[Kiran01bm]

One registry in pkg/migrate lists every operation pg-sprite can run that cannot be undone, with the acknowledgement that lifts its refusal, and a unit test fails CI when a new acknowledgement or destructive shape arrives without an entry.

Why

"Make mistakes hard to commit" is enforced gate by gate today: --allow-destructive, --accept-blocking, --force, --restart, --block-writes, each with its own tests. Nothing checks that the set of gates is complete, so a new irreversible path is caught only if its author remembers to add one. Writing the registry found a gap straight away: RunDesired rejected Force, AllowDestructive and BlockWrites, but passed AcceptBlocking and CopySwap.Restart through to every statement the plan derived. The CLI already rejects both with --desired, so only library callers were exposed.

What

• pkg/migrate/irreversible_registry.go: the five acknowledgements (ackKind) and the registry entries. The destructive-shape entries are derived from the new planner.DestructiveOpKinds(), so the planner's classification stays the only list of destructive shapes. The other five are listed: blocking DROP INDEX, blocking REINDEX, the submitted blocking form, copy-and-swap restart, and blocked writes.
• RunDesired rejects every acknowledgement by walking that list, adding ErrAcceptBlockingNotSupported and ErrRestartNotSupported.
• TestIrreversibleOperationRegistryIsComplete checks that:
  • each acknowledgement reads its own Options field, has its own sentinel, and is rejected by RunDesired;
  • each destructive shape has exactly one entry, and admission refuses a destructive plan whole;
  • each entry names an acknowledgement and a real refusal reason, and each acknowledgement gates an entry;
  • the walk is not vacuous.
• docs/schemabot-integration.md: RunDesired takes no acknowledgement.

No CLI behaviour changes; the behaviour of each gate under a real database is the follow-up.

Before / after

A library caller reuses one Options value, with CopySwap.Restart: "public.orders" left set from an imperative run, for a desired-state run whose plan retypes public.orders.id.

Before
  RunDesired(opts with Restart = "public.orders")
    plan: ALTER TABLE public.orders ALTER COLUMN id TYPE bigint   (copy-and-swap)
    the planned statement runs with Restart set
      a stopped copy-and-swap on public.orders is discarded       ── progress lost, nobody asked
    the test suite has no list to notice the gap

After
  RunDesired(opts with Restart = "public.orders")
    returns ErrRestartNotSupported before any database work
    nothing is planned or discarded; the stopped run resumes on the next run without Restart
  TestIrreversibleOperationRegistryIsComplete fails if a sixth acknowledgement
    or a fifth destructive shape arrives without an entry

Stacked on #281; retarget to main once it merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-30T04:49:14.025823Z We couldn’t complete this review. Comment @codex review to try again.	c135be8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.