, failed))
 				continue
 			}
-			let [before, mirrors] = [snapshot(copy.db), mirrorRows(copy.db)]
+			let [before, mirrors, schema] = [snapshot(copy.db), mirrorRows(copy.db), schemaOf(copy.db)]
 			let run = named(name, () => applyToCopy(copy.db, sql))
 			const retry = run.error === undefined ? undefined : await reseeded(objects, applied, making)
 			if (retry !== undefined) {
@@ -263,7 +277,7 @@ async function provePending(
 				failed = `an earlier pending file, ${name}, left a table SQLite cannot read, so this one is unproven`
 				continue
 			}
-			proofs.set(name, appliedProof(copy, run, { after, before, mirrors }))
+			proofs.set(name, appliedProof(copy, run, { after, before, mirrors, name, schema }))
 		}
 	} finally {
 		copy.db.close()