@@ -526,7 +526,7 @@ class UsersFunction(TableFunctionGenerator):
     """Generate user data."""
 
     FIXED_SCHEMA: ClassVar[pa.Schema] = pa.schema([
-        pa.field("id", pa.int64(), nullable=False),  # NOT NULL: see constraints below
+        pa.field("id", pa.int64()),  # served NOT NULL: the PRIMARY_KEY record below names it
         ("name", pa.string()),
         ("active", pa.bool_()),
     ])
@@ -600,7 +600,7 @@ if __name__ == "__main__":
 | Feature | Description |
 |---------|-------------|
 | **No schema duplication** | Function-backed tables derive schema automatically |
-| **Constraint validation** | Constraint paths, trust and Arrow nullability validated at definition time |
+| **Constraint validation** | DuckDB's ATTACH rules for records and generated columns checked at definition time |
 | **Automatic scan handling** | Function-backed tables don't need `table_scan_function_get()` |
 | **Type safety** | Frozen dataclasses with runtime validation |
 
@@ -649,23 +649,61 @@ constraint_record(
 )
 ```
 
-DuckDB checks three things when it attaches the catalog, and `Table` checks the
-same at definition time (the worker checks again when serving each table):
-
-- It reads only `ENFORCED` + `ALL_ROWS` records; state one only when every row
-  the table can ever return satisfies it.
-- Every Arrow field — descending through ordinary structs, but not into
-  extension or logical-type storage — is non-nullable exactly when a
-  `NOT_NULL` or `PRIMARY_KEY` record names its path. This applies to tables
-  with no constraints too: a non-nullable field there is an error.
-- The records are readable only under the negotiated
-  `vgi.constraint.records.read.v1` profile (plus `vgi.expression.duckdb.scalar.v1`
-  for CHECK). `ReadOnlyCatalogInterface` advertises both automatically when any
-  declared table carries records; a catalog that serves tables some other way
-  overrides `catalog_capabilities()`.
+DuckDB rejects a table at ATTACH unless its records follow the extension's
+rules. `Table` checks them at definition time, `ReadOnlyCatalogInterface` checks
+ownership and foreign-key targets across the catalog when it builds its
+registries, and the worker checks every table again when serving it (so a
+custom catalog's own unit tests and RPC calls see the same errors):
+
+- Only `ENFORCED` + `ALL_ROWS` records; state one only when every row the
+  table can ever return satisfies it.
+- Each record is owned by its table and schema; ids are unique, declared names
+  are unique case-insensitively, and there is at most one `PRIMARY_KEY`.
+- Column paths resolve. Only `NOT_NULL` may name a nested struct child;
+  `PRIMARY_KEY`, `UNIQUE` and `FOREIGN_KEY` name top-level columns, never the
+  `is_row_id` column.
+- A `FOREIGN_KEY` references a served table in the same schema, whose
+  `PRIMARY_KEY` or `UNIQUE` record has the referenced id and columns, with
+  `MATCH SIMPLE` and `NO_ACTION`/`RESTRICT` actions.
+- A `CHECK` is a single comparison between signed integer or floating-point
+  columns and numeric constants, such as `amount >= 0`. The grammar is checked
+  with DuckDB's own parser when `haybarn` or `duckdb` is installed.
+
+**Nullability is derived, not declared.** DuckDB requires every Arrow field
+(descending through ordinary structs, but not into extension or logical-type
+storage) to be non-nullable exactly when a `NOT_NULL` or `PRIMARY_KEY` record
+names it. The worker serves the schema that way: a non-nullable field no record
+names is served nullable, and a field a record names is served non-nullable.
+Arrow nullability in `columns` or a function's output schema is therefore never
+a constraint claim, and there is nothing to keep in sync by hand.
+`served_table_schema()` shows the schema a table is served with.
+
+**Negotiation.** Records are readable only under
+`vgi.constraint.records.read.v1` (plus `vgi.expression.duckdb.scalar.v1` for
+CHECK), and DuckDB writes a constrained table only under
+`vgi.constraint.enforce.v1`. `ReadOnlyCatalogInterface` advertises the read
+profiles when any declared table carries records, and the enforcement profile
+when such a table also has write functions: records on a writable table attest
+that the write functions enforce them. A catalog that serves tables some other
+way returns `catalog_capabilities_for(tables, indexes)` from its
+`catalog_capabilities()` override (`union` it with anything else it
+implements). If enforcement is not negotiated, the worker serves a constrained
+table read-only and logs a warning saying why.
 
 The legacy `not_null`, `unique`, `check`, `primary_key` and `foreign_key`
-fields are rejected; replace them with records.
+fields type-check only as `()` and raise when set; `ForeignKeyDef` and
+`ForeignKeyInfo` are deprecated. Replace them with records.
+
+### Generated columns
+
+DuckDB reads only VIRTUAL generated columns of type Boolean, int8–int64 or
+string, with no default and no extension type, whose expression uses columns,
+Boolean/integer/string literals, `CAST` to those types, comparisons,
+`AND`/`OR`/`NOT`, `IS [NOT] NULL`, `COALESCE`, `+ - * %`, `||`, `abs`, `lower`
+and `upper`. A generated column must be nullable; one no record names is
+served nullable automatically, and naming it in a `NOT_NULL` or `PRIMARY_KEY`
+record is an error. Legacy `generated_expression` field metadata is translated
+to the canonical record when it is the field's only expression metadata.
 
 ### Validation
 
@@ -687,11 +725,17 @@ Table(
     ),
 )
 
-# Error: Arrow nullability must match NOT_NULL/PRIMARY_KEY records exactly
+# Error: more than one PRIMARY_KEY record
 Table(
     name="users",
-    columns=pa.schema([pa.field("id", pa.int64(), nullable=False)]),
-)  # ValueError: ... the field is non-nullable but no ... record names it
+    columns=pa.schema([("id", pa.int64()), ("email", pa.string())]),
+    constraints=(
+        constraint_record(["main"], "users", "pk1", "PRIMARY_KEY", [["id"]],
+                          enforcement="ENFORCED", validation="ALL_ROWS"),
+        constraint_record(["main"], "users", "pk2", "PRIMARY_KEY", [["email"]],
+                          enforcement="ENFORCED", validation="ALL_ROWS"),
+    ),
+)  # ValueError: Table 'users': more than one PRIMARY_KEY
 
 # Error: default_schema not in schemas
 Catalog(
@@ -1043,6 +1087,12 @@ The current CatalogInterface has the following limitations:
 - **Tags**: Cannot be updated after object creation
 - **Schema metadata**: Comments and tags cannot be updated on schemas
 - **Constraints**: Only NOT NULL can be added/dropped (no ALTER for UNIQUE/CHECK)
+- **Constrained CREATE TABLE**: `CREATE TABLE` with `NOT NULL`, `PRIMARY KEY`,
+  `UNIQUE`, `CHECK` or `FOREIGN KEY` reaches a catalog only when it advertises
+  `vgi.constraint.create.v1` and `vgi.constraint.enforce.v1`, i.e. when its
+  `table_create()` stores the records and its write paths enforce them. The SDK
+  ships no catalog that does (the in-memory test catalog stores no rows), so
+  such statements are refused with an error naming the missing profile.
 
 ### Table writes and indexes
 
@@ -1067,9 +1117,33 @@ on declarative tables. Table writes do not require the bundled
 [transactor](api/transactor.md); that is an optional database-access service with
 additional engine requirements.
 
-Index metadata can be declared with [`Index`][vgi.catalog.descriptors.Index]. Custom
-catalogs can implement `index_get()`, `index_create()`, and `index_drop()`; support
-depends on the catalog implementation and backing data source.
+Index metadata can be declared with [`Index`][vgi.catalog.descriptors.Index],
+building its definition with `index_definition()`:
+
+```python test="skip"
+from vgi.catalog import Index, index_definition
+
+Index(name="orders_customer", definition=index_definition(["main"], "orders", [["customer_id"]], algorithm="art"))
+```
+
+`ReadOnlyCatalogInterface` advertises `vgi.index.definition.read.v1` when any
+schema declares an index. Custom catalogs can implement `index_get()`,
+`index_create()`, and `index_drop()`; support depends on the catalog
+implementation and backing data source.
+
+### Overrides written for older signatures
+
+vgi.v3 added keyword arguments to several `CatalogInterface` methods
+(`catalog_attach(client_capabilities=)`, `schema_create(options=)`,
+`view_create(aliases=, security=, comment=, tags=, column_comments=)`,
+`table_create(constraint_definitions=, ...)`) and renamed `column_name` to
+`column_path`. The worker inspects an override's signature and passes only
+what it accepts, emitting a `DeprecationWarning` (and one log line) when it
+drops an argument. It drops one only when the value carries nothing the old
+override could have honoured (`None`, empty, a top-level column path); a
+barrier view, schema options or a nested column path fail with an error naming
+the parameter instead of being silently ignored. Update overrides to the
+current signatures, or accept `**kwargs`.
 
 ---
 
 
@@ -11,14 +11,19 @@
 import pytest
 
 from vgi.catalog import SchemaObjectType
-from vgi.catalog.constraints import ConstraintEnforcement, ConstraintValidation, validate_constraint_schema
+from vgi.catalog.constraints import (
+    ConstraintEnforcement,
+    ConstraintValidation,
+    served_table_schema,
+    validate_constraint_records,
+)
 from vgi.client import Client
 
 WORKERS: dict[str, list[str]] = json.loads(os.environ.get("VGI_METADATA_WORKERS", "{}"))
 
 
 @pytest.mark.parametrize("sdk", sorted(WORKERS))
-def test_example_constraints_are_explicit_stable_untrusted_records(sdk: str) -> None:
+def test_example_constraints_are_explicit_stable_trusted_records(sdk: str) -> None:
     with Client(server_path=WORKERS[sdk], worker_limit=1) as client:
         token = client.catalog_attach(
             name="example", data_version_spec=None, implementation_version=None
@@ -32,11 +37,11 @@ def test_example_constraints_are_explicit_stable_untrusted_records(sdk: str) ->
             assert fetched.constraints == listed.constraints
             infos = fetched.constraint_infos()
             assert infos, (sdk, name)
-            assert all(item.enforcement == ConstraintEnforcement.METADATA_ONLY for item in infos)
-            assert all(item.validation == ConstraintValidation.UNVALIDATED for item in infos)
-            assert not any(item.trusted for item in infos)
-            validate_constraint_schema(
-                pa.ipc.read_schema(pa.py_buffer(fetched.columns)),
-                [item.definition for item in infos],
-                trusted=[],
-            )
+            # DuckDB reads only ENFORCED + ALL_ROWS records; anything else fails ATTACH.
+            assert all(item.enforcement == ConstraintEnforcement.ENFORCED for item in infos)
+            assert all(item.validation == ConstraintValidation.ALL_ROWS for item in infos)
+            assert all(item.trusted for item in infos)
+            columns = pa.ipc.read_schema(pa.py_buffer(fetched.columns))
+            validate_constraint_records(name, columns, infos, schema_path=["data"])
+            # Served nullability already equals NOT_NULL/PRIMARY_KEY membership.
+            assert served_table_schema(columns, infos).equals(columns, check_metadata=True)
@@ -170,12 +170,12 @@ def test_discovery_never_hides_constraints_and_mutation_requires_revision() -> N
         Worker._table_for_capabilities(table_info(definition_revision=None), PROFILES)
 
 
-def test_discovery_rejects_nullability_that_does_not_match_records() -> None:
-    wrong = pa.schema([pa.field("a.b", pa.int64(), nullable=True)])
-    with pytest.raises(ValueError, match="nullability"):
-        Worker._table_for_capabilities(
-            table_info(columns=wrong.serialize().to_pybytes(), constraints=[INFO.serialize_to_bytes()]), PROFILES
-        )
+def test_discovery_serves_record_nullability() -> None:
+    nullable = pa.schema([pa.field("a.b", pa.int64(), nullable=True)])
+    served = Worker._table_for_capabilities(
+        table_info(columns=nullable.serialize().to_pybytes(), constraints=[INFO.serialize_to_bytes()]), PROFILES
+    )
+    assert not pa.ipc.read_schema(pa.py_buffer(served.columns)).field("a.b").nullable
 
 
 @pytest.mark.parametrize(
 
@@ -7,7 +7,8 @@
 profile was negotiated, (b) every record is ENFORCED + ALL_ROWS and (c) Arrow
 nullability equals membership in the NOT_NULL/PRIMARY_KEY paths. These tests
 pin that a declarative catalog satisfies (a) with no hand-written capability
-override and that (b) and (c) fail in the worker's own process.
+override, that (b) fails in the worker's own process, and that the worker
+derives (c) from the records instead of failing.
 """
 
 from __future__ import annotations
@@ -186,39 +187,59 @@ def test_record_for_another_table_fails_at_definition() -> None:
         Table(name="places", columns=COLUMNS, constraints=(other, *RECORDS[1:]))
 
 
-# --- (c) Arrow nullability equals NOT_NULL/PRIMARY_KEY membership ---
+# --- (c) served Arrow nullability is derived from NOT_NULL/PRIMARY_KEY records ---
 
 
-def test_non_nullable_field_without_record_fails_even_without_constraints() -> None:
-    with pytest.raises(ValueError, match=r"Table 't': .*column \['id'\]: the field is non-nullable but no"):
-        Table(name="t", columns=pa.schema([pa.field("id", pa.int64(), nullable=False)]))
+def _served(columns: pa.Schema, records: tuple[ConstraintInfo, ...] = (), name: str = "places") -> pa.Schema:
+    info = TableInfo(
+        name=name,
+        schema_path=["main"],
+        comment=None,
+        tags={},
+        columns=SerializedSchema(columns.serialize().to_pybytes()),
+        constraints=[record.serialize_to_bytes() for record in records],
+    )
+    served = Worker._table_for_capabilities(info, CatalogCapabilities(read=sorted(PROFILES)))
+    return pa.ipc.read_schema(pa.py_buffer(served.columns))
+
 
+def test_unnamed_non_nullable_field_is_served_nullable() -> None:
+    Table(name="t", columns=pa.schema([pa.field("id", pa.int64(), nullable=False)]))
+    served = _served(pa.schema([pa.field("id", pa.int64(), nullable=False)]), name="t")
+    assert served.field("id").nullable
 
-def test_nullable_field_with_record_fails() -> None:
+
+def test_record_named_nullable_field_is_served_non_nullable() -> None:
     record = constraint_record(["main"], "t", "nn", "NOT_NULL", [["id"]], **TRUSTED)
-    with pytest.raises(ValueError, match=r"Table 't': .*column \['id'\]: the field is nullable but"):
-        Table(name="t", columns=pa.schema([("id", pa.int64())]), constraints=(record,))
+    Table(name="t", columns=pa.schema([("id", pa.int64())]), constraints=(record,))
+    assert not _served(pa.schema([("id", pa.int64())]), (record,), name="t").field("id").nullable
 
 
-def test_nested_struct_child_nullability_is_checked_both_ways() -> None:
-    with pytest.raises(ValueError, match=r"column \['bbox', 'xmin'\]: the field is non-nullable but no"):
-        Table(name="places", columns=COLUMNS, constraints=(RECORDS[0], RECORDS[2]))
+def test_nested_struct_child_nullability_follows_records() -> None:
+    # No record names bbox.xmin: the non-nullable child is served nullable.
+    served = _served(COLUMNS, (RECORDS[0], RECORDS[2]))
+    assert served.field("bbox").type.field("xmin").nullable
+    assert not served.field("id").nullable
+    # A record names a nullable child: it is served non-nullable; the parent stays nullable.
     nullable_child = pa.schema([COLUMNS.field("id"), pa.field("bbox", pa.struct([("xmin", pa.float64())]))])
-    with pytest.raises(ValueError, match=r"column \['bbox', 'xmin'\]: the field is nullable but"):
-        Table(name="places", columns=nullable_child, constraints=RECORDS[:2])
+    served = _served(nullable_child, RECORDS[:2])
+    assert not served.field("bbox").type.field("xmin").nullable
+    assert served.field("bbox").nullable
 
 
-def test_nested_mismatch_fails_when_served() -> None:
-    info = TableInfo(
-        name="places",
-        schema_path=["main"],
-        comment=None,
-        tags={},
-        columns=SerializedSchema(COLUMNS.serialize().to_pybytes()),
-        constraints=[RECORDS[0].serialize_to_bytes()],
+def test_row_id_and_logical_storage_are_untouched() -> None:
+    storage = pa.struct([pa.field("x", pa.float64(), nullable=False)])
+    columns = pa.schema(
+        [
+            pa.field("rowid", pa.int64(), nullable=False, metadata={b"is_row_id": b"1"}),
+            pa.field("point", storage, nullable=False, metadata={b"ARROW:extension:name": b"example.point"}),
+        ]
     )
-    with pytest.raises(ValueError, match=r"Table 'places': Arrow nullability disagrees .* \['bbox', 'xmin'\]"):
-        Worker._table_for_capabilities(info, CatalogCapabilities(read=sorted(PROFILES)))
+    served = _served(columns, name="t")
+    assert not served.field("rowid").nullable
+    assert served.field("point").nullable
+    assert not served.field("point").type.field("x").nullable
+    assert served.field("rowid").metadata == {b"is_row_id": b"1"}
 
 
 @pytest.mark.parametrize(
 
@@ -198,6 +198,13 @@ def test_unsupported_generation_rejects_before_provider_and_during_discovery(
         tags={},
     )
     monkeypatch.setattr(backend._get_catalog(), "table_get", lambda **kwargs: info)
+    if b"generated_expression" in (field.metadata or {}):
+        # Discovery translates unambiguous top-level legacy metadata to the
+        # canonical record instead of rejecting the table; CREATE still refuses it.
+        served = backend.catalog_table_get(**args(token)).to_optional()
+        expressions = column_expressions(pa.ipc.read_schema(pa.py_buffer(served.columns)).field("g"))
+        assert expressions.generated is not None and expressions.generated.sql == "n + 1"
+        return
     with pytest.raises(error, match=message):
         backend.catalog_table_get(**args(token))