fix(breg): keep role changes from widening a legacy ledger

A role change re-applies the active package, whose schema fingerprint an
earlier release measured with the 1,024-statement ledger constraint.
Widening that constraint during the role change made the measured catalog
differ from the declared one and failed the activation. A fresh ledger now
carries the 4,096-statement constraint from creation, and only a successor
to a different package widens a legacy one.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/registry-breg/src/postgres/interlock.rs

@@ -2605,7 +2605,12 @@ async fn begin_successor_in(
         .is_some();
     if fresh {
         verify_import_run_admission_state(transaction, current.activation_uuid()?).await?;
-        ensure_migration_statement_capacity(transaction).await?;
+        // A role change re-applies the active package, whose fingerprint
+        // covers the ledger constraint already in place; only a successor to
+        // a different package may widen it.
+        if target.package_digest != current.package_digest {
+            ensure_migration_statement_capacity(transaction).await?;
+        }
     }
     let changed = transaction
         .execute(

crates/registry-breg/src/postgres/migration_ledger.rs

@@ -300,7 +300,7 @@ pub(crate) async fn install_migration_ledger(
     migration: &impl GenericClient,
     runtime_role: &SqlIdentifier,
 ) -> Result<()> {
-    let ledger_ddl =
+    let ledger_ddl = format!(
         "CREATE TABLE IF NOT EXISTS registry_internal.registry_migrations (
                  activation_id uuid PRIMARY KEY,
                  apply_order bigint NOT NULL
@@ -309,10 +309,10 @@ pub(crate) async fn install_migration_ledger(
                      CHECK (apply_order > 0),
                  package_digest text NOT NULL
                      CONSTRAINT registry_migrations_package_digest_sha256
-                     CHECK (package_digest ~ '^sha256:[0-9a-f]{64}$'),
+                     CHECK (package_digest ~ '^sha256:[0-9a-f]{{64}}$'),
                  predecessor_package_digest text
                      CONSTRAINT registry_migrations_predecessor_digest_sha256
-                     CHECK (predecessor_package_digest ~ '^sha256:[0-9a-f]{64}$'),
+                     CHECK (predecessor_package_digest ~ '^sha256:[0-9a-f]{{64}}$'),
                  registry_revision text NOT NULL
                      CONSTRAINT registry_migrations_registry_revision_nonempty
                      CHECK (registry_revision <> ''),
@@ -372,6 +372,9 @@ pub(crate) async fn install_migration_ledger(
                  ),
                  CONSTRAINT registry_migrations_applied_at_consistent CHECK (
                      (outcome = 'applied') = (applied_at IS NOT NULL)
+                 ),
+                 CONSTRAINT registry_migrations_statement_checksums_bounded_v2 CHECK (
+                     {statement_checksums_bounded}
                  )
              );
              CREATE UNIQUE INDEX IF NOT EXISTS registry_migrations_one_open_activation_per_digest
@@ -404,9 +407,10 @@ pub(crate) async fn install_migration_ledger(
                  )
              );
              REVOKE ALL ON TABLE registry_internal.registry_migrations FROM PUBLIC;
-             REVOKE ALL ON TABLE registry_internal.registry_migration_steps FROM PUBLIC;";
-    migration.batch_execute(ledger_ddl).await?;
-    ensure_migration_statement_capacity(migration).await?;
+             REVOKE ALL ON TABLE registry_internal.registry_migration_steps FROM PUBLIC;",
+        statement_checksums_bounded = statement_checksums_bounded_check(),
+    );
+    migration.batch_execute(&ledger_ddl).await?;
     let revoke = RuntimeRevoke::detect(migration, runtime_role).await?;
     migration
         .batch_execute(&format!(
@@ -419,9 +423,28 @@ pub(crate) async fn install_migration_ledger(
     Ok(())
 }
 
+/// The body of `registry_migrations_statement_checksums_bounded_v2`, shared
+/// by a fresh ledger and the successor that widens a legacy one, so both
+/// catalogs fingerprint the same.
+fn statement_checksums_bounded_check() -> String {
+    format!(
+        "COALESCE(array_ndims(statement_checksums), 1) = 1
+         AND cardinality(statement_checksums) BETWEEN 0 AND {MAX_MIGRATION_STATEMENTS}
+         AND array_position(statement_checksums, '') IS NULL
+         AND (
+             (migration_kind = 'metadata-only' AND cardinality(statement_checksums) = 0)
+             OR (migration_kind = 'reviewed' AND cardinality(statement_checksums) = 0)
+             OR (migration_kind IN ('compiled-additive', 'reviewed')
+                 AND cardinality(statement_checksums) BETWEEN 1 AND {MAX_MIGRATION_STATEMENTS})
+         )"
+    )
+}
+
 /// Widens the legacy ledger statement bound inside the caller's
-/// migration-authorized transaction. The versioned constraint makes repeated
-/// startup, rehearsal, and successor retries no-ops after the first upgrade.
+/// migration-authorized transaction. Only a successor to a different package
+/// calls it: that package's fingerprint was measured on a fresh ledger, which
+/// already carries the versioned constraint. The versioned constraint makes
+/// successor retries and rehearsals no-ops after the first upgrade.
 pub(crate) async fn ensure_migration_statement_capacity(
     migration: &impl GenericClient,
 ) -> Result<()> {
@@ -444,20 +467,11 @@ pub(crate) async fn ensure_migration_statement_capacity(
                  ) THEN
                      ALTER TABLE registry_internal.registry_migrations
                          ADD CONSTRAINT registry_migrations_statement_checksums_bounded_v2
-                         CHECK (
-                             COALESCE(array_ndims(statement_checksums), 1) = 1
-                             AND cardinality(statement_checksums) BETWEEN 0 AND {MAX_MIGRATION_STATEMENTS}
-                             AND array_position(statement_checksums, '') IS NULL
-                             AND (
-                                 (migration_kind = 'metadata-only' AND cardinality(statement_checksums) = 0)
-                                 OR (migration_kind = 'reviewed' AND cardinality(statement_checksums) = 0)
-                                 OR (migration_kind IN ('compiled-additive', 'reviewed')
-                                     AND cardinality(statement_checksums) BETWEEN 1 AND {MAX_MIGRATION_STATEMENTS})
-                             )
-                         );
+                         CHECK ({statement_checksums_bounded});
                  END IF;
              END
-             $migration_statement_capacity$;"
+             $migration_statement_capacity$;",
+            statement_checksums_bounded = statement_checksums_bounded_check(),
         ))
         .await?;
     Ok(())

crates/registry-breg/tests/postgres_package/migration_capacity.rs

@@ -251,6 +251,69 @@ fn preassertion_review_source(
     }
 }
 
+/// Puts back the 1,024-statement ledger constraint an earlier release
+/// installed, and returns the schema fingerprint of the catalog that leaves.
+async fn reinstall_legacy_statement_constraint(
+    database: &TestDatabase,
+    registry: &registry_breg::CompiledRegistry,
+) -> String {
+    database
+        .admin
+        .batch_execute(
+            "ALTER TABLE registry_internal.registry_migrations
+                 DROP CONSTRAINT registry_migrations_statement_checksums_bounded_v2;
+             ALTER TABLE registry_internal.registry_migrations
+                 ADD CONSTRAINT registry_migrations_checksums_nonempty
+                 CHECK (
+                     COALESCE(array_ndims(statement_checksums), 1) = 1
+                     AND cardinality(statement_checksums) BETWEEN 0 AND 1024
+                     AND array_position(statement_checksums, '') IS NULL
+                     AND (
+                         (migration_kind = 'metadata-only' AND cardinality(statement_checksums) = 0)
+                         OR (migration_kind = 'reviewed' AND cardinality(statement_checksums) = 0)
+                         OR (migration_kind IN ('compiled-additive', 'reviewed')
+                             AND cardinality(statement_checksums) BETWEEN 1 AND 1024)
+                     )
+                 );",
+        )
+        .await
+        .expect("fixture reinstalls the legacy statement constraint");
+    let (migration, migration_task) = database.connect_migration().await;
+    let legacy_fingerprint = managed_schema_fingerprint(
+        &migration,
+        &database.runtime_role,
+        &ExpectedManagedCatalog::compiled(registry),
+    )
+    .await
+    .expect("the legacy ledger catalog fingerprints");
+    drop(migration);
+    migration_task.abort();
+    legacy_fingerprint
+}
+
+/// The ledger statement constraints present: (v2, legacy).
+async fn ledger_statement_constraints(database: &TestDatabase) -> (bool, bool) {
+    let row = database
+        .admin
+        .query_one(
+            "SELECT
+                 EXISTS (
+                     SELECT 1 FROM pg_catalog.pg_constraint
+                     WHERE conrelid = 'registry_internal.registry_migrations'::regclass
+                       AND conname = 'registry_migrations_statement_checksums_bounded_v2'
+                 ),
+                 EXISTS (
+                     SELECT 1 FROM pg_catalog.pg_constraint
+                     WHERE conrelid = 'registry_internal.registry_migrations'::regclass
+                       AND conname = 'registry_migrations_checksums_nonempty'
+                 )",
+            &[],
+        )
+        .await
+        .expect("ledger constraints are inspectable");
+    (row.get(0), row.get(1))
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn reviewed_flow_package_beyond_the_old_statement_limit_prepares_and_activates() {
     let source = serde_json::to_vec(&reviewed_flow_project(4, PROPOSAL_OPERATIONS))
@@ -345,37 +408,7 @@ async fn reviewed_successor_upgrades_the_legacy_ledger_and_applies_more_than_102
     .await
     .expect("prior package activates");
 
-    database
-        .admin
-        .batch_execute(
-            "ALTER TABLE registry_internal.registry_migrations
-                 DROP CONSTRAINT registry_migrations_statement_checksums_bounded_v2;
-             ALTER TABLE registry_internal.registry_migrations
-                 ADD CONSTRAINT registry_migrations_checksums_nonempty
-                 CHECK (
-                     COALESCE(array_ndims(statement_checksums), 1) = 1
-                     AND cardinality(statement_checksums) BETWEEN 0 AND 1024
-                     AND array_position(statement_checksums, '') IS NULL
-                     AND (
-                         (migration_kind = 'metadata-only' AND cardinality(statement_checksums) = 0)
-                         OR (migration_kind = 'reviewed' AND cardinality(statement_checksums) = 0)
-                         OR (migration_kind IN ('compiled-additive', 'reviewed')
-                             AND cardinality(statement_checksums) BETWEEN 1 AND 1024)
-                     )
-                 );",
-        )
-        .await
-        .expect("fixture reinstalls the legacy statement constraint");
-    let (migration, migration_task) = database.connect_migration().await;
-    let legacy_fingerprint = managed_schema_fingerprint(
-        &migration,
-        &database.runtime_role,
-        &ExpectedManagedCatalog::compiled(&prior),
-    )
-    .await
-    .expect("the legacy ledger catalog fingerprints");
-    drop(migration);
-    migration_task.abort();
+    let legacy_fingerprint = reinstall_legacy_statement_constraint(&database, &prior).await;
     assert_ne!(
         legacy_fingerprint, current.schema_fingerprint,
         "the constraint version belongs to the managed schema fingerprint"
@@ -545,3 +578,93 @@ async fn reviewed_successor_upgrades_the_legacy_ledger_and_applies_more_than_102
     assert_eq!(ledger, (ledger_statement_count as i32, true, false));
     database.cleanup().await;
 }
+
+/// A role change re-applies the active package and runs no DDL, so a registry
+/// an earlier release activated keeps the ledger constraint the schema
+/// fingerprint of that package covers. Only a successor widens the ledger.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn role_change_keeps_the_legacy_ledger_constraint_its_active_package_declares() {
+    let source = serde_json::to_vec(&reviewed_flow_project(1, &[])).expect("fixture serializes");
+    let project = parse_project_json(&source).expect("fixture project parses");
+    let compiled = compile_project(&project, &[], CompileProfile::Production)
+        .expect("fixture compiles in production");
+
+    let database = TestDatabase::create(1).await;
+    let fingerprint = measure_fresh_compiled_schema(&database, &compiled).await;
+    let prepared = prepare_package(capacity_request(
+        source.clone(),
+        fingerprint,
+        None,
+        PackageMigrationPlanInput::InitialCompiledDdl,
+    ))
+    .expect("package prepares");
+    let root = TempRoot::create();
+    prepared
+        .publish_to_directory(root.path())
+        .expect("package publishes");
+    let package = load_package(root.path(), &local_context()).expect("package verifies");
+    let active = apply_package(
+        &database,
+        &package,
+        ApplyPrecondition::InitialActivation,
+        Duration::from_secs(30),
+        Duration::from_secs(60),
+    )
+    .await
+    .expect("package activates");
+
+    // The registry as an earlier release left it: the legacy ledger
+    // constraint, and an active package whose declared schema fingerprint
+    // was measured with that constraint.
+    let legacy_fingerprint = reinstall_legacy_statement_constraint(&database, &compiled).await;
+    let legacy_prepared = prepare_package(capacity_request(
+        source,
+        legacy_fingerprint.clone(),
+        None,
+        PackageMigrationPlanInput::InitialCompiledDdl,
+    ))
+    .expect("the earlier release's package prepares");
+    let legacy_root = TempRoot::create();
+    legacy_prepared
+        .publish_to_directory(legacy_root.path())
+        .expect("the earlier release's package publishes");
+    let legacy_package = load_package(legacy_root.path(), &local_context())
+        .expect("the earlier release's package verifies");
+    database
+        .admin
+        .batch_execute(&format!(
+            "UPDATE registry_internal.registry_state
+             SET active_package_digest = '{digest}', schema_fingerprint = '{legacy_fingerprint}'
+             WHERE singleton AND active_activation_id = '{activation}'::uuid;
+             UPDATE registry_internal.registry_migrations
+             SET package_digest = '{digest}'
+             WHERE activation_id = '{activation}'::uuid;",
+            digest = legacy_package.package_digest(),
+            activation = active.activation_id,
+        ))
+        .await
+        .expect("fixture records the earlier release's active package");
+    let current = ExpectedRegistryIdentity {
+        package_digest: legacy_package.package_digest().to_owned(),
+        schema_fingerprint: legacy_fingerprint.clone(),
+        ..active
+    };
+
+    // The re-apply serves with the migration role alone, so it is a role
+    // change rather than a re-apply that leaves nothing to activate.
+    let reapplied = apply_verified_package(ApplyVerifiedPackageRequest::new(
+        &database.migration_config,
+        &legacy_package,
+        ActivationDeployment::new("local", INSTANCE, DATABASE),
+        ApplyPrecondition::RoleChange { current: &current },
+        ApplyRoles::new(&database.migration_role, &database.migration_role),
+        ApplyTimeouts::new(Duration::from_secs(30), Duration::from_secs(60))
+            .expect("role change timeouts are bounded"),
+        database.activation_audit(),
+    ))
+    .await
+    .expect("the role change re-applies the package the earlier release activated");
+    assert_eq!(reapplied.schema_fingerprint, legacy_fingerprint);
+    assert_eq!(ledger_statement_constraints(&database).await, (false, true));
+    database.cleanup().await;
+}

products/breg/README.md

@@ -217,7 +217,8 @@ The first successor on a database with the legacy 1,024-statement ledger bound
 widens that constraint when maintenance begins. This engine catalog change
 remains if a later precondition or migration step fails. Correct the cause and
 retry the exact pinned target; if it cannot complete and reconciliation reports
-`unresolvable`, restore the pre-activation backup.
+`unresolvable`, restore the pre-activation backup. A role change re-applies the
+active package and leaves the ledger bound as that package declares it.
 
 Authoring and migration authority are deliberately separate. An author or
 coding agent can edit configuration, inspect a diff, and run checks. Those