probe-migration-in-transactionlisted

# Probe a migration in a transaction The deliverable is a role × capability matrix for the PR body. ## Procedure 0. **Connect, then prove where you are.** Every `client` below is this one. The connection string comes from the project's dev environment — a `DEV_DATABASE_URL` in `.env`, the output of `supabase status`, the CI workflow — never from a guess: ```js const pg = require('pg'); const url = process.env.DEV_DATABASE_URL; if (!url) throw new Error('no dev connection string — stop'); // unset, pg const client = new pg.Client(url); // falls back to PG* env / localhost and await client.connect(); // connects *somewhere* without saying so ``` Before `begin`, ask the server what it is and compare against the dev target you meant to reach — the host and database named by the same source the URL came from: ```sql select current_database(), inet_server_addr(), inet_server_port(); ``` Match against what dev is *known* to be, not against a list of what production might be: anything that is not the expected dev identity — including an identity you cannot place — is the first STOP condition below, now mechanically checkable instead of known out-of-band. Refuse before `begin`, not after. 1. **Name the invariant and record it before touching anything.** One count on the table the migration must *not* reach — `widgets`, or whatever the change claims to leave alone. Step 6 re-reads it after the