spg_sql/

parser.rs

//! Recursive-descent parser with a Pratt (precedence-climbing) sub-parser for
//! expressions.
//!
//! Precedence (lowest → highest binding):
//! `OR` (1) `<` `AND` (2) `<` `NOT` unary (3) `<`
//! comparisons `=` `<>` `<` `<=` `>` `>=` (4) `<`
//! `+` `-` (5) `<` `*` `/` (6) `<` unary `-` (7) `<` parens / atom.
//!
//! This matches PG's behaviour for the operators we support — e.g. `NOT a = b`
//! parses as `NOT (a = b)` and `-a * b` as `(-a) * b`.

use alloc::boxed::Box;
use alloc::format;
use alloc::string::{String, ToString};
use alloc::vec;
use alloc::vec::Vec;
use core::fmt;
use core::mem;

use crate::ast::{
    AssignTarget, BinOp, CastTarget, Collation, ColumnDef, ColumnName, ColumnTypeName,
    CreateFunctionStatement, CreateIndexStatement, CreatePublicationStatement,
    CreateSubscriptionStatement, CreateTableStatement, CreateTriggerStatement, DiscardTarget, Expr,
    ExtractField, FkAction, ForeignKeyConstraint, FrameBound, FrameExclusion, FrameKind,
    FromClause, FromJoin, FunctionArg, FunctionArgMode, FunctionArgType, FunctionAttrs,
    FunctionBody, FunctionParallel, FunctionReturn, FunctionVolatility, GrantObject, GrantPriv,
    GrantStatement, IndexMethod, InsertStatement, IsolationLevel, JoinKind, Literal, MysqlIntWidth,
    NullTreatment, OrderBy, Overriding, PlPgSqlBlock, PlPgSqlDeclare, PlPgSqlStmt,
    PublicationScope, RaiseLevel, RangeKindAst, ReturnTarget, SelectItem, SelectStatement,
    Statement, TableRef, TriggerEvent, TriggerForEach, TriggerTiming, UnOp, UnionKind, VecEncoding,
    WindowFrame,
};
use crate::lexer::{self, LexError, Token};

/// v7.38 — a `WINDOW w AS (…)` definition body:
/// `(PARTITION BY exprs, ORDER BY (expr, desc, nulls_first), frame)`.
type WindowDef = (
    Vec<Expr>,
    Vec<(Expr, bool, Option<bool>)>,
    Option<WindowFrame>,
);

/// v7.14.0 — true when the leading keyword of a top-level
/// statement is one of the dump-emitted DDL forms SPG accepts
/// as a no-op (no behavioural effect on the single-schema /
/// single-database model). These statements are consumed up to
/// the next `;` / EOF and returned as `Statement::Empty`.
/// v7.39 (read01 round 57) — wrap a parsed GRANT body in the right statement.
fn finish_grant(grant: bool, g: GrantStatement) -> Statement {
    if grant {
        Statement::Grant(g)
    } else {
        Statement::Revoke(g)
    }
}

fn is_dump_noise_statement(lc: &str) -> bool {
    matches!(
        lc,
        // v7.39 (read01 round 50): "comment" moved OUT — COMMENT ON is now a
        // real statement with a real store. v7.39 (read01 round 57): "grant" /
        // "revoke" moved OUT — table privileges are now REAL (stored in
        // `relacl`, enforced against the session role); a grant on any other
        // object class still parses and no-ops so dumps restore.
        // MySQL bulk-load brackets.
        "unlock"
            // MySQL OPTIMIZE / ANALYZE TABLE / CHECK TABLE
            // diagnostics that pg_dump-style tools also emit
            // post-restore.
            | "optimize"
            | "check"
            | "use"
            // PG psql backslash meta-commands that newer
            // pg_dump versions emit unescaped (\restrict /
            // \unrestrict). Real psql intercepts these; SPG's
            // PG-wire sees them as raw text.
            | "\\restrict"
            | "\\unrestrict"
            // v7.17.0 Phase 4.1 — MySQL `DELIMITER //` and
            // `DELIMITER ;` directives. Technically client-side
            // (the `mysql` CLI uses them to set the statement
            // terminator), not SQL — but mysqldump and stored-
            // procedure scripts emit them inline. SPG's parser
            // sees one statement at a time and doesn't care
            // about the terminator, so consume DELIMITER lines
            // as Empty.
            | "delimiter"
            // v7.37.17 (17.6 siblings) — additional PG maintenance /
            // session-state statements pg_dump + application startup
            // scripts emit. SPG has no matching session-state to
            // discard (no prepared-plan cache surface, no temp
            // sequences), no matching security-label / storage-
            // option to apply, no separate CREATE/DROP CAST that
            // affects execution.
            // v7.37.17 (17.6 siblings) — PG role-cleanup statements
            // pg_dump / pg_dumpall emit around DROP ROLE:
            //   REASSIGN OWNED BY <role> [, ...] TO <newrole>
            //   DROP OWNED BY <role> [, ...] [CASCADE | RESTRICT]
            // Both operate on the role's owned objects; SPG has no
            // role-owner model, so accept-and-no-op.
            // v7.37.17 (17.6 sibling) — LOAD '<library>'. pg_dump
            // + extension scripts use LOAD to preload shared
            // libraries. SPG doesn't have a shared-library extension
            // point today (extensions ship as first-class crates
            // linked at build time); accept as a no-op.
            | "load"
    )
}

/// v7.37.43-T4 — PG-unreserved keywords that are legal identifiers
/// per `pg_get_keywords()`. SPG tokenizes these as named variants
/// so the parser can dispatch on them in their owning contexts
/// (`RELEASE SAVEPOINT`, `SHOW name`, `BEGIN`/`COMMIT`/`ROLLBACK`,
/// `CREATE INDEX`, etc.), but they MUST stay usable as table /
/// column / alias names — that's the PG contract for unreserved
/// keywords (see PG docs Appendix C.1).
///
/// Before this generalisation, sentori migration 0001_init.sql
/// `release TEXT NOT NULL` blew up the parser with "expected
/// identifier, got Release", and the same gap stalked every
/// SPG drop-in user whose schema had a column / alias named
/// `release` / `index` / `tables` / `show` / `savepoint` /
/// `begin` / `commit` / `rollback` / `drop` / `insert` / `values`
/// / `limit` / `partition`. PG accepts all of them as identifiers
/// when unquoted, so SPG must too.
///
/// Returns the canonical lowercase identifier text when the token
/// belongs to PG's unreserved class, `None` otherwise. Used by
/// `expect_ident_like` (column / table / alias names) so the
/// generalisation applies everywhere an identifier may appear,
/// not just in the contexts these tokens were introduced for.
fn unreserved_keyword_text(tok: &Token) -> Option<String> {
    let s = match tok {
        // PG keyword class: unreserved or col_name.
        //
        Token::Release => "release",
        Token::Savepoint => "savepoint",
        Token::Show => "show",
        Token::Index => "index",
        Token::Begin => "begin",
        Token::Commit => "commit",
        Token::Rollback => "rollback",
        Token::Drop => "drop",
        Token::Insert => "insert",
        Token::Values => "values",
        Token::Limit => "limit",
        Token::Partition => "partition",
        Token::Tables => "tables",
        Token::Connection => "connection",
        Token::Publication => "publication",
        Token::Subscription => "subscription",
        Token::Interval => "interval",
        // `extract` is non-reserved in PG too (it's a function the
        // parser dispatches via context — outside that context it's
        // a plain identifier).
        Token::Extract => "extract",
        Token::Offset => "offset",
        // `to` is reserved in PG (used in many "AS … TO …" forms), so
        // it is NOT relaxed here. Same for `from`, `where`, `as`,
        // `select`, `not`, `and`, `or`, `null`, `true`, `false`,
        // `create`, `table`, `into`, `on`, `order`, `by`, `having`,
        // `group`, `distinct`, `union`, `all`, `join`, `inner`,
        // `left`, `cross`, `outer`, `default`, `is`, `between`,
        // `in`, `like`, `for`, `except`, `desc`, `asc`, `partition`
        // (partial — keep partition as unreserved per modern PG).
        _ => return None,
    };
    Some(s.to_string())
}

/// v7.9.22 — recognise pgvector / SPG vector-index opclass names
/// in CREATE INDEX. SPG's HNSW already routes by query operator;
/// the opclass is accepted for `pg_dump` compatibility (mailrs
/// migration follow-up G5).
/// v7.13.0 — extended to recognise PG built-in / pg_trgm opclasses
/// (mailrs round-5 G5). These are tokens-only acceptance — SPG
/// doesn't change index behaviour based on them.
/// v7.37.17 (17.6 siblings) — the four PG `each` SRFs share one
/// FROM-clause pipeline; the stored name tells the executor whether
/// the value column keeps JSON rendering (`jsonb_each` / `json_each`)
/// or unwraps to text (`*_each_text`).
fn is_json_each_name(s: &str) -> bool {
    s.eq_ignore_ascii_case("jsonb_each_text")
        || s.eq_ignore_ascii_case("jsonb_each")
        || s.eq_ignore_ascii_case("json_each_text")
        || s.eq_ignore_ascii_case("json_each")
}

/// v7.38 (read01, T14) — resolve named function arguments (`argname => value`)
/// to positional order for the `make_*` family (the AST stays positional).
/// Positional args fill slots left-to-right; a named arg goes to its registered
/// slot; unfilled slots default to integer 0 (PG's optional make_interval
/// fields — the make_date/time arity is still checked at eval time).
fn reorder_named_args(
    fname: &str,
    args: Vec<Expr>,
    names: &[Option<String>],
) -> Result<Vec<Expr>, String> {
    let params: &[&str] = match fname.to_ascii_lowercase().as_str() {
        "make_date" => &["year", "month", "day"],
        "make_time" => &["hour", "min", "sec"],
        "make_timestamp" | "make_timestamptz" => &["year", "month", "mday", "hour", "min", "sec"],
        "make_interval" => &["years", "months", "weeks", "days", "hours", "mins", "secs"],
        other => {
            return Err(alloc::format!(
                "function {other}(...) does not support named arguments"
            ));
        }
    };
    let mut slots: Vec<Option<Expr>> = (0..params.len()).map(|_| None).collect();
    let mut next_positional = 0usize;
    for (arg, name) in args.into_iter().zip(names.iter()) {
        let idx = match name {
            Some(n) => params
                .iter()
                .position(|p| p.eq_ignore_ascii_case(n))
                .ok_or_else(|| alloc::format!("{fname}(...) has no argument named \"{n}\""))?,
            None => {
                let i = next_positional;
                next_positional += 1;
                i
            }
        };
        if idx >= slots.len() {
            return Err(alloc::format!("too many arguments for {fname}(...)"));
        }
        if slots[idx].is_some() {
            return Err(alloc::format!(
                "argument \"{}\" specified more than once",
                params[idx]
            ));
        }
        slots[idx] = Some(arg);
    }
    Ok(slots
        .into_iter()
        .map(|s| s.unwrap_or(Expr::Literal(Literal::Integer(0))))
        .collect())
}

/// v7.38 (read01) — parse a lexer `Token::Numeric` source string (digits with
/// an optional single `.`, no sign, no exponent) into `(unscaled, scale)` for
/// `Literal::Numeric`. Returns `None` if the mantissa overflows i128.
/// v7.39 (read01 numeric.c) — the result of expanding an `1.5e3`-style
/// scientific literal into PG's plain NUMERIC decimal form.
#[derive(Debug)]
pub enum SciExpanded {
    /// Plain decimal string ("1.5e3" → "1500", "1e-5" → "0.00001").
    Expanded(String),
    /// Exponent pushes the value outside PG's numeric format
    /// (more than 131072 integer digits or 16383 fractional digits).
    Overflow,
    /// Not a `[±]digits[.digits]e[±]digits` literal at all.
    NotScientific,
}

/// Expand scientific notation into a plain decimal string by moving the
/// decimal point — no float round-trip, so the value stays exact. PG treats
/// such literals as NUMERIC; the digit-count caps mirror PG's numeric format
/// limits ("value overflows numeric format").
pub fn expand_scientific_literal(s: &str) -> SciExpanded {
    let s = s.trim();
    let Some(epos) = s.find(['e', 'E']) else {
        return SciExpanded::NotScientific;
    };
    let (mant, exp_str) = (&s[..epos], &s[epos + 1..]);
    let Ok(exp) = exp_str.parse::<i64>() else {
        return SciExpanded::NotScientific;
    };
    let (neg, mant) = match mant.strip_prefix('-') {
        Some(r) => (true, r),
        None => (false, mant.strip_prefix('+').unwrap_or(mant)),
    };
    let (int_part, frac_part) = match mant.split_once('.') {
        Some((i, f)) => (i, f),
        None => (mant, ""),
    };
    if (int_part.is_empty() && frac_part.is_empty())
        || !int_part.bytes().all(|b| b.is_ascii_digit())
        || !frac_part.bytes().all(|b| b.is_ascii_digit())
    {
        return SciExpanded::NotScientific;
    }
    let mut digits = String::with_capacity(int_part.len() + frac_part.len());
    digits.push_str(int_part);
    digits.push_str(frac_part);
    // Decimal point position within `digits` after applying the exponent.
    let new_point = int_part.len() as i64 + exp;
    // PG's numeric format: up to 131072 digits before the point, 16383 after.
    if new_point > 131_072 {
        return SciExpanded::Overflow;
    }
    if (digits.len() as i64 - new_point) > 16_383 {
        return SciExpanded::Overflow;
    }
    let sign = if neg { "-" } else { "" };
    let plain = if new_point <= 0 {
        let mut out = String::with_capacity(digits.len() + 2 + (-new_point) as usize);
        out.push_str("0.");
        for _ in 0..(-new_point) {
            out.push('0');
        }
        out.push_str(&digits);
        out
    } else if (new_point as usize) >= digits.len() {
        let mut out = digits;
        for _ in 0..(new_point as usize - out.len()) {
            out.push('0');
        }
        out
    } else {
        let mut out = String::with_capacity(digits.len() + 1);
        out.push_str(&digits[..new_point as usize]);
        out.push('.');
        out.push_str(&digits[new_point as usize..]);
        out
    };
    SciExpanded::Expanded(alloc::format!("{sign}{plain}"))
}

/// v7.39 (round 367, M20) — lower a MySQL hexadecimal binary-string
/// literal (`0x…` / `X'…'`) onto the existing bytea cast. The hex digits
/// are left-padded to an even count (`0x123` → byte string `01 23`, per
/// MariaDB) and handed to the PG bytea input format (`\x…`).
#[inline(never)]
fn hex_literal_to_bytea_expr(hex: &str) -> Expr {
    let padded = if hex.len() % 2 == 1 {
        alloc::format!("0{hex}")
    } else {
        hex.to_string()
    };
    Expr::Cast {
        expr: alloc::boxed::Box::new(Expr::Literal(Literal::String(alloc::format!(
            "\\x{padded}"
        )))),
        target: CastTarget::Named("bytea".to_string()),
    }
}

/// v7.39 (round 367, M20) — lower a MySQL bit-value literal (`b'1010'`)
/// onto the bytea cast. The bits are read big-endian and left-padded to a
/// whole number of bytes (`b'1010'` → one byte `0x0A`, per MariaDB).
#[inline(never)]
fn bits_literal_to_bytea_expr(bits: &str) -> Expr {
    let pad = (8 - bits.len() % 8) % 8;
    let mut hex = String::with_capacity((bits.len() + pad).div_ceil(4));
    let padded: String = core::iter::repeat_n('0', pad).chain(bits.chars()).collect();
    for nibble in padded.as_bytes().chunks(4) {
        let mut v = 0u8;
        for &b in nibble {
            v = (v << 1) | (b - b'0');
        }
        hex.push(char::from_digit(u32::from(v), 16).unwrap_or('0'));
    }
    hex_literal_to_bytea_expr(&hex)
}

/// Resolve a lexer `Token::Numeric` into its literal. PG semantics: a dotted
/// or over-i64 literal is exact NUMERIC; scientific notation is NUMERIC too
/// (expanded to the plain decimal form); only a fractional depth beyond SPG's
/// scale width (u8) falls back to double precision (recorded delta).
/// Kept out of the parse_expr recursion frame — see the call site.
#[inline(never)]
fn numeric_token_to_literal(s: String) -> Result<Literal, String> {
    match parse_decimal_literal(&s) {
        Some((unscaled, scale)) => Ok(Literal::Numeric { unscaled, scale }),
        // v7.38 (read01, T3.C3) — a plain decimal too wide for i128 keeps
        // its exact value as a NumericBig.
        None if !s.contains(['e', 'E']) => Ok(Literal::NumericBig(s)),
        // v7.39 (read01 numeric.c) — expand the exponent form.
        None => match expand_scientific_literal(&s) {
            SciExpanded::Expanded(plain) => match parse_decimal_literal(&plain) {
                Some((unscaled, scale)) => Ok(Literal::Numeric { unscaled, scale }),
                None if plain
                    .split_once('.')
                    .is_none_or(|(_, f)| u8::try_from(f.len()).is_ok()) =>
                {
                    Ok(Literal::NumericBig(plain))
                }
                None => s
                    .parse::<f64>()
                    .map(Literal::Float)
                    .map_err(|_| format!("invalid numeric literal {s:?}")),
            },
            SciExpanded::Overflow => Err("value overflows numeric format".to_string()),
            SciExpanded::NotScientific => s
                .parse::<f64>()
                .map(Literal::Float)
                .map_err(|_| format!("invalid numeric literal {s:?}")),
        },
    }
}

fn parse_decimal_literal(s: &str) -> Option<(i128, u16)> {
    let (int_part, frac_part) = match s.split_once('.') {
        Some((i, f)) => (i, f),
        None => (s, ""),
    };
    // v7.39 (round 271) — was u8::MAX. A literal with 256 decimal
    // places fell out of the numeric path here, which is why
    // `pg_typeof(1e-256)` answered double precision and a plain
    // 256-place decimal aborted the query in the big-decimal converter.
    if frac_part.len() > u16::MAX as usize {
        return None;
    }
    let mut digits = String::with_capacity(int_part.len() + frac_part.len());
    digits.push_str(int_part);
    digits.push_str(frac_part);
    let mantissa: i128 = digits.parse().ok()?;
    #[allow(clippy::cast_possible_truncation)]
    Some((mantissa, frac_part.len() as u16))
}

/// `jsonb_to_record` / `jsonb_to_recordset` (+ `json_` variants) — the
/// record-returning JSON functions that take a `AS alias(col type, …)`
/// column-definition list in FROM position.
fn is_json_to_record_name(s: &str) -> bool {
    s.eq_ignore_ascii_case("jsonb_to_recordset")
        || s.eq_ignore_ascii_case("jsonb_to_record")
        // v7.39 (read01 jsonfuncs.c) — the populate family with an AS
        // column-definition list desugars identically (the record base
        // argument only carries the type; a non-NULL base's field
        // defaults are a recorded delta).
        || s.eq_ignore_ascii_case("json_populate_record")
        || s.eq_ignore_ascii_case("jsonb_populate_record")
        || s.eq_ignore_ascii_case("json_populate_recordset")
        || s.eq_ignore_ascii_case("jsonb_populate_recordset")
        || s.eq_ignore_ascii_case("json_to_recordset")
        || s.eq_ignore_ascii_case("json_to_record")
}

impl Parser {
    /// Whether what follows an identifier ends an index key, which is how
    /// an operator class is told from anything else in that position.
    fn opclass_position_follows(next: Option<&Token>) -> bool {
        match next {
            // `ASC` / `DESC` have their own tokens; matching them as
            // identifiers named "asc" / "desc" — which the first version of
            // this did — never fires, and `(c text_pattern_ops DESC)` (which
            // PG18.4 accepts, verified) went on failing to parse.
            Some(Token::Comma | Token::RParen | Token::Asc | Token::Desc) => true,
            Some(Token::Ident(w)) => {
                w.eq_ignore_ascii_case("nulls") || w.eq_ignore_ascii_case("collate")
            }
            _ => false,
        }
    }
}

fn is_vector_opclass_name(name: &str) -> bool {
    let lc = name.to_ascii_lowercase();
    matches!(
        lc.as_str(),
        "vector_cosine_ops"
            | "vector_l2_ops"
            | "vector_ip_ops"
            | "halfvec_cosine_ops"
            | "halfvec_l2_ops"
            | "halfvec_ip_ops"
            | "sq8_cosine_ops"
            | "sq8_l2_ops"
            | "sq8_ip_ops"
            // pg_trgm — trigram operator class. SPG's GIN index
            // already uses tsvector tokens; trigram-style LIKE
            // pattern matching still routes through a sequential
            // scan, but the opclass name is accepted so PG schemas
            // load.
            | "gin_trgm_ops"
            | "gist_trgm_ops"
            // PG built-in btree opclasses occasionally appear in
            // pg_dump output for column types with multiple
            // sort orders (text_pattern_ops, varchar_pattern_ops,
            // bpchar_pattern_ops).
            | "text_pattern_ops"
            | "varchar_pattern_ops"
            | "bpchar_pattern_ops"
            | "int4_ops"
            | "int8_ops"
            | "text_ops"
    )
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ParseError {
    pub message: String,
    /// Index into the token stream where parsing tripped. Not a byte offset.
    /// v7.39 (read01 round 95) — the byte/char position is NOT stored here: a
    /// field would grow every `Result<_, ParseError>` slot on the deeply
    /// recursive parse stack and tip the nesting-budget frame cliff. PG's
    /// 1-based char position is recovered on the cold error path by
    /// [`syntax_error_position`], which re-tokenizes to map this token index.
    pub token_pos: usize,
}

impl fmt::Display for ParseError {
    /// v7.39 (round 322/V24) — the message ALONE. It used to be prefixed
    /// with `parse error at token #N: `, which PG has no equivalent of:
    /// the message bodies are already PG's verbatim (`LIMIT must not be
    /// negative`, `invalid input syntax for type bigint: "abc"`), and the
    /// prefix was SPG's internal token index leaking into every one of
    /// them. `token_pos` stays a field — the wire recovers PG's 1-based
    /// character position from it for the ErrorResponse `P`.
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(&self.message)
    }
}

impl From<LexError> for ParseError {
    fn from(e: LexError) -> Self {
        Self {
            message: format!("lex: {e}"),
            token_pos: 0,
        }
    }
}

/// v7.9.30 — parse a single expression (no trailing junk). Used by
/// the engine to re-hydrate stored partial-index / unique-index
/// predicates from their canonical Display form. The same Pratt
/// parser the statement path uses; this entry point just skips the
/// statement dispatch.
pub fn parse_expression(input: &str) -> Result<Expr, ParseError> {
    let (tokens, offsets) =
        lexer::tokenize_with_offsets(input, false).map_err(|e| shape_lex_error(&e, input))?;
    let mut p = Parser::new(tokens);
    let expr = p
        .parse_expr(0)
        .and_then(|e| p.expect_eof().map(|()| e))
        .map_err(|e| shape_syntax_error(e, input, &offsets))?;
    Ok(expr)
}

/// Parse exactly one statement, swallow an optional trailing `;`, and require
/// the token stream to end there. PG string semantics.
pub fn parse_statement(input: &str) -> Result<Statement, ParseError> {
    parse_statement_with(input, false)
}

/// v7.22 (round-13 T3) — dialect-aware entry: `backslash_escapes`
/// selects MySQL-style string lexing (see `lexer::tokenize_with`).
/// The engine threads its session flag through here.
pub fn parse_statement_with(input: &str, backslash_escapes: bool) -> Result<Statement, ParseError> {
    let (tokens, offsets) = lexer::tokenize_with_offsets(input, backslash_escapes)
        .map_err(|e| shape_lex_error(&e, input))?;
    // The same session flag names the dialect for both the lexer and
    // the type mapping.
    let mut p = Parser::new_with_dialect(tokens, backslash_escapes).with_source(input, &offsets);
    let stmt = (|| {
        let stmt = p.parse_one_statement()?;
        if matches!(p.peek(), Token::Semicolon) {
            p.advance();
        }
        p.expect_eof()?;
        Ok(stmt)
    })()
    .map_err(|e: ParseError| shape_syntax_error(e, input, &offsets))?;
    Ok(stmt)
}

/// v7.39 (round 340, V56) — PG has exactly two syntax-error wordings:
/// `syntax error at or near "<token>"` and `syntax error at end of input`
/// (measured on 18.4 across a dozen shapes). SPG wrote its own per-site
/// prose — `expected identifier, got Eof`, `unexpected token From in
/// expression`, `expected end of input, got Ident("with")` — which named
/// internal token types and, in the Debug forms, leaked the parser's own
/// enum into a message clients read.
///
/// Applied once on the way out, so every construction site is covered and
/// the token named is the one the error itself points at. Messages whose
/// bodies are already PG's verbatim (`LIMIT must not be negative`,
/// `invalid input syntax for type bigint: "abc"`) are left alone — those
/// are PG's own errors, not its syntax error.
fn shape_syntax_error(e: ParseError, input: &str, offsets: &[usize]) -> ParseError {
    if !(e.message.starts_with("expected ") || e.message.starts_with("unexpected token ")) {
        return e;
    }
    let message = match offending_lexeme(input, offsets, e.token_pos) {
        Some(tok) => alloc::format!("syntax error at or near \"{tok}\""),
        None => "syntax error at end of input".into(),
    };
    ParseError {
        message,
        token_pos: e.token_pos,
    }
}

/// v7.39 (round 340, V56) — a lexer-level failure the way PG words it.
/// Measured on 18.4: `unterminated quoted string at or near "'abc"`,
/// `unterminated quoted identifier at or near ""abc"`, `unterminated /*
/// comment at or near "/* x"` — the quoted part runs from the opening
/// delimiter to the end of the input. SPG reported its own internal
/// shape instead (`unterminated string literal at byte 7`), which named
/// a byte offset no client can use.
fn shape_lex_error(e: &lexer::LexError, input: &str) -> ParseError {
    use lexer::LexErrorKind as K;
    let from_here = input.get(e.pos..).map(str::trim_end).unwrap_or("");
    let message = match &e.kind {
        K::UnterminatedString => {
            alloc::format!("unterminated quoted string at or near \"{from_here}\"")
        }
        K::UnterminatedQuotedIdent => {
            alloc::format!("unterminated quoted identifier at or near \"{from_here}\"")
        }
        K::UnterminatedBlockComment => {
            alloc::format!("unterminated /* comment at or near \"{from_here}\"")
        }
        // PG has no "unknown character" error of its own — the character
        // is skipped and the parser reports the next token. SPG stops at
        // the character itself and names it, which is the same shape.
        K::UnknownChar(c) => alloc::format!("syntax error at or near \"{c}\""),
        // The number-literal kinds already carry PG's `at or near` form.
        other => alloc::format!(
            "{}",
            lexer::LexError {
                kind: other.clone(),
                pos: e.pos,
            }
        ),
    };
    ParseError {
        message,
        token_pos: 0,
    }
}

/// The offending token exactly as it appears in the input, or `None` at
/// end of input. PG echoes the source spelling — a lower-case `frm`
/// reports as `frm`, not as a canonicalised keyword.
fn offending_lexeme<'a>(input: &'a str, offsets: &[usize], token_pos: usize) -> Option<&'a str> {
    let start = *offsets.get(token_pos)?;
    if start >= input.len() {
        return None;
    }
    let end = offsets
        .get(token_pos + 1)
        .copied()
        .unwrap_or(input.len())
        .min(input.len());
    let seg = input.get(start..end)?.trim();
    if seg.is_empty() {
        return None;
    }
    // A quoted literal / identifier keeps its inner spaces; anything else
    // ends at the first whitespace (the segment runs to the NEXT token's
    // start, which may swallow a comment).
    if seg.starts_with('\'') || seg.starts_with('"') || seg.starts_with('`') {
        Some(seg)
    } else {
        seg.split_whitespace().next()
    }
}

/// v7.39 (read01 round 95) — recover PG's 1-based CHARACTER error position for
/// a [`ParseError::token_pos`]. Kept off the `ParseError` struct (and so off
/// every recursive `Result` slot) to protect the nesting-budget frame cliff:
/// this re-tokenizes `input` on the cold error path to map the failing token
/// index to its start byte, then to a character offset. `backslash_escapes`
/// must match the parse that produced `token_pos` (it barely shifts offsets,
/// but stay consistent). Returns `None` when the index has no offset or the
/// byte isn't a char boundary. The wire attaches it as the ErrorResponse `P`.
#[must_use]
pub fn syntax_error_position(
    input: &str,
    backslash_escapes: bool,
    token_pos: usize,
) -> Option<usize> {
    let (_, offsets) = lexer::tokenize_with_offsets(input, backslash_escapes).ok()?;
    let byte_off = *offsets.get(token_pos)?;
    if byte_off > input.len() || !input.is_char_boundary(byte_off) {
        return None;
    }
    Some(input[..byte_off].chars().count() + 1)
}

struct Parser {
    tokens: Vec<Token>,
    pos: usize,
    /// v7.39 (round 274) — the session's dialect, carried by the same
    /// signal that drives string-literal escaping: `SET sql_mode` (only
    /// MySQL clients and mysqldump preambles emit it) turns it on,
    /// `SET standard_conforming_strings` (every pg_dump preamble) turns
    /// it off. Needed here because the two dialects disagree about what
    /// `REAL` means — see the type mapping below.
    mysql_dialect: bool,
    /// v7.30.2 (mailrs round-25 ask 2) — live nesting depth of the
    /// mutually recursive expr/select parsers. Bounded so a deeply
    /// nested input returns a parse error instead of overflowing
    /// the stack (embed hosts die on overflow — it is an abort,
    /// not a catchable error).
    nest_depth: usize,
    /// TABLESAMPLE lowering channel: the table-ref parser pushes a
    /// `random() < p/100` predicate here; the enclosing SELECT
    /// drains the list after its WHERE parses and ANDs the
    /// predicates in. parse_bare_select save/restores around its
    /// FROM+WHERE so nested selects only drain their own.
    pending_sample_preds: Vec<Expr>,
    /// v7.39 (round 691) — collation lowering channel, the same shape as
    /// `pending_sample_preds` above. `expr COLLATE "name"` is ORDERING
    /// information, and `ast::OrderBy` is where this parser keeps ordering
    /// information (`desc`, `nulls_first`); the alternative — a new `Expr`
    /// variant — puts a new arm on `eval_expr`, which this repo has
    /// measured to overflow the debug stack. So while an ORDER BY KEY is
    /// being parsed the postfix loop drops the name here instead of
    /// refusing it, and the key's parser takes it.
    ///
    /// Only inside an ORDER BY key: everywhere else an unperformable
    /// collation still errors, because accepting one at a COMPARISON and
    /// ignoring it is the defect F36 exists to close.
    in_order_by_key: bool,
    order_key_collation: Option<String>,
    /// POSITION(sub IN str) — while parsing the needle, the IN
    /// keyword is the argument separator, not a membership test.
    /// The postfix loop leaves IN unconsumed when this is set.
    suppress_in_tail: bool,
    /// Index of the token the last `advance()` returned — see
    /// [`Parser::consumed_pos`].
    last_consumed: usize,
    /// v7.39 (round 506) — the statement's own text and the byte each token
    /// starts at, so a MySQL projection item can report the SOURCE TEXT
    /// MariaDB reports: `SELECT a  +  b` names its column `a  +  b`,
    /// spacing and all. Only filled for a MySQL session — a PG one names
    /// columns from the parsed shape and pays nothing for this.
    src: Option<(String, Vec<usize>)>,
}

/// Max expr/select parser nesting (parens, subqueries, CASE, …).
/// Real SQL nests a few dozen levels at the extreme. Each nesting level
/// costs a parse_expr→parse_unary→parse_atom frame chain, so the budget
/// exists to turn a deep statement into a catchable parse ERROR: a stack
/// overflow is an abort, and in the server it does not fail one query, it
/// takes the process down and every other connection with it.
///
/// v7.39 (round 507) — measured, because the figure here used to be a
/// guess ("over 10 KiB in debug … comfortably inside a 2 MiB worker stack
/// in BOTH debug and release"), and the debug half of that is wrong by
/// more than an order of magnitude:
///
///   * RELEASE, on a 2 MiB worker stack: every recursive shape reaches
///     this budget and errors. Verified against a live server for nested
///     derived tables, parens, calls, CASE, IN-subqueries, scalar
///     subqueries, NOT and unary minus — the server stayed up through all
///     of them. This is the contract that matters, and it holds.
///   * DEBUG: nested derived tables cost roughly 235 KiB of stack PER
///     LEVEL, so parsing alone aborts around 35 levels on an 8 MiB stack
///     and executing aborts around 8 inside a test thread. The budget is
///     simply unreachable there, which is why a deep-nesting test has to
///     ask for a large stack of its own — see `nesting_budget_errors_at`
///     in the parser tests.
/// v7.39 (round 541) — the pg_catalog relations SPG synthesises, in
/// one place.
///
/// There were two copies of this fact: a curated list, used for BARE
/// names, and — in `try_peek_meta_qualified` — no list at all, which
/// rewrote `pg_catalog.<anything>` to `__spg_pg_<anything>` and left
/// the engine to complain about a view it could not materialise. So
/// writing the schema qualifier CHANGED THE ANSWER: `pg_stat_activity`
/// had rows, `pg_catalog.pg_stat_activity` was an error.
///
/// PG puts `pg_catalog` at the implicit front of every search_path, so
/// the two spellings name the same relation and must resolve the same
/// way. Names NOT here (`pg_stat_activity`, `pg_locks`,
/// `pg_stat_statements`, `pg_statio_user_tables`) route through the
/// meta_view_result path under their own names and must not be
/// rewritten; a name that is neither reaches the ordinary resolver,
/// which reports that the relation does not exist — PG's answer.
const SYNTHESISED_PG_CATALOGS: &[&str] = &[
    "pg_am",
    "pg_attrdef",
    "pg_attribute",
    "pg_cast",
    "pg_db_role_setting",
    "pg_conversion",
    "pg_default_acl",
    "pg_shadow",
    "pg_sequences",
    "pg_range",
    "pg_partitioned_table",
    "pg_language",
    "pg_group",
    "pg_authid",
    "pg_class",
    "pg_collation",
    "pg_constraint",
    "pg_database",
    "pg_depend",
    // v7.39 (read01 round 50) — COMMENT ON store, PG's pg_description.
    "pg_description",
    "pg_enum",
    "pg_extension",
    // v7.39 (round 541) — pg_dump reads it for every relation of kind
    // 'f'. SPG has no foreign tables, so it is empty, which is also
    // what PG reports on a database that has none.
    "pg_foreign_table",
    // v7.39 (round 541) — the empty-by-truth family; see
    // EMPTY_PG_CATALOGS in spg-engine::system_catalog.
    "pg_event_trigger",
    "pg_file_settings",
    "pg_foreign_data_wrapper",
    "pg_foreign_server",
    "pg_hba_file_rules",
    "pg_ident_file_mappings",
    "pg_init_privs",
    "pg_parameter_acl",
    "pg_prepared_xacts",
    "pg_publication_namespace",
    "pg_publication_rel",
    "pg_publication_tables",
    "pg_replication_origin",
    "pg_replication_origin_status",
    "pg_seclabel",
    "pg_seclabels",
    "pg_shdepend",
    "pg_shdescription",
    "pg_shmem_allocations",
    "pg_shmem_allocations_numa",
    "pg_shseclabel",
    "pg_statistic_ext_data",
    "pg_stats_ext",
    "pg_stats_ext_exprs",
    "pg_subscription_rel",
    "pg_transform",
    "pg_user_mapping",
    "pg_user_mappings",
    "pg_index",
    "pg_indexes",
    "pg_inherits",
    // v7.39 (round 650) — the text-search catalogs SPG can fill
    // honestly. `pg_ts_config_map` is deliberately NOT here: it maps
    // token types to dictionaries and SPG has no token-type model,
    // the same gap that leaves `ts_token_type` / `ts_debug` unbuilt.
    "pg_ts_config",
    "pg_ts_config_map",
    "pg_ts_dict",
    "pg_ts_parser",
    "pg_ts_template",
    "pg_matviews",
    "pg_namespace",
    // v7.39 (round 621)
    "pg_operator",
    "pg_policies",
    "pg_policy",
    "pg_proc",
    "pg_publication",
    "pg_replication_slots",
    "pg_roles",
    // v7.39 (round 143) — the rewrite-rule listing view.
    // v7.39 (round 312) — and the rule catalogue itself, which
    // `pg_get_ruledef(oid)` resolves against.
    "pg_rewrite",
    "pg_rules",
    "pg_sequence",
    "pg_settings",
    "pg_stat_archiver",
    "pg_stat_bgwriter",
    "pg_stat_checkpointer",
    "pg_stat_database",
    "pg_stat_io",
    "pg_stat_progress_analyze",
    "pg_auth_members",
    "pg_stat_progress_create_index",
    "pg_stat_progress_vacuum",
    "pg_stat_replication",
    "pg_stat_slru",
    "pg_stat_subscription_stats",
    "pg_stat_user_functions",
    "pg_stat_user_indexes",
    "pg_stat_user_tables",
    "pg_stat_wal",
    "pg_prepared_statements",
    "pg_largeobject",
    "pg_largeobject_metadata",
    "pg_statistic",
    "pg_statistic_ext",
    "pg_subscription",
    "pg_tables",
    "pg_tablespace",
    // v7.39 (round 502) — the timezone catalogues. SPG resolved
    // named zones correctly but could not list them, so a client
    // populating a timezone picker got "relation does not exist".
    "pg_timezone_abbrevs",
    "pg_timezone_names",
    "pg_trigger",
    "pg_type",
    "pg_user",
    "pg_views",
];

const MAX_NEST_DEPTH: usize = 64;

/// Stack accounting for the nesting budget, test-only.
///
/// `MAX_NEST_DEPTH` is a fixed count calibrated against a frame size
/// that MOVES: a compiler upgrade grew the parser's debug frames and
/// silently ate the margin until `nesting_budget_errors_cleanly` went
/// from erroring cleanly to aborting on a stack overflow. A count
/// cannot notice that on its own, so the budget is measured here and
/// held to a ceiling.
///
/// The reading has to come from a helper whose OWN frame is the same at
/// every call: debug slot placement does not follow source order, so a
/// local's address inside the function under test is not that
/// function's frame boundary. Two earlier probes were wrong that way —
/// one read `&self.nest_depth`, which is the `Parser`'s address and
/// never moves at all.
#[cfg(test)]
mod frame_meter {
    extern crate std;
    use std::cell::Cell;

    // Per-THREAD, not global. `cargo test` runs tests in parallel and
    // plenty of them parse nested expressions, so shared statics get
    // stack addresses from several threads at once and the subtraction
    // below turns into noise — it read 229,772 bytes per level that way,
    // while passing when the test was run on its own.
    std::thread_local! {
        static AT_LO: Cell<usize> = const { Cell::new(0) };
        static AT_HI: Cell<usize> = const { Cell::new(0) };
    }

    pub(super) const SAMPLE_LO: usize = 4;
    pub(super) const SAMPLE_HI: usize = 24;

    #[inline(never)]
    pub(super) fn record(depth: usize) {
        let anchor = 0u8;
        let at = core::ptr::from_ref(&anchor) as usize;
        if depth == SAMPLE_LO {
            AT_LO.with(|c| c.set(at));
        } else if depth == SAMPLE_HI {
            AT_HI.with(|c| c.set(at));
        }
    }

    /// Bytes of stack one nesting level costs, averaged over the span.
    pub(super) fn bytes_per_level() -> usize {
        let lo = AT_LO.with(Cell::get);
        let hi = AT_HI.with(Cell::get);
        assert!(lo > 0 && hi > 0, "meter never sampled: lo={lo} hi={hi}");
        assert!(lo > hi, "stack grew upwards? lo={lo} hi={hi}");
        (lo - hi) / (SAMPLE_HI - SAMPLE_LO)
    }

    pub(super) fn reset() {
        AT_LO.with(|c| c.set(0));
        AT_HI.with(|c| c.set(0));
    }
}

/// v7.39 (read01 geo_ops.c) — prefix `@@` desugar target, out-of-line so
/// the constructor's temporaries stay off `parse_unary`'s recursion frame.
#[inline(never)]
fn build_center_call(e: Expr) -> Expr {
    Expr::FunctionCall {
        name: alloc::string::String::from("center"),
        args: alloc::vec![e],
    }
}

/// Max consecutive binary operators at ONE precedence level
/// (`a OR b OR c …`, `1+1+1…`). The chain builds iteratively at
/// parse time but evaluates and drops recursively — depth beyond
/// this overflows 2 MiB worker stacks (debug eval frames run
/// multiple KiB). `IN (…)` lists are flat and unaffected.
const MAX_BINARY_CHAIN: usize = 256;

/// v7.22 (round-13 gap 5) — the kind keyword after `CONSTRAINT
/// <name>` in a CREATE TABLE column list. FOREIGN KEY is not here:
/// it keeps its dedicated path (`parse_table_level_fk`).
enum NamedTableConstraintKind {
    Check,
    Unique,
    PrimaryKey,
    Exclude,
}

impl Parser {
    fn new(tokens: Vec<Token>) -> Self {
        Self::new_with_dialect(tokens, false)
    }

    fn new_with_dialect(tokens: Vec<Token>, mysql_dialect: bool) -> Self {
        Self {
            tokens,
            mysql_dialect,
            in_order_by_key: false,
            order_key_collation: None,
            pos: 0,
            nest_depth: 0,
            pending_sample_preds: Vec::new(),
            suppress_in_tail: false,
            last_consumed: 0,
            src: None,
        }
    }

    /// Hand the parser the text it is parsing, for [`Parser::source_span`].
    fn with_source(mut self, input: &str, offsets: &[usize]) -> Self {
        if self.mysql_dialect {
            self.src = Some((input.to_string(), offsets.to_vec()));
        }
        self
    }

    /// The source text spanning tokens `start ..= end`, trimmed.
    ///
    /// The offsets are token STARTS, so the span runs to the start of the
    /// token after `end` and gives back the whitespace between them —
    /// trimming is what makes `a + b FROM t` end at `b`.
    fn source_span(&self, start: usize, end: usize) -> Option<&str> {
        let (text, offsets) = self.src.as_ref()?;
        let from = *offsets.get(start)?;
        let to = *offsets.get(end + 1)?;
        text.get(from..to).map(str::trim_end)
    }

    /// v7.30.2 (mailrs round-25 ask 2) — bump the expr/select
    /// nesting depth, erroring out cleanly past the budget.
    fn enter_nested(&mut self) -> Result<(), ParseError> {
        self.nest_depth += 1;
        #[cfg(test)]
        frame_meter::record(self.nest_depth);
        if self.nest_depth > MAX_NEST_DEPTH {
            self.nest_depth -= 1;
            return Err(self.err(alloc::format!(
                "statement nests deeper than {MAX_NEST_DEPTH} levels"
            )));
        }
        Ok(())
    }

    fn peek(&self) -> &Token {
        // tokens always ends with Eof; pos is clamped in advance().
        &self.tokens[self.pos]
    }

    fn advance(&mut self) -> Token {
        let t = mem::replace(&mut self.tokens[self.pos], Token::Eof);
        self.last_consumed = self.pos;
        if self.pos + 1 < self.tokens.len() {
            self.pos += 1;
        }
        t
    }

    /// v7.39 (round 340, V56) — the index of the token `advance()` just
    /// returned. It was computed as `pos - 1`, which is wrong at both
    /// ends: `advance()` parks on the final Eof rather than running off
    /// the end (so `SELECT * FROM` named `FROM` where PG says `at end of
    /// input`), and after backtracking `pos` is no longer one past the
    /// token that failed. Recorded by `advance()` itself instead.
    const fn consumed_pos(&self) -> usize {
        self.last_consumed
    }

    fn err(&self, message: String) -> ParseError {
        ParseError {
            message,
            token_pos: self.pos,
        }
    }

    fn expect_eof(&self) -> Result<(), ParseError> {
        if matches!(self.peek(), Token::Eof) {
            Ok(())
        } else {
            Err(self.err(format!("expected end of input, got {:?}", self.peek())))
        }
    }

    /// v7.14.0 — swallow every token up to (but not including) the
    /// next semicolon / EOF. Used by the dump-noise dispatcher
    /// to consume `COMMENT ON …`, `GRANT …`, `LOCK TABLES …`,
    /// etc. without modeling each grammar.
    /// v7.39 (read01 round 50) — `COMMENT ON <kind> <name> IS { 'text' | NULL }`.
    /// Kinds SPG stores by name: TABLE / COLUMN / INDEX / VIEW / SEQUENCE /
    /// SCHEMA / TYPE / DATABASE / FUNCTION. Anything else (and the multi-word
    /// `CONSTRAINT c ON t` / `MATERIALIZED VIEW` forms) keeps the old
    /// swallow-as-no-op behaviour so a pg_dump tail still loads.
    fn parse_comment_on(&mut self) -> Result<Statement, ParseError> {
        let start = self.pos;
        self.advance(); // COMMENT
        if !matches!(self.peek(), Token::On) {
            self.pos = start;
            self.consume_until_statement_boundary();
            return Ok(Statement::Empty);
        }
        self.advance(); // ON
        let kind = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
            Token::Table => "table".into(),
            _ => {
                self.consume_until_statement_boundary();
                return Ok(Statement::Empty);
            }
        };
        if !matches!(
            kind.as_str(),
            "table"
                | "column"
                | "index"
                | "view"
                | "sequence"
                | "schema"
                | "type"
                | "database"
                | "function"
        ) {
            self.consume_until_statement_boundary();
            return Ok(Statement::Empty);
        }
        self.advance(); // the kind keyword
        // The object name. ⚠️ `expect_ident_like` strips a leading
        // `<schema>.` qualifier and returns only the trailing ident (SPG is
        // single-schema), which would turn `COMMENT ON COLUMN t.c` into just
        // `c`. Read the dotted parts from raw tokens instead, then let a
        // 3-part `schema.t.c` drop its leading schema like everywhere else.
        let mut parts: alloc::vec::Vec<String> = alloc::vec::Vec::new();
        loop {
            match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => parts.push(s),
                other if unreserved_keyword_text(&other).is_some() => {
                    parts.push(unreserved_keyword_text(&other).unwrap());
                }
                other => {
                    return Err(ParseError {
                        message: alloc::format!("expected identifier, got {other:?}"),
                        token_pos: self.consumed_pos(),
                    });
                }
            }
            if matches!(self.peek(), Token::Dot) {
                self.advance();
            } else {
                break;
            }
        }
        // COLUMN wants `table.column`; every other kind wants a bare name.
        let want = if kind == "column" { 2 } else { 1 };
        while parts.len() > want {
            parts.remove(0);
        }
        let name = parts.join(".");
        // v7.39 (round 710) — `COMMENT ON FUNCTION f(int, text) IS …`.
        // pg_dump writes the SIGNATURE, and the paren list was a syntax
        // error here — a dump carrying one function comment failed to
        // restore. The list is consumed (the comment store keys by name;
        // overload-precise comments are the function-predicate follow-up).
        if matches!(self.peek(), Token::LParen)
            && matches!(
                kind.as_str(),
                "function" | "procedure" | "aggregate" | "routine"
            )
        {
            let mut depth = 0usize;
            loop {
                match self.advance() {
                    Token::LParen => depth += 1,
                    Token::RParen => {
                        depth -= 1;
                        if depth == 0 {
                            break;
                        }
                    }
                    Token::Eof => {
                        return Err(self.err(alloc::string::String::from(
                            "unterminated argument list in COMMENT ON",
                        )));
                    }
                    _ => {}
                }
            }
        }
        // `IS`
        if !matches!(self.peek(), Token::Is) {
            self.expect_keyword_ident("is")?;
        } else {
            self.advance();
        }
        let comment = match self.peek() {
            Token::Null => {
                self.advance();
                None
            }
            _ => Some(self.expect_string_literal()?),
        };
        Ok(Statement::CommentOn {
            kind,
            name,
            comment,
        })
    }

    /// v7.39 (read01 round 57) — `GRANT <privs> ON <obj> TO <roles> [WITH GRANT
    /// OPTION]` / `REVOKE [GRANT OPTION FOR] <privs> ON <obj> FROM <roles>
    /// [CASCADE|RESTRICT]`.
    ///
    /// TABLE privileges are the real ones (stored, enforced, introspectable).
    /// Every other object class — SCHEMA / SEQUENCE / DATABASE / FUNCTION / …,
    /// and the no-ON `GRANT role TO role` membership form — parses into
    /// `GrantObject::Other` and no-ops in the engine, so a pg_dump that grants
    /// on them still restores.
    fn parse_grant_or_revoke(&mut self, grant: bool) -> Result<Statement, ParseError> {
        self.advance(); // GRANT / REVOKE
        // REVOKE's optional `GRANT OPTION FOR` prefix.
        let mut grant_option = false;
        if !grant
            && self.peek_keyword_ident("grant")
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("option"))
        {
            self.advance(); // GRANT
            self.advance(); // OPTION
            self.expect_keyword_ident("for")?;
            grant_option = true;
        }
        // The privilege list: `ALL [PRIVILEGES] [(cols)]`, or comma-separated
        // words each with an optional COLUMN list.
        let mut privileges: Vec<GrantPriv> = Vec::new();
        if matches!(self.peek(), Token::All) {
            self.advance();
            if self.peek_keyword_ident("privileges") {
                self.advance();
            }
            // `GRANT ALL (col) ON t TO r` — every column privilege, on that
            // column only.
            if matches!(self.peek(), Token::LParen) {
                let columns = self.parse_grant_column_list()?;
                privileges.push(GrantPriv {
                    word: "ALL".into(),
                    columns,
                });
            }
        } else {
            loop {
                // SELECT and INSERT lex as reserved tokens, so they never
                // reach `expect_ident_like` as plain idents; the rest
                // (UPDATE / DELETE / TRUNCATE / REFERENCES / TRIGGER /
                // MAINTAIN) are ordinary identifiers.
                let w = match self.peek() {
                    Token::Select => {
                        self.advance();
                        "SELECT".to_string()
                    }
                    Token::Insert => {
                        self.advance();
                        "INSERT".to_string()
                    }
                    // v7.39 (read01 round 60) — CREATE is a privilege word on a
                    // schema / database, and it lexes as a reserved token.
                    Token::Create => {
                        self.advance();
                        "CREATE".to_string()
                    }
                    // NOT upper-cased: in the no-ON shape (`GRANT devs TO
                    // alice`) these "privilege words" are ROLE NAMES, and a
                    // role name is case-sensitive. `priv_from_word` folds case
                    // itself when they really are privileges.
                    _ => self.expect_ident_like()?,
                };
                // v7.39 (read01 round 59) — the optional per-privilege COLUMN
                // list: `GRANT SELECT (a, b), INSERT (c) ON t TO dan`.
                let columns = if matches!(self.peek(), Token::LParen) {
                    self.parse_grant_column_list()?
                } else {
                    Vec::new()
                };
                privileges.push(GrantPriv { word: w, columns });
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                } else {
                    break;
                }
            }
        }
        // v7.39 (read01 round 58) — no ON clause at all = `GRANT devs TO alice`:
        // role MEMBERSHIP. The words parsed as "privileges" are the role names.
        if !matches!(self.peek(), Token::On) {
            let roles: Vec<String> = core::mem::take(&mut privileges)
                .into_iter()
                .map(|p| p.word)
                .collect();
            let grantees = self.parse_grantee_list(grant)?;
            // `WITH ADMIN OPTION` / `GRANTED BY x` — accepted, ignored (SPG has
            // no admin-option layer: a member cannot re-grant).
            self.consume_until_statement_boundary();
            return Ok(finish_grant(
                grant,
                GrantStatement {
                    privileges: Vec::new(),
                    object: GrantObject::Roles(roles),
                    grantees,
                    grant_option,
                },
            ));
        }
        self.advance(); // ON
        // An optional object-class keyword. `TABLE` (or no keyword at all) is
        // the enforced case; anything else parses and no-ops.
        let mut class = "TABLE";
        match self.peek() {
            Token::Table => {
                self.advance();
            }
            Token::All => {
                // v7.39 (read01 round 61) — `ALL TABLES IN SCHEMA x` expands to
                // every table at GRANT time, like PG. `ALL SEQUENCES/FUNCTIONS
                // IN SCHEMA` stay no-ops and keep their own object class.
                self.advance(); // ALL
                let kind = match self.peek() {
                    Token::Ident(w) | Token::QuotedIdent(w) => w.to_ascii_lowercase(),
                    // TABLES has its own token (SHOW TABLES owns it).
                    Token::Tables | Token::Table => "tables".to_string(),
                    _ => String::new(),
                };
                if !kind.is_empty() {
                    self.advance();
                }
                // `IN SCHEMA <name>`
                if matches!(self.peek(), Token::In) {
                    self.advance();
                    if self.peek_keyword_ident("schema") {
                        self.advance();
                        let _schema = self.expect_ident_like()?;
                    }
                }
                if kind != "tables" {
                    self.consume_until_statement_boundary();
                    return Ok(finish_grant(
                        grant,
                        GrantStatement {
                            privileges,
                            object: GrantObject::Other("ALL … IN SCHEMA".into()),
                            grantees: Vec::new(),
                            grant_option,
                        },
                    ));
                }
                let grantees = self.parse_grantee_list(grant)?;
                self.consume_until_statement_boundary();
                return Ok(finish_grant(
                    grant,
                    GrantStatement {
                        privileges,
                        object: GrantObject::AllTablesInSchema,
                        grantees,
                        grant_option,
                    },
                ));
            }
            Token::Ident(w) | Token::QuotedIdent(w) => {
                let lc = w.to_ascii_lowercase();
                // v7.39 (read01 round 60) — SEQUENCE / SCHEMA / DATABASE are
                // real objects with real ACLs now.
                if matches!(lc.as_str(), "sequence" | "schema" | "database") {
                    self.advance();
                    let mut names: Vec<String> = Vec::new();
                    loop {
                        let mut parts: Vec<String> = Vec::new();
                        loop {
                            parts.push(self.expect_ident_like()?);
                            if matches!(self.peek(), Token::Dot) {
                                self.advance();
                            } else {
                                break;
                            }
                        }
                        names.push(parts.pop().expect("at least one part"));
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                        } else {
                            break;
                        }
                    }
                    let grantees = self.parse_grantee_list(grant)?;
                    let mut grant_option = grant_option;
                    if grant && self.peek_keyword_ident("with") {
                        self.advance();
                        self.expect_keyword_ident("grant")?;
                        self.expect_keyword_ident("option")?;
                        grant_option = true;
                    }
                    self.consume_until_statement_boundary();
                    let object = match lc.as_str() {
                        "sequence" => GrantObject::Sequences(names),
                        "schema" => GrantObject::Schemas(names),
                        _ => GrantObject::Databases(names),
                    };
                    return Ok(finish_grant(
                        grant,
                        GrantStatement {
                            privileges,
                            object,
                            grantees,
                            grant_option,
                        },
                    ));
                }
                // v7.39 (read01 round 61) — `ON FUNCTION f(int)` is real. SPG
                // keys functions by NAME, so the argument list parses and is
                // dropped (an overload set shares one ACL — recorded residual).
                if matches!(lc.as_str(), "function" | "procedure" | "routine") {
                    self.advance();
                    let mut names: Vec<(String, Option<Vec<String>>)> = Vec::new();
                    loop {
                        let mut parts: Vec<String> = Vec::new();
                        loop {
                            parts.push(self.expect_ident_like()?);
                            if matches!(self.peek(), Token::Dot) {
                                self.advance();
                            } else {
                                break;
                            }
                        }
                        let fname = parts.pop().expect("at least one part");
                        // v7.39 (read01 round 62) — the signature picks the
                        // overload, so it is captured.
                        let sig = if matches!(self.peek(), Token::LParen) {
                            Some(self.parse_function_signature_types()?)
                        } else {
                            None
                        };
                        names.push((fname, sig));
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                        } else {
                            break;
                        }
                    }
                    let grantees = self.parse_grantee_list(grant)?;
                    self.consume_until_statement_boundary();
                    return Ok(finish_grant(
                        grant,
                        GrantStatement {
                            privileges,
                            object: GrantObject::Functions(names),
                            grantees,
                            grant_option,
                        },
                    ));
                }
                if matches!(
                    lc.as_str(),
                    "type"
                        | "domain"
                        | "language"
                        | "tablespace"
                        | "large"
                        | "foreign"
                        | "parameter"
                ) {
                    self.consume_until_statement_boundary();
                    return Ok(finish_grant(
                        grant,
                        GrantStatement {
                            privileges,
                            object: GrantObject::Other(lc.to_ascii_uppercase()),
                            grantees: Vec::new(),
                            grant_option,
                        },
                    ));
                }
                class = "TABLE";
            }
            _ => {}
        }
        let _ = class;
        // The table list. Schema-qualified names drop their qualifier (SPG is
        // single-schema) — but read the dotted parts from raw tokens, since
        // `expect_ident_like` would silently swallow the leading part.
        let mut tables: Vec<String> = Vec::new();
        loop {
            let mut parts: Vec<String> = Vec::new();
            loop {
                parts.push(self.expect_ident_like()?);
                if matches!(self.peek(), Token::Dot) {
                    self.advance();
                } else {
                    break;
                }
            }
            tables.push(parts.pop().expect("at least one part"));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        let grantees = self.parse_grantee_list(grant)?;
        if grant && self.peek_keyword_ident("with") {
            self.advance();
            self.expect_keyword_ident("grant")?;
            self.expect_keyword_ident("option")?;
            grant_option = true;
        }
        // REVOKE's trailing CASCADE / RESTRICT — SPG has no dependent grants
        // to cascade to (no re-granting), so both are accepted and ignored.
        if !grant && (self.peek_keyword_ident("cascade") || self.peek_keyword_ident("restrict")) {
            self.advance();
        }
        Ok(finish_grant(
            grant,
            GrantStatement {
                privileges,
                object: GrantObject::Tables(tables),
                grantees,
                grant_option,
            },
        ))
    }

    /// v7.39 (read01 round 62) — the argument TYPES in a function signature:
    /// `(int, text)` or `(x int, y text)` (PG accepts either). Returns the type
    /// words; the caller normalises them into a signature key.
    fn parse_function_signature_types(&mut self) -> Result<Vec<String>, ParseError> {
        self.advance(); // (
        let mut types: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::RParen) {
            self.advance();
            return Ok(types);
        }
        loop {
            // Collect the words of one argument up to a comma / close paren.
            let mut words: Vec<String> = Vec::new();
            loop {
                match self.peek() {
                    Token::Comma | Token::RParen | Token::Eof => break,
                    _ => {}
                }
                let tok = self.advance();
                match tok {
                    Token::Ident(w) | Token::QuotedIdent(w) => words.push(w),
                    other => {
                        if let Some(w) = unreserved_keyword_text(&other) {
                            words.push(w);
                        }
                    }
                }
            }
            // `name TYPE` or a bare `TYPE`. Several of PG's type names are
            // themselves several words (`double precision`, `character
            // varying`, `timestamp with time zone`), so "two words means the
            // first is a parameter name" reads the type off `f(double
            // precision)` as `precision`. v7.39 (round 282): recognise the
            // multi-word spellings first — a leading word that STARTS one of
            // them is part of the type, not a name.
            let joined = words.join(" ");
            let ty = if words.len() >= 2 && is_multiword_type_phrase(&joined) {
                joined
            } else if words.len() >= 2 {
                words[1..].join(" ")
            } else {
                words.first().cloned().unwrap_or_default()
            };
            types.push(ty);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        if matches!(self.peek(), Token::RParen) {
            self.advance();
        }
        Ok(types)
    }

    /// v7.39 (read01 round 59) — `( col, col, … )` after a privilege word.
    fn parse_grant_column_list(&mut self) -> Result<Vec<String>, ParseError> {
        self.advance(); // (
        let mut cols = Vec::new();
        loop {
            cols.push(self.expect_ident_like()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close the column list, got {:?}",
                self.peek()
            )));
        }
        self.advance(); // )
        Ok(cols)
    }

    /// `TO <roles>` (grant) / `FROM <roles>` (revoke). An empty-string entry is
    /// PUBLIC.
    fn parse_grantee_list(&mut self, grant: bool) -> Result<Vec<String>, ParseError> {
        if grant {
            if matches!(self.peek(), Token::To) {
                self.advance();
            } else {
                self.expect_keyword_ident("to")?;
            }
        } else if matches!(self.peek(), Token::From) {
            self.advance();
        } else {
            self.expect_keyword_ident("from")?;
        }
        let mut grantees: Vec<String> = Vec::new();
        loop {
            // `GROUP name` is the legacy spelling of a plain role name.
            if self.peek_keyword_ident("group") {
                self.advance();
            }
            if self.peek_keyword_ident("public") {
                self.advance();
                grantees.push(String::new()); // PUBLIC
            } else {
                grantees.push(self.expect_ident_like()?);
            }
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        Ok(grantees)
    }

    /// v7.39 (round 277) — `PREPARE <name> [(type, …)] AS <statement>`.
    /// The body keeps its `$N` placeholders; substitution happens at
    /// EXECUTE. The declared types are recorded for
    /// `pg_prepared_statements.parameter_types` but are not enforced —
    /// PG infers when the list is omitted, and SPG resolves the values
    /// at substitution time either way.
    fn parse_prepare(&mut self) -> Result<Statement, ParseError> {
        let start = self.pos;
        self.advance(); // PREPARE
        // v7.39 (round 278) — `PREPARE TRANSACTION '<gid>'` is 2PC, a
        // different statement that happens to share the keyword. PG
        // ships with `max_prepared_transactions = 0` and reports it
        // this way; SPG has no prepared-transaction registry, so the
        // same wording is the accurate answer rather than a dodge.
        // Round 277 turned this from a silent no-op into a confusing
        // "expected AS in PREPARE" parse error.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("transaction")) {
            self.advance();
            let gid = match self.advance() {
                Token::String(g) => g,
                other => {
                    return Err(self.err(alloc::format!(
                        "expected a transaction identifier after PREPARE TRANSACTION, got {other:?}"
                    )));
                }
            };
            return Ok(Statement::PrepareTransaction(gid));
        }
        let name = self.expect_ident_like()?;
        let mut param_types = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                let mut ty = self.expect_ident_like()?;
                // A parameterised type name (`numeric(10,2)`,
                // `varchar(20)`) keeps its argument list in the text.
                if matches!(self.peek(), Token::LParen) {
                    let mut depth = 0usize;
                    let mut buf = String::from("(");
                    loop {
                        match self.advance() {
                            Token::LParen => {
                                depth += 1;
                                if depth > 1 {
                                    buf.push('(');
                                }
                            }
                            Token::RParen => {
                                depth -= 1;
                                buf.push(')');
                                if depth == 0 {
                                    break;
                                }
                            }
                            Token::Comma => buf.push(','),
                            Token::Integer(n) => buf.push_str(&alloc::format!("{n}")),
                            Token::Eof => break,
                            _ => {}
                        }
                    }
                    ty.push_str(&buf);
                }
                // r1049 — `PREPARE p(bigint[]) AS …`: the sixth `[]`
                // position, same family as the parameter list above.
                let array_suffix = self.consume_array_suffix();
                ty.push_str(&array_suffix);
                param_types.push(ty);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in PREPARE parameter list, got {other:?}"
                        )));
                    }
                }
            }
        }
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS in PREPARE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let body = self.parse_one_statement()?;
        // The Parser holds tokens, not the source text, so the
        // statement PG reports in `pg_prepared_statements.statement`
        // is rebuilt from the AST rather than sliced from the input.
        let _ = start;
        let mut source = alloc::format!("PREPARE {}", crate::ast::quote_ident(&name));
        if !param_types.is_empty() {
            source.push_str(" (");
            source.push_str(&param_types.join(", "));
            source.push(')');
        }
        source.push_str(" AS ");
        source.push_str(&alloc::format!("{body}"));
        Ok(Statement::Prepare {
            name,
            param_types,
            body: alloc::boxed::Box::new(body),
            source,
        })
    }

    /// v7.39 (round 277) — `EXECUTE <name> [(<expr>, …)]`.
    fn parse_execute(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // EXECUTE
        let name = self.expect_ident_like()?;
        let mut args = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            if matches!(self.peek(), Token::RParen) {
                self.advance();
            } else {
                loop {
                    args.push(self.parse_expr(0)?);
                    match self.advance() {
                        Token::Comma => {}
                        Token::RParen => break,
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected ',' or ')' in EXECUTE arguments, got {other:?}"
                            )));
                        }
                    }
                }
            }
        }
        Ok(Statement::Execute { name, args })
    }

    /// v7.39 (round 277) — `DEALLOCATE {[PREPARE] <name> | ALL}`.
    /// v7.39 (round 278) — `CALL <proc>([args])`. There is no
    /// procedure catalog yet, so this reports PG's not-found error
    /// (with its HINT) rather than pretending the call ran.
    /// v7.39 (round 320, V53) — `DISCARD { ALL | PLANS | SEQUENCES | TEMP }`.
    /// Bare `DISCARD` is a syntax error in PG; so it is here.
    fn parse_discard(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // DISCARD
        let target = match self.advance() {
            Token::All => DiscardTarget::All,
            Token::Ident(w) | Token::QuotedIdent(w) => match w.to_ascii_lowercase().as_str() {
                "all" => DiscardTarget::All,
                "plans" => DiscardTarget::Plans,
                "sequences" => DiscardTarget::Sequences,
                "temp" | "temporary" => DiscardTarget::Temp,
                other => {
                    return Err(self.err(format!(
                        "expected ALL / PLANS / SEQUENCES / TEMP after DISCARD, got {other:?}"
                    )));
                }
            },
            other => {
                return Err(self.err(format!(
                    "expected ALL / PLANS / SEQUENCES / TEMP after DISCARD, got {other:?}"
                )));
            }
        };
        Ok(Statement::Discard(target))
    }

    /// v7.39 (round 318, V51) — MySQL `KILL [HARD|SOFT] [CONNECTION|QUERY]
    /// <expr>`. MariaDB accepts an expression for the id (its own docs use
    /// `KILL connection_id()`), and the HARD / SOFT prefixes only pick how
    /// aggressively the server interrupts, which SPG does not distinguish.
    /// Bare `KILL <id>` means CONNECTION.
    fn parse_kill(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // KILL
        let mut query_only = false;
        loop {
            // CONNECTION is a reserved keyword token (it also opens
            // `CREATE SUBSCRIPTION … CONNECTION '…'`), so it arrives as
            // `Token::Connection` rather than a bare ident.
            if matches!(self.peek(), Token::Connection) {
                self.advance();
                break;
            }
            let (Token::Ident(w) | Token::QuotedIdent(w)) = self.peek() else {
                break;
            };
            match w.to_ascii_lowercase().as_str() {
                "hard" | "soft" => {
                    self.advance();
                }
                "query" => {
                    self.advance();
                    query_only = true;
                    break;
                }
                _ => break,
            }
        }
        let id = self.parse_expr(0)?;
        Ok(Statement::Kill {
            query_only,
            id: Box::new(id),
        })
    }

    fn parse_call(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // CALL
        let name = self.expect_ident_like()?;
        self.consume_until_statement_boundary();
        Ok(Statement::Call(name))
    }

    fn parse_deallocate(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // DEALLOCATE
        // PG accepts an optional noise `PREPARE` keyword here.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("prepare")) {
            self.advance();
        }
        if matches!(self.peek(), Token::All) {
            self.advance();
            return Ok(Statement::Deallocate(None));
        }
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("all")) {
            self.advance();
            return Ok(Statement::Deallocate(None));
        }
        let name = self.expect_ident_like()?;
        Ok(Statement::Deallocate(Some(name)))
    }

    fn consume_until_statement_boundary(&mut self) {
        loop {
            match self.peek() {
                Token::Semicolon | Token::Eof => return,
                _ => self.advance(),
            };
        }
    }

    /// v7.22 (round-13 T2) — consume to the statement boundary like
    /// `consume_until_statement_boundary`, but pick out the sequence
    /// name on the way: either `SEQUENCE NAME <ident>` (identity
    /// columns) or the first string literal (`nextval('<seq>')`).
    /// Schema qualifiers and `::regclass` casts are stripped.
    fn scan_sequence_name_until_boundary(&mut self) -> Option<String> {
        let mut seq: Option<String> = None;
        let mut after_sequence_kw = false;
        let mut after_name_kw = false;
        loop {
            match self.peek().clone() {
                Token::Semicolon | Token::Eof => break,
                Token::Ident(s) | Token::QuotedIdent(s) => {
                    if after_name_kw && seq.is_none() {
                        self.advance();
                        let mut name = s;
                        // `SEQUENCE NAME public.groups_id_seq` — keep
                        // the bare name, drop qualifiers.
                        while matches!(self.peek(), Token::Dot) {
                            self.advance();
                            if let Token::Ident(n) | Token::QuotedIdent(n) = self.advance() {
                                name = n;
                            }
                        }
                        seq = Some(name);
                        after_name_kw = false;
                        continue;
                    }
                    if after_sequence_kw && s.eq_ignore_ascii_case("name") {
                        after_name_kw = true;
                        after_sequence_kw = false;
                    } else {
                        after_sequence_kw = s.eq_ignore_ascii_case("sequence");
                    }
                    self.advance();
                }
                Token::String(s) => {
                    if seq.is_none() {
                        // `nextval('public.groups_id_seq'::regclass)`
                        let bare = s
                            .rsplit_once('.')
                            .map_or_else(|| s.clone(), |(_, b)| b.to_string());
                        seq = Some(bare);
                    }
                    self.advance();
                }
                _ => {
                    after_sequence_kw = false;
                    after_name_kw = false;
                    self.advance();
                }
            }
        }
        seq
    }

    /// v7.39 (round 621) — is the next token the keyword `BY`?
    ///
    /// `pg_get_keywords()` classes `by` as `U` (unreserved), so it is a legal
    /// column, table and alias name — and SPG lexed it into a dedicated
    /// `Token::By`, which made it unusable as a name ANYWHERE. Of the seven
    /// two-letter keywords the lexer knew, this was the only one PG leaves
    /// unreserved (`as`, `in`, `on`, `or`, `to` are reserved and `is` is `T`).
    ///
    /// The token is gone; the three clauses that own the word — GROUP BY,
    /// ORDER BY, PARTITION BY — and the handful of other places that expect it
    /// ask this instead. Adding it to the unreserved-identifier table was not
    /// enough on its own: identifier positions that match the token shape
    /// directly (an index's column list, a table alias) never consult that
    /// table, so `CREATE INDEX … ON t(by)` and `FROM t AS by` still failed.
    /// Not lexing it as a keyword closes the whole class rather than the two
    /// positions that happened to be noticed.
    fn peek_is_by(&self) -> bool {
        matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("by"))
    }

    /// v7.39 (round 621) — the optional `CASCADE` / `RESTRICT` trailer a DROP
    /// takes. Accepted and dropped: SPG tracks no dependents to cascade to,
    /// which is what `DROP TABLE` and `DROP INDEX` have done since v7.14.
    fn consume_drop_behaviour(&mut self) {
        if matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("cascade") || s.eq_ignore_ascii_case("restrict")
        ) {
            self.advance();
        }
    }

    fn expect_ident_like(&mut self) -> Result<String, ParseError> {
        let first = match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) => s,
            // v7.37.43-T4 — PG-unreserved keywords are legal identifiers
            // per PG's `pg_get_keywords()` classification. SPG tokenizes
            // these as named variants for parsing leverage in the
            // contexts that own them (`RELEASE SAVEPOINT`, `SHOW name`,
            // `BEGIN`, etc.), but they MUST still be usable as table /
            // column / alias names in DDL+DML. Sentori migrations like
            // 0001_init.sql ship `release TEXT NOT NULL` in the events
            // table — the `events.release` column carries the release
            // identifier string. Pre-T4 this triggered "expected
            // identifier, got Release" and blocked every drop-in user
            // whose schema had a column / alias with one of these names.
            other if unreserved_keyword_text(&other).is_some() => {
                unreserved_keyword_text(&other).unwrap()
            }
            other => {
                return Err(ParseError {
                    message: format!("expected identifier, got {other:?}"),
                    token_pos: self.consumed_pos(),
                });
            }
        };
        // v7.14.0 — strip optional `<schema>.` prefix. PG dumps
        // qualify every name with `public.` (and pg_catalog.* for
        // functions); SPG is single-schema so we discard the
        // prefix and return only the trailing ident. Same shape
        // also handles MySQL `db.tbl` cross-database refs (SPG
        // ignores the db part).
        if matches!(self.peek(), Token::Dot) {
            self.advance();
            match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => return Ok(s),
                other if unreserved_keyword_text(&other).is_some() => {
                    return Ok(unreserved_keyword_text(&other).unwrap());
                }
                other => {
                    return Err(ParseError {
                        message: format!("expected identifier after '{first}.', got {other:?}"),
                        token_pos: self.consumed_pos(),
                    });
                }
            }
        }
        Ok(first)
    }

    #[allow(clippy::too_many_lines)]
    fn parse_one_statement(&mut self) -> Result<Statement, ParseError> {
        // v7.14.0 — empty / comment-only / semicolon-only input
        // (after the lexer strips line + block + MySQL
        // conditional comments) lands as Statement::Empty.
        // pg_dump and mysqldump emit several wrappers that
        // collapse to nothing after stripping (`/*!40101 SET …
        // */;`, blank lines between statements); the engine
        // returns CommandOk no-op so the dump loads cleanly.
        if matches!(self.peek(), Token::Eof | Token::Semicolon) {
            return Ok(Statement::Empty);
        }
        // v7.14.0 — pg_dump / mysqldump "noise" statements:
        // catalog / metadata DDL that has no behavioural effect
        // on SPG's single-schema, single-database, single-user
        // model. Consume the whole statement up to the next
        // semicolon / EOF and return Empty. This is broader than
        // the per-keyword DROP / SET / COMMENT arms but lets the
        // long tail of `LOCK TABLES`, `UNLOCK TABLES`, `GRANT`,
        // `REVOKE`, `ALTER OWNER TO`, `\restrict`, `\unrestrict`,
        // `BEGIN; COMMIT;` wrappers, etc. all pass through.
        if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek() {
            let lc = s.to_ascii_lowercase();
            // v7.39 (read01 round 50) — COMMENT ON is a real statement now.
            if lc == "comment" {
                return self.parse_comment_on();
            }
            // v7.39 (read01 round 57) — so is GRANT / REVOKE.
            if lc == "grant" || lc == "revoke" {
                return self.parse_grant_or_revoke(lc == "grant");
            }
            // v7.39 (round 277) — the SQL-level prepared-statement
            // surface is REAL now. It used to be accepted and dropped
            // on the theory that "real execution still happens via the
            // extended-query flow" — true only for a driver that uses
            // that flow; a plain SQL PREPARE / EXECUTE returned no
            // rows at all.
            if lc == "prepare" {
                return self.parse_prepare();
            }
            if lc == "execute" {
                return self.parse_execute();
            }
            if lc == "deallocate" {
                return self.parse_deallocate();
            }
            // v7.39 (round 278) — `CALL <proc>(<args>)` used to be
            // accepted and dropped, so an application's stored-procedure
            // invocation reported success and did nothing. SPG has no
            // procedure catalog, so every CALL names a procedure that
            // does not exist — which is exactly what PG says.
            if lc == "call" {
                return self.parse_call();
            }
            // v7.39 (round 318, V51) — MySQL `KILL`. Not dump noise: it
            // names one connection and acts on it.
            if lc == "kill" {
                return self.parse_kill();
            }
            if lc == "discard" {
                return self.parse_discard();
            }
            // v7.39 (round 696) — REASSIGN OWNED BY <role> [, …] TO <role>.
            // Still performs nothing; the roles are carried out so a name
            // that does not exist is refused, as PG18 refuses it.
            if lc == "reassign" {
                self.advance();
                if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("owned")) {
                    self.advance();
                }
                if self.peek_is_by() {
                    self.advance();
                }
                // Only the roles BEFORE the TO are the ones that must
                // exist — `TO` names the new owner, which PG checks as
                // well, so both lists are collected.
                let mut names = self.take_comma_separated_names();
                if matches!(self.peek(), Token::To) {
                    self.advance();
                    names.extend(self.take_comma_separated_names());
                }
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::RoleName,
                    names,
                });
            }
            // v7.39 (round 696) — SECURITY LABEL. PG18 refuses it
            // unconditionally with `no security label providers have been
            // loaded`, whatever object it names, because none is loaded.
            // SPG has none either; accepting it told the caller a label had
            // been applied when nothing anywhere records one.
            if lc == "security" {
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::SecurityLabel,
                    names: Vec::new(),
                });
            }
            if is_dump_noise_statement(&lc) {
                self.consume_until_statement_boundary();
                return Ok(Statement::Empty);
            }
        }
        match self.peek() {
            Token::Select => self.parse_select_stmt(),
            // v7.37.17 (17.6 siblings) — a statement opening with a
            // parenthesized query group: `(SELECT … UNION …)
            // INTERSECT …`. parse_bare_select's group arm consumes
            // the parens; the select parser handles the outer chain
            // and tail.
            Token::LParen
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Select | Token::LParen | Token::Values)
                ) =>
            {
                self.parse_select_stmt()
            }
            // v7.37.17 (17.6 siblings) — top-level bare VALUES
            // statement (`VALUES (1), (2) [ORDER BY …] [LIMIT …]`).
            // Lowers to the same UNION ALL chain the FROM-position
            // form uses, then reuses the shared SELECT tail.
            Token::Values => {
                self.advance(); // VALUES
                let mut head = self.parse_values_rows_body()?;
                self.parse_select_tail_into(&mut head)?;
                Ok(Statement::Select(head))
            }
            // SQL-standard `TABLE name` shorthand for
            // `SELECT * FROM name` — pg_dump never emits it, but
            // psql users and PG docs use it constantly. Set-op
            // chains and the ORDER BY/LIMIT tail compose like any
            // SELECT head.
            Token::Table
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(_) | Token::QuotedIdent(_))
                ) =>
            {
                let mut head = self.parse_table_shorthand()?;
                self.parse_setop_chain_into(&mut head)?;
                self.parse_select_tail_into(&mut head)?;
                Ok(Statement::Select(head))
            }
            // v7.9.27 — `DO $$ … $$ [LANGUAGE plpgsql]`. The
            // body is a dollar-quoted plpgsql block (lexer already
            // collapsed `$$…$$` into a single Token::String).
            // v7.16.2 — mailrs round-10 A.2: parse the body as a
            // real PlPgSqlBlock so the engine can EXECUTE it at
            // top level instead of silently swallowing. Pre-
            // v7.16.2 the parser threw the body away and the
            // engine returned CommandOk for the entire DO; that
            // turned `DO BEGIN … IF EXISTS ... THEN ALTER …; END
            // $$` into a SEV-1 silent no-op (the IF + the rename
            // were both invisible — mailrs's migrate-042 didn't
            // actually run). Now the body parses + executes;
            // EmbeddedSql inside the block runs immediately
            // against the engine (not deferred — we're at top
            // level, not inside a trigger row-write loop).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("do") => {
                self.advance();
                let body_text = match self.advance() {
                    Token::String(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected dollar-quoted body after DO, got {other:?}"
                        )));
                    }
                };
                // Optional `LANGUAGE <name>` trailer (idents only).
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("language")) {
                    self.advance();
                    let _ = self.expect_ident_like()?;
                }
                // Parse the body — same shape CREATE FUNCTION
                // uses for trigger function bodies. If the body
                // doesn't parse cleanly we surface the error
                // (better than silent no-op).
                let block = parse_plpgsql_body(&body_text)?;
                Ok(Statement::DoBlock(block))
            }
            // v4.11: `WITH name AS (SELECT ...) [, ...] SELECT ...`.
            // WITH isn't a reserved token in our lexer — comes through
            // as `Token::Ident("with")` (case-insensitive).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with") => {
                self.advance();
                self.parse_with_cte_then_select()
            }
            // v4.26: `EXPLAIN [ANALYZE] <select>`. Comes through as
            // an identifier — not a reserved keyword.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("explain") => {
                self.advance();
                let mut analyze = false;
                let mut suggest = false;
                let mut costs_off = false;
                let mut buffers = false;
                let mut timing_off = false;
                let mut settings = false;
                let mut wal = false;
                let mut summary_off = false;
                let mut format = crate::ast::ExplainFormat::Text;
                // v6.8.3 + v7.37.7 — `EXPLAIN (option [, option…])`
                // syntax accepts SUGGEST + COSTS ON|OFF. Multiple
                // options are comma-separated. Booleans default to ON
                // when the value token is omitted (matches PG).
                if matches!(self.peek(), Token::LParen) {
                    self.advance();
                    loop {
                        let opt = match self.peek().clone() {
                            Token::Ident(s) | Token::QuotedIdent(s) => s,
                            other => {
                                return Err(self.err(format!(
                                    "expected option keyword inside EXPLAIN (…), got {other:?}"
                                )));
                            }
                        };
                        self.advance();
                        if opt.eq_ignore_ascii_case("suggest") {
                            suggest = true;
                            // SUGGEST takes no explicit value today.
                        } else if opt.eq_ignore_ascii_case("costs") {
                            // PG syntax: `COSTS [ON | OFF]`. Default
                            // when value omitted is ON, so plain
                            // `COSTS` is a no-op. `COSTS OFF` flips.
                            // `ON` lexes to `Token::On` (reserved
                            // keyword in JOIN ... ON contexts); accept
                            // it alongside the bare Ident form so the
                            // grammar matches PG verbatim.
                            let value = match self.peek().clone() {
                                Token::On => {
                                    self.advance();
                                    true
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("off") =>
                                {
                                    self.advance();
                                    false
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("true") =>
                                {
                                    self.advance();
                                    true
                                }
                                _ => true,
                            };
                            costs_off = !value;
                        } else if opt.eq_ignore_ascii_case("analyze")
                            || opt.eq_ignore_ascii_case("analyse")
                        {
                            // v7.37.22 — `EXPLAIN (ANALYZE [ON|OFF]) <S>`.
                            // Same default-ON rule as ANALYZE keyword form.
                            let value = match self.peek().clone() {
                                Token::On => {
                                    self.advance();
                                    true
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("off") =>
                                {
                                    self.advance();
                                    false
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("true") =>
                                {
                                    self.advance();
                                    true
                                }
                                _ => true,
                            };
                            analyze = value;
                        } else if opt.eq_ignore_ascii_case("buffers") {
                            // v7.37.22 — `BUFFERS [ON|OFF]`.
                            let value = match self.peek().clone() {
                                Token::On => {
                                    self.advance();
                                    true
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("off") =>
                                {
                                    self.advance();
                                    false
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("true") =>
                                {
                                    self.advance();
                                    true
                                }
                                _ => true,
                            };
                            buffers = value;
                        } else if opt.eq_ignore_ascii_case("timing") {
                            // v7.37.22 — `TIMING [ON|OFF]`. OFF strips
                            // the measured wall-clock annotation.
                            let value = match self.peek().clone() {
                                Token::On => {
                                    self.advance();
                                    true
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("off") =>
                                {
                                    self.advance();
                                    false
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("true") =>
                                {
                                    self.advance();
                                    true
                                }
                                _ => true,
                            };
                            timing_off = !value;
                        } else if opt.eq_ignore_ascii_case("settings") {
                            settings = true;
                        } else if opt.eq_ignore_ascii_case("wal") {
                            wal = true;
                        } else if opt.eq_ignore_ascii_case("summary") {
                            // v7.39 (round 227) — `SUMMARY [ON|OFF]` really
                            // gates the trailing Planning/Execution Time
                            // lines now (was accept-and-no-op).
                            let value = match self.peek().clone() {
                                Token::On => {
                                    self.advance();
                                    true
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("off") =>
                                {
                                    self.advance();
                                    false
                                }
                                Token::Ident(v) | Token::QuotedIdent(v)
                                    if v.eq_ignore_ascii_case("true") =>
                                {
                                    self.advance();
                                    true
                                }
                                _ => true,
                            };
                            summary_off = !value;
                        } else if opt.eq_ignore_ascii_case("verbose")
                            || opt.eq_ignore_ascii_case("format")
                        {
                            // v7.37.22 — accept-but-no-op the remaining
                            // PG options so EXPLAIN-using clients
                            // (pgAdmin / DataGrip) don't see syntax
                            // errors. FORMAT takes a value (text /
                            // json / yaml / xml); skip the next token
                            // if it's an ident.
                            if opt.eq_ignore_ascii_case("format") {
                                if let Token::Ident(v) | Token::QuotedIdent(v) = self.peek().clone()
                                {
                                    self.advance();
                                    format = match v.to_ascii_lowercase().as_str() {
                                        "text" => crate::ast::ExplainFormat::Text,
                                        "json" => crate::ast::ExplainFormat::Json,
                                        "xml" => crate::ast::ExplainFormat::Xml,
                                        "yaml" => crate::ast::ExplainFormat::Yaml,
                                        other => {
                                            return Err(self.err(format!(
                                                "EXPLAIN (FORMAT …): unknown format {other:?}; \
                                                 supports text, json, xml, yaml"
                                            )));
                                        }
                                    };
                                }
                            } else {
                                // VERBOSE / SUMMARY take optional ON/OFF;
                                // consume if present.
                                if matches!(self.peek(), Token::On) {
                                    self.advance();
                                } else if let Token::Ident(v) | Token::QuotedIdent(v) =
                                    self.peek().clone()
                                    && (v.eq_ignore_ascii_case("off")
                                        || v.eq_ignore_ascii_case("true"))
                                {
                                    self.advance();
                                    let _ = v;
                                }
                            }
                        } else {
                            return Err(self.err(format!(
                                "unknown EXPLAIN option {opt:?}; supports ANALYZE, COSTS, BUFFERS, TIMING, SETTINGS, WAL, SUGGEST, VERBOSE, FORMAT, SUMMARY"
                            )));
                        }
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                            continue;
                        }
                        break;
                    }
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' after EXPLAIN options, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                } else if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek()
                    && (s.eq_ignore_ascii_case("analyze") || s.eq_ignore_ascii_case("analyse"))
                {
                    self.advance();
                    analyze = true;
                }
                // v7.39 (round 224) — the body may open with WITH (CTEs);
                // route through the same CTE-then-SELECT path the top-level
                // WITH statement uses. v7.39 (round 225) — DML bodies parse
                // too (PG explains INSERT / UPDATE / DELETE).
                let inner = match self.peek().clone() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("with") => {
                        self.advance();
                        self.parse_with_cte_then_select()?
                    }
                    Token::Insert => self.parse_insert_stmt(false)?,
                    Token::Ident(s) if s.eq_ignore_ascii_case("update") => {
                        self.advance();
                        self.parse_update_after_keyword()?
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("delete") => {
                        self.advance();
                        self.parse_delete_after_keyword()?
                    }
                    _ => self.parse_select_stmt()?,
                };
                if !matches!(
                    inner,
                    Statement::Select(_)
                        | Statement::Insert(_)
                        | Statement::Update(_)
                        | Statement::Delete(_)
                ) {
                    return Err(self.err(format!(
                        "EXPLAIN body must be SELECT / INSERT / UPDATE / DELETE, got {inner:?}"
                    )));
                }
                Ok(Statement::Explain(crate::ast::ExplainStatement {
                    analyze,
                    inner: Box::new(inner),
                    suggest,
                    costs_off,
                    buffers,
                    timing_off,
                    settings,
                    wal,
                    summary_off,
                    format,
                }))
            }
            Token::Create => self.parse_create_stmt(),
            Token::Insert => self.parse_insert_stmt(false),
            // MySQL `DESCRIBE t` / `DESC t` — the SHOW COLUMNS
            // spelling; route to the same handler. DESC is the
            // reserved ORDER BY token, so it gets its own arm.
            Token::Ident(s)
                if s.eq_ignore_ascii_case("describe")
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(_) | Token::QuotedIdent(_))
                    ) =>
            {
                self.advance();
                let table = self.expect_ident_like()?;
                Ok(Statement::ShowColumns(table))
            }
            Token::Desc
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(_) | Token::QuotedIdent(_))
                ) =>
            {
                self.advance();
                let table = self.expect_ident_like()?;
                Ok(Statement::ShowColumns(table))
            }
            // `COPY table [(cols)] TO STDOUT` — the export half of
            // pg_dump's COPY pair (the FROM stdin half rides the
            // embed import path). Options need a format design and
            // error honestly.
            Token::Ident(s)
                if s.eq_ignore_ascii_case("copy")
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(_) | Token::QuotedIdent(_))
                    ) =>
            {
                self.advance(); // COPY
                let table = self.expect_ident_like()?;
                let columns = if matches!(self.peek(), Token::LParen) {
                    self.advance();
                    let mut cols = alloc::vec![self.expect_ident_like()?];
                    while matches!(self.peek(), Token::Comma) {
                        self.advance();
                        cols.push(self.expect_ident_like()?);
                    }
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' after COPY column list, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    Some(cols)
                } else {
                    None
                };
                // v7.39 (round 249) — `COPY t FROM '<path>'`: the file
                // endpoint. (FROM STDIN still rides the wire/import path —
                // its data arrives out of band.)
                if matches!(self.peek(), Token::From)
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::String(_)))
                {
                    self.advance(); // FROM
                    let Token::String(path) = self.advance() else {
                        unreachable!()
                    };
                    let options = self.parse_copy_to_options()?;
                    return Ok(Statement::CopyFromFile {
                        table,
                        columns,
                        path,
                        options,
                    });
                }
                if !matches!(self.peek(), Token::To) {
                    return Err(self.err(format!(
                        "COPY: only TO STDOUT is supported here (FROM stdin \
                         rides the import path); got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if matches!(self.peek(), Token::String(_)) {
                    let Token::String(path) = self.advance() else { unreachable!() };
                    let options = self.parse_copy_to_options()?;
                    return Ok(Statement::CopyToFile {
                        table,
                        columns,
                        query: None,
                        path,
                        options,
                    });
                }
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("stdout")) {
                    return Err(self.err(format!(
                        "COPY TO supports STDOUT only (no file endpoints), got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let options = self.parse_copy_to_options()?;
                Ok(Statement::CopyTo {
                    table,
                    columns,
                    query: None,
                    options,
                })
            }
            // v7.39 (read01 round 94) — `COPY (<query>) TO STDOUT [WITH (…)]`.
            // The parens directly after COPY wrap a SELECT/VALUES/CTE whose
            // result set is streamed in COPY format (PG's query form).
            Token::Ident(s)
                if s.eq_ignore_ascii_case("copy")
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) =>
            {
                self.advance(); // COPY
                self.advance(); // (
                let query = self.parse_select_stmt()?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' after COPY query, got {:?}",
                        self.peek()
                    )));
                }
                self.advance(); // )
                if !matches!(self.peek(), Token::To) {
                    return Err(self.err(format!(
                        "COPY (query): only TO STDOUT is supported, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if matches!(self.peek(), Token::String(_)) {
                    let Token::String(path) = self.advance() else { unreachable!() };
                    let options = self.parse_copy_to_options()?;
                    return Ok(Statement::CopyToFile {
                        table: String::new(),
                        columns: None,
                        query: Some(alloc::boxed::Box::new(query)),
                        path,
                        options,
                    });
                }
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("stdout")) {
                    return Err(self.err(format!(
                        "COPY (query): TO supports STDOUT only, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let options = self.parse_copy_to_options()?;
                Ok(Statement::CopyTo {
                    table: String::new(),
                    columns: None,
                    query: Some(alloc::boxed::Box::new(query)),
                    options,
                })
            }
            // MySQL `REPLACE INTO t …` — delete-then-insert upsert.
            // Shares the INSERT body; the replace flag lowers it
            // onto ON CONFLICT DO UPDATE with an empty assignment
            // list (engine: replace the whole row).
            Token::Ident(s)
                if s.eq_ignore_ascii_case("replace")
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Into)) =>
            {
                self.parse_insert_stmt(true)
            }
            Token::Begin => {
                self.advance();
                // v7.38 轴 4 / v7.39 (read01 round 118, B3) — PG-standard
                // `BEGIN [WORK|TRANSACTION] [ISOLATION LEVEL …] [READ ONLY|WRITE]
                // [[NOT] DEFERRABLE]`. The optional WORK/TRANSACTION noise word
                // is consumed first, then the trailing modes — including the
                // case where `ISOLATION LEVEL …` follows BEGIN directly (no
                // WORK/TRANSACTION). The explicit level, when present, rides the
                // statement so `exec_begin` applies it for this transaction.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("work") || s.eq_ignore_ascii_case("transaction"))
                {
                    self.advance();
                }
                let iso = self.parse_isolation_level_clauses()?;
                Ok(Statement::Begin(iso))
            }
            // v7.38 轴 4 — PG-standard `START TRANSACTION …` synonym
            // for BEGIN. START is contextual in PG too; pattern-match
            // on the ident here. Iso clauses are parse-and-ignored,
            // same as BEGIN above.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("start") => {
                self.advance();
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("transaction"))
                {
                    return Err(self.err(alloc::format!(
                        "expected TRANSACTION after START, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let iso = self.parse_isolation_level_clauses()?;
                Ok(Statement::Begin(iso))
            }
            Token::Commit => {
                self.advance();
                // PG: `COMMIT [WORK | TRANSACTION]`.
                if let Token::Ident(w) = self.peek()
                    && (w.eq_ignore_ascii_case("work") || w.eq_ignore_ascii_case("transaction"))
                {
                    self.advance();
                }
                Ok(Statement::Commit)
            }
            // r1066 (7.38 S5.1) — `END [WORK | TRANSACTION]` is PG's
            // COMMIT synonym; pgbench's builtin tpcb-like script closes
            // every transaction with `END;` and the drop-in aborted on
            // it. Only reachable at statement start (CASE … END lives
            // inside expressions), so no ambiguity.
            Token::Ident(s) if s.eq_ignore_ascii_case("end") => {
                self.advance();
                if let Token::Ident(w) = self.peek()
                    && (w.eq_ignore_ascii_case("work") || w.eq_ignore_ascii_case("transaction"))
                {
                    self.advance();
                }
                Ok(Statement::Commit)
            }
            Token::Rollback => {
                self.advance();
                // `ROLLBACK TO [SAVEPOINT] <name>` returns to that
                // savepoint without ending the transaction. Bare
                // `ROLLBACK` drops the whole TX.
                if matches!(self.peek(), Token::To) {
                    self.advance();
                    if matches!(self.peek(), Token::Savepoint) {
                        self.advance();
                    }
                    let name = self.expect_ident_like()?;
                    Ok(Statement::RollbackToSavepoint(name))
                } else {
                    Ok(Statement::Rollback)
                }
            }
            Token::Savepoint => {
                self.advance();
                let name = self.expect_ident_like()?;
                Ok(Statement::Savepoint(name))
            }
            Token::Release => {
                self.advance();
                // `RELEASE [SAVEPOINT] <name>` — the `SAVEPOINT` keyword
                // is optional in standard SQL.
                if matches!(self.peek(), Token::Savepoint) {
                    self.advance();
                }
                let name = self.expect_ident_like()?;
                Ok(Statement::ReleaseSavepoint(name))
            }
            Token::Show => {
                self.advance();
                // `SHOW TABLES` / `SHOW USERS` / `SHOW COLUMNS FROM <table>`.
                // v6.1.2 promoted TABLES to a reserved keyword (for
                // `CREATE PUBLICATION … FOR ALL TABLES`), so it now
                // arrives as `Token::Tables` rather than a bare ident.
                // USERS / COLUMNS remain bare idents.
                let target = match self.advance() {
                    Token::Tables => "tables".to_string(),
                    // v7.17.0 Phase 3.P0-59 — CREATE is a reserved
                    // keyword token; recognise it as the SHOW CREATE
                    // dispatch keyword too.
                    Token::Create => "create".to_string(),
                    // v7.17.0 Phase 3.P0-60 — INDEX is a reserved
                    // keyword too; let SHOW INDEX FROM parse.
                    Token::Index => "index".to_string(),
                    // v7.37.17 (17.6 sibling) — SHOW ALL. ALL is
                    // reserved (used in aggregate function calls);
                    // recognise it here so the parser dispatches
                    // to ShowParameter("all") — the engine returns
                    // the curated parameter inventory.
                    Token::All => "all".to_string(),
                    Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                    other => {
                        return Err(self.err(format!(
                            "expected SHOW target, got {other:?}"
                        )));
                    }
                };
                match target.as_str() {
                    "tables" => Ok(Statement::ShowTables),
                    "users" => Ok(Statement::ShowUsers),
                    // v7.38 轴 4 — `SHOW transaction_isolation`
                    // returns the currently-selected isolation level.
                    "transaction_isolation" => Ok(Statement::ShowParameter(
                        "transaction_isolation".to_string(),
                    )),
                    // v7.17.0 Phase 3.P0-59 — MySQL `SHOW CREATE
                    // TABLE <t>` returns a 2-column row: (Table,
                    // Create Table). mysqldump emits this for every
                    // table at scrape time; without it the dump
                    // round-trip stalls.
                    // v7.17.0 Phase 3.P0-60 — MySQL `SHOW INDEXES
                    // FROM <t>` (also spelled `SHOW INDEX` and
                    // `SHOW KEYS`). admin / mysqldump probes use
                    // it to list per-table indexes.
                    "indexes" | "index" | "keys" => {
                        if !matches!(self.peek(), Token::From) {
                            return Err(self.err(format!(
                                "expected FROM after SHOW INDEXES, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let table = self.expect_ident_like()?;
                        Ok(Statement::ShowIndexes(table))
                    }
                    // v7.17.0 Phase 3.P0-61 — MySQL `SHOW STATUS` /
                    // `SHOW VARIABLES`. Both return a 2-column row
                    // set listing server-side state; clients probe
                    // them at connect time.
                    "status" => Ok(Statement::ShowStatus),
                    "variables" => {
                        // r1067 — `SHOW VARIABLES LIKE 'pat'`.
                        if matches!(self.peek(), Token::Like) {
                            self.advance();
                            let pat = match self.advance() {
                                Token::String(p) => p,
                                other => {
                                    return Err(self.err(format!(
                                        "SHOW VARIABLES LIKE expects a quoted pattern, got {other:?}"
                                    )));
                                }
                            };
                            return Ok(Statement::ShowVariablesLike(pat));
                        }
                        Ok(Statement::ShowVariables)
                    }
                    // v7.17.0 Phase 3.P0-62 — MySQL `SHOW PROCESSLIST`.
                    "processlist" => Ok(Statement::ShowProcesslist),
                    "create" => {
                        // SHOW CREATE TABLE / VIEW / DATABASE — only
                        // TABLE is supported in v7.17.
                        let kind = match self.advance() {
                            Token::Ident(s) | Token::QuotedIdent(s) => s,
                            Token::Table => "table".to_string(),
                            other => {
                                return Err(self.err(format!(
                                    "expected TABLE after SHOW CREATE, got {other:?}"
                                )));
                            }
                        };
                        if !kind.eq_ignore_ascii_case("table") {
                            return Err(self.err(format!(
                                "unsupported SHOW CREATE {kind:?}; v7.17 supports TABLE only"
                            )));
                        }
                        let name = self.expect_ident_like()?;
                        Ok(Statement::ShowCreateTable(name))
                    }
                    // v7.17.0 Phase 3.P0-58 — MySQL `SHOW DATABASES`
                    // (and `SHOW SCHEMAS` alias). The mysql client uses
                    // it to populate the database selector at connect
                    // time; without it `mysql -p` errors before the
                    // first user query.
                    "databases" | "schemas" => Ok(Statement::ShowDatabases),
                    // v6.1.3 — PUBLICATIONS plural is NOT a reserved
                    // keyword on its own; it lands here as a bare
                    // ident. Returning all publications + their
                    // scope summary.
                    "publications" => Ok(Statement::ShowPublications),
                    // v6.1.4 — same shape for SUBSCRIPTIONS plural.
                    "subscriptions" => Ok(Statement::ShowSubscriptions),
                    "columns" => {
                        if !matches!(self.peek(), Token::From) {
                            return Err(self.err(format!(
                                "expected FROM after SHOW COLUMNS, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let table = self.expect_ident_like()?;
                        Ok(Statement::ShowColumns(table))
                    }
                    // v7.38 轴 4 surface — `SHOW <param>` for any
                    // remaining session / preset parameter name
                    // (server_version, search_path, client_encoding,
                    // …). The engine's ShowParameter handler does the
                    // dispatch; unrecognised names error there with
                    // a pointer to pg_settings, not at parse time —
                    // so a driver that issues `SHOW spam_setting`
                    // gets a clear runtime error instead of a
                    // confusing "unknown SHOW target".
                    other => {
                        // v7.38 (read01 P3.20) — a custom namespaced GUC
                        // (`SHOW app.foo`) arrives as `app` + `.` + `foo`;
                        // consume the dotted tail so it round-trips with
                        // `SET app.foo` / `current_setting('app.foo')`.
                        let mut full = other.to_string();
                        while matches!(self.peek(), Token::Dot) {
                            self.advance();
                            let seg = self.expect_ident_like()?;
                            full.push('.');
                            full.push_str(&seg.to_ascii_lowercase());
                        }
                        Ok(Statement::ShowParameter(full))
                    }
                }
            }
            // v6.1.2: `DROP` is now a reserved keyword (it dispatches
            // to DROP USER and DROP PUBLICATION today; DROP TABLE /
            // DROP INDEX are still SHOW-shaped admin ops). Pre-6.1.2
            // arrived as a bare ident; tokenising it dedicatedly
            // keeps the dispatch tree small.
            Token::Drop => {
                self.advance();
                match self.peek() {
                    // v7.37.17 (17.6 sibling) — DROP OWNED BY <role>
                    // [, ...] [CASCADE | RESTRICT]. pg_dumpall emits
                    // around DROP ROLE cleanup. SPG has no role-owner
                    // model, so consume to boundary as a no-op.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("owned") =>
                    {
                        // v7.39 (round 696) — still a no-op (SPG has no
                        // role-owner model), but the ROLE is carried out so
                        // the engine can refuse one that does not exist,
                        // which is what PG18 does.
                        self.advance();
                        if self.peek_is_by() {
                            self.advance();
                        }
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        Ok(Statement::ValidateOnly {
                            kind: crate::ast::ValidateOnlyKind::RoleName,
                            names,
                        })
                    }
                    // v7.39 (round 436) — MySQL's `DROP TEMPORARY TABLE t`.
                    // It drops only a TEMPORARY table, and name resolution
                    // already prefers the session's own, so the keyword is
                    // consumed and the ordinary DROP TABLE path runs.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("temporary") || s.eq_ignore_ascii_case("temp") =>
                    {
                        self.advance();
                        if !matches!(self.peek(), Token::Table) {
                            return Err(self.err(alloc::format!(
                                "expected TABLE after DROP TEMPORARY, got {:?}",
                                self.peek()
                            )));
                        }
                        self.parse_drop_table_after_keyword()
                    }
                    Token::Publication => {
                        self.advance();
                        // v7.39 (round 754, F31-B4) — the round-753
                        // audit probe tripped over the missing
                        // `IF EXISTS` here (syntax error).
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_or_string()?;
                        Ok(Statement::DropPublication { name, if_exists })
                    }
                    Token::Subscription => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_or_string()?;
                        Ok(Statement::DropSubscription { name, if_exists })
                    }
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("user") || s.eq_ignore_ascii_case("role") =>
                    {
                        self.advance();
                        // v7.39 (read01 round 58) — DROP ROLE is DROP USER: a
                        // login user IS a role in PG, and SPG's store holds
                        // both. `IF EXISTS` is accepted on either spelling.
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_or_string()?;
                        Ok(Statement::DropUser { name, if_exists })
                    }
                    // v7.39 (round 806) — DROP DATABASE [IF EXISTS] <name>.
                    // CREATE DATABASE has parsed since v7.14 and this did
                    // not, so `DROP DATABASE IF EXISTS x` — what every
                    // teardown script and pg_dumpall preamble opens with —
                    // came back as a syntax error, which IF EXISTS cannot
                    // soften. The name is carried so the engine can answer
                    // the way PG does; PG never lets this succeed on a
                    // single-database server, since the name is either
                    // unknown ("database … does not exist", or a notice
                    // under IF EXISTS) or the one you are connected to
                    // ("cannot drop the currently open database").
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("database") =>
                    {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_or_string()?;
                        self.consume_until_statement_boundary();
                        Ok(Statement::DropDatabase { name, if_exists })
                    }
                    // v7.12.4 — DROP TRIGGER [IF EXISTS] name ON table.
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("trigger") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_like()?;
                        // ON <table>
                        if !matches!(self.peek(), Token::On) {
                            return Err(self.err(alloc::format!(
                                "expected ON <table> after DROP TRIGGER {name:?}, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let table = self.expect_ident_like()?;
                        Ok(Statement::DropTrigger {
                            name,
                            table,
                            if_exists,
                        })
                    }
                    // v7.39 (round 139) — DROP RULE [IF EXISTS] name ON table
                    // [CASCADE|RESTRICT]. Mirrors DROP TRIGGER's shape.
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("rule") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_like()?;
                        if !matches!(self.peek(), Token::On) {
                            return Err(self.err(alloc::format!(
                                "expected ON <table> after DROP RULE {name:?}, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let table = self.expect_ident_like()?;
                        // Optional CASCADE / RESTRICT — accepted, no effect.
                        self.consume_until_statement_boundary();
                        Ok(Statement::DropRule {
                            name,
                            table,
                            if_exists,
                        })
                    }
                    // v7.12.4 — DROP FUNCTION [IF EXISTS] name [(args)].
                    // v7.12.4 ignores any optional arg-list (signature-
                    // based overload disambiguation lands in v7.12.5+).
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("function") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_like()?;
                        // v7.39 (read01 round 62) — the argument list identifies
                        // WHICH overload to drop, so it is captured, not
                        // discarded. `DROP FUNCTION f` (no list) is legal when
                        // the name is unambiguous; the engine enforces that.
                        let args = if matches!(self.peek(), Token::LParen) {
                            Some(self.parse_function_signature_types()?)
                        } else {
                            None
                        };
                        // v7.39 (round 621) — the `CASCADE` / `RESTRICT`
                        // trailer, which `DROP TABLE` and `DROP INDEX` have
                        // accepted since v7.14 and this one refused outright.
                        // pg_dump writes it, so refusing was a parse error in
                        // the middle of a restore. SPG drops the function
                        // either way — it tracks no dependents to cascade to —
                        // which is the same reading the other two give it.
                        self.consume_drop_behaviour();
                        Ok(Statement::DropFunction {
                            name,
                            args,
                            if_exists,
                        })
                    }
                    // v7.14.0 — DROP TABLE [IF EXISTS] name [, name…]
                    // [CASCADE|RESTRICT]. pg_dump and mysqldump both
                    // emit DROP TABLE IF EXISTS at the head of every
                    // CREATE TABLE block so re-importing a dump
                    // overwrites prior state. SPG accepts and removes
                    // matching tables; CASCADE/RESTRICT trailers
                    // accepted silently.
                    Token::Table => self.parse_drop_table_after_keyword(),
                    // v7.14.0 — DROP INDEX [IF EXISTS] name
                    // [CASCADE|RESTRICT]. PG / mysqldump emit this
                    // for partial-index renames and pgvector
                    // migrations. SPG removes the matching index;
                    // IF EXISTS makes the drop idempotent.
                    Token::Index => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let name = self.expect_ident_like()?;
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropIndex { name, if_exists })
                    }
                    // v7.14.0 — DROP SCHEMA [IF EXISTS] name
                    // [CASCADE|RESTRICT]. SPG is single-database;
                    // v7.17.0 Phase 1.6 — DROP SCHEMA [IF EXISTS]
                    // name [, name…] [CASCADE | RESTRICT]. Real
                    // unregister (was silent no-op pre-v7.17).
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("schema") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropSchema { names, if_exists })
                    }
                    // v7.17.0 Phase 1.4 — DROP TYPE [IF EXISTS]
                    // name [, name…] [CASCADE|RESTRICT].
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("type") =>
                    {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropType { names, if_exists })
                    }
                    // v7.17.0 Phase 1.5 — DROP DOMAIN [IF EXISTS]
                    // name [, name…] [CASCADE|RESTRICT].
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("domain") =>
                    {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropDomain { names, if_exists })
                    }
                    // v7.17.0 Phase 1.3 — DROP MATERIALIZED VIEW
                    // [IF EXISTS] name [, name…] [CASCADE|RESTRICT].
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("materialized") =>
                    {
                        self.advance();
                        let nxt = self.peek().clone();
                        if !matches!(&nxt, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("view"))
                        {
                            return Err(self.err(alloc::format!(
                                "expected VIEW after DROP MATERIALIZED, got {nxt:?}"
                            )));
                        }
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropMaterializedView { names, if_exists })
                    }
                    // v7.17.0 Phase 1.2 — DROP VIEW [IF EXISTS]
                    // name [, name…] [CASCADE|RESTRICT].
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("view") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropView { names, if_exists })
                    }
                    // v7.17.0 — DROP SEQUENCE [IF EXISTS] name [,name…]
                    // [CASCADE|RESTRICT]. Real removal from catalog
                    // (was a silent no-op pre-v7.17).
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("sequence") => {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut names = vec![self.expect_ident_like()?];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            names.push(self.expect_ident_like()?);
                        }
                        if matches!(
                            self.peek(),
                            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                                || s.eq_ignore_ascii_case("restrict")
                        ) {
                            self.advance();
                        }
                        Ok(Statement::DropSequence { names, if_exists })
                    }
                    // v7.39 (RLS) — DROP POLICY [IF EXISTS] name ON table.
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("policy") => {
                        self.advance();
                        self.parse_drop_policy_after_keyword()
                    }
                    // v7.37.17 (17.6 siblings) — DROP <target> for
                    // targets SPG doesn't natively track. pg_dump
                    // emits DROP EXTENSION / DROP TYPE / DROP DOMAIN
                    // / DROP AGGREGATE / DROP OPERATOR / DROP CAST /
                    // DROP COLLATION / DROP LANGUAGE / DROP CONVERSION
                    // / DROP TEXT SEARCH / DROP FOREIGN * / DROP
                    // SERVER / DROP MATERIALIZED VIEW / DROP EVENT
                    // TRIGGER / DROP TABLESPACE / DROP RULE / DROP
                    // POLICY / DROP LARGE OBJECT / DROP ROLE / DROP
                    // ACCESS METHOD / DROP OPERATOR CLASS/FAMILY /
                    // etc. — accept + Empty-return so pg_dump tails
                    // load through. Materialized-view drop dispatches
                    // to the existing DropTable path when the token
                    // is Materialized-View-shaped (elsewhere in
                    // this parser).
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("text")
                            // The DROP dispatch matches on PEEK — `text` is
                            // not yet consumed, so SEARCH/CONFIGURATION sit
                            // at pos+1/pos+2 (the round-695 trap's mirror).
                            && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(k)) if k.eq_ignore_ascii_case("search"))
                            && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(k)) if k.eq_ignore_ascii_case("configuration")) =>
                    {
                        // v7.39 (round 709) — DROP TEXT SEARCH CONFIGURATION
                        // validates the name; DICTIONARY / PARSER / TEMPLATE
                        // stay in the noise arm below.
                        self.advance(); // TEXT
                        self.advance(); // SEARCH
                        self.advance(); // CONFIGURATION
                        let if_exists = self.consume_if_exists();
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        if if_exists {
                            return Ok(Statement::Empty);
                        }
                        Ok(Statement::ValidateOnly {
                            kind: crate::ast::ValidateOnlyKind::TsConfigName,
                            names,
                        })
                    }
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if matches!(
                            s.to_ascii_lowercase().as_str(),
                            "type"
                                | "domain"
                                | "operator"
                                | "cast"
                                // `text` = TEXT SEARCH DICTIONARY / PARSER /
                                // TEMPLATE (CONFIGURATION intercepted above).
                                | "text"
                                | "materialized"
                                | "large"
                                | "role"
                                | "access"
                                | "procedure"
                                | "routine"
                        ) =>
                    {
                        self.consume_until_statement_boundary();
                        Ok(Statement::Empty)
                    }
                    // v7.39 (round 709) — DROP COLLATION / EVENT TRIGGER /
                    // TABLESPACE / TEXT SEARCH CONFIGURATION validate their
                    // NAME; DROP SERVER / DROP FOREIGN TABLE join the
                    // foreign-data warning family (round 706) so a
                    // CREATE→DROP sequence in a dump stays consistent.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("server")
                            || s.eq_ignore_ascii_case("foreign") =>
                    {
                        self.advance();
                        self.consume_until_statement_boundary();
                        Ok(Statement::ValidateOnly {
                            kind: crate::ast::ValidateOnlyKind::ForeignInfra,
                            names: Vec::new(),
                        })
                    }
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("collation")
                            || s.eq_ignore_ascii_case("tablespace") =>
                    {
                        let kind = if s.eq_ignore_ascii_case("collation") {
                            crate::ast::ValidateOnlyKind::CollationName
                        } else {
                            crate::ast::ValidateOnlyKind::TablespaceName
                        };
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        if if_exists {
                            return Ok(Statement::Empty);
                        }
                        Ok(Statement::ValidateOnly { kind, names })
                    }
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("event") =>
                    {
                        self.advance();
                        if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("trigger"))
                        {
                            self.advance();
                        }
                        let if_exists = self.consume_if_exists();
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        if if_exists {
                            return Ok(Statement::Empty);
                        }
                        Ok(Statement::ValidateOnly {
                            kind: crate::ast::ValidateOnlyKind::EventTriggerName,
                            names,
                        })
                    }
                    // v7.39 (round 708) — DROP CONVERSION / DROP LANGUAGE
                    // leave the noise list; see the ValidateOnly kinds.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("conversion")
                            || s.eq_ignore_ascii_case("language")
                            // `DROP PROCEDURAL LANGUAGE` puts the modifier
                            // FIRST — the first draft looked for it after.
                            || s.eq_ignore_ascii_case("procedural") =>
                    {
                        let kind = if s.eq_ignore_ascii_case("conversion") {
                            crate::ast::ValidateOnlyKind::ConversionName
                        } else {
                            crate::ast::ValidateOnlyKind::LanguageName
                        };
                        self.advance();
                        if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("language"))
                        {
                            self.advance();
                        }
                        let if_exists = self.consume_if_exists();
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        if if_exists {
                            return Ok(Statement::Empty);
                        }
                        Ok(Statement::ValidateOnly { kind, names })
                    }
                    // v7.39 (round 707) — `DROP AGGREGATE [IF EXISTS]
                    // name(argtypes)[, …]`. Parsed for real so the engine
                    // can answer as PG does; see Statement::DropAggregate.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("aggregate") =>
                    {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let mut items: Vec<(String, Option<Vec<String>>)> = Vec::new();
                        loop {
                            let name = self.expect_ident_like()?;
                            if !matches!(self.peek(), Token::LParen) {
                                return Err(self.err(alloc::format!(
                                    "expected argument list after DROP AGGREGATE {name}"
                                )));
                            }
                            self.advance();
                            let mut args: Vec<String> = Vec::new();
                            let mut star = false;
                            loop {
                                match self.peek().clone() {
                                    Token::RParen => {
                                        self.advance();
                                        break;
                                    }
                                    Token::Star => {
                                        self.advance();
                                        star = true;
                                    }
                                    Token::Comma => {
                                        self.advance();
                                    }
                                    _ => {
                                        // A type name may be multi-token
                                        // (`double precision`); glue idents
                                        // until , or ).
                                        let mut t = self.expect_ident_like()?;
                                        while let Token::Ident(nx) = self.peek() {
                                            let nx = nx.clone();
                                            self.advance();
                                            t.push(' ');
                                            t.push_str(&nx);
                                        }
                                        args.push(t);
                                    }
                                }
                            }
                            items.push((name, if star { None } else { Some(args) }));
                            if matches!(self.peek(), Token::Comma) {
                                self.advance();
                            } else {
                                break;
                            }
                        }
                        self.consume_until_statement_boundary();
                        Ok(Statement::DropAggregate { if_exists, items })
                    }
                    // v7.39 (round 697) — `DROP EXTENSION [IF EXISTS] <e>
                    // [, …] [CASCADE|RESTRICT]`. PG refuses one that is not
                    // installed; `IF EXISTS` is the spelling that says do
                    // not, and it keeps the no-op.
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("extension") =>
                    {
                        self.advance();
                        let if_exists = self.consume_if_exists();
                        let names = self.take_comma_separated_names();
                        self.consume_until_statement_boundary();
                        if if_exists {
                            return Ok(Statement::Empty);
                        }
                        Ok(Statement::ValidateOnly {
                            kind: crate::ast::ValidateOnlyKind::ExtensionInstalled,
                            names,
                        })
                    }
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("statistics") =>
                    {
                        self.parse_drop_statistics_after_drop()
                    }
                    other => Err(self.err(format!(
                        "expected TABLE / INDEX / SCHEMA / SEQUENCE / USER / PUBLICATION / \
                         SUBSCRIPTION / TRIGGER / FUNCTION / STATISTICS after DROP, got {other:?}"
                    ))),
                }
            }
            // v7.17.0 Phase 1.3 — REFRESH MATERIALIZED VIEW name [WITH [NO] DATA].
            // v7.37.19 (19.8) — `CONCURRENTLY` modifier (PG 9.4+) parsed
            // and accepted before the view name. SPG materialised
            // views re-evaluate on read (always-fresh semantics), so
            // the CONCURRENTLY-vs-serial distinction has no runtime
            // effect — the refresh body does not block readers either
            // way. Same accept-and-no-op pattern as DETACH PARTITION
            // CONCURRENTLY (16.5).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("refresh") => {
                self.advance();
                let nxt = self.peek().clone();
                if !matches!(&nxt, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("materialized"))
                {
                    return Err(self.err(alloc::format!(
                        "expected MATERIALIZED after REFRESH, got {nxt:?}"
                    )));
                }
                self.advance();
                let nxt2 = self.peek().clone();
                if !matches!(&nxt2, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("view"))
                {
                    return Err(self.err(alloc::format!(
                        "expected VIEW after REFRESH MATERIALIZED, got {nxt2:?}"
                    )));
                }
                self.advance();
                // Optional CONCURRENTLY noise word — consumed without
                // changing semantics.
                if matches!(self.peek(), Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("concurrently"))
                {
                    self.advance();
                }
                let name = self.expect_ident_like()?;
                let with_data = self.parse_optional_with_data(true)?;
                Ok(Statement::RefreshMaterializedView { name, with_data })
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update") => {
                self.advance();
                self.parse_update_after_keyword()
            }
            // v7.37.17 (17.6 sibling) — TRUNCATE [TABLE] [ONLY]
            // <name> [, ...] [RESTART IDENTITY | CONTINUE IDENTITY]
            // [CASCADE | RESTRICT]. Clears every row from each named
            // table. Parses at the top level; the engine dispatcher
            // walks Statement::Truncate.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("truncate") => {
                self.advance();
                // Optional TABLE noise word — PG accepts both the reserved
                // token and the bare identifier spelling.
                if matches!(self.peek(), Token::Table)
                    || matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("table"))
                {
                    self.advance();
                }
                // v7.39 (round 647) — `TRUNCATE ONLY t` is carried now,
                // not absorbed. The lookahead keeps a table genuinely
                // called `only` working: the keyword is a keyword only
                // when a name follows it.
                let only = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("only"))
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(_) | Token::QuotedIdent(_))
                    );
                if only {
                    self.advance();
                }
                // Table names (comma-separated).
                let mut tables = Vec::new();
                loop {
                    tables.push(self.expect_ident_like()?);
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                        continue;
                    }
                    break;
                }
                // Optional RESTART IDENTITY / CONTINUE IDENTITY.
                let mut restart_identity = false;
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("restart"))
                {
                    self.advance();
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("identity"))
                    {
                        self.advance();
                        restart_identity = true;
                    }
                } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("continue"))
                {
                    self.advance();
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("identity"))
                    {
                        self.advance();
                    }
                }
                // Optional CASCADE / RESTRICT.
                let mut cascade = false;
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("cascade"))
                {
                    self.advance();
                    cascade = true;
                } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("restrict"))
                {
                    self.advance();
                }
                Ok(Statement::Truncate {
                    tables,
                    restart_identity,
                    cascade,
                    only,
                })
            }
            // v7.37.17 (17.6 sibling) — REINDEX [(OPTION [, ...])]
            // [CONCURRENTLY] { INDEX | TABLE | SCHEMA | DATABASE |
            // SYSTEM } [IF EXISTS] <name>. SPG rebuilds indexes as
            // rows change so the index tree is always up-to-date;
            // REINDEX is a strict no-op. Accept the whole statement
            // shape to boundary for pg_dump round-trip compatibility.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("reindex") => {
                // v7.39 (round 535) — the target is CARRIED now. SPG has no
                // index bloat to rebuild, so the work stays a no-op, but PG
                // validates what it was pointed at and this swallowed the
                // name at parse time — `REINDEX TABLE typo` reported
                // success. Measured on PG18: INDEX / TABLE name a relation,
                // SCHEMA a schema, SYSTEM nothing.
                self.advance();
                self.parse_reindex_tail()
            }
            // v7.37.17 (17.6 sibling) — VACUUM [(OPTION [, ...])]
            // [FULL] [FREEZE] [VERBOSE] [ANALYZE] [<table> [(cols)]].
            // SPG has no MVCC bloat today (Phase D visibility map
            // queues with v7.38); the freezer collapses hot-tier
            // rows into cold segments automatically. VACUUM is a
            // no-op — pg_dump maintenance scripts and Discourse's
            // periodic-maintenance path both emit it.
            // v7.39 (round 169) — VACUUM is REAL now: with the in-place
            // MVCC gate ON (v7.37.15 flip), tombstoned versions are
            // actual bloat, so the pre-MVCC accept-and-ignore posture
            // became a silent no-op on a customer's manual reclaim.
            // Grammar: VACUUM [(opts)] [FULL] [FREEZE] [VERBOSE]
            // [ANALYZE] [<table> [(cols)]] — option words are absorbed,
            // ANALYZE is captured, the optional table name is captured.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("vacuum") => {
                self.advance();
                // Parenthesised option list: absorb it.
                if matches!(self.peek(), Token::LParen) {
                    let mut depth = 0usize;
                    loop {
                        match self.advance() {
                            Token::LParen => depth += 1,
                            Token::RParen => {
                                depth -= 1;
                                if depth == 0 {
                                    break;
                                }
                            }
                            Token::Eof => break,
                            _ => {}
                        }
                    }
                }
                let mut analyze = false;
                let mut table: Option<String> = None;
                loop {
                    match self.peek() {
                        // v7.39 (round 535) — `FULL` lexes as a keyword, not
                        // an identifier, so the loop below broke out on it and
                        // dropped the table name: `VACUUM FULL nosuch` was
                        // accepted where `VACUUM nosuch` was refused.
                        Token::Full => {
                            self.advance();
                        }
                        Token::Ident(w) | Token::QuotedIdent(w) => {
                            let wl = w.to_ascii_lowercase();
                            match wl.as_str() {
                                "full" | "freeze" | "verbose" => {
                                    self.advance();
                                }
                                "analyze" | "analyse" => {
                                    analyze = true;
                                    self.advance();
                                }
                                _ => {
                                    table = Some(self.expect_ident_like()?);
                                    break;
                                }
                            }
                        }
                        _ => break,
                    }
                }
                // Optional trailing column list / anything else to the
                // statement boundary (PG accepts per-column ANALYZE).
                self.consume_until_statement_boundary();
                Ok(Statement::Vacuum { table, analyze })
            }
            // v7.37.17 (17.6 sibling) — CLUSTER [VERBOSE] <table>
            // [USING <index>] / CLUSTER (VERBOSE) <table> USING
            // <index>. PG stores rows in physical order matching
            // an index; SPG's hot-tier is append-only + cold-tier
            // is segment-frozen, so clustering has no persistent
            // effect. Accept-and-no-op for pg_dump compat.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("cluster") => {
                // v7.39 (round 535) — same as REINDEX above: the relation is
                // carried so the engine can refuse one that does not exist.
                // A bare `CLUSTER [VERBOSE]` names nothing and is accepted.
                self.advance();
                self.parse_cluster_tail()
            }
            // v7.39 (round 222) — LISTEN / NOTIFY / UNLISTEN with real
            // delivery (was accept-and-drop since v7.37.17). NOTIFY takes an
            // optional string payload; UNLISTEN takes a channel or `*`.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("listen") => {
                self.advance();
                let ch = match self.advance() {
                    Token::Ident(c) | Token::QuotedIdent(c) => c,
                    other => {
                        return Err(self.err(format!(
                            "expected channel name after LISTEN, got {other:?}"
                        )));
                    }
                };
                Ok(Statement::Listen(ch))
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("notify") => {
                self.advance();
                let channel = match self.advance() {
                    Token::Ident(c) | Token::QuotedIdent(c) => c,
                    other => {
                        return Err(self.err(format!(
                            "expected channel name after NOTIFY, got {other:?}"
                        )));
                    }
                };
                let payload = if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    match self.advance() {
                        Token::String(p) => Some(p),
                        other => {
                            return Err(self.err(format!(
                                "expected string payload after NOTIFY <channel>, got {other:?}"
                            )));
                        }
                    }
                } else {
                    None
                };
                Ok(Statement::Notify { channel, payload })
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("unlisten") => {
                self.advance();
                match self.advance() {
                    Token::Star => Ok(Statement::Unlisten(None)),
                    Token::Ident(c) | Token::QuotedIdent(c) => Ok(Statement::Unlisten(Some(c))),
                    other => Err(self.err(format!(
                        "expected channel name or * after UNLISTEN, got {other:?}"
                    ))),
                }
            }
            // v7.37.17 (17.6 sibling) — LOCK [TABLE] [ONLY] <table>
            // [IN <mode> MODE] [NOWAIT]. SPG's engine holds a
            // process-wide write lock today; explicit LOCK has no
            // effect. Accept-and-no-op for pg_dump / migration
            // compat.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("lock") => {
                self.advance();
                // v7.39 (round 696) — the LOCK still has no effect (SPG's
                // engine holds a process-wide write lock), but the TABLE
                // NAME is now carried out so the engine can refuse one that
                // does not exist, as PG18 does. MySQL's `LOCK TABLES …
                // READ|WRITE` is a different statement with the same first
                // word; it keeps the old no-op, because a MySQL dump's
                // bracket names tables it is about to create.
                let mysql_tables = matches!(self.peek(), Token::Ident(k)
                    if k.eq_ignore_ascii_case("tables"));
                if mysql_tables {
                    self.consume_until_statement_boundary();
                    return Ok(Statement::Empty);
                }
                if matches!(self.peek(), Token::Table) {
                    self.advance();
                }
                let names = self.take_comma_separated_names();
                self.consume_until_statement_boundary();
                Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::LockTable,
                    names,
                })
            }
            // v7.37.17 (17.6 sibling) — CHECKPOINT. Forces a WAL
            // durability marker + snapshot in PG. SPG has WAL
            // checkpointing on a byte / time schedule (v7.37.10
            // 60s / 4 MiB defaults). The bare statement parses to
            // `Statement::Empty` here (the no_std engine owns no
            // WAL / snapshot); v7.37 Epic Du wires the HOST
            // (embedded `Database::execute_buffered`, via
            // `sql_is_checkpoint`) to force an immediate synchronous
            // checkpoint through `Database::checkpoint` — a real
            // durability barrier, matching PG.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("checkpoint") => {
                self.advance();
                self.consume_until_statement_boundary();
                Ok(Statement::Empty)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete") => {
                self.advance();
                self.parse_delete_after_keyword()
            }
            // v6.0.4: ALTER INDEX <name> REBUILD [WITH (encoding = ...)].
            // ALTER is not a reserved keyword in the lexer — handled
            // as a bare ident here.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("alter") => {
                self.advance();
                self.parse_alter_after_keyword()
            }
            // v6.1.7: WAIT FOR WAL POSITION <pos> [WITH TIMEOUT <ms>].
            // WAIT / POSITION / TIMEOUT are bare idents — no lexer
            // additions needed.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("wait") => {
                self.advance();
                self.parse_wait_after_keyword()
            }
            // v6.2.0: ANALYZE [<table>]. ANALYZE is a bare ident.
            // Bare ANALYZE → analyse every user table; ANALYZE
            // <name> → re-stats one. The argument is an optional
            // ident (or quoted ident); anything else is a parse
            // error.
            // v6.7.3 — `COMPACT COLD SEGMENTS`. No arguments, no
            // `WHERE` filter (carved out per V6_7_DESIGN.md
            // STABILITY). Lex order: identifier "compact" → "cold"
            // → "segments". Anything else after `COMPACT` is a
            // parse error.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("compact") => {
                self.advance();
                let next = self.peek().clone();
                let cold = match next {
                    Token::Ident(s) | Token::QuotedIdent(s) => s,
                    _ => {
                        return Err(
                            self.err(format!("expected COLD after COMPACT, got {:?}", self.peek()))
                        );
                    }
                };
                if !cold.eq_ignore_ascii_case("cold") {
                    return Err(self.err(format!("expected COLD after COMPACT, got {cold:?}")));
                }
                self.advance();
                let next = self.peek().clone();
                let segments = match next {
                    Token::Ident(s) | Token::QuotedIdent(s) => s,
                    _ => {
                        return Err(self.err(format!(
                            "expected SEGMENTS after COMPACT COLD, got {:?}",
                            self.peek()
                        )));
                    }
                };
                if !segments.eq_ignore_ascii_case("segments") {
                    return Err(self.err(format!(
                        "expected SEGMENTS after COMPACT COLD, got {segments:?}"
                    )));
                }
                self.advance();
                Ok(Statement::CompactColdSegments)
            }
            // v7.17.0 Phase 3.P0-42 — SQL:2003 / PG 15+ MERGE.
            // Parsed as a case-insensitive identifier since MERGE
            // isn't a reserved lexer keyword (collides with the
            // mysqldump `ALGORITHM = MERGE` view clause if it
            // were); the inner parser drives the rest of the
            // surface (USING / ON / WHEN [NOT] MATCHED / THEN).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("merge") => {
                self.advance();
                self.parse_merge_after_keyword()
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("analyze") => {
                self.advance();
                let target = match self.peek() {
                    Token::Eof | Token::Semicolon => None,
                    Token::Ident(_) | Token::QuotedIdent(_) => {
                        Some(self.expect_ident_like()?)
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected table name or end of statement after ANALYZE, got {other:?}"
                        )));
                    }
                };
                // v7.39 (round 776, F31 J7) — the per-column form
                // (`ANALYZE t (x, y)`, PG-accepted) was a syntax error
                // here while the VACUUM arm already consumed it; SPG
                // analyzes whole tables, so the list parses and is
                // accepted like the VACUUM path's.
                if target.is_some() && matches!(self.peek(), Token::LParen) {
                    self.advance();
                    loop {
                        let _ = self.expect_ident_like()?;
                        match self.peek() {
                            Token::Comma => {
                                self.advance();
                            }
                            Token::RParen => {
                                self.advance();
                                break;
                            }
                            other => {
                                return Err(self.err(format!(
                                    "expected ',' or ')' in ANALYZE column list, got {other:?}"
                                )));
                            }
                        }
                    }
                }
                Ok(Statement::Analyze(target))
            }
            // v7.12.1 — `SET <name> [TO|=] <value>`. The
            // `default_text_search_config` parameter is consumed
            // by the FTS function dispatcher; other parameter
            // names are recorded but treated as a no-op so PG
            // dump output loads.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("set") => {
                self.advance();
                // PG allows `SET LOCAL` / `SET SESSION` qualifiers; MySQL
                // adds `SET GLOBAL` too (and the alias `SET @@global.name =
                // …` which the SessionVar path handles). `LOCAL` is the only
                // one that changes semantics — it scopes the change to the
                // current transaction — so capture it; SESSION / GLOBAL are
                // accepted and treated as the default session scope.
                let mut set_local = false;
                if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek() {
                    let q = s.to_ascii_lowercase();
                    if q == "local" || q == "session" || q == "global" {
                        set_local = q == "local";
                        self.advance();
                    }
                }
                // v7.14.0 — MySQL `SET NAMES <charset> [COLLATE
                // <collation>]` — change the connection client
                // charset. SPG stores UTF-8 always and orders
                // bytewise; accept as a no-op.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("names"))
                {
                    self.advance();
                    // Charset ident-or-string.
                    if matches!(
                        self.peek(),
                        Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                    ) {
                        self.advance();
                    }
                    // Optional `COLLATE <name>`.
                    if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("collate"))
                    {
                        self.advance();
                        if matches!(
                            self.peek(),
                            Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                        ) {
                            self.advance();
                        }
                    }
                    return Ok(Statement::Empty);
                }
                // v7.37.17 (17.6 sibling) — PG `SET ROLE
                // { NONE | DEFAULT | <role_name> }`. pg_dump preamble
                // uses this to switch to the object owner before
                // recreating tables. SPG has no role system so this
                // is a no-op.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("role"))
                {
                    self.advance(); // ROLE
                    // v7.39 (RLS) — real session-role switch. NONE / DEFAULT
                    // reset to the login identity; a name / string sets the
                    // effective role that drives current_user + RLS.
                    let role = match self.peek().clone() {
                        Token::Default => {
                            self.advance();
                            None
                        }
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("none") =>
                        {
                            self.advance();
                            None
                        }
                        Token::String(s) | Token::Ident(s) | Token::QuotedIdent(s) => {
                            self.advance();
                            Some(s)
                        }
                        _ => None,
                    };
                    return Ok(Statement::SetRole(role));
                }
                // v7.37.17 (17.6 sibling) — PG `SET SESSION
                // CHARACTERISTICS AS TRANSACTION <mode>` (per PG
                // ISO SQL surface). pg_dump prepends this to fix
                // the isolation level for the restore session. SPG
                // defaults to READ COMMITTED and doesn't yet honor
                // session-set isolation across statements — accept
                // and no-op. SET (LOCAL/SESSION) TRANSACTION AS ...
                // per-tx form is handled elsewhere.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("characteristics"))
                {
                    self.advance(); // CHARACTERISTICS
                    self.consume_until_statement_boundary();
                    return Ok(Statement::Empty);
                }
                // v7.37.17 (17.6 sibling) — PG `SET CONSTRAINTS
                // { ALL | <name>[, ...] } { DEFERRED | IMMEDIATE }`.
                // pg_dump emits this to control the deferrability of
                // FK / UNIQUE constraints across a bulk restore. SPG
                // has no deferrable-constraint machinery today; the
                // FK checker is strict-immediate. Accept-and-no-op
                // for pg_dump round-trip compatibility.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("constraints"))
                {
                    self.advance(); // CONSTRAINTS
                    // v7.39 (round 288) — no longer a no-op: the trailing
                    // DEFERRED / IMMEDIATE sets the transaction's timing.
                    // v7.39 (round 308, V29) — and the names are kept.
                    // They used to be skipped over on the way to the
                    // DEFERRED keyword, so a named form silently behaved
                    // as ALL: `SET CONSTRAINTS fk_a DEFERRED` deferred
                    // every deferrable constraint in the transaction.
                    let mut names: alloc::vec::Vec<alloc::string::String> =
                        alloc::vec::Vec::new();
                    if matches!(self.peek(), Token::All) {
                        self.advance();
                    } else {
                        loop {
                            let mut n = self.expect_ident_like()?;
                            // A schema-qualified name (`public.fk_a`)
                            // identifies the same constraint; PG resolves
                            // it by the trailing segment.
                            while matches!(self.peek(), Token::Dot) {
                                self.advance();
                                n = self.expect_ident_like()?;
                            }
                            names.push(n);
                            if matches!(self.peek(), Token::Comma) {
                                self.advance();
                            } else {
                                break;
                            }
                        }
                    }
                    let deferred = match self.peek() {
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("deferred") =>
                        {
                            true
                        }
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("immediate") =>
                        {
                            false
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected DEFERRED or IMMEDIATE after SET CONSTRAINTS, got {other:?}"
                            )));
                        }
                    };
                    self.advance();
                    return Ok(Statement::SetConstraints { names, deferred });
                }
                // v7.16.2 — PG `SET [SESSION] AUTHORIZATION
                // { DEFAULT | '<role>' | <ident> }` (mailrs
                // round-10 A.1). pg_dump preamble emits the
                // `DEFAULT` form to reset session authorization.
                //
                // v7.39 (round 697) — this said "SPG has no role system so
                // this is a strict no-op". SPG has had one since round 58;
                // the comment outlived it, and with it the reason a name
                // that is not a role was accepted here. It still switches
                // no authorization — what it does now is refuse a role
                // that does not exist, as PG18 does. PG also accepts `RESET SESSION
                // AUTHORIZATION` (handled by the RESET parser
                // elsewhere). Reference:
                // <https://www.postgresql.org/docs/current/sql-set-session-authorization.html>
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("authorization"))
                {
                    self.advance(); // AUTHORIZATION
                    match self.peek().clone() {
                        Token::Default => {
                            self.advance();
                        }
                        Token::String(r) | Token::Ident(r) | Token::QuotedIdent(r) => {
                            self.advance();
                            return Ok(Statement::ValidateOnly {
                                kind: crate::ast::ValidateOnlyKind::RoleName,
                                names: alloc::vec![r],
                            });
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected DEFAULT / '<role>' / <ident> after SET SESSION AUTHORIZATION, got {other:?}"
                            )));
                        }
                    }
                    return Ok(Statement::Empty);
                }
                // v7.38 轴 4 — `SET [SESSION] TRANSACTION
                // ISOLATION LEVEL { READ COMMITTED | READ
                // UNCOMMITTED | REPEATABLE READ | SERIALIZABLE }
                // [, READ {ONLY|WRITE}] [, [NOT] DEFERRABLE]`.
                // PG-standard surface. v7.37.8 accepts the syntax
                // and tracks the selected level on
                // `Engine::current_isolation_level()`; the actual
                // MVCC / SSI semantics implementation lands in
                // the 轴 4 isolation framework (separate train).
                // PG itself maps READ UNCOMMITTED to READ COMMITTED
                // internally; SPG behaves the same (effectively
                // READ COMMITTED at every level today).
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("transaction"))
                {
                    self.advance(); // TRANSACTION
                    let level = self.parse_isolation_level_clauses()?.unwrap_or_default();
                    return Ok(Statement::SetTransaction { isolation: level });
                }
                // v7.14.0 — MySQL `SET CHARACTER SET <charset>`
                // alias — same accept-as-no-op as SET NAMES.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("character"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("set"))
                {
                    self.advance(); // CHARACTER
                    self.advance(); // SET
                    if matches!(
                        self.peek(),
                        Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                    ) {
                        self.advance();
                    }
                    return Ok(Statement::Empty);
                }
                // v7.39 (GUC) — PG spells the timezone GUC as two
                // keywords: `SET [LOCAL|SESSION] TIME ZONE <value>`,
                // where <value> is a string/ident or the LOCAL /
                // DEFAULT keyword (both mean "back to the default").
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
                {
                    self.advance(); // TIME
                    self.advance(); // ZONE
                    let value = match self.peek().clone() {
                        Token::Ident(s)
                            if s.eq_ignore_ascii_case("local")
                                || s.eq_ignore_ascii_case("default") =>
                        {
                            self.advance();
                            crate::ast::SetValue::Default
                        }
                        Token::Default => {
                            self.advance();
                            crate::ast::SetValue::Default
                        }
                        _ => self.parse_set_value()?,
                    };
                    return Ok(Statement::SetParameter {
                        name: "timezone".into(),
                        value,
                        local: set_local,
                    });
                }
                // v7.39 (round 430) — `SET @x = <expr> [, @y := <expr>]` is a
                // MySQL USER-variable assignment: its own per-session
                // namespace, an arbitrary expression on the right, and `:=`
                // as a second spelling of `=`. It used to fall into the
                // session-PARAMETER list below, whose values are literals and
                // whose store nothing reads back under a `@` name — so the
                // assignment reported success and vanished.
                //
                // A `@@`-prefixed LHS is a real engine setting and keeps the
                // old path.
                if matches!(self.peek(), Token::SessionVar(s) if !s.starts_with("@@")) {
                    return self.parse_set_user_vars();
                }
                // v7.14.0 — multi-assignment form
                // `SET a = 1, b = 2, …`. Single-assignment is the
                // 1-element case. Each LHS may be a regular ident
                // or a SessionVar (`@VAR` / `@@VAR`).
                let mut pairs: Vec<(String, crate::ast::SetValue)> = Vec::new();
                loop {
                    let lhs = match self.peek().clone() {
                        Token::SessionVar(s) => {
                            self.advance();
                            s
                        }
                        Token::Ident(_) | Token::QuotedIdent(_) => self.parse_set_param_name()?,
                        other => {
                            return Err(self.err(format!(
                                "expected parameter name after SET, got {other:?}"
                            )));
                        }
                    };
                    // Accept either `=` or the bare `TO` keyword.
                    match self.peek() {
                        Token::Eq => {
                            self.advance();
                        }
                        Token::To => {
                            self.advance();
                        }
                        other => {
                            return Err(self.err(format!(
                                "expected `=` or TO after SET {lhs}, got {other:?}"
                            )));
                        }
                    }
                    let mut value = self.parse_set_value()?;
                    // v7.39 (GUC) — disambiguate the comma: `, name =` /
                    // `, name TO` continues a MySQL-style multi-assign,
                    // anything else is a PG list VALUE
                    // (`SET search_path = myschema, public`) folded into
                    // one comma-joined string.
                    while matches!(self.peek(), Token::Comma) {
                        let is_assign = matches!(
                            self.tokens.get(self.pos + 1),
                            Some(Token::Ident(_) | Token::QuotedIdent(_) | Token::SessionVar(_))
                        ) && matches!(
                            self.tokens.get(self.pos + 2),
                            Some(Token::Eq | Token::To)
                        );
                        if is_assign {
                            break;
                        }
                        self.advance(); // comma
                        let next = self.parse_set_value()?;
                        let joined = alloc::format!(
                            "{}, {}",
                            set_value_text(&value),
                            set_value_text(&next)
                        );
                        value = crate::ast::SetValue::String(joined);
                    }
                    pairs.push((lhs, value));
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                        continue;
                    }
                    break;
                }
                if pairs.len() == 1 {
                    let (name, value) = pairs.into_iter().next().unwrap();
                    Ok(Statement::SetParameter {
                        name,
                        value,
                        local: set_local,
                    })
                } else {
                    Ok(Statement::SetParameterList(pairs))
                }
            }
            // v7.12.1 — `RESET <name>` / `RESET ALL`.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("reset") => {
                self.advance();
                match self.peek().clone() {
                    Token::All => {
                        self.advance();
                        Ok(Statement::ResetParameter(None))
                    }
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("all") => {
                        self.advance();
                        Ok(Statement::ResetParameter(None))
                    }
                    // v7.39 (RLS) — `RESET ROLE` clears the session role.
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("role") => {
                        self.advance();
                        Ok(Statement::SetRole(None))
                    }
                    _ => {
                        let name = self.parse_set_param_name()?;
                        Ok(Statement::ResetParameter(Some(name)))
                    }
                }
            }
            // v7.39 (round 218) — server-side cursors.
            Token::Ident(s) if s.eq_ignore_ascii_case("declare") => self.parse_declare_cursor(),
            Token::Ident(s) if s.eq_ignore_ascii_case("fetch") => self.parse_fetch_or_move(false),
            Token::Ident(s) if s.eq_ignore_ascii_case("move") => self.parse_fetch_or_move(true),
            Token::Ident(s) if s.eq_ignore_ascii_case("close") => {
                self.advance();
                match self.peek().clone() {
                    Token::All => {
                        self.advance();
                        Ok(Statement::CloseCursor { name: None })
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("all") => {
                        self.advance();
                        Ok(Statement::CloseCursor { name: None })
                    }
                    Token::Ident(n) | Token::QuotedIdent(n) => {
                        self.advance();
                        Ok(Statement::CloseCursor { name: Some(n) })
                    }
                    other => Err(self.err(format!(
                        "expected cursor name or ALL after CLOSE, got {other:?}"
                    ))),
                }
            }
            other => Err(self.err(format!(
                "expected SELECT / CREATE / DROP / INSERT / UPDATE / DELETE / ALTER / BEGIN / COMMIT / \
                 ROLLBACK / SAVEPOINT / RELEASE / SHOW at start of statement, got {other:?}"
            ))),
        }
    }

    /// v7.39 (round 218) — `DECLARE <name> [BINARY] [INSENSITIVE] [ASENSITIVE]
    /// [[NO] SCROLL] CURSOR [{WITH|WITHOUT} HOLD] FOR <select>`. BINARY /
    /// (IN|A)SENSITIVE are accepted and ignored (SPG cursors materialize at
    /// DECLARE, which is INSENSITIVE — PG's only actual behaviour too).
    fn parse_declare_cursor(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // DECLARE
        let name = match self.advance() {
            Token::Ident(n) | Token::QuotedIdent(n) => n,
            other => {
                return Err(self.err(format!("expected cursor name after DECLARE, got {other:?}")));
            }
        };
        let mut scroll: Option<bool> = None;
        loop {
            match self.peek() {
                Token::Ident(s)
                    if s.eq_ignore_ascii_case("binary")
                        || s.eq_ignore_ascii_case("insensitive")
                        || s.eq_ignore_ascii_case("asensitive") =>
                {
                    self.advance();
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("scroll") => {
                    self.advance();
                    scroll = Some(true);
                }
                Token::Not | Token::Ident(_) if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("no")) =>
                {
                    self.advance(); // NO
                    if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("scroll")) {
                        return Err(self.err(format!(
                            "expected SCROLL after NO in DECLARE, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    scroll = Some(false);
                }
                _ => break,
            }
        }
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("cursor")) {
            return Err(self.err(format!("expected CURSOR in DECLARE, got {:?}", self.peek())));
        }
        self.advance();
        let mut hold = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("hold")) {
                return Err(self.err(format!(
                    "expected HOLD after WITH in DECLARE, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            hold = true;
        } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("without")) {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("hold")) {
                return Err(self.err(format!(
                    "expected HOLD after WITHOUT in DECLARE, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
        }
        if !matches!(self.peek(), Token::For) {
            return Err(self.err(format!(
                "expected FOR before the cursor query, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let query = self.parse_one_statement()?;
        Ok(Statement::DeclareCursor {
            name,
            scroll,
            hold,
            query: alloc::boxed::Box::new(query),
        })
    }

    /// v7.39 (round 218) — `FETCH`/`MOVE` `[<direction>] [FROM|IN] <name>`.
    /// Direction: NEXT | PRIOR | FIRST | LAST | ABSOLUTE n | RELATIVE n | n |
    /// ALL | FORWARD [n|ALL] | BACKWARD [n|ALL]; bare `FETCH <name>` = NEXT.
    fn parse_fetch_or_move(&mut self, is_move: bool) -> Result<Statement, ParseError> {
        use crate::ast::CursorDirection as D;
        self.advance(); // FETCH / MOVE
        let mut signed_count = |this: &mut Self| -> Result<i64, ParseError> {
            let neg = if matches!(this.peek(), Token::Minus) {
                this.advance();
                true
            } else {
                false
            };
            match this.advance() {
                Token::Integer(v) => Ok(if neg { -v } else { v }),
                other => Err(this.err(format!("expected count, got {other:?}"))),
            }
        };
        let direction = match self.peek().clone() {
            Token::Ident(s) if s.eq_ignore_ascii_case("next") => {
                self.advance();
                D::Next
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("prior") => {
                self.advance();
                D::Prior
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("first") => {
                self.advance();
                D::First
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("last") => {
                self.advance();
                D::Last
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("absolute") => {
                self.advance();
                D::Absolute(signed_count(self)?)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("relative") => {
                self.advance();
                D::Relative(signed_count(self)?)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("forward") => {
                self.advance();
                match self.peek().clone() {
                    Token::All => {
                        self.advance();
                        D::All
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("all") => {
                        self.advance();
                        D::All
                    }
                    Token::Integer(_) | Token::Minus => D::Count(signed_count(self)?),
                    _ => D::Next, // bare FORWARD = FORWARD 1
                }
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("backward") => {
                self.advance();
                match self.peek().clone() {
                    Token::All => {
                        self.advance();
                        D::BackwardAll
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("all") => {
                        self.advance();
                        D::BackwardAll
                    }
                    Token::Integer(_) | Token::Minus => D::Backward(signed_count(self)?),
                    _ => D::Backward(1), // bare BACKWARD = BACKWARD 1
                }
            }
            Token::All => {
                self.advance();
                D::All
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("all") => {
                self.advance();
                D::All
            }
            Token::Integer(_) | Token::Minus => D::Count(signed_count(self)?),
            // Bare `FETCH <name>` — direction defaults to NEXT.
            _ => D::Next,
        };
        // Optional FROM / IN.
        if matches!(self.peek(), Token::From)
            || matches!(self.peek(), Token::In)
            || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("in"))
        {
            self.advance();
        }
        let name = match self.advance() {
            Token::Ident(n) | Token::QuotedIdent(n) => n,
            other => {
                return Err(self.err(format!("expected cursor name, got {other:?}")));
            }
        };
        Ok(if is_move {
            Statement::MoveCursor { name, direction }
        } else {
            Statement::FetchCursor { name, direction }
        })
    }

    /// v7.39 (round 280) — `CREATE STATISTICS [IF NOT EXISTS] <name>
    /// [(kind, …)] ON <col>, … FROM <table>`.
    fn parse_create_statistics_after_create(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // STATISTICS
        // `IF` / `EXISTS` lex as plain identifiers; only NOT is a keyword.
        let mut if_not_exists = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Not))
        {
            self.advance();
            self.advance();
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exists")) {
                self.advance();
                if_not_exists = true;
            }
        }
        let name = self.expect_ident_like()?;
        let mut kinds = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                let k = self.expect_ident_like()?;
                // PG stores the single letters; accept the spelled-out
                // names the SQL uses and record what PG records.
                kinds.push(match k.to_ascii_lowercase().as_str() {
                    "ndistinct" => String::from("d"),
                    "dependencies" => String::from("f"),
                    "mcv" => String::from("m"),
                    other => {
                        return Err(
                            self.err(alloc::format!("unrecognized statistics kind \"{other}\""))
                        );
                    }
                });
                match self.advance() {
                    Token::Comma => {}
                    Token::RParen => break,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in statistics kind list, got {other:?}"
                        )));
                    }
                }
            }
        }
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(alloc::format!(
                "expected ON in CREATE STATISTICS, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut columns = Vec::new();
        loop {
            columns.push(self.expect_ident_like()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        if !matches!(self.peek(), Token::From) {
            return Err(self.err(alloc::format!(
                "expected FROM in CREATE STATISTICS, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;
        Ok(Statement::CreateStatistics {
            name,
            if_not_exists,
            kinds,
            columns,
            table,
        })
    }

    /// v7.39 (round 280) — `DROP STATISTICS [IF EXISTS] <name>`.
    /// v7.39 (round 436) — the body of `DROP TABLE [IF EXISTS] a[, b] …`,
    /// entered with the `TABLE` keyword still unconsumed. Extracted so
    /// `DROP TEMPORARY TABLE` (MySQL) runs the identical grammar instead of
    /// a second copy — the parser cannot rewind, so re-dispatch has to be a
    /// forward call.
    fn parse_drop_table_after_keyword(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // TABLE
        let if_exists = self.consume_if_exists();
        let mut names: Vec<String> = Vec::new();
        loop {
            names.push(self.expect_ident_like()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        if matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                || s.eq_ignore_ascii_case("restrict")
        ) {
            self.advance();
        }
        Ok(Statement::DropTable { names, if_exists })
    }

    fn parse_drop_statistics_after_drop(&mut self) -> Result<Statement, ParseError> {
        self.advance(); // STATISTICS
        let mut if_exists = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"))
            && matches!(self.tokens.get(self.pos + 1),
                        Some(Token::Ident(e)) if e.eq_ignore_ascii_case("exists"))
        {
            self.advance();
            self.advance();
            if_exists = true;
        }
        let name = self.expect_ident_like()?;
        Ok(Statement::DropStatistics { name, if_exists })
    }

    fn parse_create_stmt(&mut self) -> Result<Statement, ParseError> {
        debug_assert!(matches!(self.peek(), Token::Create));
        self.advance();
        match self.peek() {
            Token::Table => self.parse_create_table_stmt_after_create(),
            Token::Index => self.parse_create_index_stmt_after_create(false),
            // v7.39 (round 280) — CREATE STATISTICS is a real catalog
            // object now. It used to be consumed by the CREATE-noise
            // arm, so a pg_dump that declares extended statistics
            // restored silently without them and reflection showed
            // nothing.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("statistics") => {
                self.parse_create_statistics_after_create()
            }
            // v7.9.29 — `CREATE UNIQUE INDEX … [WHERE pred]`.
            // The `UNIQUE` modifier turns a partial index into a
            // partial-uniqueness invariant (only rows matching the
            // WHERE predicate are checked for duplicates). mailrs
            // K1 (3 hits: email_templates default, calendar_events
            // master, calendar_events instance).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("unique") => {
                self.advance();
                if !matches!(self.peek(), Token::Index) {
                    return Err(self.err(alloc::format!(
                        "expected INDEX after CREATE UNIQUE, got {:?}",
                        self.peek()
                    )));
                }
                self.parse_create_index_stmt_after_create(true)
            }
            Token::Publication => {
                self.advance();
                self.parse_create_publication_after_keyword()
            }
            Token::Subscription => {
                self.advance();
                self.parse_create_subscription_after_keyword()
            }
            // v4.1: CREATE USER 'name' WITH PASSWORD 'pw' [ROLE 'role'].
            // USER isn't a reserved keyword — we look for the bare
            // identifier so the lexer doesn't have to grow a token.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("user") => {
                self.advance();
                self.parse_create_user_after_keyword(true)
            }
            // v7.39 (read01 round 58) — `CREATE ROLE name [WITH] [options]`.
            // PG's CREATE USER *is* CREATE ROLE … LOGIN; the only difference is
            // the default of the LOGIN attribute.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("role") => {
                self.advance();
                self.parse_create_user_after_keyword(false)
            }
            // v7.39 (RLS) — `CREATE POLICY name ON table …`.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("policy") => {
                self.advance();
                self.parse_create_policy_after_keyword()
            }
            // v7.9.15 — `CREATE EXTENSION [IF NOT EXISTS] <name>
            // [WITH SCHEMA …] [VERSION '…'] [CASCADE]` as a
            // no-op. mailrs follow-up F3.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("extension") => {
                self.advance();
                self.parse_create_extension_after_keyword()
            }
            // v7.12.4 — `CREATE [OR REPLACE] FUNCTION …` and
            // `CREATE [OR REPLACE] TRIGGER …`. `OR REPLACE` is
            // optional; absorb it here and forward to the
            // per-kind parsers with the flag. OR is a reserved
            // keyword token.
            Token::Or => {
                self.advance();
                let next = self.peek();
                let (Token::Ident(s2) | Token::QuotedIdent(s2)) = next else {
                    return Err(self.err(alloc::format!(
                        "expected REPLACE after CREATE OR, got {next:?}"
                    )));
                };
                if !s2.eq_ignore_ascii_case("replace") {
                    return Err(self.err(alloc::format!(
                        "expected REPLACE after CREATE OR, got {s2:?}"
                    )));
                }
                self.advance();
                self.parse_create_function_or_trigger_after_or_replace(true)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("function") => {
                self.advance();
                self.parse_create_function_after_keyword(false)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("trigger") => {
                self.advance();
                self.parse_create_trigger_after_keyword(false)
            }
            // v7.39 (round 139) — CREATE RULE …
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("rule") => {
                self.advance();
                self.parse_create_rule_after_keyword(false)
            }
            // v7.39 (read01 round 82) — CREATE CONSTRAINT TRIGGER. A constraint
            // trigger is a row-level AFTER trigger that additionally carries
            // DEFERRABLE / INITIALLY DEFERRED timing; the `parse_create_trigger`
            // path already tolerates and skips those clauses, so consuming the
            // CONSTRAINT keyword and reusing it makes the statement parse and the
            // trigger fire. (The deferral timing itself is not yet honoured —
            // SPG fires it as a plain AFTER trigger, which is correct behaviour
            // for every non-deferred use.)
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("constraint") => {
                self.advance();
                if !matches!(self.peek(), Token::Ident(t) | Token::QuotedIdent(t)
                    if t.eq_ignore_ascii_case("trigger"))
                {
                    return Err(self.err(alloc::format!(
                        "expected TRIGGER after CREATE CONSTRAINT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                self.parse_create_trigger_after_keyword(false)
            }
            // v7.17.0 — CREATE [TEMPORARY] SEQUENCE …
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("sequence") => {
                self.advance();
                self.parse_create_sequence_after_keyword(false)
            }
            // v7.17.0 Phase 1.2 — CREATE [TEMPORARY] VIEW …
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("view") => {
                self.advance();
                self.parse_create_view_after_keyword(false, false, false)
            }
            // v7.17.0 Phase 2.6 — MySQL view prefix clauses
            // `ALGORITHM = {UNDEFINED|MERGE|TEMPTABLE}` /
            // `DEFINER = <user>` / `SQL SECURITY {DEFINER|INVOKER}`
            // appear (in any order) between `CREATE` and `VIEW` in
            // every mysqldump-emitted view. Pre-2.6 the parser
            // rejected the prefix and the customer's whole view
            // backup failed on the first view. The hints are pure
            // planner / permission metadata; SPG's view-rewrite
            // path is semantically equivalent for all three
            // algorithms in v7.17 (TEMPTABLE differs only in
            // perf for huge views — out of v7.17 scope), and
            // DEFINER / SQL SECURITY are pure single-user
            // permissioning that SPG ignores by design.
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("algorithm")
                    || s.eq_ignore_ascii_case("definer")
                    || s.eq_ignore_ascii_case("sql") =>
            {
                self.consume_mysql_view_prefix()?;
                // After absorbing ALGORITHM / DEFINER / SQL SECURITY
                // (in any order, in any combination), the next
                // keyword must be VIEW. mysqldump never emits these
                // prefixes on non-view statements.
                let next = self.peek().clone();
                if matches!(&next, Token::Ident(s2) | Token::QuotedIdent(s2)
                    if s2.eq_ignore_ascii_case("view"))
                {
                    self.advance();
                    self.parse_create_view_after_keyword(false, false, false)
                } else {
                    Err(self.err(alloc::format!(
                        "expected VIEW after MySQL view prefix (ALGORITHM/DEFINER/SQL SECURITY), got {next:?}"
                    )))
                }
            }
            // v7.17.0 Phase 1.4 — CREATE TYPE name AS ENUM (…).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("type") => {
                self.advance();
                self.parse_create_type_after_keyword()
            }
            // v7.17.0 Phase 1.5 — CREATE DOMAIN name AS base
            // [DEFAULT expr] [NOT NULL] [CHECK (expr)]*.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("domain") => {
                self.advance();
                self.parse_create_domain_after_keyword()
            }
            // v7.17.0 Phase 1.6 — CREATE SCHEMA [IF NOT EXISTS]
            // name [AUTHORIZATION user]. Real catalog registry
            // (was silent-no-op'd pre-v7.17).
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("schema") => {
                self.advance();
                let if_not_exists = self.parse_if_not_exists();
                let name = self.expect_ident_like()?;
                // Optional `AUTHORIZATION <user>` trailer — accepted,
                // ignored (single-user catalog).
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("authorization"))
                {
                    self.advance();
                    let _ = self.expect_ident_like()?;
                }
                Ok(Statement::CreateSchema { name, if_not_exists })
            }
            // v7.17.0 Phase 1.3 — CREATE MATERIALIZED VIEW …
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("materialized") => {
                self.advance();
                let next = self.peek().clone();
                if matches!(&next, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("view"))
                {
                    self.advance();
                    self.parse_create_materialized_view_after_keyword()
                } else {
                    Err(self.err(alloc::format!(
                        "expected VIEW after CREATE MATERIALIZED, got {next:?}"
                    )))
                }
            }
            // v7.38 (read01 P6.57) — CREATE UNLOGGED TABLE. Unlike TEMP (a
            // no-op below), an UNLOGGED table is a real, fully-usable table in
            // PG — it only skips WAL. SPG creates a normal table (the WAL-skip
            // durability optimisation is a follow-up), so a dump / app that
            // declares UNLOGGED tables works instead of failing to parse.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("unlogged") => {
                self.advance(); // UNLOGGED
                if matches!(self.peek(), Token::Table) {
                    self.parse_create_table_stmt_after_create()
                } else {
                    Err(self.err(format!(
                        "expected TABLE after CREATE UNLOGGED, got {:?}",
                        self.peek()
                    )))
                }
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("temporary") || s.eq_ignore_ascii_case("temp") =>
            {
                self.advance();
                // TEMPORARY/TEMP followed by SEQUENCE / VIEW.
                let next = self.peek().clone();
                if matches!(&next, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("sequence"))
                {
                    self.advance();
                    self.parse_create_sequence_after_keyword(true)
                } else if matches!(&next, Token::Ident(s2) | Token::QuotedIdent(s2) if s2.eq_ignore_ascii_case("view"))
                {
                    self.advance();
                    self.parse_create_view_after_keyword(false, false, true)
                } else {
                    // v7.39 (round 436) — `CREATE TEMPORARY TABLE` used to be
                    // consumed and answered OK while creating nothing, so
                    // every statement that touched the table afterwards failed
                    // with "table not found" — the DDL itself lied. It is a
                    // real CREATE TABLE now, marked temporary so the executor
                    // puts it in the session's own namespace. An optional
                    // TABLE keyword may or may not be present (`CREATE TEMP t`
                    // is not legal, but the keyword is consumed by the
                    // CREATE TABLE parser itself).
                    let stmt = self.parse_create_table_stmt_after_create()?;
                    match stmt {
                        Statement::CreateTable(mut c) => {
                            c.temporary = true;
                            Ok(Statement::CreateTable(c))
                        }
                        // `CREATE TEMPORARY TABLE x AS <select>` lowers to the
                        // CTAS node, which needs the same session namespace.
                        Statement::CreateMaterializedView(mut m) if m.as_plain_table => {
                            m.temporary = true;
                            Ok(Statement::CreateMaterializedView(m))
                        }
                        other => Ok(other),
                    }
                }
            }
            // v7.17.0 Phase 4.2 — MySQL `CREATE PROCEDURE name (…)
            // BEGIN <body> END`. The body may reference `@var`
            // session variables, SET statements, internal `;`
            // terminators, etc. SPG has no procedure runtime, so
            // consume the whole `CREATE PROCEDURE … END` block as
            // a no-op so mysqldump scripts that include stored
            // routines load through. The matching-END consumer
            // tracks BEGIN/END nesting depth to handle nested
            // BEGIN blocks correctly.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("procedure") => {
                self.consume_mysql_routine_body();
                Ok(Statement::Empty)
            }
            // v7.14.0 — pg_dump / mysqldump emit
            // `CREATE SCHEMA / VIEW / MATERIALIZED VIEW /
            // TYPE / DOMAIN / DATABASE / ROLE / POLICY / OPERATOR`.
            // SPG is single-schema / single-database; these have
            // no behavioural effect, so consume + return Empty.
            // v7.17.0 NOTE: SEQUENCE / VIEW / MATERIALIZED VIEW /
            // TYPE / DOMAIN / SCHEMA were here pre-v7.17; all
            // moved up to real parser branches. DATABASE / ROLE /
            // POLICY / OPERATOR stay no-op forever
            // (single-database, hardcoded roles).
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    s.to_ascii_lowercase().as_str(),
                    "database"
                        | "role"
                        | "operator"
                        | "cast"
                        | "aggregate"
                        | "language"
                        | "collation"
                        | "conversion"
                        // v7.17.0 Phase 8 (audit N6) — rarely-
                        // emitted pg_dump shapes that should
                        // load through without a parser error.
                        // SPG has no planner statistics catalog,
                        // no event-trigger hooks, no foreign-
                        // data-wrapper infrastructure; consume
                        // + return Empty.
                        | "statistics"
                        | "event"
                        // v7.37.17 (17.6 siblings) — additional CREATE
                        // targets pg_dump / operator install scripts
                        // may emit that SPG has no matching machinery
                        // for. Consume + Empty-return.
                        | "text"
                        | "tablespace"
                        | "access"
                        | "large"
                ) =>
            {
                // DATABASE is the one member of this list PG refuses
                // inside a transaction block; the rest (ROLE, CAST,
                // TABLESPACE, …) it runs there quite happily, so only
                // this one is named. Still a no-op otherwise — SPG is
                // single-database.
                let is_database = s.eq_ignore_ascii_case("database");
                self.consume_until_statement_boundary();
                if is_database {
                    return Ok(Statement::NoOpPreventedInTransaction {
                        what: String::from("CREATE DATABASE"),
                    });
                }
                Ok(Statement::Empty)
            }
            // v7.39 (round 706) — the foreign-data family leaves the silent
            // list: `CREATE SERVER …`, `CREATE FOREIGN TABLE …`, `CREATE
            // FOREIGN DATA WRAPPER …` are still consumed whole (SPG has no
            // FDW machinery), but the ENGINE now warns, so a restore log
            // says what will not function instead of reporting success.
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("server") || s.eq_ignore_ascii_case("foreign") =>
            {
                self.consume_until_statement_boundary();
                Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::ForeignInfra,
                    names: Vec::new(),
                })
            }
            other => Err(self.err(format!(
                "expected TABLE / INDEX / USER / EXTENSION / PUBLICATION / SUBSCRIPTION / FUNCTION / TRIGGER / SEQUENCE / SCHEMA / VIEW / TYPE / DOMAIN [OR REPLACE …] after CREATE, got {other:?}"
            ))),
        }
    }

    /// v7.12.4 — `CREATE OR REPLACE` already consumed; the next
    /// keyword decides whether we parse a function or trigger
    /// body. PG accepts other `OR REPLACE`-able objects (VIEW,
    /// PROCEDURE) — those land in later releases.
    fn parse_create_function_or_trigger_after_or_replace(
        &mut self,
        or_replace: bool,
    ) -> Result<Statement, ParseError> {
        let tok = self.peek();
        let (Token::Ident(s) | Token::QuotedIdent(s)) = tok else {
            return Err(self.err(alloc::format!(
                "expected FUNCTION / TRIGGER / RULE / VIEW after CREATE OR REPLACE, got {tok:?}"
            )));
        };
        if s.eq_ignore_ascii_case("function") {
            self.advance();
            self.parse_create_function_after_keyword(or_replace)
        } else if s.eq_ignore_ascii_case("trigger") {
            self.advance();
            self.parse_create_trigger_after_keyword(or_replace)
        } else if s.eq_ignore_ascii_case("rule") {
            // v7.39 (round 143) — CREATE OR REPLACE RULE name AS ON …
            self.advance();
            self.parse_create_rule_after_keyword(or_replace)
        } else if s.eq_ignore_ascii_case("view") {
            // v7.17.0 Phase 1.2 — CREATE OR REPLACE VIEW name AS SELECT …
            self.advance();
            self.parse_create_view_after_keyword(or_replace, false, false)
        } else if s.eq_ignore_ascii_case("temporary") || s.eq_ignore_ascii_case("temp") {
            // CREATE OR REPLACE TEMPORARY VIEW … (rare but legal).
            self.advance();
            let nxt = self.peek().clone();
            if matches!(&nxt, Token::Ident(n) | Token::QuotedIdent(n) if n.eq_ignore_ascii_case("view"))
            {
                self.advance();
                self.parse_create_view_after_keyword(or_replace, false, true)
            } else {
                Err(self.err(alloc::format!(
                    "expected VIEW after CREATE OR REPLACE TEMPORARY, got {nxt:?}"
                )))
            }
        } else {
            Err(self.err(alloc::format!(
                "expected FUNCTION / TRIGGER / RULE / VIEW after CREATE OR REPLACE, got {s:?}"
            )))
        }
    }

    /// v7.9.15 — accept and discard `CREATE EXTENSION` DDL.
    /// SPG doesn't have a registry; pgvector / similar are
    /// either builtin (VECTOR(N) ↔ pgvector) or n/a. Parsing
    /// the syntax lets dual-target schemas keep the line.
    fn parse_create_extension_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // Optional `IF NOT EXISTS`.
        self.consume_if_not_exists();
        let name = self.expect_ident_like()?;
        // Drain optional WITH SCHEMA <ident> / VERSION '<v>' /
        // CASCADE / FROM '<v>' clauses; we don't model them.
        loop {
            match self.peek() {
                Token::Ident(s) if s.eq_ignore_ascii_case("with") => {
                    self.advance();
                    continue;
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("schema") => {
                    self.advance();
                    let _ = self.expect_ident_like()?;
                    continue;
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("version") => {
                    self.advance();
                    // String or ident literal.
                    let _ = self.advance();
                    continue;
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("from") => {
                    self.advance();
                    let _ = self.advance();
                    continue;
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("cascade") => {
                    self.advance();
                    continue;
                }
                _ => break,
            }
        }
        // v7.39 (round 697) — the NAME is checked now. `CREATE EXTENSION
        // nosuch` reported success and `pg_extension` then did not list it,
        // which is the accept-and-do-nothing shape F31 exists to find.
        Ok(Statement::ValidateOnly {
            kind: crate::ast::ValidateOnlyKind::ExtensionAvailable,
            names: alloc::vec![name],
        })
    }

    /// v7.12.4 — body of `CREATE [OR REPLACE] FUNCTION`. The
    /// `[OR REPLACE]` flag (and the `FUNCTION` keyword) have
    /// already been consumed by the caller. Grammar accepted:
    ///
    ///   name `(` arg-list `)`
    ///   `RETURNS` return-type
    ///   [ `LANGUAGE` ident ]
    ///   `AS` $$ body $$
    ///   [ `LANGUAGE` ident ]
    ///
    /// Either `LANGUAGE` position is allowed; PG accepts both.
    fn parse_create_function_after_keyword(
        &mut self,
        or_replace: bool,
    ) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        // Argument list. v7.12.4 commonly sees the empty `()`
        // (trigger functions); typed args parse and round-trip
        // but the executor only invokes nullary functions.
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after function name {name:?}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let args = self.parse_function_arg_list()?;
        // RETURNS clause.
        let tok = self.peek();
        let (Token::Ident(s) | Token::QuotedIdent(s)) = tok else {
            return Err(self.err(alloc::format!(
                "expected RETURNS after function arg list, got {tok:?}"
            )));
        };
        if !s.eq_ignore_ascii_case("returns") {
            return Err(self.err(alloc::format!(
                "expected RETURNS after function arg list, got {s:?}"
            )));
        }
        self.advance();
        let returns = self.parse_function_return()?;
        // Optional LANGUAGE clause (PG also accepts after AS — we'll
        // re-check after the body too).
        let mut language: Option<String> = self.parse_optional_language()?;
        // v7.39 (round 322, V46) — attribute clauses. PG allows them on
        // either side of the body and in any order, interleaved with
        // LANGUAGE; `CREATE FUNCTION f() RETURNS int LANGUAGE sql
        // IMMUTABLE STRICT AS $$…$$` used to be a parse error, which meant
        // PG's own pg_dump output did not restore.
        let mut attrs = FunctionAttrs::default();
        loop {
            let before = self.pos;
            self.parse_function_attrs_into(&mut attrs)?;
            if language.is_none() {
                language = self.parse_optional_language()?;
            }
            if self.pos == before {
                break;
            }
        }
        // `AS` followed by a $$-quoted body (lexer already
        // collapses both `$$…$$` and `$tag$…$tag$` to a single
        // Token::String). AS is a reserved keyword (Token::As).
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS before function body, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let body_text = match self.peek() {
            Token::String(s) => {
                let body = s.clone();
                self.advance();
                body
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected $$-quoted function body after AS, got {other:?}"
                )));
            }
        };
        // Trailing clauses — PG's other accepted position for both the
        // LANGUAGE and the attributes.
        loop {
            let before = self.pos;
            self.parse_function_attrs_into(&mut attrs)?;
            if language.is_none() {
                language = self.parse_optional_language()?;
            }
            if self.pos == before {
                break;
            }
        }
        let language = language.unwrap_or_else(|| String::from("sql"));
        // PL/pgSQL bodies get structure-parsed. Other languages
        // (or PL/pgSQL bodies the v7.12.4 parser doesn't yet
        // recognise) round-trip as Raw text — the executor errors
        // when invoked with a clear unsupported message.
        let body = if language.eq_ignore_ascii_case("plpgsql") {
            match parse_plpgsql_body(&body_text) {
                Ok(block) => FunctionBody::PlPgSql(block),
                // Best-effort: if the body parser doesn't yet
                // support a construct used inside, fall back to
                // raw — keeps `CREATE FUNCTION` itself working
                // (catalogue accepts), executor errors on
                // invocation only.
                Err(_) => FunctionBody::Raw(body_text),
            }
        } else {
            FunctionBody::Raw(body_text)
        };
        Ok(Statement::CreateFunction(CreateFunctionStatement {
            name,
            or_replace,
            args,
            returns,
            language,
            body,
            attrs,
        }))
    }

    /// v7.39 (round 322, V46) — consume any run of `CREATE FUNCTION`
    /// attribute clauses into `attrs`, stopping at the first token that
    /// is not one. Measured against PG 18.4, which accepts them in any
    /// order and on either side of the body.
    fn parse_function_attrs_into(&mut self, attrs: &mut FunctionAttrs) -> Result<(), ParseError> {
        loop {
            let word = match self.peek() {
                Token::Ident(w) | Token::QuotedIdent(w) => w.to_ascii_lowercase(),
                // NOT LEAKPROOF — NOT is a reserved keyword token.
                Token::Not
                    if matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("leakproof")
                    ) =>
                {
                    self.advance();
                    self.advance();
                    attrs.leakproof = false;
                    continue;
                }
                _ => return Ok(()),
            };
            match word.as_str() {
                "immutable" => {
                    self.advance();
                    attrs.volatility = FunctionVolatility::Immutable;
                }
                "stable" => {
                    self.advance();
                    attrs.volatility = FunctionVolatility::Stable;
                }
                "volatile" => {
                    self.advance();
                    attrs.volatility = FunctionVolatility::Volatile;
                }
                "strict" => {
                    self.advance();
                    attrs.strict = true;
                }
                "leakproof" => {
                    self.advance();
                    attrs.leakproof = true;
                }
                // RETURNS NULL ON NULL INPUT / CALLED ON NULL INPUT — the
                // spelled-out forms of STRICT and its opposite.
                "returns" | "called" => {
                    let strict = word == "returns";
                    let mut probe = self.pos + 1;
                    if strict {
                        // RETURNS *NULL* ON NULL INPUT; a bare RETURNS here
                        // is not ours.
                        match self.tokens.get(probe) {
                            Some(Token::Null) => probe += 1,
                            Some(Token::Ident(w)) if w.eq_ignore_ascii_case("null") => probe += 1,
                            _ => return Ok(()),
                        }
                    }
                    let ok = matches!(self.tokens.get(probe), Some(Token::On))
                        || matches!(self.tokens.get(probe), Some(Token::Ident(w)) if w.eq_ignore_ascii_case("on"));
                    if !ok {
                        return Ok(());
                    }
                    probe += 1;
                    match self.tokens.get(probe) {
                        Some(Token::Null) => probe += 1,
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("null") => probe += 1,
                        _ => return Ok(()),
                    }
                    match self.tokens.get(probe) {
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("input") => probe += 1,
                        _ => return Ok(()),
                    }
                    self.pos = probe;
                    attrs.strict = strict;
                }
                "security" | "external" => {
                    // [EXTERNAL] SECURITY { INVOKER | DEFINER }
                    let mut probe = self.pos + 1;
                    if word == "external" {
                        match self.tokens.get(probe) {
                            Some(Token::Ident(w)) if w.eq_ignore_ascii_case("security") => {
                                probe += 1;
                            }
                            _ => return Ok(()),
                        }
                    }
                    let definer = match self.tokens.get(probe) {
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("definer") => true,
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("invoker") => false,
                        _ => return Ok(()),
                    };
                    self.pos = probe + 1;
                    attrs.security_definer = definer;
                }
                "parallel" => {
                    let level = match self.tokens.get(self.pos + 1) {
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("safe") => {
                            FunctionParallel::Safe
                        }
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("restricted") => {
                            FunctionParallel::Restricted
                        }
                        Some(Token::Ident(w)) if w.eq_ignore_ascii_case("unsafe") => {
                            FunctionParallel::Unsafe
                        }
                        _ => return Ok(()),
                    };
                    self.pos += 2;
                    attrs.parallel = level;
                }
                "cost" | "rows" => {
                    let Some(n) = self.peek_number_at(self.pos + 1) else {
                        return Ok(());
                    };
                    self.pos += 2;
                    if word == "cost" {
                        attrs.cost = Some(n);
                    } else {
                        attrs.rows = Some(n);
                    }
                }
                _ => return Ok(()),
            }
        }
    }

    /// The numeric literal at `idx`, if there is one.
    fn peek_number_at(&self, idx: usize) -> Option<f64> {
        match self.tokens.get(idx)? {
            Token::Integer(n) => Some(*n as f64),
            Token::Float(f) => Some(*f),
            Token::Numeric(t) => t.parse::<f64>().ok(),
            _ => None,
        }
    }

    /// Closing `)`-terminated argument list. v7.12.4 commonly
    /// sees the empty `()`; typed args round-trip but the
    /// executor (yet) doesn't invoke them.
    /// v7.39 (round 344) — consume a `( n [, m] )` type modifier and throw
    /// it away, which is what PG does with one on a function parameter.
    fn skip_type_modifier(&mut self) {
        if !matches!(self.peek(), Token::LParen) {
            return;
        }
        // Only a numeric modifier — anything else is not one, and eating
        // it would swallow real grammar.
        let mut i = self.pos + 1;
        let mut seen_number = false;
        loop {
            match self.tokens.get(i) {
                Some(Token::Integer(_)) => seen_number = true,
                Some(Token::Comma) => {}
                Some(Token::RParen) => break,
                _ => return,
            }
            i += 1;
        }
        if !seen_number {
            return;
        }
        while self.pos <= i {
            self.advance();
        }
    }

    fn parse_function_arg_list(&mut self) -> Result<Vec<FunctionArg>, ParseError> {
        let mut args: Vec<FunctionArg> = Vec::new();
        if matches!(self.peek(), Token::RParen) {
            self.advance();
            return Ok(args);
        }
        loop {
            // Optional `IN` / `OUT` / `INOUT` mode keyword. IN is
            // a reserved token; OUT / INOUT are bare idents.
            let mode = if matches!(self.peek(), Token::In) {
                self.advance();
                FunctionArgMode::In
            } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("out"))
            {
                self.advance();
                FunctionArgMode::Out
            } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("inout"))
            {
                self.advance();
                FunctionArgMode::InOut
            } else {
                FunctionArgMode::In
            };
            // Optional name. The next token is either a name
            // (followed by a type ident) or the type itself.
            // Disambiguate by peeking ahead: if the token after
            // the next ident is also an ident, we treat the
            // first as the name.
            // v7.39 (round 315, V19) — take EVERY ident-like word up to
            // the comma or paren, then decide. Reading at most two of
            // them could not spell `x double precision` at all, and
            // silently mis-read the bare `double precision` as a
            // parameter named "double" — which is what made the same
            // signature key two different ways.
            let (name, ty_token) = {
                let mut words: Vec<String> = alloc::vec![self.expect_ident_like()?];
                while matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_)) {
                    words.push(self.expect_ident_like()?);
                }
                // v7.39 (round 344) — a length / precision modifier on the
                // type: `f(character varying(9))`, `f(numeric(10,2))`. PG
                // accepts it and DROPS it — `pg_get_function_arguments`
                // reports plain `character varying` / `numeric`, measured on
                // 18.4 — but SPG raised `syntax error at or near "("`,
                // because the modifier's parens were never consumed.
                self.skip_type_modifier();
                // r1049 — `f(v bigint[])`. The array suffix parsed in
                // the column position, the cast position and (r1038)
                // the RETURNS position, but not here: the fifth
                // member of the same family, reported by sentori as
                // presumably the same code. It is now.
                let array_suffix = self.consume_array_suffix();
                let whole = words.join(" ");
                let (name, mut ty_token) = if words.len() >= 2 && !is_multiword_type_phrase(&whole)
                {
                    (Some(words[0].clone()), words[1..].join(" "))
                } else {
                    (None, whole)
                };
                ty_token.push_str(&array_suffix);
                (name, ty_token)
            };
            // Type — try to map to ColumnTypeName, else Raw.
            let ty = match map_type_ident_to_column_type_name(&ty_token) {
                Some(t) => FunctionArgType::Typed(t),
                None => FunctionArgType::Raw(ty_token),
            };
            args.push(FunctionArg { mode, name, ty });
            match self.peek() {
                Token::Comma => {
                    self.advance();
                    continue;
                }
                Token::RParen => {
                    self.advance();
                    return Ok(args);
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected , or ) in function arg list, got {other:?}"
                    )));
                }
            }
        }
    }

    fn parse_function_return(&mut self) -> Result<FunctionReturn, ParseError> {
        // v7.39 (read01 round 65) — `RETURNS TABLE(col type, …)`: a set-returning
        // function whose row shape is named inline.
        if matches!(self.peek(), Token::Table)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance(); // TABLE
            self.advance(); // (
            let mut cols: Vec<String> = Vec::new();
            loop {
                let cname = self.expect_ident_like()?;
                let mut ty: Vec<String> = Vec::new();
                loop {
                    match self.peek() {
                        Token::Comma | Token::RParen | Token::Eof => break,
                        _ => {}
                    }
                    match self.advance() {
                        Token::Ident(w) | Token::QuotedIdent(w) => ty.push(w),
                        other => {
                            if let Some(w) = unreserved_keyword_text(&other) {
                                ty.push(w);
                            }
                        }
                    }
                }
                cols.push(alloc::format!("{cname} {}", ty.join(" ")));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                } else {
                    break;
                }
            }
            if matches!(self.peek(), Token::RParen) {
                self.advance();
            }
            return Ok(FunctionReturn::Other(alloc::format!(
                "TABLE({})",
                cols.join(", ")
            )));
        }
        let ident = self.expect_ident_like()?;
        // v7.39 (read01 round 65) — `RETURNS SETOF <type>`.
        if ident.eq_ignore_ascii_case("setof") {
            let inner = self.expect_ident_like()?;
            let inner = alloc::format!("{inner}{}", self.consume_array_suffix());
            return Ok(FunctionReturn::Other(alloc::format!("SETOF {inner}")));
        }
        if ident.eq_ignore_ascii_case("trigger") {
            return Ok(FunctionReturn::Trigger);
        }
        if ident.eq_ignore_ascii_case("void") {
            return Ok(FunctionReturn::Void);
        }
        // r1038 — `RETURNS bigint[]`. An array COLUMN type parsed; the
        // RETURN position did not, so the `[` was a syntax error and the
        // whole migration stopped. sentori worked around it by returning
        // zero-padded text.
        let suffix = self.consume_array_suffix();
        if !suffix.is_empty() {
            return Ok(FunctionReturn::Other(alloc::format!("{ident}{suffix}")));
        }
        match map_type_ident_to_column_type_name(&ident) {
            Some(t) => Ok(FunctionReturn::Type(t)),
            None => Ok(FunctionReturn::Other(ident)),
        }
    }

    /// Consume any `[]` / `[N]` array markers after a type name and give
    /// back their text. Empty when there are none.
    fn consume_array_suffix(&mut self) -> String {
        let mut out = String::new();
        while matches!(self.peek(), Token::LBracket) {
            self.advance();
            // `[N]` is accepted and, as in PG, the length is not enforced.
            if let Token::Integer(n) = self.peek().clone() {
                self.advance();
                out.push_str(&alloc::format!("[{n}]"));
            } else {
                out.push_str("[]");
            }
            if matches!(self.peek(), Token::RBracket) {
                self.advance();
            }
        }
        out
    }

    fn parse_optional_language(&mut self) -> Result<Option<String>, ParseError> {
        match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("language") => {
                self.advance();
                let lang = self.expect_ident_like()?;
                Ok(Some(lang.to_ascii_lowercase()))
            }
            _ => Ok(None),
        }
    }

    /// v7.17.0 Phase 1.5 — body of `CREATE DOMAIN name AS
    /// base_type [DEFAULT expr] [NOT NULL | NULL] [CHECK
    /// (expr)]*`. The `DOMAIN` keyword has already been
    /// consumed. PG allows the trailing constraints in any
    /// order; we approximate with a small loop.
    fn parse_create_domain_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        // Optional `AS`.
        if matches!(self.peek(), Token::As) {
            self.advance();
        }
        // v7.39 (round 259) — keep the raw type NAME when the base is not
        // a builtin: it is how `CREATE DOMAIN child AS parent` records its
        // parent domain.
        let (base_type, _, _, base_user_ref, _, _, _, _, _, _, _, _) =
            self.parse_type_with_implied_flags()?;
        let mut default: Option<Expr> = None;
        let mut not_null = false;
        let mut checks: Vec<Expr> = Vec::new();
        loop {
            match self.peek() {
                Token::Default => {
                    if default.is_some() {
                        return Err(self.err("DOMAIN DEFAULT specified twice".into()));
                    }
                    self.advance();
                    default = Some(self.parse_expr(0)?);
                }
                Token::Not => {
                    self.advance();
                    if !matches!(self.peek(), Token::Null) {
                        return Err(self.err(alloc::format!(
                            "expected NULL after NOT in DOMAIN, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    not_null = true;
                }
                Token::Null => {
                    self.advance();
                    // v7.39 (round 761, F31 tranche 2 #31) — bare NULL
                    // is the default-nullable marker (PG accepts it),
                    // but AFTER a NOT NULL it is a conflict PG refuses
                    // (`conflicting NULL/NOT NULL constraints`,
                    // PG18-measured); the old arm no-opped both ways.
                    if not_null {
                        return Err(self.err(alloc::string::String::from(
                            "conflicting NULL/NOT NULL constraints",
                        )));
                    }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("check") => {
                    self.advance();
                    if !matches!(self.peek(), Token::LParen) {
                        return Err(self.err(alloc::format!(
                            "expected '(' after CHECK in DOMAIN, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let expr = self.parse_expr(0)?;
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(alloc::format!(
                            "expected ')' after CHECK expr, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    checks.push(expr);
                }
                // CONSTRAINT <name> CHECK (…) — PG accepts a name
                // prefix on the constraint; we drop the name and
                // recurse into the constraint parsing.
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("constraint") => {
                    self.advance();
                    let _ = self.expect_ident_like()?;
                }
                _ => break,
            }
        }
        Ok(Statement::CreateDomain(crate::ast::CreateDomainStatement {
            name,
            base_type,
            base_domain: base_user_ref,
            default,
            not_null,
            checks,
        }))
    }

    /// v7.17.0 Phase 1.4 — body of `CREATE TYPE name AS ENUM
    /// ('a', 'b', …)`. The `TYPE` keyword has already been
    /// consumed.
    fn parse_create_type_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        // Required `AS`.
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS after CREATE TYPE {name:?}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v7.37.x (ζ-B composite Phase 1) — `AS (` is the composite-
        // type shape: `CREATE TYPE foo AS (a INT, b TEXT)`. Branch
        // on the next token: `(` = composite, ident `ENUM` = enum.
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            let mut fields: Vec<(String, ColumnTypeName)> = Vec::new();
            let mut field_user_types: Vec<Option<String>> = Vec::new();
            // v7.39 (round 769, F31 tranche 5 #140) — `CREATE TYPE x AS ()`
            // is legal PG (an attribute-less composite; measured — the old
            // e2e note claimed PG requires at least one attribute).
            if matches!(self.peek(), Token::RParen) {
                self.advance();
                return Ok(Statement::CreateType(crate::ast::CreateTypeStatement {
                    name,
                    kind: crate::ast::TypeKind::Composite {
                        fields,
                        field_user_types,
                    },
                }));
            }
            loop {
                let field_name = self.expect_ident_like()?;
                // v7.39 (round 264) — keep the raw type name when it is not
                // a builtin: that is how a NESTED composite field records
                // which composite it holds.
                let (field_type, _, _, field_user_ref, _, _, _, _, _, _, _, _) =
                    self.parse_type_with_implied_flags()?;
                fields.push((field_name, field_type));
                field_user_types.push(field_user_ref);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                if matches!(self.peek(), Token::RParen) {
                    self.advance();
                    break;
                }
                return Err(self.err(alloc::format!(
                    "expected , or ) in composite field list, got {:?}",
                    self.peek()
                )));
            }
            if fields.is_empty() {
                return Err(self.err("CREATE TYPE … AS (…) must declare at least one field".into()));
            }
            return Ok(Statement::CreateType(crate::ast::CreateTypeStatement {
                name,
                kind: crate::ast::TypeKind::Composite {
                    fields,
                    field_user_types,
                },
            }));
        }
        // Required `ENUM` ident.
        let kind_ident = match self.peek().clone() {
            Token::Ident(s) | Token::QuotedIdent(s) => s,
            other => {
                return Err(self.err(alloc::format!(
                    "expected ENUM or '(' after CREATE TYPE {name:?} AS, got {other:?}"
                )));
            }
        };
        if !kind_ident.eq_ignore_ascii_case("enum") {
            return Err(self.err(alloc::format!(
                "Phase 1.4 only supports ENUM or composite '(…)'; got {kind_ident:?}"
            )));
        }
        self.advance();
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after ENUM, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut labels: Vec<String> = Vec::new();
        loop {
            match self.peek().clone() {
                Token::String(s) => {
                    self.advance();
                    labels.push(s);
                }
                other => {
                    return Err(
                        self.err(alloc::format!("expected enum label string, got {other:?}"))
                    );
                }
            }
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            if matches!(self.peek(), Token::RParen) {
                self.advance();
                break;
            }
            return Err(self.err(alloc::format!(
                "expected , or ) in ENUM label list, got {:?}",
                self.peek()
            )));
        }
        if labels.is_empty() {
            return Err(self.err("CREATE TYPE … AS ENUM must declare at least one label".into()));
        }
        Ok(Statement::CreateType(crate::ast::CreateTypeStatement {
            name,
            kind: crate::ast::TypeKind::Enum { labels },
        }))
    }

    /// v7.17.0 Phase 1.3 — body of `CREATE MATERIALIZED VIEW
    /// [IF NOT EXISTS] name [(col, …)] AS <SELECT …> [WITH [NO] DATA]`.
    /// The `CREATE MATERIALIZED VIEW` keywords have already been
    /// consumed.
    fn parse_create_materialized_view_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let if_not_exists = self.parse_if_not_exists();
        let name = self.expect_ident_like()?;
        let mut columns: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                let c = self.expect_ident_like()?;
                columns.push(c);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                if matches!(self.peek(), Token::RParen) {
                    self.advance();
                    break;
                }
                return Err(self.err(alloc::format!(
                    "expected , or ) in MATERIALIZED VIEW column list, got {:?}",
                    self.peek()
                )));
            }
        }
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS <SELECT …> after CREATE MATERIALIZED VIEW {name:?}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v7.39 (round 151) — a WITH-headed body is legal (read-only
        // CTEs only; the engine rejects data-modifying ones with PG's
        // message). A trailing `WITH [NO] DATA` can't START the body,
        // so WITH here heads the query.
        let body = if self.peek_is_with_kw() {
            self.advance();
            self.parse_nested_with_select()?
        } else {
            let body_stmt = self.parse_select_stmt()?;
            let Statement::Select(body) = body_stmt else {
                return Err(self.err(alloc::format!(
                    "CREATE MATERIALIZED VIEW body must be a SELECT, got {body_stmt:?}"
                )));
            };
            body
        };
        // Optional trailing `WITH [NO] DATA`.
        let with_data = self.parse_optional_with_data(true)?;
        Ok(Statement::CreateMaterializedView(
            crate::ast::CreateMaterializedViewStatement {
                temporary: false,
                name,
                if_not_exists,
                columns,
                body,
                with_data,
                as_plain_table: false,
            },
        ))
    }

    /// v7.17.0 Phase 1.3 — `WITH [NO] DATA` trailer.
    /// `default_when_absent` is what to return if the tail is
    /// missing (CREATE defaults to WITH DATA, REFRESH defaults to
    /// WITH DATA).
    fn parse_optional_with_data(&mut self, default_when_absent: bool) -> Result<bool, ParseError> {
        let save = self.pos;
        // `WITH` is an Ident (not reserved in the lexer).
        let is_with = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.eq_ignore_ascii_case("with"),
            _ => false,
        };
        if !is_with {
            return Ok(default_when_absent);
        }
        self.advance();
        // Optional `NO`.
        let mut with_data = true;
        let is_no = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.eq_ignore_ascii_case("no"),
            _ => false,
        };
        if is_no {
            self.advance();
            with_data = false;
        }
        // Required `DATA` ident.
        let is_data = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.eq_ignore_ascii_case("data"),
            _ => false,
        };
        if is_data {
            self.advance();
            Ok(with_data)
        } else {
            // Caller's WITH wasn't WITH-DATA — rewind so the outer
            // parser can interpret it.
            self.pos = save;
            Ok(default_when_absent)
        }
    }

    /// v7.17.0 Phase 1.2 — body of `CREATE [OR REPLACE]
    /// [TEMPORARY] VIEW [IF NOT EXISTS] name [(col, …)] AS <SELECT>`.
    /// All keyword prefixes have already been consumed; the flags
    /// say which were present.
    fn parse_create_view_after_keyword(
        &mut self,
        or_replace: bool,
        _materialized_unused: bool,
        temporary: bool,
    ) -> Result<Statement, ParseError> {
        let if_not_exists = self.parse_if_not_exists();
        let name = self.expect_ident_like()?;
        // Optional `(col, col, …)` rename list.
        let mut columns: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                let c = self.expect_ident_like()?;
                columns.push(c);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                if matches!(self.peek(), Token::RParen) {
                    self.advance();
                    break;
                }
                return Err(self.err(alloc::format!(
                    "expected , or ) in VIEW column list, got {:?}",
                    self.peek()
                )));
            }
        }
        // Required `AS`.
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS <SELECT …> after CREATE VIEW {name:?}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // Body: a regular SELECT statement. v7.39 (round 151) — a
        // WITH-headed body is legal too (read-only CTEs only; the
        // engine rejects data-modifying ones with PG's message).
        // Disambiguation vs `WITH CHECK OPTION`: a body can't START
        // with the check-option clause, so WITH here heads the query.
        let body = if self.peek_is_with_kw() {
            self.advance();
            self.parse_nested_with_select()?
        } else {
            let body_stmt = self.parse_select_stmt()?;
            let Statement::Select(body) = body_stmt else {
                return Err(self.err(alloc::format!(
                    "CREATE VIEW body must be a SELECT statement, got {body_stmt:?}"
                )));
            };
            body
        };
        // v7.39 (round 132) — optional `WITH [ LOCAL | CASCADED ] CHECK OPTION`.
        // The SELECT parser stops before a trailing WITH, so it lands here.
        let check_option = if matches!(self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with"))
        {
            self.advance(); // WITH
            let opt = match self.peek() {
                Token::Ident(s) if s.eq_ignore_ascii_case("local") => {
                    self.advance();
                    crate::ast::ViewCheckOption::Local
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("cascaded") => {
                    self.advance();
                    crate::ast::ViewCheckOption::Cascaded
                }
                // Bare `WITH CHECK OPTION` defaults to CASCADED (PG).
                _ => crate::ast::ViewCheckOption::Cascaded,
            };
            if !matches!(self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("check"))
            {
                return Err(self.err(alloc::format!(
                    "expected CHECK in CREATE VIEW … WITH [LOCAL|CASCADED] CHECK OPTION, got {:?}",
                    self.peek()
                )));
            }
            self.advance(); // CHECK
            if !matches!(self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("option"))
            {
                return Err(self.err(alloc::format!(
                    "expected OPTION after WITH CHECK in CREATE VIEW, got {:?}",
                    self.peek()
                )));
            }
            self.advance(); // OPTION
            Some(opt)
        } else {
            None
        };
        Ok(Statement::CreateView(crate::ast::CreateViewStatement {
            name,
            or_replace,
            if_not_exists,
            temporary,
            columns,
            body,
            check_option,
        }))
    }

    /// v7.17.0 — body of `CREATE [TEMPORARY] SEQUENCE`. The
    /// `[TEMPORARY]` and `SEQUENCE` tokens have already been
    /// consumed; `temporary` carries whether TEMPORARY was seen.
    fn parse_create_sequence_after_keyword(
        &mut self,
        temporary: bool,
    ) -> Result<Statement, ParseError> {
        let if_not_exists = self.parse_if_not_exists();
        let name = self.expect_ident_like()?;
        // Optional `AS data_type`.
        let data_type = if matches!(self.peek(), Token::As) {
            self.advance();
            Some(self.parse_sequence_data_type()?)
        } else {
            None
        };
        let options = self.parse_sequence_options(/* allow_restart = */ false)?;
        Ok(Statement::CreateSequence(
            crate::ast::CreateSequenceStatement {
                name,
                if_not_exists,
                temporary,
                data_type,
                options,
            },
        ))
    }

    /// v7.17.0 — body of `ALTER SEQUENCE`. The `ALTER` keyword has
    /// already been consumed; this is reached after `SEQUENCE`.
    /// v7.39 (round 260) — `ALTER DOMAIN name <action>`.
    fn parse_alter_domain_after_keyword(&mut self) -> Result<Statement, ParseError> {
        use crate::ast::AlterDomainAction as A;
        let name = self.expect_ident_like()?;
        // DROP / SET / ADD lex as reserved keyword tokens, not idents.
        let kw = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
            Token::Drop => alloc::string::String::from("drop"),
            Token::Default => alloc::string::String::from("default"),
            other => {
                return Err(self.err(alloc::format!(
                    "expected an ALTER DOMAIN action, got {other:?}"
                )));
            }
        };
        let action = match kw.as_str() {
            "add" => {
                self.advance();
                let cname = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint"))
                {
                    self.advance();
                    Some(self.expect_ident_like()?)
                } else {
                    None
                };
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("check")) {
                    return Err(self.err(alloc::format!(
                        "ALTER DOMAIN ADD supports CHECK only, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err("expected '(' after CHECK".into()));
                }
                self.advance();
                let check = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err("expected ')' after CHECK expression".into()));
                }
                self.advance();
                A::AddConstraint { name: cname, check }
            }
            "drop" => {
                self.advance();
                match self.peek() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("constraint") => {
                        self.advance();
                        let if_exists = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"))
                        {
                            self.advance();
                            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exists"))
                            {
                                return Err(self.err("expected EXISTS after IF".into()));
                            }
                            self.advance();
                            true
                        } else {
                            false
                        };
                        let cn = self.expect_ident_like()?;
                        A::DropConstraint {
                            name: cn,
                            if_exists,
                        }
                    }
                    Token::Default => {
                        self.advance();
                        A::DropDefault
                    }
                    Token::Not => {
                        self.advance();
                        if !matches!(self.peek(), Token::Null) {
                            return Err(self.err("expected NULL after NOT".into()));
                        }
                        self.advance();
                        A::DropNotNull
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "ALTER DOMAIN DROP expects CONSTRAINT / DEFAULT / NOT NULL, got {other:?}"
                        )));
                    }
                }
            }
            "set" => {
                self.advance();
                match self.peek() {
                    Token::Default => {
                        self.advance();
                        A::SetDefault(self.parse_expr(0)?)
                    }
                    Token::Not => {
                        self.advance();
                        if !matches!(self.peek(), Token::Null) {
                            return Err(self.err("expected NULL after NOT".into()));
                        }
                        self.advance();
                        A::SetNotNull
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "ALTER DOMAIN SET expects DEFAULT / NOT NULL, got {other:?}"
                        )));
                    }
                }
            }
            "rename" => {
                self.advance();
                if !matches!(self.peek(), Token::To) {
                    return Err(self.err("expected TO after RENAME".into()));
                }
                self.advance();
                A::RenameTo(self.expect_ident_like()?)
            }
            other => {
                return Err(self.err(alloc::format!("unsupported ALTER DOMAIN action {other:?}")));
            }
        };
        Ok(Statement::AlterDomain { name, action })
    }

    fn parse_alter_sequence_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let if_exists = self.parse_if_exists();
        let name = self.expect_ident_like()?;
        // v7.39 (read01 round 49) — `RENAME TO new`; mutually exclusive with
        // the option list (PG allows only one or the other).
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("rename")) {
            self.advance();
            if matches!(self.peek(), Token::To) {
                self.advance();
            } else {
                self.expect_keyword_ident("to")?;
            }
            let new = self.expect_ident_like()?;
            return Ok(Statement::AlterSequence(
                crate::ast::AlterSequenceStatement {
                    name,
                    if_exists,
                    options: crate::ast::SequenceOptions::default(),
                    rename_to: Some(new),
                },
            ));
        }
        let options = self.parse_sequence_options(/* allow_restart = */ true)?;
        Ok(Statement::AlterSequence(
            crate::ast::AlterSequenceStatement {
                name,
                if_exists,
                options,
                rename_to: None,
            },
        ))
    }

    fn parse_sequence_data_type(&mut self) -> Result<crate::ast::SequenceDataType, ParseError> {
        let kw = self.expect_ident_like()?;
        match kw.to_ascii_lowercase().as_str() {
            "smallint" | "int2" => Ok(crate::ast::SequenceDataType::SmallInt),
            "integer" | "int" | "int4" => Ok(crate::ast::SequenceDataType::Int),
            "bigint" | "int8" => Ok(crate::ast::SequenceDataType::BigInt),
            other => Err(self.err(alloc::format!(
                "expected SMALLINT / INTEGER / BIGINT after SEQUENCE AS, got {other:?}"
            ))),
        }
    }

    fn parse_sequence_options(
        &mut self,
        allow_restart: bool,
    ) -> Result<crate::ast::SequenceOptions, ParseError> {
        use crate::ast::{SeqBound, SequenceOptions, SequenceOwnedBy};
        let mut opts = SequenceOptions::default();
        #[allow(clippy::while_let_loop)]
        loop {
            // Match an ident; stop at any non-ident token (sentinel,
            // semicolon, end of statement).
            let kw_lc = match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                _ => break,
            };
            match kw_lc.as_str() {
                "increment" => {
                    self.advance();
                    // Optional BY.
                    if self.peek_is_by() {
                        self.advance();
                    }
                    opts.increment = Some(self.expect_signed_int()?);
                }
                "minvalue" => {
                    self.advance();
                    opts.min_value = Some(SeqBound::Value(self.expect_signed_int()?));
                }
                "maxvalue" => {
                    self.advance();
                    opts.max_value = Some(SeqBound::Value(self.expect_signed_int()?));
                }
                "no" => {
                    self.advance();
                    let what = self.expect_ident_like()?;
                    match what.to_ascii_lowercase().as_str() {
                        "minvalue" => opts.min_value = Some(SeqBound::NoBound),
                        "maxvalue" => opts.max_value = Some(SeqBound::NoBound),
                        "cycle" => opts.cycle = Some(false),
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected MINVALUE / MAXVALUE / CYCLE after NO, got {other:?}"
                            )));
                        }
                    }
                }
                "start" => {
                    self.advance();
                    // Optional WITH.
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("with"))
                    {
                        self.advance();
                    }
                    opts.start = Some(self.expect_signed_int()?);
                }
                "restart" if allow_restart => {
                    self.advance();
                    // Optional WITH n; bare RESTART means restart at START.
                    let mut with_val: Option<i64> = None;
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("with"))
                    {
                        self.advance();
                        with_val = Some(self.expect_signed_int()?);
                    } else if matches!(self.peek(), Token::Integer(_) | Token::Minus) {
                        with_val = Some(self.expect_signed_int()?);
                    }
                    opts.restart = Some(with_val);
                }
                "cache" => {
                    self.advance();
                    opts.cache = Some(self.expect_signed_int()?);
                }
                "cycle" => {
                    self.advance();
                    opts.cycle = Some(true);
                }
                "owned" => {
                    self.advance();
                    match self.peek() {
                        Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("by") => {
                            self.advance();
                        }
                        other => {
                            return Err(
                                self.err(alloc::format!("expected BY after OWNED, got {other:?}"))
                            );
                        }
                    }
                    // OWNED BY {NONE | tab.col}. Read just one ident
                    // (NOT expect_ident_like which would auto-strip
                    // a schema prefix and consume the `.col` we need).
                    let first = match self.advance() {
                        Token::Ident(s) | Token::QuotedIdent(s) => s,
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected identifier or NONE after OWNED BY, got {other:?}"
                            )));
                        }
                    };
                    if first.eq_ignore_ascii_case("none") {
                        opts.owned_by = Some(SequenceOwnedBy::None);
                    } else if matches!(self.peek(), Token::Dot) {
                        self.advance();
                        let second = match self.advance() {
                            Token::Ident(s) | Token::QuotedIdent(s) => s,
                            other => {
                                return Err(self.err(alloc::format!(
                                    "expected column name after OWNED BY {first}., got {other:?}"
                                )));
                            }
                        };
                        // v7.17 dump-compat fix — pg_dump emits
                        // OWNED BY clauses as
                        // `schema.table.column` (three segments).
                        // If a third `.<ident>` follows, treat the
                        // first ident as schema (drop it; SPG is
                        // single-schema) and the middle / last
                        // pair as table.column. Otherwise it's
                        // the two-segment form table.column.
                        if matches!(self.peek(), Token::Dot) {
                            self.advance();
                            let third = match self.advance() {
                                Token::Ident(s) | Token::QuotedIdent(s) => s,
                                other => {
                                    return Err(self.err(alloc::format!(
                                        "expected column name after OWNED BY {first}.{second}., got {other:?}"
                                    )));
                                }
                            };
                            let _ = first; // schema prefix discarded
                            opts.owned_by = Some(SequenceOwnedBy::Column {
                                table: second,
                                column: third,
                            });
                        } else {
                            opts.owned_by = Some(SequenceOwnedBy::Column {
                                table: first,
                                column: second,
                            });
                        }
                    } else {
                        return Err(self.err(alloc::format!(
                            "expected table.column or NONE after OWNED BY, got {first:?}"
                        )));
                    }
                }
                _ => break,
            }
        }
        Ok(opts)
    }

    fn expect_signed_int(&mut self) -> Result<i64, ParseError> {
        let neg = if matches!(self.peek(), Token::Minus) {
            self.advance();
            true
        } else {
            false
        };
        match self.peek() {
            Token::Integer(n) => {
                let v = *n;
                self.advance();
                Ok(if neg { -v } else { v })
            }
            other => Err(self.err(alloc::format!("expected signed integer, got {other:?}"))),
        }
    }

    /// v7.17.0 Phase 3.1 — absorb `[NOT] DEFERRABLE [INITIALLY
    /// {DEFERRED | IMMEDIATE}]` constraint-timing clauses. Each
    /// clause is fully accepted and discarded — SPG always runs
    /// constraint checks immediately (single-writer model). The
    /// loop allows DEFERRABLE and the INITIALLY suffix to appear
    /// in either order (per the SQL spec they're independent),
    /// though pg_dump always emits them in the canonical
    /// `[NOT] DEFERRABLE INITIALLY {DEFERRED|IMMEDIATE}` shape.
    /// Stops at the first token that isn't part of the clause.
    fn consume_optional_deferrable_clauses(&mut self) -> Result<(), ParseError> {
        self.consume_deferrable_clauses_timed().map(|_| ())
    }

    /// v7.39 (round 288) — the same scan, but reporting what it saw:
    /// `(deferrable, initially_deferred)`. The clauses were parsed and
    /// dropped, so `DEFERRABLE INITIALLY DEFERRED` on an FK behaved as
    /// NOT DEFERRABLE and a circular-FK migration could not load.
    fn consume_deferrable_clauses_timed(&mut self) -> Result<(bool, bool), ParseError> {
        let mut deferrable = false;
        let mut initially_deferred = false;
        loop {
            // Bare `DEFERRABLE` (Phase 3.1 — was hard-error pre-3.1).
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("deferrable")) {
                self.advance();
                deferrable = true;
                if self.consume_optional_initially_clause()? {
                    initially_deferred = true;
                }
                continue;
            }
            // `NOT DEFERRABLE` — already worked pre-3.1.
            if matches!(self.peek(), Token::Not) {
                let look = self.tokens.get(self.pos + 1);
                if matches!(look, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("deferrable")) {
                    self.advance(); // NOT
                    self.advance(); // DEFERRABLE
                    deferrable = false;
                    initially_deferred = false;
                    let _ = self.consume_optional_initially_clause()?;
                    continue;
                }
                break;
            }
            // Standalone `INITIALLY {DEFERRED|IMMEDIATE}` — PG
            // accepts this without a leading [NOT] DEFERRABLE
            // (the timing keyword alone). pg_dump occasionally
            // emits it on FK constraints that inherit timing.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("initially")) {
                if self.consume_optional_initially_clause()? {
                    initially_deferred = true;
                    // PG: a bare `INITIALLY DEFERRED` implies DEFERRABLE.
                    deferrable = true;
                }
                continue;
            }
            break;
        }
        Ok((deferrable, initially_deferred))
    }

    /// Helper for [`consume_optional_deferrable_clauses`]. When the
    /// next token is `INITIALLY`, consume it plus the required
    /// `DEFERRED` | `IMMEDIATE` trailer. No-op otherwise.
    /// Returns true when the timing seen was `DEFERRED`.
    fn consume_optional_initially_clause(&mut self) -> Result<bool, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("initially")) {
            return Ok(false);
        }
        self.advance(); // INITIALLY
        match self.advance() {
            Token::Ident(s)
                if s.eq_ignore_ascii_case("deferred") || s.eq_ignore_ascii_case("immediate") =>
            {
                Ok(s.eq_ignore_ascii_case("deferred"))
            }
            other => Err(self.err(alloc::format!(
                "expected DEFERRED or IMMEDIATE after INITIALLY, got {other:?}"
            ))),
        }
    }

    /// v7.17.0 Phase 4.2 — consume a MySQL `CREATE PROCEDURE` body
    /// in its entirety so the parser returns Empty without
    /// touching the runtime. The CREATE+PROCEDURE keywords are
    /// already consumed; this swallows everything from the
    /// procedure name through the matching `END`, including
    /// nested `BEGIN`/`END` blocks, internal `;` terminators
    /// (DELIMITER `//` makes the script splitter forward the
    /// whole block as one statement), `@var` session-variable
    /// references, and the trailing terminator.
    ///
    /// Tracks nesting depth so:
    ///   BEGIN
    ///     IF cond THEN
    ///       BEGIN ... END;
    ///     END IF;
    ///   END
    /// terminates at the outer END.
    fn consume_mysql_routine_body(&mut self) {
        // Outer skeleton: name, (...), optional clauses, BEGIN
        // <body> END [;]. Scan for the first BEGIN — anything
        // before it is signature decoration we don't care about.
        // Once inside BEGIN, count up on BEGIN, down on END.
        let mut depth: i32 = 0;
        let mut started = false;
        loop {
            match self.peek().clone() {
                Token::Begin => {
                    self.advance();
                    depth += 1;
                    started = true;
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("end") => {
                    self.advance();
                    if started {
                        depth -= 1;
                        if depth <= 0 {
                            // Optional trailing ident (`END IF`,
                            // `END LOOP`, `END WHILE`, `END CASE`,
                            // `END label_name`) — eat the next
                            // ident if present so we don't
                            // mistake `END IF;` for the outer
                            // close.
                            if matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_)) {
                                // If the next token is one of the
                                // PL/SQL block-closer keywords,
                                // the END belongs to an inner
                                // block; bump depth back up.
                                let is_inner_close = matches!(
                                    self.peek(),
                                    Token::Ident(s) | Token::QuotedIdent(s)
                                        if matches!(
                                            s.to_ascii_lowercase().as_str(),
                                            "if" | "loop" | "while" | "case" | "repeat"
                                        )
                                );
                                if is_inner_close {
                                    self.advance();
                                    depth += 1;
                                    continue;
                                }
                            }
                            // Eat optional trailing `;`.
                            if matches!(self.peek(), Token::Semicolon) {
                                self.advance();
                            }
                            return;
                        }
                    }
                }
                Token::Eof => return,
                _ => {
                    self.advance();
                }
            }
        }
    }

    /// v7.17.0 Phase 2.6 — absorb the MySQL view-prefix clauses
    /// that appear between `CREATE` and `VIEW` in mysqldump output:
    ///
    /// * `ALGORITHM = {UNDEFINED|MERGE|TEMPTABLE}`
    /// * `DEFINER = <user>`  (user may be a quoted string, a bare
    ///   ident, or `ident @ ident-or-quoted-string` host form)
    /// * `SQL SECURITY {DEFINER|INVOKER}`
    ///
    /// Each clause may appear at most once but in any order.
    /// The hints are pure planner / permission metadata that
    /// SPG's view-rewrite engine handles uniformly; we accept
    /// and discard. Returns `Ok(())` once a non-clause token is
    /// peeked (the caller then checks for the `VIEW` keyword).
    fn consume_mysql_view_prefix(&mut self) -> Result<(), ParseError> {
        loop {
            match self.peek().clone() {
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("algorithm") => {
                    self.advance(); // ALGORITHM
                    // Optional `=`. MySQL spec requires it but be
                    // generous.
                    if matches!(self.peek(), Token::Eq) {
                        self.advance();
                    }
                    // UNDEFINED / MERGE / TEMPTABLE — accept any
                    // bare ident; unknown values still parse so
                    // future MySQL versions don't break.
                    if matches!(
                        self.peek(),
                        Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                    ) {
                        self.advance();
                    }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("definer") => {
                    self.advance(); // DEFINER
                    if matches!(self.peek(), Token::Eq) {
                        self.advance();
                    }
                    // User: quoted string, ident, OR ident @ host
                    // (host may itself be quoted or bare).
                    match self.peek().clone() {
                        Token::String(_) | Token::Ident(_) | Token::QuotedIdent(_) => {
                            self.advance();
                            // Optional `@host`.
                            if matches!(self.peek(), Token::At) {
                                self.advance();
                                if matches!(
                                    self.peek(),
                                    Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                                ) {
                                    self.advance();
                                }
                            }
                        }
                        _ => {}
                    }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("sql") => {
                    // `SQL SECURITY {DEFINER|INVOKER}`. Only honoured
                    // when followed by SECURITY — the dispatcher must
                    // not consume a bare `SQL` token (it's not a
                    // legal CREATE prefix on its own).
                    let save = self.pos;
                    self.advance(); // SQL
                    if matches!(self.peek(), Token::Ident(s2) | Token::QuotedIdent(s2)
                        if s2.eq_ignore_ascii_case("security"))
                    {
                        self.advance(); // SECURITY
                        // DEFINER / INVOKER trailing ident.
                        if matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_)) {
                            self.advance();
                        }
                    } else {
                        // Not a SQL SECURITY clause — roll back and
                        // bail; the caller will error out cleanly.
                        self.pos = save;
                        return Ok(());
                    }
                }
                _ => return Ok(()),
            }
        }
    }

    fn parse_if_not_exists(&mut self) -> bool {
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("if"))
        {
            let save = self.pos;
            self.advance();
            if matches!(self.peek(), Token::Not) {
                self.advance();
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("exists"))
                {
                    self.advance();
                    return true;
                }
            }
            self.pos = save;
        }
        false
    }

    fn parse_if_exists(&mut self) -> bool {
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("if"))
        {
            let save = self.pos;
            self.advance();
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("exists"))
            {
                self.advance();
                return true;
            }
            self.pos = save;
        }
        false
    }

    /// v7.12.4 — body of `CREATE [OR REPLACE] TRIGGER`. The
    /// `[OR REPLACE]` flag and the `TRIGGER` keyword have already
    /// been consumed.
    fn parse_create_trigger_after_keyword(
        &mut self,
        or_replace: bool,
    ) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        let timing = {
            let ident = self.expect_ident_like()?;
            if ident.eq_ignore_ascii_case("before") {
                TriggerTiming::Before
            } else if ident.eq_ignore_ascii_case("after") {
                TriggerTiming::After
            } else if ident.eq_ignore_ascii_case("instead") {
                let next = self.expect_ident_like()?;
                if !next.eq_ignore_ascii_case("of") {
                    return Err(self.err(alloc::format!(
                        "expected OF after INSTEAD in trigger timing, got {next:?}"
                    )));
                }
                TriggerTiming::InsteadOf
            } else {
                return Err(self.err(alloc::format!(
                    "expected BEFORE / AFTER / INSTEAD OF in trigger timing, got {ident:?}"
                )));
            }
        };
        // Events: INSERT [ OR UPDATE [ OR DELETE [ OR TRUNCATE ] ] ].
        // OR is a reserved keyword token (Token::Or), not an Ident.
        // v7.13.0 — after an UPDATE event we may optionally see
        // `OF col, col, …` (mailrs round-5 G7). Columns are
        // captured into `update_columns` once across the whole
        // events list; multiple `UPDATE OF` clauses are rejected.
        let mut events: Vec<TriggerEvent> = Vec::new();
        let mut update_columns: Vec<String> = Vec::new();
        let (first_ev, first_cols) = self.parse_trigger_event_with_optional_of()?;
        events.push(first_ev);
        if !first_cols.is_empty() {
            update_columns = first_cols;
        }
        while matches!(self.peek(), Token::Or) {
            self.advance();
            let (ev, cols) = self.parse_trigger_event_with_optional_of()?;
            events.push(ev);
            if !cols.is_empty() {
                if !update_columns.is_empty() {
                    return Err(
                        self.err("CREATE TRIGGER: `UPDATE OF cols` may appear at most once".into())
                    );
                }
                update_columns = cols;
            }
        }
        // ON <table>
        let tok = self.peek();
        let Token::On = tok else {
            return Err(self.err(alloc::format!(
                "expected ON after trigger events, got {tok:?}"
            )));
        };
        self.advance();
        let table = self.expect_ident_like()?;
        // v7.39 (read01 round 82) — a CONSTRAINT TRIGGER may carry `FROM
        // reftable` and `[NOT] DEFERRABLE [INITIALLY {DEFERRED|IMMEDIATE}]`
        // between the table and FOR EACH ROW. Accept and skip them: SPG fires
        // the trigger as a plain AFTER trigger (correct for every non-deferred
        // use; deferral timing is not yet honoured).
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
            if s.eq_ignore_ascii_case("from"))
        {
            self.advance();
            let _reftable = self.expect_ident_like()?;
        }
        self.consume_optional_deferrable_clauses()?;
        // FOR EACH ROW / FOR EACH STATEMENT. FOR is a reserved
        // keyword (Token::For); EACH / ROW / STATEMENT are bare
        // idents.
        if !matches!(self.peek(), Token::For) {
            return Err(self.err(alloc::format!(
                "expected FOR EACH ROW / STATEMENT, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let for_each = {
            let e = self.expect_ident_like()?;
            if !e.eq_ignore_ascii_case("each") {
                return Err(self.err(alloc::format!("expected EACH after FOR, got {e:?}")));
            }
            let unit = self.expect_ident_like()?;
            if unit.eq_ignore_ascii_case("row") {
                TriggerForEach::Row
            } else if unit.eq_ignore_ascii_case("statement") {
                TriggerForEach::Statement
            } else {
                return Err(self.err(alloc::format!(
                    "expected ROW / STATEMENT after FOR EACH, got {unit:?}"
                )));
            }
        };
        // v7.39 (round 138) — optional `WHEN ( condition )` before EXECUTE.
        let when_condition = if matches!(self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("when"))
        {
            self.advance();
            Some(self.parse_paren_expr("WHEN")?)
        } else {
            None
        };
        // EXECUTE FUNCTION/PROCEDURE name(...)
        let exec = self.expect_ident_like()?;
        if !exec.eq_ignore_ascii_case("execute") {
            return Err(self.err(alloc::format!(
                "expected EXECUTE FUNCTION/PROCEDURE in CREATE TRIGGER, got {exec:?}"
            )));
        }
        let fn_or_proc = self.expect_ident_like()?;
        if !(fn_or_proc.eq_ignore_ascii_case("function")
            || fn_or_proc.eq_ignore_ascii_case("procedure"))
        {
            return Err(self.err(alloc::format!(
                "expected FUNCTION / PROCEDURE after EXECUTE, got {fn_or_proc:?}"
            )));
        }
        let function = self.expect_ident_like()?;
        // Optional empty arg list `()`.
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "v7.12.4 trigger function calls take no args; got {:?}",
                    self.peek()
                )));
            }
            self.advance();
        }
        Ok(Statement::CreateTrigger(CreateTriggerStatement {
            name,
            or_replace,
            timing,
            events,
            table,
            for_each,
            function,
            update_columns,
            when_condition,
        }))
    }

    /// v7.39 (round 139) — `CREATE RULE <name> AS ON <event> TO <table>
    /// [WHERE <cond>] DO [ALSO|INSTEAD] { NOTHING | cmd | ( cmd; … ) }`.
    fn parse_create_rule_after_keyword(
        &mut self,
        or_replace: bool,
    ) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        if !matches!(self.peek(), Token::As) {
            return Err(self.err(alloc::format!(
                "expected AS in CREATE RULE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(alloc::format!(
                "expected ON in CREATE RULE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let event = self.parse_rule_event()?;
        if !matches!(self.peek(), Token::To)
            && !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("to"))
        {
            return Err(self.err(alloc::format!(
                "expected TO after rule event, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;
        // Optional `WHERE <cond>` (no parentheses, unlike a trigger WHEN).
        let when_condition = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        if !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("do"))
        {
            return Err(self.err(alloc::format!(
                "expected DO in CREATE RULE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // `DO [ ALSO | INSTEAD ]` — ALSO is the default when neither is written.
        let instead = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("instead"))
        {
            self.advance();
            true
        } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("also")) {
            self.advance();
            false
        } else {
            false
        };
        // `NOTHING` | `( cmd; … )` | `cmd`.
        let commands = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nothing"))
        {
            self.advance();
            Vec::new()
        } else if matches!(self.peek(), Token::LParen) {
            self.advance();
            let mut cmds = Vec::new();
            loop {
                cmds.push(self.parse_one_statement()?);
                if matches!(self.peek(), Token::Semicolon) {
                    self.advance();
                    if matches!(self.peek(), Token::RParen) {
                        break;
                    }
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ) closing the CREATE RULE command list, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            cmds
        } else {
            alloc::vec![self.parse_one_statement()?]
        };
        Ok(Statement::CreateRule(crate::ast::CreateRuleStatement {
            name,
            or_replace,
            event,
            table,
            instead,
            when_condition,
            commands,
        }))
    }

    /// v7.39 (round 139) — a rule event keyword → uppercase string.
    fn parse_rule_event(&mut self) -> Result<alloc::string::String, ParseError> {
        if matches!(self.peek(), Token::Insert) {
            self.advance();
            return Ok(alloc::string::String::from("INSERT"));
        }
        if matches!(self.peek(), Token::Select) {
            self.advance();
            return Ok(alloc::string::String::from("SELECT"));
        }
        match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update") => {
                self.advance();
                Ok(alloc::string::String::from("UPDATE"))
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete") => {
                self.advance();
                Ok(alloc::string::String::from("DELETE"))
            }
            other => Err(self.err(alloc::format!(
                "expected INSERT / UPDATE / DELETE / SELECT in CREATE RULE, got {other:?}"
            ))),
        }
    }

    /// v7.13.0 — parse one trigger event, then optionally consume
    /// `OF col, col, …` after `UPDATE` (mailrs round-5 G7). Other
    /// events (INSERT/DELETE/TRUNCATE) don't accept the OF tail.
    fn parse_trigger_event_with_optional_of(
        &mut self,
    ) -> Result<(TriggerEvent, Vec<String>), ParseError> {
        let ev = self.parse_trigger_event()?;
        if !matches!(ev, TriggerEvent::Update) {
            return Ok((ev, Vec::new()));
        }
        // `OF` is a bare ident.
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("of")) {
            return Ok((ev, Vec::new()));
        }
        self.advance(); // OF
        let mut cols: Vec<String> = Vec::new();
        loop {
            cols.push(self.expect_ident_like()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        if cols.is_empty() {
            return Err(
                self.err("CREATE TRIGGER: `UPDATE OF` requires at least one column name".into())
            );
        }
        Ok((ev, cols))
    }

    /// v7.12.4 — `BEGIN stmt; stmt; … END[;]` PL/pgSQL block.
    /// v7.12.6 — optional `DECLARE var TYPE [:= init];` prelude
    /// before `BEGIN`, and IF / RAISE / embedded SQL statements
    /// inside the body.
    /// Called by [`parse_plpgsql_body`] after the body's tokens
    /// have been lexed into this temporary parser.
    pub(crate) fn parse_plpgsql_block(&mut self) -> Result<PlPgSqlBlock, ParseError> {
        // v7.12.6 — optional DECLARE prelude.
        let declarations = if matches!(
            self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("declare")
        ) {
            self.advance();
            self.parse_plpgsql_declare_block()?
        } else {
            Vec::new()
        };
        // BEGIN keyword (PL/pgSQL — distinct from the SQL
        // `BEGIN` transaction-start, but we can reuse the
        // reserved Token::Begin since the body is a separate
        // lex/parse context).
        if !matches!(self.peek(), Token::Begin) {
            return Err(self.err(alloc::format!(
                "expected BEGIN at start of plpgsql block, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let statements = self.parse_plpgsql_stmt_list_until_end()?;
        // v7.37.20 (20.10) — optional EXCEPTION clause between the
        // body's last statement and the trailing END. When present
        // it's a series of `WHEN <cond> [OR <cond>]* THEN <body>`
        // arms terminated by END.
        let exception_handlers = if matches!(
            self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("exception")
        ) {
            self.advance();
            self.parse_plpgsql_exception_handlers()?
        } else {
            Vec::new()
        };
        Ok(PlPgSqlBlock {
            declarations,
            statements,
            exception_handlers,
        })
    }

    /// v7.37.20 (20.10) — parse EXCEPTION handlers `WHEN <cond>
    /// [OR <cond>]* THEN <body>` sequence up to the trailing END.
    fn parse_plpgsql_exception_handlers(
        &mut self,
    ) -> Result<Vec<crate::ast::ExceptionHandler>, ParseError> {
        let mut out: Vec<crate::ast::ExceptionHandler> = Vec::new();
        loop {
            // Stop at END — the block-level trailing END LOOP / END;
            // is handled by the caller.
            if matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("end")
            ) {
                return Ok(out);
            }
            // WHEN <cond> [OR <cond>]* THEN <body>
            if !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("when"))
            {
                return Err(self.err(alloc::format!(
                    "expected WHEN or END inside EXCEPTION clause, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut conditions: Vec<String> = Vec::new();
            conditions.push(self.expect_ident_like()?);
            while matches!(self.peek(), Token::Or) {
                self.advance();
                conditions.push(self.expect_ident_like()?);
            }
            let then_kw = self.expect_ident_like()?;
            if !then_kw.eq_ignore_ascii_case("then") {
                return Err(self.err(alloc::format!(
                    "expected THEN after WHEN condition list, got {then_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            out.push(crate::ast::ExceptionHandler { conditions, body });
        }
    }

    /// v7.12.6 — parse the `DECLARE ... [var TYPE [:= init];]+`
    /// prelude. Caller has already consumed `DECLARE`. We stop
    /// reading entries when we hit `BEGIN`.
    fn parse_plpgsql_declare_block(&mut self) -> Result<Vec<PlPgSqlDeclare>, ParseError> {
        let mut out: Vec<PlPgSqlDeclare> = Vec::new();
        loop {
            if matches!(self.peek(), Token::Begin) {
                return Ok(out);
            }
            let name = self.expect_ident_like()?;
            // v7.37.20 (20.7) — type inference: if the next token is
            // `:=` or `=` (no explicit type), infer from the default
            // expression. Otherwise the ident that follows is the
            // declared type.
            //
            // v7.37.20 (20.8) — `<table>.<col>%TYPE` / `<table>%ROWTYPE`
            // (PG-standard). SPG parse-accepts and treats identically
            // to inference — the eventual runtime value determines
            // the local's type, which is faithful to how SPG handles
            // untyped locals today (see 20.7). Full compile-time
            // catalog lookup queues with v7.40 PL/pgSQL epic.
            let ty = if matches!(self.peek(), Token::ColonEq | Token::Eq) {
                // Sentinel: `FunctionArgType::Raw("_infer_")` tells the
                // downstream declaration walker to type the local by
                // the runtime type of the default expression.
                FunctionArgType::Raw("_infer_".into())
            } else {
                let ty_token = self.expect_ident_like()?;
                // Detect `<ident>[.<ident>][%TYPE | %ROWTYPE]`:
                // consume optional `.<ident>` qualifier + `%<KW>`
                // suffix. Both qualifier and suffix map to _infer_.
                if matches!(self.peek(), Token::Dot) {
                    self.advance();
                    let _ = self.expect_ident_like()?;
                }
                if matches!(self.peek(), Token::Percent) {
                    self.advance();
                    // Consume the trailing TYPE / ROWTYPE ident.
                    let _ = self.expect_ident_like()?;
                    FunctionArgType::Raw("_infer_".into())
                } else {
                    match map_type_ident_to_column_type_name(&ty_token) {
                        Some(t) => FunctionArgType::Typed(t),
                        None => FunctionArgType::Raw(ty_token),
                    }
                }
            };
            let default = match self.peek() {
                Token::ColonEq => {
                    self.advance();
                    Some(self.parse_expr(0)?)
                }
                Token::Eq => {
                    // PL/pgSQL also accepts `=` for the
                    // DECLARE default (PG treats them the same
                    // in this position).
                    self.advance();
                    Some(self.parse_expr(0)?)
                }
                _ => None,
            };
            // Mandatory `;` between declarations.
            if !matches!(self.peek(), Token::Semicolon) {
                return Err(self.err(alloc::format!(
                    "expected ; after DECLARE entry for {name:?}, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            out.push(PlPgSqlDeclare { name, ty, default });
        }
    }

    /// v7.12.6 — parse PL/pgSQL statements up to (and consuming)
    /// the terminating `END;` (or `END IF;` etc — handled by the
    /// per-construct sub-parsers). Used by both the outer block
    /// and the IF/ELSE branch bodies.
    fn parse_plpgsql_stmt_list_until_end(&mut self) -> Result<Vec<PlPgSqlStmt>, ParseError> {
        let mut statements: Vec<PlPgSqlStmt> = Vec::new();
        loop {
            // Allow trailing semicolons + END.
            while matches!(self.peek(), Token::Semicolon) {
                self.advance();
            }
            // END / ELSE / ELSIF / EXCEPTION — handled by the caller.
            if matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("end")
                        || s.eq_ignore_ascii_case("else")
                        || s.eq_ignore_ascii_case("elsif")
                        || s.eq_ignore_ascii_case("elseif")
                        || s.eq_ignore_ascii_case("exception")
                        || s.eq_ignore_ascii_case("when")
            ) {
                return Ok(statements);
            }
            // Otherwise: one statement, then expect `;` or
            // a block-terminator keyword.
            let stmt = self.parse_plpgsql_stmt()?;
            statements.push(stmt);
            match self.peek() {
                Token::Semicolon => {
                    self.advance();
                }
                Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("end")
                        || s.eq_ignore_ascii_case("else")
                        || s.eq_ignore_ascii_case("elsif")
                        || s.eq_ignore_ascii_case("elseif")
                        || s.eq_ignore_ascii_case("exception")
                        || s.eq_ignore_ascii_case("when") =>
                {
                    // Final statement of the block without `;`.
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected ; or END/ELSE/ELSIF after plpgsql statement, got {other:?}"
                    )));
                }
            }
        }
    }

    fn parse_plpgsql_stmt(&mut self) -> Result<PlPgSqlStmt, ParseError> {
        // RETURN keyword?
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("return"))
        {
            self.advance();
            return self.parse_plpgsql_return();
        }
        // v7.12.6 — IF block.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("if"))
        {
            self.advance();
            return self.parse_plpgsql_if();
        }
        // v7.37.20 (20.6) — FOR <var> IN EXECUTE <string_expr> LOOP.
        // Detected by peeking that token pos+3 is Ident("execute").
        if matches!(self.peek(), Token::For)
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            )
            && matches!(self.tokens.get(self.pos + 2), Some(Token::In))
            && matches!(
                self.tokens.get(self.pos + 3),
                Some(Token::Ident(s) | Token::QuotedIdent(s)) if s.eq_ignore_ascii_case("execute")
            )
        {
            self.advance(); // FOR
            let var = self.expect_ident_like()?;
            self.advance(); // IN
            self.advance(); // EXECUTE
            // Prescan for LOOP at paren depth 0 so parse_expr stops
            // before the LOOP keyword (same trick as the bare-SELECT
            // ForQuery arm).
            let mut depth: i32 = 0;
            let mut loop_pos: Option<usize> = None;
            let mut scan = self.pos;
            while scan < self.tokens.len() {
                match self.tokens.get(scan) {
                    Some(Token::LParen) => depth += 1,
                    Some(Token::RParen) => depth -= 1,
                    Some(Token::Ident(s) | Token::QuotedIdent(s))
                        if depth == 0 && s.eq_ignore_ascii_case("loop") =>
                    {
                        loop_pos = Some(scan);
                        break;
                    }
                    _ => {}
                }
                scan += 1;
            }
            let loop_pos = loop_pos.ok_or_else(|| {
                self.err(alloc::format!(
                    "FOR <var> IN EXECUTE <expr> ... LOOP: no LOOP keyword found"
                ))
            })?;
            let saved_loop = self.tokens[loop_pos].clone();
            self.tokens[loop_pos] = Token::Semicolon;
            let expr_result = self.parse_expr(0);
            self.tokens[loop_pos] = saved_loop;
            let sql_expr = expr_result?;
            let loop_kw = self.expect_ident_like()?;
            if !loop_kw.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected LOOP after FOR <var> IN EXECUTE <expr>, got {loop_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            let end_kw = self.expect_ident_like()?;
            if !end_kw.eq_ignore_ascii_case("end") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR IN EXECUTE body, got {end_kw:?}"
                )));
            }
            let loop_kw2 = self.expect_ident_like()?;
            if !loop_kw2.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR IN EXECUTE body, got END {loop_kw2:?}"
                )));
            }
            return Ok(PlPgSqlStmt::ForExecute {
                var,
                sql_expr,
                body,
            });
        }
        // v7.37.20 (20.5) — FOR <var> IN <SELECT> LOOP.
        //
        // Two syntactic forms:
        //   FOR var IN SELECT ... ORDER BY ... LOOP ...
        //   FOR var IN (SELECT ...) LOOP ...
        //
        // Bare-SELECT form: to keep parse_select_stmt from swallowing
        // the trailing `LOOP` keyword as a table alias, we prescan
        // forward to find LOOP at paren depth 0, splice a fake
        // Semicolon at that position (so SELECT parses cleanly),
        // then re-splice LOOP back in.
        //
        // Paren-wrapped form: parse `(` `SELECT ...` `)` then expect
        // LOOP directly — no scan required.
        if matches!(self.peek(), Token::For)
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            )
            && matches!(self.tokens.get(self.pos + 2), Some(Token::In))
            && (matches!(self.tokens.get(self.pos + 3), Some(Token::Select))
                || matches!(self.tokens.get(self.pos + 3), Some(Token::LParen)))
        {
            self.advance(); // FOR
            let var = self.expect_ident_like()?;
            // IN
            self.advance();
            let query = if matches!(self.peek(), Token::LParen) {
                // Paren-wrapped SELECT.
                self.advance();
                let inner = self.parse_select_stmt()?;
                let Statement::Select(q) = inner else {
                    return Err(self.err(alloc::format!(
                        "expected SELECT inside (…), got {:?}",
                        self.peek()
                    )));
                };
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after FOR-IN-SELECT body, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                q
            } else {
                // Bare SELECT: prescan to find the LOOP boundary.
                let mut depth: i32 = 0;
                let mut loop_pos: Option<usize> = None;
                let mut scan = self.pos;
                while scan < self.tokens.len() {
                    match self.tokens.get(scan) {
                        Some(Token::LParen) => depth += 1,
                        Some(Token::RParen) => depth -= 1,
                        Some(Token::Ident(s) | Token::QuotedIdent(s))
                            if depth == 0 && s.eq_ignore_ascii_case("loop") =>
                        {
                            loop_pos = Some(scan);
                            break;
                        }
                        _ => {}
                    }
                    scan += 1;
                }
                let loop_pos = loop_pos.ok_or_else(|| {
                    self.err(alloc::format!(
                        "FOR <var> IN <SELECT> ... LOOP: no LOOP keyword found"
                    ))
                })?;
                // Swap the LOOP token with a synthetic Semicolon so
                // parse_select_stmt stops there, then restore afterward.
                let saved_loop = self.tokens[loop_pos].clone();
                self.tokens[loop_pos] = Token::Semicolon;
                let parse_result = self.parse_select_stmt();
                self.tokens[loop_pos] = saved_loop;
                let inner = parse_result?;
                let Statement::Select(q) = inner else {
                    return Err(self.err(alloc::format!(
                        "expected SELECT after FOR <var> IN, got {:?}",
                        self.peek()
                    )));
                };
                q
            };
            let loop_kw = self.expect_ident_like()?;
            if !loop_kw.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected LOOP after FOR <var> IN <SELECT>, got {loop_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            let end_kw = self.expect_ident_like()?;
            if !end_kw.eq_ignore_ascii_case("end") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR IN SELECT body, got {end_kw:?}"
                )));
            }
            let loop_kw2 = self.expect_ident_like()?;
            if !loop_kw2.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR IN SELECT body, got END {loop_kw2:?}"
                )));
            }
            return Ok(PlPgSqlStmt::ForQuery {
                var,
                query: Box::new(query),
                body,
            });
        }
        // v7.37.20 (20.4) — FOR <var> IN [REVERSE] <start>..<end> LOOP.
        // FOR is a reserved keyword token (Token::For).
        if matches!(self.peek(), Token::For)
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            )
            && matches!(self.tokens.get(self.pos + 2), Some(Token::In))
        {
            self.advance(); // FOR
            let var = self.expect_ident_like()?;
            if !matches!(self.peek(), Token::In) {
                return Err(self.err(alloc::format!(
                    "expected IN after FOR <var>, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let reverse = matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("reverse")
            );
            if reverse {
                self.advance();
            }
            let start = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::DotDot) {
                return Err(self.err(alloc::format!(
                    "expected '..' between FOR loop bounds, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let end = self.parse_expr(0)?;
            let loop_kw = self.expect_ident_like()?;
            if !loop_kw.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected LOOP after FOR <var> IN start..end, got {loop_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            let end_kw = self.expect_ident_like()?;
            if !end_kw.eq_ignore_ascii_case("end") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR body, got {end_kw:?}"
                )));
            }
            let loop_kw2 = self.expect_ident_like()?;
            if !loop_kw2.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after FOR body, got END {loop_kw2:?}"
                )));
            }
            return Ok(PlPgSqlStmt::ForRange {
                var,
                start,
                end,
                reverse,
                body,
            });
        }
        // v7.37.20 (20.2) — bare `LOOP <body> END LOOP;`.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("loop"))
        {
            self.advance();
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            let end_kw = self.expect_ident_like()?;
            if !end_kw.eq_ignore_ascii_case("end") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after LOOP body, got {end_kw:?}"
                )));
            }
            let loop_kw = self.expect_ident_like()?;
            if !loop_kw.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after LOOP body, got END {loop_kw:?}"
                )));
            }
            return Ok(PlPgSqlStmt::Loop { body });
        }
        // v7.37.20 (20.2) — `EXIT [WHEN <cond>]` inside a loop.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("exit"))
        {
            self.advance();
            let when = if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("when"))
            {
                self.advance();
                Some(self.parse_expr(0)?)
            } else {
                None
            };
            return Ok(PlPgSqlStmt::Exit { when });
        }
        // v7.37.20 (20.13) — `EXECUTE <string_expr>`. Dispatches an
        // already-parsed Statement or a runtime-computed SQL string.
        // The disambiguator vs the extended-query-protocol `EXECUTE
        // <stmt_name>` (which is a top-level Statement, not a
        // plpgsql line) is that inside a DO block / trigger body the
        // EXECUTE keyword ALWAYS refers to dynamic SQL.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("execute"))
        {
            self.advance();
            let sql = self.parse_expr(0)?;
            return Ok(PlPgSqlStmt::ExecuteDynamic { sql });
        }
        // v7.37.20 (20.2) — `CONTINUE [WHEN <cond>]` inside a loop.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("continue"))
        {
            self.advance();
            let when = if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("when"))
            {
                self.advance();
                Some(self.parse_expr(0)?)
            } else {
                None
            };
            return Ok(PlPgSqlStmt::Continue { when });
        }
        // v7.37.20 (20.3) — WHILE <cond> LOOP <body> END LOOP.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("while"))
        {
            self.advance();
            let condition = self.parse_expr(0)?;
            let loop_kw = self.expect_ident_like()?;
            if !loop_kw.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected LOOP after WHILE <condition>, got {loop_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            // Expect END LOOP.
            let end_kw = self.expect_ident_like()?;
            if !end_kw.eq_ignore_ascii_case("end") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after WHILE body, got {end_kw:?}"
                )));
            }
            let loop_kw2 = self.expect_ident_like()?;
            if !loop_kw2.eq_ignore_ascii_case("loop") {
                return Err(self.err(alloc::format!(
                    "expected END LOOP after WHILE body, got END {loop_kw2:?}"
                )));
            }
            return Ok(PlPgSqlStmt::While { condition, body });
        }
        // v7.12.6 — RAISE.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("raise"))
        {
            self.advance();
            return self.parse_plpgsql_raise();
        }
        // v7.37.20 (20.14) — ASSERT <cond> [, <msg>].
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("assert"))
        {
            self.advance();
            let condition = self.parse_expr(0)?;
            let message = if matches!(self.peek(), Token::Comma) {
                self.advance();
                Some(self.parse_expr(0)?)
            } else {
                None
            };
            return Ok(PlPgSqlStmt::Assert { condition, message });
        }
        // v7.37.20 (20.12) — PERFORM <select>. Per PG docs:
        //   "PERFORM is equivalent to SELECT but discards the
        //    result." Side effects (function calls, RAISE inside
        //    SQL functions, etc.) still execute. We desugar to
        //    `SELECT <body>` and wrap in EmbeddedSql so the engine's
        //    existing embedded-statement path handles execution +
        //    result-discard cleanly. The result is naturally
        //    discarded because EmbeddedSql doesn't propagate row
        //    sets back to the plpgsql interpreter.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("perform"))
        {
            self.advance();
            // Splice a synthetic Token::Select into the stream at
            // the current position so parse_select_stmt parses the
            // remainder as a normal SELECT body. Token-stream
            // surgery mirrors the try_parse_plpgsql_select_into
            // pattern used for SELECT … INTO desugaring.
            self.tokens.insert(self.pos, Token::Select);
            let select = self.parse_select_stmt()?;
            let Statement::Select(s) = select else {
                return Err(self.err(alloc::format!(
                    "expected SELECT body after PERFORM, got {:?}",
                    self.peek()
                )));
            };
            return Ok(PlPgSqlStmt::EmbeddedSql(Box::new(Statement::Select(s))));
        }
        // v7.16.2 — `SELECT <projection> INTO <var> [FROM …]`
        // plpgsql-specific shape (mailrs round-10 migrate-042).
        // PG's SELECT INTO at top-level SQL would CREATE a new
        // table; inside plpgsql it ASSIGNS the query result to
        // a local variable. We detect the INTO at paren-depth
        // 0 between SELECT and the statement boundary; if
        // found, split the token stream into "pre-INTO
        // projection" + "var" + "post-INTO FROM/WHERE…" and
        // rebuild as a SelectInto with a regular SELECT body
        // (no INTO clause).
        if matches!(self.peek(), Token::Select)
            && let Some((select_body, var_name)) = self.try_parse_plpgsql_select_into()?
        {
            return Ok(PlPgSqlStmt::SelectInto {
                var: var_name,
                body: Box::new(select_body),
            });
        }
        // v7.12.6 — embedded SQL statements. INSERT/UPDATE/DELETE/
        // SELECT can appear directly inside a trigger body; we
        // recurse into the regular Statement parser, which will
        // stop at the trailing `;` (which our caller then
        // consumes).
        // v7.16.2 — top-level DO blocks (mailrs round-10 A.2)
        // also embed ALTER / CREATE / DROP statements; route
        // those through the same parser so the DO body parses
        // cleanly.
        if matches!(self.peek(), Token::Insert)
            || matches!(self.peek(), Token::Select)
            || matches!(self.peek(), Token::Create)
            || matches!(self.peek(), Token::Drop)
            || matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("update")
                    || s.eq_ignore_ascii_case("delete")
                    || s.eq_ignore_ascii_case("alter"))
        {
            let stmt = self.parse_one_statement()?;
            return Ok(PlPgSqlStmt::EmbeddedSql(Box::new(stmt)));
        }
        // Otherwise: assignment. `NEW.col` / `OLD.col` / `var`
        // followed by `:=` and an expression.
        let target = self.parse_plpgsql_assign_target()?;
        // PL/pgSQL assignment uses `:=`. The lexer represents
        // this as a colon followed by `=`; check both shapes.
        match self.peek() {
            Token::ColonEq => {
                self.advance();
            }
            Token::Colon => {
                self.advance();
                if !matches!(self.peek(), Token::Eq) {
                    return Err(self.err(alloc::format!(
                        "expected := after plpgsql assign target, got `:` then {:?}",
                        self.peek()
                    )));
                }
                self.advance();
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected := after plpgsql assign target, got {other:?}"
                )));
            }
        }
        let value = self.parse_expr(0)?;
        Ok(PlPgSqlStmt::Assign { target, value })
    }

    /// v7.12.6 — `IF cond THEN body [ELSIF cond THEN body]*
    /// [ELSE body] END IF`. `IF` keyword already consumed.
    fn parse_plpgsql_if(&mut self) -> Result<PlPgSqlStmt, ParseError> {
        let mut branches: Vec<(Expr, Vec<PlPgSqlStmt>)> = Vec::new();
        let mut else_branch: Vec<PlPgSqlStmt> = Vec::new();
        loop {
            // <expr> THEN
            let cond = self.parse_expr(0)?;
            let then_kw = self.expect_ident_like()?;
            if !then_kw.eq_ignore_ascii_case("then") {
                return Err(self.err(alloc::format!(
                    "expected THEN after IF/ELSIF condition, got {then_kw:?}"
                )));
            }
            let body = self.parse_plpgsql_stmt_list_until_end()?;
            branches.push((cond, body));
            // Look at terminator: ELSIF/ELSEIF, ELSE, or END IF.
            match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("elsif") || s.eq_ignore_ascii_case("elseif") =>
                {
                    self.advance();
                    continue;
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("else") => {
                    self.advance();
                    else_branch = self.parse_plpgsql_stmt_list_until_end()?;
                    break;
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("end") => {
                    break;
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected ELSIF / ELSE / END after IF branch body, got {other:?}"
                    )));
                }
            }
        }
        // Expect `END IF` (the END keyword is the one we're
        // looking at right now).
        let end_kw = self.expect_ident_like()?;
        if !end_kw.eq_ignore_ascii_case("end") {
            return Err(self.err(alloc::format!("expected END IF, got {end_kw:?}")));
        }
        let if_kw = self.expect_ident_like()?;
        if !if_kw.eq_ignore_ascii_case("if") {
            return Err(self.err(alloc::format!("expected END IF, got END {if_kw:?}")));
        }
        Ok(PlPgSqlStmt::If {
            branches,
            else_branch,
        })
    }

    /// v7.12.6 — `RAISE { NOTICE | WARNING | INFO | LOG | DEBUG
    /// | EXCEPTION } '<message>' [, args]*`. The `RAISE` keyword
    /// is already consumed.
    fn parse_plpgsql_raise(&mut self) -> Result<PlPgSqlStmt, ParseError> {
        let lvl_ident = self.expect_ident_like()?;
        let level = match lvl_ident.to_ascii_lowercase().as_str() {
            "notice" => RaiseLevel::Notice,
            "warning" => RaiseLevel::Warning,
            "info" => RaiseLevel::Info,
            "log" => RaiseLevel::Log,
            "debug" => RaiseLevel::Debug,
            "exception" => RaiseLevel::Exception,
            other => {
                return Err(self.err(alloc::format!(
                    "expected RAISE level (NOTICE/WARNING/INFO/LOG/DEBUG/EXCEPTION), got {other:?}"
                )));
            }
        };
        // Message: required for v7.12.6. PG accepts a bare
        // RAISE-rethrow form (no message), reserved for future
        // RAISE-no-args support.
        let Token::String(msg) = self.peek() else {
            return Err(self.err(alloc::format!(
                "expected RAISE message string, got {:?}",
                self.peek()
            )));
        };
        let message = msg.clone();
        self.advance();
        // Optional comma-separated args (PG `%` format substitution).
        let mut args: Vec<Expr> = Vec::new();
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            args.push(self.parse_expr(0)?);
        }
        Ok(PlPgSqlStmt::Raise {
            level,
            message,
            args,
        })
    }

    /// v7.16.2 — scan ahead for a plpgsql-flavoured `SELECT
    /// <projection> INTO <var> [FROM …]` (mailrs round-10
    /// migrate-042). Returns `(rebuilt_select_without_into,
    /// var_name)` when the pattern matches; `None` for
    /// regular SELECTs (those go through the embedded-SQL
    /// path). Token-stream surgery so the rebuilt SELECT
    /// parses through the regular `parse_select_stmt`.
    #[allow(clippy::too_many_lines)]
    fn try_parse_plpgsql_select_into(
        &mut self,
    ) -> Result<Option<(SelectStatement, String)>, ParseError> {
        // Scan forward from `self.pos + 1` (past Token::Select)
        // for Token::Into at paren-depth 0, stopping at the
        // first `;`, `END`, `ELSE`, `ELSIF` keyword that would
        // end the plpgsql statement.
        let start = self.pos;
        let mut into_pos: Option<usize> = None;
        let mut depth: i32 = 0;
        let mut i = start + 1;
        while i < self.tokens.len() {
            match &self.tokens[i] {
                Token::LParen => depth += 1,
                Token::RParen => depth -= 1,
                Token::Semicolon if depth == 0 => break,
                Token::Ident(s)
                    if depth == 0
                        && (s.eq_ignore_ascii_case("end")
                            || s.eq_ignore_ascii_case("else")
                            || s.eq_ignore_ascii_case("elsif")) =>
                {
                    break;
                }
                Token::Into if depth == 0 => {
                    into_pos = Some(i);
                    break;
                }
                _ => {}
            }
            i += 1;
        }
        let Some(into_at) = into_pos else {
            return Ok(None);
        };
        // The token immediately after INTO must be the target
        // var ident; anything else (e.g. INSERT INTO table)
        // ruled out by the depth-0 check above. Capture it.
        let var = match self.tokens.get(into_at + 1) {
            Some(Token::Ident(s) | Token::QuotedIdent(s)) => s.clone(),
            other => {
                return Err(self.err(alloc::format!(
                    "expected variable name after SELECT … INTO, got {other:?}"
                )));
            }
        };
        // Find the end of the plpgsql SELECT INTO statement —
        // same boundary rules as the depth-0 scan above.
        let mut end = into_at + 2;
        let mut depth2: i32 = 0;
        while end < self.tokens.len() {
            match &self.tokens[end] {
                Token::LParen => depth2 += 1,
                Token::RParen => depth2 -= 1,
                Token::Semicolon if depth2 == 0 => break,
                Token::Ident(s)
                    if depth2 == 0
                        && (s.eq_ignore_ascii_case("end")
                            || s.eq_ignore_ascii_case("else")
                            || s.eq_ignore_ascii_case("elsif")) =>
                {
                    break;
                }
                _ => {}
            }
            end += 1;
        }
        // Rebuild a token stream that represents the SELECT
        // WITHOUT the INTO clause: [SELECT .. up-to-INTO] + [
        // post-var tokens up to statement end]. Run the
        // regular `parse_select_stmt` against it.
        let mut rebuilt: Vec<Token> = Vec::with_capacity(end - start);
        for j in start..into_at {
            rebuilt.push(self.tokens[j].clone());
        }
        for j in (into_at + 2)..end {
            rebuilt.push(self.tokens[j].clone());
        }
        rebuilt.push(Token::Eof);
        let saved_pos = self.pos;
        let saved_tokens = core::mem::replace(&mut self.tokens, rebuilt);
        self.pos = 0;
        // parse_select_stmt → parse_bare_select consumes Token::Select itself.
        if !matches!(self.peek(), Token::Select) {
            self.tokens = saved_tokens;
            self.pos = saved_pos;
            return Err(self.err("plpgsql SELECT … INTO: rebuilt stream missing SELECT".into()));
        }
        let sel = self.parse_select_stmt();
        self.tokens = saved_tokens;
        self.pos = end;
        let sel = sel?;
        let Statement::Select(body) = sel else {
            return Err(self.err(alloc::format!(
                "plpgsql SELECT … INTO: rebuilt SELECT did not produce a Select node, got {sel:?}"
            )));
        };
        Ok(Some((body, var)))
    }

    fn parse_plpgsql_assign_target(&mut self) -> Result<AssignTarget, ParseError> {
        // v7.16.1 — read the head token DIRECTLY rather than
        // via `expect_ident_like`. The v7.14.0 schema-qualifier
        // strip (`public.t` → `t`) inside `expect_ident_like`
        // greedily consumes any `ident . ident` pair, which
        // silently turned every `NEW.col := …` /
        // `OLD.col := …` plpgsql assignment into a Local("col")
        // assignment — the head "new"/"old" was eaten as if it
        // were a schema name and the Dot was consumed too, so
        // this function's own `peek() == Token::Dot` check
        // below never fired. Every BEFORE trigger that rewrote
        // a NEW cell was a silent no-op for two major releases
        // (v7.14.0 + v7.15.0) until the e2e_trigger workspace-
        // gate failures were investigated as v7.16.1 backlog.
        let head = match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) => s,
            other => {
                return Err(self.err(alloc::format!(
                    "expected NEW / OLD / <local_var> as plpgsql assign target, got {other:?}"
                )));
            }
        };
        if matches!(self.peek(), Token::Dot) {
            self.advance();
            let col = self.expect_ident_like()?;
            if head.eq_ignore_ascii_case("new") {
                return Ok(AssignTarget::NewColumn(col));
            }
            if head.eq_ignore_ascii_case("old") {
                return Ok(AssignTarget::OldColumn(col));
            }
            return Err(self.err(alloc::format!(
                "plpgsql assign target must be NEW.<col> / OLD.<col> / <local_var>; \
                 got {head:?}.<col>"
            )));
        }
        Ok(AssignTarget::Local(head))
    }

    fn parse_plpgsql_return(&mut self) -> Result<PlPgSqlStmt, ParseError> {
        // RETURN NEW / OLD / NULL — bare-ident forms.
        match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("new") => {
                self.advance();
                return Ok(PlPgSqlStmt::Return(ReturnTarget::New));
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("old") => {
                self.advance();
                return Ok(PlPgSqlStmt::Return(ReturnTarget::Old));
            }
            Token::Null => {
                self.advance();
                return Ok(PlPgSqlStmt::Return(ReturnTarget::Null));
            }
            // Bare `RETURN;` (no value) — treated as `RETURN NULL`
            // per PL/pgSQL convention.
            Token::Semicolon => {
                return Ok(PlPgSqlStmt::Return(ReturnTarget::Null));
            }
            _ => {}
        }
        // v7.37.20 (20.11) — RETURN QUERY <select> / RETURN QUERY
        // EXECUTE <expr>. In a DO block context RETURN QUERY has no
        // caller-visible effect (blocks don't return sets), so we
        // desugar it identically to PERFORM: parse the SELECT (or
        // EXECUTE dynamic) as embedded SQL that runs for side
        // effects and discards the result. RETURN NEXT <expr>
        // (single-row accumulator) queues with v7.40 SETOF function
        // infrastructure.
        // v7.39 (read01 round 66) — `RETURN NEXT <expr>`: append a row to the set
        // and keep going.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("next"))
        {
            self.advance();
            let e = self.parse_expr(0)?;
            return Ok(PlPgSqlStmt::ReturnNext(e));
        }
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("query"))
        {
            self.advance();
            // v7.39 (read01 round 68) — `RETURN QUERY EXECUTE <sql expr>`: the
            // rows go to the set, like the static form. It used to desugar to a
            // bare ExecuteDynamic, whose result was DISCARDED.
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("execute"))
            {
                self.advance();
                let sql = self.parse_expr(0)?;
                return Ok(PlPgSqlStmt::ReturnQueryExecute { sql });
            }
            // Bare RETURN QUERY <select>. If the current token is
            // not already SELECT (e.g., the user wrote `RETURN QUERY
            // <projection> FROM ...` in a shorthand — rare but PG
            // accepts a bare projection here), splice one in. Same
            // trick as PERFORM.
            if !matches!(self.peek(), Token::Select) {
                self.tokens.insert(self.pos, Token::Select);
            }
            let select = self.parse_select_stmt()?;
            let Statement::Select(s) = select else {
                return Err(self.err(alloc::format!(
                    "expected SELECT body after RETURN QUERY, got {:?}",
                    self.peek()
                )));
            };
            // v7.39 (read01 round 66) — a REAL statement now. It used to desugar
            // to an embedded side-effect SELECT whose rows were DISCARDED, which
            // in a SETOF function is the entire answer thrown away.
            return Ok(PlPgSqlStmt::ReturnQuery(Box::new(s)));
        }
        // Fall through: parse a full expression.
        let e = self.parse_expr(0)?;
        Ok(PlPgSqlStmt::Return(ReturnTarget::Expr(e)))
    }

    fn parse_trigger_event(&mut self) -> Result<TriggerEvent, ParseError> {
        // INSERT is a reserved Token; UPDATE / DELETE / TRUNCATE
        // are ident-shaped (the parser keys off case-insensitive
        // match — same shape used by the top-level Update / Delete
        // dispatchers at parse_one_statement).
        if matches!(self.peek(), Token::Insert) {
            self.advance();
            return Ok(TriggerEvent::Insert);
        }
        match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update") => {
                self.advance();
                Ok(TriggerEvent::Update)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete") => {
                self.advance();
                Ok(TriggerEvent::Delete)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("truncate") => {
                self.advance();
                Ok(TriggerEvent::Truncate)
            }
            other => Err(self.err(alloc::format!(
                "expected INSERT / UPDATE / DELETE / TRUNCATE in trigger event list, got {other:?}"
            ))),
        }
    }

    /// v6.1.2 → v6.1.3 — `CREATE PUBLICATION <name>` body. Accepts:
    ///   - (no clause) → implicit `FOR ALL TABLES`
    ///   - `FOR ALL TABLES`
    ///   - `FOR ALL TABLES EXCEPT t1, t2, …` (v6.1.3)
    ///   - `FOR TABLE t1, t2, …` (v6.1.3) — `FOR TABLES …` also
    ///     accepted as an SPG lenience. PG18-measured (round 753): PG
    ///     REJECTS the bare plural (`invalid publication object list`,
    ///     TABLES only pairs with IN SCHEMA); the old note claimed an
    ///     unverifiable "PG 19 accepts both". Ledgered, not load-bearing.
    fn parse_create_publication_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let name = self.expect_ident_or_string()?;
        // Bare DDL maps to FOR ALL TABLES — matches the v6.1.2
        // shape so existing publications keep parsing identically.
        let scope = if matches!(self.peek(), Token::For) {
            self.advance();
            if matches!(self.peek(), Token::All) {
                self.advance();
                if !matches!(self.peek(), Token::Tables) {
                    return Err(self.err(format!(
                        "expected TABLES after FOR ALL, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if matches!(self.peek(), Token::Except) {
                    self.advance();
                    let tables = self.parse_publication_table_list()?;
                    PublicationScope::AllTablesExcept(tables)
                } else {
                    PublicationScope::AllTables
                }
            } else if matches!(self.peek(), Token::Table) {
                self.advance();
                let tables = self.parse_publication_table_list()?;
                PublicationScope::ForTables(tables)
            } else if matches!(self.peek(), Token::Tables) {
                // v7.39 (round 754, F31-B5) — PG18-measured: the bare
                // plural (`FOR TABLES t`) is REJECTED (`invalid
                // publication object list`); TABLES only pairs with
                // `IN SCHEMA`. The old arm accepted it on an
                // unverifiable "PG 19 accepts both" claim.
                self.advance();
                if !matches!(self.peek(), Token::In) {
                    return Err(self.err(alloc::string::String::from(
                        "invalid publication object list",
                    )));
                }
                self.advance();
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("schema")) {
                    return Err(self.err(format!(
                        "expected SCHEMA after FOR TABLES IN, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let schema = self.expect_ident_or_string()?;
                PublicationScope::TablesInSchema(schema)
            } else {
                return Err(self.err(format!(
                    "expected ALL TABLES or TABLE <list> after FOR, got {:?}",
                    self.peek()
                )));
            }
        } else {
            PublicationScope::AllTables
        };
        Ok(Statement::CreatePublication(CreatePublicationStatement {
            name,
            scope,
        }))
    }

    /// v6.1.3 — Comma-separated identifier list for the publication
    /// FOR-clause. Requires at least one entry; empty list is a
    /// parse error (PG behaviour). Quoted idents are accepted; the
    /// names round-trip through `Display` as `quote_ident(name)`.
    ///
    /// v7.37.21 (21.2 + 21.3) — accept-and-discard the per-table
    /// `(col_list) WHERE (predicate)` modifiers PG 15+ emits in
    /// pg_dump output. SPG's publication state today is per-table
    /// only (matching the pre-PG-15 surface); the col list + WHERE
    /// are parsed so dumps load through and the table name reaches
    /// `PublicationScope::ForTables`, but the filter is not enforced
    /// at publish time. Re-open when a customer dogfood gate
    /// requires per-row-filter or column-subset publish semantics
    /// (which gates on persistent slot state landing first, 21.12).
    fn parse_publication_table_list(&mut self) -> Result<Vec<String>, ParseError> {
        let first = self.parse_publication_table_entry()?;
        let mut out = alloc::vec![first];
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            out.push(self.parse_publication_table_entry()?);
        }
        Ok(out)
    }

    /// One table entry inside a FOR TABLE clause:
    ///     tab_name [ (col, col, …) ] [ WHERE (predicate) ]
    /// Returns just the table name; the column list + WHERE predicate
    /// are consumed and discarded per the parse-accept-discard
    /// commitment above.
    fn parse_publication_table_entry(&mut self) -> Result<String, ParseError> {
        let name = self.expect_ident_like()?;
        // Optional column list — `(col, col, …)`.
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            // Empty parens are a PG error too; require ≥ 1 column.
            let _ = self.expect_ident_like()?;
            while matches!(self.peek(), Token::Comma) {
                self.advance();
                let _ = self.expect_ident_like()?;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' to close publication column list, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
        }
        // Optional row filter — `WHERE (predicate)`.
        if matches!(self.peek(), Token::Where) {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected '(' after WHERE in publication row filter, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let _ = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' to close publication WHERE filter, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
        }
        Ok(name)
    }

    /// v6.1.4 — `CREATE SUBSCRIPTION <name>
    ///                 CONNECTION '<conn>'
    ///                 PUBLICATION <pub> [, <pub> ...]`.
    ///
    /// The clause order is fixed (CONNECTION first, then
    /// PUBLICATION) to match PG. No WITH-options accepted in
    /// v6.1.4 — `enabled` defaults to true, no other knobs ship.
    fn parse_create_subscription_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let name = self.expect_ident_or_string()?;
        if !matches!(self.peek(), Token::Connection) {
            return Err(self.err(format!(
                "expected CONNECTION after CREATE SUBSCRIPTION <name>, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let conn_str = self.expect_string_literal()?;
        if !matches!(self.peek(), Token::Publication) {
            return Err(self.err(format!(
                "expected PUBLICATION after CONNECTION '<conn>', got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // Reuse the publication FOR-list parser shape: at least one
        // identifier, comma-separated.
        let first = self.expect_ident_like()?;
        let mut publications = alloc::vec![first];
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            publications.push(self.expect_ident_like()?);
        }
        Ok(Statement::CreateSubscription(CreateSubscriptionStatement {
            name,
            conn_str,
            publications,
        }))
    }

    /// v6.1.7 — `WAIT FOR WAL POSITION <pos> [WITH TIMEOUT <ms>]`.
    /// All keywords after `WAIT` are bare idents in v6.1.x; no
    /// lexer churn. Both `<pos>` and `<ms>` are positive integers
    /// that fit `u64`.
    /// Parameter name in `SET <name>`. A GUC name may be dotted, but the
    /// qualifier is a *namespace* the app owns (`app.user_id`,
    /// `myapp.tenant` — the request-context / RLS pattern), NOT a schema
    /// to discard. So parse the raw segments here instead of
    /// `expect_ident_like`, which strips a leading `schema.` qualifier
    /// and would collapse `SET app.foo` to just `foo`. Standard GUCs are
    /// a single segment and round-trip unchanged.
    fn parse_set_param_name(&mut self) -> Result<String, ParseError> {
        let mut parts: alloc::vec::Vec<String> = alloc::vec::Vec::new();
        loop {
            let seg = match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => s,
                other if unreserved_keyword_text(&other).is_some() => {
                    unreserved_keyword_text(&other).unwrap()
                }
                other => {
                    return Err(ParseError {
                        message: format!("expected parameter name, got {other:?}"),
                        token_pos: self.consumed_pos(),
                    });
                }
            };
            parts.push(seg);
            if matches!(self.peek(), Token::Dot) {
                self.advance();
                continue;
            }
            break;
        }
        Ok(parts.join(".").to_ascii_lowercase())
    }

    fn parse_set_value(&mut self) -> Result<crate::ast::SetValue, ParseError> {
        Self::parse_set_value_inner(self)
    }

    fn parse_set_value_inner(&mut self) -> Result<crate::ast::SetValue, ParseError> {
        match self.advance() {
            Token::String(s) => Ok(crate::ast::SetValue::String(s)),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("default") => {
                Ok(crate::ast::SetValue::Default)
            }
            Token::Ident(s) | Token::QuotedIdent(s) => {
                let mut accum = s;
                while matches!(self.peek(), Token::Dot) {
                    self.advance();
                    let next = self.expect_ident_like()?;
                    accum.push('.');
                    accum.push_str(&next);
                }
                Ok(crate::ast::SetValue::Ident(accum))
            }
            Token::Integer(n) => Ok(crate::ast::SetValue::Number(n.to_string())),
            Token::Float(f) => Ok(crate::ast::SetValue::Number(f.to_string())),
            // v7.22 (mailrs round-13 gap 2) — PG boolean parameter
            // spellings that lex as keyword tokens, not idents:
            // `SET standard_conforming_strings = on` is in every
            // pg_dump preamble (`off` already lexes as an ident).
            // v7.39 (round 769, F31 tranche 5 #150) — `SET x TO DEFAULT`:
            // DEFAULT lexes as its keyword token, so the ident arm above
            // never saw it and the everyday reset form was a syntax error.
            Token::Default => Ok(crate::ast::SetValue::Default),
            Token::On => Ok(crate::ast::SetValue::Ident("on".to_string())),
            Token::True => Ok(crate::ast::SetValue::Ident("true".to_string())),
            Token::False => Ok(crate::ast::SetValue::Ident("false".to_string())),
            // v7.14.0 — MySQL session/user variable RHS
            // (e.g. `SET OLD_FOREIGN_KEY_CHECKS = @@FOREIGN_KEY_CHECKS`).
            // Wrap as Ident so the SET handler can record it; the
            // engine treats `@VAR` / `@@VAR` values as opaque
            // strings.
            Token::SessionVar(s) => Ok(crate::ast::SetValue::Ident(s)),
            // v7.14.0 — `SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO,STRICT_TRANS_TABLES'`
            // is the common MySQL preamble shape. Allow a `+` or
            // `-` prefix on negative numerics for parity with PG
            // (some param defaults are negative).
            Token::Minus => match self.advance() {
                Token::Integer(n) => Ok(crate::ast::SetValue::Number(alloc::format!("-{n}"))),
                Token::Float(f) => Ok(crate::ast::SetValue::Number(alloc::format!("-{f}"))),
                other => Err(self.err(format!(
                    "expected numeric after `-` in SET value, got {other:?}"
                ))),
            },
            other => Err(self.err(format!(
                "expected literal, identifier, or DEFAULT after `=` in SET, got {other:?}"
            ))),
        }
    }

    /// v7.38 轴 4 — `[ISOLATION LEVEL …] [READ ONLY|WRITE]
    /// [[NOT] DEFERRABLE]` modes after `SET TRANSACTION` or
    /// `START TRANSACTION` / `BEGIN`. Returns the isolation level
    /// (default `ReadCommitted` if no `ISOLATION LEVEL` clause was
    /// present). Modes are comma-separated per PG; SPG also
    /// accepts space-separated for tolerance. READ ONLY / WRITE
    /// / DEFERRABLE are parsed-and-ignored (recorded for future
    /// surface but not behaviorally honoured today).
    /// Parse the trailing `[ISOLATION LEVEL …] [READ ONLY|WRITE]
    /// [[NOT] DEFERRABLE]` modes of BEGIN / START TRANSACTION / SET
    /// TRANSACTION. Returns `Some(level)` only when an explicit `ISOLATION
    /// LEVEL` clause was given, so a bare `BEGIN` / `BEGIN READ ONLY` keeps the
    /// session default rather than forcing READ COMMITTED.
    fn parse_isolation_level_clauses(&mut self) -> Result<Option<IsolationLevel>, ParseError> {
        let mut level = IsolationLevel::default();
        let mut have_level = false;
        loop {
            // ISOLATION LEVEL …
            let saw_isolation =
                matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("isolation"));
            if saw_isolation {
                self.advance(); // ISOLATION
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("level")) {
                    return Err(self.err(alloc::format!(
                        "expected LEVEL after ISOLATION, got {:?}",
                        self.peek()
                    )));
                }
                self.advance(); // LEVEL
                // SERIALIZABLE | REPEATABLE READ | READ COMMITTED | READ UNCOMMITTED
                let w1 = self
                    .expect_ident_like()
                    .map_err(|e| self.err(alloc::format!("isolation level: {e:?}")))?;
                let lc = w1.to_ascii_lowercase();
                level = match lc.as_str() {
                    "serializable" => IsolationLevel::Serializable,
                    "repeatable" => {
                        // Expect READ
                        let w2 = self
                            .expect_ident_like()
                            .map_err(|e| self.err(alloc::format!("REPEATABLE …: {e:?}")))?;
                        if !w2.eq_ignore_ascii_case("read") {
                            return Err(self.err(alloc::format!(
                                "expected READ after REPEATABLE, got {w2:?}"
                            )));
                        }
                        IsolationLevel::RepeatableRead
                    }
                    "read" => {
                        let w2 = self
                            .expect_ident_like()
                            .map_err(|e| self.err(alloc::format!("READ …: {e:?}")))?;
                        match w2.to_ascii_lowercase().as_str() {
                            "committed" => IsolationLevel::ReadCommitted,
                            "uncommitted" => IsolationLevel::ReadUncommitted,
                            other => {
                                return Err(self.err(alloc::format!(
                                    "expected COMMITTED or UNCOMMITTED after READ, got {other:?}"
                                )));
                            }
                        }
                    }
                    other => {
                        return Err(self.err(alloc::format!("unknown isolation level {other:?}")));
                    }
                };
                have_level = true;
            } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("read")) {
                // READ ONLY | READ WRITE — parsed, not behaviorally honoured.
                self.advance();
                match self.peek().clone() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("only") => {
                        self.advance();
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("write") => {
                        self.advance();
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ONLY or WRITE after READ, got {other:?}"
                        )));
                    }
                }
            } else if matches!(self.peek(), Token::Not) {
                // NOT DEFERRABLE — `NOT` lexes as a reserved keyword.
                self.advance();
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("deferrable")) {
                    return Err(self.err(alloc::format!(
                        "expected DEFERRABLE after NOT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
            } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("deferrable"))
            {
                self.advance();
            } else {
                break;
            }
            // Optional comma between modes.
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            }
        }
        Ok(have_level.then_some(level))
    }

    fn parse_wait_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // FOR is a v6.1.2-reserved keyword (Token::For). The
        // other two are bare idents — they've never needed lexer
        // support and we keep it that way.
        if !matches!(self.peek(), Token::For) {
            return Err(self.err(format!("expected FOR after WAIT, got {:?}", self.peek())));
        }
        self.advance();
        self.expect_keyword_ident("wal")?;
        self.expect_keyword_ident("position")?;
        let pos = self.expect_u64_literal()?;
        let timeout_ms = if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with"))
        {
            self.advance();
            self.expect_keyword_ident("timeout")?;
            Some(self.expect_u64_literal()?)
        } else {
            None
        };
        Ok(Statement::WaitForWalPosition { pos, timeout_ms })
    }

    /// v6.1.7 helper — consume a `Token::Integer` and check it
    /// fits `u64`. WAL positions and millisecond timeouts are
    /// non-negative.
    fn expect_u64_literal(&mut self) -> Result<u64, ParseError> {
        match self.advance() {
            Token::Integer(n) if n >= 0 => Ok(n as u64),
            Token::Integer(n) => Err(ParseError {
                message: format!("expected non-negative integer, got {n}"),
                token_pos: self.consumed_pos(),
            }),
            other => Err(ParseError {
                message: format!("expected integer literal, got {other:?}"),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    /// `CREATE USER` body — name + WITH PASSWORD '<pw>' + optional
    /// ROLE '<role>' (defaults to readonly). All string slots accept
    /// either a quoted ident or a quoted string literal.
    /// `CREATE {USER|ROLE} name [WITH] [PASSWORD 'x'] [LOGIN|NOLOGIN]
    /// [INHERIT|NOINHERIT] [SUPERUSER|NOSUPERUSER] [ROLE 'admin']`.
    ///
    /// `is_user` = the statement said USER, which in PG means LOGIN by default.
    /// The legacy SPG `ROLE 'readwrite'` clause (the coarse read/write/admin
    /// wire role) still parses — it is a different axis from the PG attributes.
    /// v7.39 (round 547) — is this ALTER ROLE / DATABASE one of the
    /// SET forms? Peeks past the name (and an `IN DATABASE d`) for SET
    /// or RESET, so the plain attribute forms keep their old path.
    fn peeks_db_role_setting(&self) -> bool {
        let mut i = self.pos + 1; // past the object's name
        let word = |p: usize| -> Option<String> {
            match self.tokens.get(p) {
                Some(Token::Ident(s) | Token::QuotedIdent(s)) => Some(s.to_ascii_lowercase()),
                Some(Token::In) => Some(String::from("in")),
                _ => None,
            }
        };
        if word(i).as_deref() == Some("in") && word(i + 1).as_deref() == Some("database") {
            i += 3; // IN DATABASE <name>
        }
        matches!(word(i).as_deref(), Some("set" | "reset"))
    }

    fn parse_db_role_setting(&mut self, is_database: bool) -> Result<Statement, ParseError> {
        use crate::ast::SetDbRoleSettingStatement;
        // `ALTER ROLE ALL SET …` — ALL lexes as a KEYWORD, not an
        // identifier, so the ordinary name reader refuses it. Same trap
        // as TABLE / INDEX / FULL / DEFAULT before it.
        let name = if matches!(self.peek(), Token::All) {
            self.advance();
            String::from("all")
        } else {
            self.expect_ident_or_string()?
        };
        // `ALTER ROLE ALL SET …` is PG's every-role scope (oid 0).
        let all = name.eq_ignore_ascii_case("all");
        let (mut database, mut role) = if is_database {
            (Some(name), None)
        } else if all {
            (None, None)
        } else {
            (None, Some(name))
        };
        if matches!(self.peek(), Token::In) {
            self.advance();
            self.advance(); // DATABASE
            database = Some(self.expect_ident_or_string()?);
        }
        let resetting = matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("reset"));
        self.advance(); // SET | RESET
        if resetting && matches!(self.peek(), Token::All) {
            self.advance();
            self.consume_until_statement_boundary();
            return Ok(Statement::SetDbRoleSetting(Box::new(
                SetDbRoleSettingStatement {
                    database,
                    role,
                    param: None,
                    value: None,
                },
            )));
        }
        let param = self.expect_ident_like()?;
        let value = if resetting {
            None
        } else {
            // `SET p = v` and PG's `SET p TO v` both. TO lexes as a
            // KEYWORD, so the ident-only check missed it and consumed
            // the word itself as the value — the same trap as ALL, one
            // clause over.
            if matches!(self.peek(), Token::Eq | Token::To) || self.peek_keyword_ident("to") {
                self.advance();
            }
            Some(self.take_guc_value())
        };
        self.consume_until_statement_boundary();
        Ok(Statement::SetDbRoleSetting(Box::new(
            SetDbRoleSettingStatement {
                database,
                role,
                param: Some(param),
                value,
            },
        )))
    }

    /// The remainder of a `SET <p> = …` clause as PG renders it back:
    /// a quoted literal loses its quotes, a bare word or number does not.
    fn take_guc_value(&mut self) -> String {
        match self.advance() {
            Token::String(s) => s,
            Token::Integer(n) => format!("{n}"),
            Token::Float(f) => format!("{f}"),
            Token::Ident(s) | Token::QuotedIdent(s) => s,
            other => format!("{other:?}"),
        }
    }

    fn parse_create_user_after_keyword(&mut self, is_user: bool) -> Result<Statement, ParseError> {
        let name = self.expect_ident_or_string()?;
        if self.peek_keyword_ident("with") {
            self.advance();
        }
        let mut password = String::new();
        let mut role = String::new();
        let mut login: Option<bool> = None;
        let mut inherit: Option<bool> = None;
        let mut superuser: Option<bool> = None;
        // Not a `while let`: the pattern would borrow `self` across the
        // body, which calls `self.advance()` / `self.expect_*` (&mut).
        #[allow(clippy::while_let_loop)]
        loop {
            let (Token::Ident(w) | Token::QuotedIdent(w)) = self.peek() else {
                break;
            };
            match w.to_ascii_lowercase().as_str() {
                "password" => {
                    self.advance();
                    password = self.expect_string_literal()?;
                }
                // PG accepts (and pg_dump emits) ENCRYPTED PASSWORD; the value
                // is the same slot.
                "encrypted" => {
                    self.advance();
                    self.expect_keyword_ident("password")?;
                    password = self.expect_string_literal()?;
                }
                "login" => {
                    self.advance();
                    login = Some(true);
                }
                "nologin" => {
                    self.advance();
                    login = Some(false);
                }
                "inherit" => {
                    self.advance();
                    inherit = Some(true);
                }
                "noinherit" => {
                    self.advance();
                    inherit = Some(false);
                }
                "superuser" => {
                    self.advance();
                    superuser = Some(true);
                }
                "nosuperuser" => {
                    self.advance();
                    superuser = Some(false);
                }
                // SPG's own coarse wire role: `ROLE 'readwrite'`.
                "role" => {
                    self.advance();
                    role = self.expect_string_literal()?;
                }
                // Every other PG role option (CREATEDB, CONNECTION LIMIT n,
                // VALID UNTIL '…', CREATEROLE, REPLICATION, BYPASSRLS …) is
                // accepted and ignored so a pg_dump role block restores. They
                // gate capabilities SPG does not have.
                "createdb" | "nocreatedb" | "createrole" | "nocreaterole" | "replication"
                | "noreplication" | "bypassrls" | "nobypassrls" => {
                    self.advance();
                }
                "connection" => {
                    self.advance();
                    self.expect_keyword_ident("limit")?;
                    self.advance(); // the number
                }
                "valid" => {
                    self.advance();
                    self.expect_keyword_ident("until")?;
                    self.expect_string_literal()?;
                }
                _ => break,
            }
        }
        if role.is_empty() {
            role = "readonly".to_string();
        }
        Ok(Statement::CreateUser(crate::ast::CreateUserStatement {
            name,
            password,
            role,
            login,
            inherit,
            superuser,
            is_user,
        }))
    }

    /// v7.39 (RLS) — parenthesised policy qualifier `( <expr> )`; caller has
    /// consumed the USING / WITH CHECK keyword.
    fn parse_paren_expr(&mut self, clause: &str) -> Result<Expr, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after {clause}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let e = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close {clause}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(e)
    }

    /// v7.39 (RLS) — `TO role [, role]*`; caller has consumed `TO`.
    fn parse_policy_roles(&mut self) -> Result<Vec<String>, ParseError> {
        let mut roles = Vec::new();
        loop {
            roles.push(self.expect_ident_like()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        Ok(roles)
    }

    /// v7.39 (RLS) — `CREATE POLICY name ON table [AS {PERMISSIVE|RESTRICTIVE}]
    /// [FOR cmd] [TO roles] [USING (expr)] [WITH CHECK (expr)]`. Caller consumed
    /// `CREATE POLICY`.
    fn parse_create_policy_after_keyword(&mut self) -> Result<Statement, ParseError> {
        use crate::ast::PolicyCmd;
        let name = self.expect_ident_like()?;
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(alloc::format!(
                "expected ON after CREATE POLICY name, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;

        let mut permissive = true;
        if matches!(self.peek(), Token::As) {
            self.advance();
            let w = self.expect_ident_like()?;
            permissive = if w.eq_ignore_ascii_case("permissive") {
                true
            } else if w.eq_ignore_ascii_case("restrictive") {
                false
            } else {
                return Err(self.err(alloc::format!(
                    "expected PERMISSIVE or RESTRICTIVE after AS, got {w:?}"
                )));
            };
        }

        let mut cmd = PolicyCmd::All;
        if matches!(self.peek(), Token::For) {
            self.advance();
            cmd = self.parse_policy_cmd()?;
        }

        let mut roles = Vec::new();
        if matches!(self.peek(), Token::To) {
            self.advance();
            roles = self.parse_policy_roles()?;
        }

        let mut using = None;
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("using"))
        {
            self.advance();
            using = Some(self.parse_paren_expr("USING")?);
        }

        let mut with_check = None;
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with"))
        {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("check"))
            {
                return Err(self.err(alloc::format!(
                    "expected CHECK after WITH, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            with_check = Some(self.parse_paren_expr("WITH CHECK")?);
        }

        // Clause-per-command matrix (PG wording).
        match cmd {
            PolicyCmd::Insert => {
                if using.is_some() {
                    return Err(self.err("only WITH CHECK expression allowed for INSERT".into()));
                }
            }
            PolicyCmd::Select | PolicyCmd::Delete => {
                if with_check.is_some() {
                    return Err(self.err("WITH CHECK cannot be applied to SELECT or DELETE".into()));
                }
            }
            PolicyCmd::Update | PolicyCmd::All => {}
        }

        Ok(Statement::CreatePolicy(crate::ast::CreatePolicyStatement {
            name,
            table,
            permissive,
            cmd,
            roles,
            using,
            with_check,
        }))
    }

    /// v7.39 (RLS) — the command word after `FOR`.
    fn parse_policy_cmd(&mut self) -> Result<crate::ast::PolicyCmd, ParseError> {
        use crate::ast::PolicyCmd;
        match self.peek().clone() {
            Token::All => {
                self.advance();
                Ok(PolicyCmd::All)
            }
            Token::Select => {
                self.advance();
                Ok(PolicyCmd::Select)
            }
            Token::Insert => {
                self.advance();
                Ok(PolicyCmd::Insert)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("update") => {
                self.advance();
                Ok(PolicyCmd::Update)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("delete") => {
                self.advance();
                Ok(PolicyCmd::Delete)
            }
            other => Err(self.err(alloc::format!(
                "expected ALL/SELECT/INSERT/UPDATE/DELETE after FOR, got {other:?}"
            ))),
        }
    }

    /// v7.39 (RLS) — `ALTER POLICY name ON table { RENAME TO new | [TO roles]
    /// [USING (expr)] [WITH CHECK (expr)] }`. Caller consumed `ALTER POLICY`.
    fn parse_alter_policy_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let name = self.expect_ident_like()?;
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(alloc::format!(
                "expected ON after ALTER POLICY name, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;

        // RENAME TO new
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("rename"))
        {
            self.advance();
            if !matches!(self.peek(), Token::To) {
                return Err(self.err(alloc::format!(
                    "expected TO after RENAME, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let new = self.expect_ident_like()?;
            return Ok(Statement::AlterPolicy(crate::ast::AlterPolicyStatement {
                name,
                table,
                rename_to: Some(new),
                roles: None,
                using: None,
                with_check: None,
            }));
        }

        let mut roles = None;
        if matches!(self.peek(), Token::To) {
            self.advance();
            roles = Some(self.parse_policy_roles()?);
        }
        let mut using = None;
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("using"))
        {
            self.advance();
            using = Some(self.parse_paren_expr("USING")?);
        }
        let mut with_check = None;
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with"))
        {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("check"))
            {
                return Err(self.err(alloc::format!(
                    "expected CHECK after WITH, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            with_check = Some(self.parse_paren_expr("WITH CHECK")?);
        }
        Ok(Statement::AlterPolicy(crate::ast::AlterPolicyStatement {
            name,
            table,
            rename_to: None,
            roles,
            using,
            with_check,
        }))
    }

    /// v7.39 (RLS) — `DROP POLICY [IF EXISTS] name ON table`. Caller consumed
    /// `DROP POLICY`.
    fn parse_drop_policy_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let if_exists = self.consume_if_exists();
        let name = self.expect_ident_like()?;
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(alloc::format!(
                "expected ON after DROP POLICY name, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;
        Ok(Statement::DropPolicy(crate::ast::DropPolicyStatement {
            name,
            table,
            if_exists,
        }))
    }
}
fn wrap_from_leaves(
    e: &mut Expr,
    names: &[String],
    make: &dyn Fn(Expr) -> Expr,
    refs: &dyn Fn(&Expr) -> bool,
) {
    if let Expr::Column(c) = e {
        if c.qualifier
            .as_deref()
            .is_some_and(|q| names.iter().any(|n| n.eq_ignore_ascii_case(q)))
        {
            let taken = core::mem::replace(e, Expr::Literal(Literal::Null));
            *e = make(taken);
        }
        return;
    }
    match e {
        Expr::Binary { lhs, rhs, .. } => {
            wrap_from_leaves(lhs, names, make, refs);
            wrap_from_leaves(rhs, names, make, refs);
        }
        Expr::Unary { expr, .. } | Expr::Cast { expr, .. } | Expr::IsNull { expr, .. } => {
            wrap_from_leaves(expr, names, make, refs)
        }
        Expr::FunctionCall { args, .. } => {
            for a in args.iter_mut() {
                wrap_from_leaves(a, names, make, refs);
            }
        }
        Expr::Case {
            operand,
            branches,
            else_branch,
        } => {
            if let Some(o) = operand.as_deref_mut() {
                wrap_from_leaves(o, names, make, refs);
            }
            for (w, t) in branches.iter_mut() {
                wrap_from_leaves(w, names, make, refs);
                wrap_from_leaves(t, names, make, refs);
            }
            if let Some(el) = else_branch.as_deref_mut() {
                wrap_from_leaves(el, names, make, refs);
            }
        }
        // Compound variants the walk doesn't decompose: keep the
        // pre-D.30 behavior — wrap the whole sub-expr if it touches
        // a source table, so nothing regresses.
        other => {
            if refs(other) {
                let taken = core::mem::replace(other, Expr::Literal(Literal::Null));
                *other = make(taken);
            }
        }
    }
}

/// v7.39 (round 241) — does this expression reference any of the FROM /
/// USING table names (shared by the UPDATE…FROM and DELETE…USING
/// lowerings)?
fn expr_refs_tables(e: &Expr, names: &[String]) -> bool {
    match e {
        Expr::Column(c) => c
            .qualifier
            .as_deref()
            .is_some_and(|q| names.iter().any(|n| n.eq_ignore_ascii_case(q))),
        Expr::Binary { lhs, rhs, .. } => {
            expr_refs_tables(lhs, names) || expr_refs_tables(rhs, names)
        }
        Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => expr_refs_tables(expr, names),
        Expr::FunctionCall { args, .. } => args.iter().any(|a| expr_refs_tables(a, names)),
        Expr::Case {
            operand,
            branches,
            else_branch,
        } => {
            operand
                .as_deref()
                .is_some_and(|o| expr_refs_tables(o, names))
                || branches
                    .iter()
                    .any(|(w, t)| expr_refs_tables(w, names) || expr_refs_tables(t, names))
                || else_branch
                    .as_deref()
                    .is_some_and(|el| expr_refs_tables(el, names))
        }
        _ => false,
    }
}

impl Parser {
    /// v4.4 `UPDATE <table> SET col = expr [, col = expr]* [WHERE cond]`.
    /// Caller already consumed the leading `UPDATE` ident.
    /// v7.39 (round 420) — does a JOIN clause start here? Used to spot
    /// MySQL's multi-table `UPDATE a JOIN b ON …` / `UPDATE a LEFT JOIN b …`
    /// after the target name has been read. `JOIN` is a reserved token;
    /// the qualifiers are bare idents.
    fn peek_is_update_join_start(&self) -> bool {
        match self.peek() {
            // JOIN and its qualifiers are reserved lexer tokens (the grammar
            // dedicates arms to `LEFT [OUTER] JOIN` and friends).
            Token::Join
            | Token::Inner
            | Token::Left
            | Token::Right
            | Token::Cross
            | Token::Full => true,
            // NATURAL / STRAIGHT_JOIN arrive as bare idents.
            Token::Ident(s) | Token::QuotedIdent(s) => {
                matches!(s.to_ascii_lowercase().as_str(), "natural" | "straight_join")
            }
            _ => false,
        }
    }

    /// v7.39 (round 430) — `SET @x = <expr> [, @y := <expr>]`, MySQL's
    /// USER-variable assignment. Its own per-session namespace, an arbitrary
    /// expression on the right, and `:=` as a second spelling of `=`.
    ///
    /// Out-of-line (`inline(never)`): the statement-parse frame it is called
    /// from sits on the nesting recursion chain (a CTE body, a subquery),
    /// and holding this loop's `Vec` + `String` locals there overflowed the
    /// 512 KiB guard (`e2e_in_list_depth::round25_union_cte_search_shape`).
    #[inline(never)]
    fn parse_set_user_vars(&mut self) -> Result<Statement, ParseError> {
        let mut assigns: Vec<(String, Expr)> = Vec::new();
        let mut settings: Vec<(String, Expr)> = Vec::new();
        loop {
            // v7.39 (round 554) — a plain NAME here is a session
            // setting, not a user variable. mysqldump writes the two in
            // one statement — `SET @OLD_SQL_MODE=@@SQL_MODE,
            // SQL_MODE='NO_AUTO_VALUE_ON_ZERO'` saves a value and
            // changes it — and this refused the mixture outright, so no
            // dump could be restored past its preamble.
            if let Token::Ident(name) | Token::QuotedIdent(name) = self.peek().clone() {
                self.advance();
                if !matches!(self.peek(), Token::Eq | Token::ColonEq) {
                    return Err(self.err(alloc::format!(
                        "expected `=` after {name}, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let value = self.parse_expr(0)?;
                settings.push((name.to_ascii_lowercase(), value));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            let Token::SessionVar(raw) = self.peek().clone() else {
                return Err(self.err(alloc::format!(
                    "expected a user variable after SET, got {:?}",
                    self.peek()
                )));
            };
            if raw.starts_with("@@") {
                return Err(self.err(alloc::string::String::from(
                    "cannot mix `@@` settings with `@` user variables in one SET",
                )));
            }
            self.advance();
            if !matches!(self.peek(), Token::Eq | Token::ColonEq) {
                return Err(self.err(alloc::format!(
                    "expected `=` or `:=` after {raw}, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let value = self.parse_expr(0)?;
            assigns.push((raw.trim_start_matches('@').to_ascii_lowercase(), value));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        Ok(Statement::SetUserVars(assigns, settings))
    }

    fn parse_update_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // v7.39 (round 646) — `UPDATE ONLY t SET …`. Read as a table
        // NAMED `only` until now, which failed on `relation "only" does
        // not exist`. The lookahead is what keeps a table actually
        // called `only` working: the keyword is only a keyword when a
        // TABLE NAME follows it — and `SET` arrives as an identifier
        // here, so `UPDATE only SET a = 2` would otherwise take `SET`
        // for the table and die on the `=`. Measured by the pin.
        let only = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
            if s.eq_ignore_ascii_case("only"))
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(n) | Token::QuotedIdent(n)) if !n.eq_ignore_ascii_case("set")
            );
        if only {
            self.advance();
        }
        let table = self.expect_ident_like()?;
        // v7.39 (round 241) — `UPDATE t [AS] alias SET …`. PG allows the
        // bare spelling; a bare identifier that is the SET keyword itself
        // is the clause, not an alias.
        // v7.39 (round 420) — nor is a bare join qualifier (`LEFT` / `INNER`
        // / …) an alias: `UPDATE a LEFT JOIN b …` starts the MySQL
        // multi-table form, and swallowing `LEFT` as `a`'s alias made the
        // following JOIN a syntax error.
        let starts_join = self.mysql_dialect && self.peek_is_update_join_start();
        let alias = if matches!(self.peek(), Token::As) {
            self.advance();
            Some(self.expect_ident_like()?)
        } else {
            match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s)
                    if !s.eq_ignore_ascii_case("set") && !starts_join =>
                {
                    let a = s.clone();
                    self.advance();
                    Some(a)
                }
                _ => None,
            }
        };
        // v7.39 (round 420) — MySQL's multi-table UPDATE:
        //     UPDATE a, b        SET a.v = b.v WHERE a.id = b.id
        //     UPDATE a JOIN b ON a.id = b.id      SET a.v = b.v + 1
        //     UPDATE a LEFT JOIN b ON a.id = b.id SET a.v = COALESCE(b.v, -1)
        // The FIRST table is the mutation target and the rest are sources —
        // exactly the shape PG spells `UPDATE a SET … FROM b WHERE …`, which
        // SPG already lowers onto correlated subqueries. So rewind, let
        // `parse_from_clause` read the whole list (it handles aliases, comma
        // lists, and every JOIN form), then peel the target off the front.
        let (mysql_from, mysql_on, mysql_outer) = if self.mysql_dialect
            && (matches!(self.peek(), Token::Comma) || self.peek_is_update_join_start())
        {
            // NOTE: `advance()` destroys the tokens it returns
            // (`mem::replace(.., Eof)`), so re-parsing by rewinding `self.pos`
            // is NOT possible — the tail is read forward, once, through the
            // same grammar `parse_from_clause` uses after its primary.
            let target_qual = alias.clone().unwrap_or_else(|| table.clone());
            let mut joins = self.parse_from_joins(&target_qual)?;
            if joins.is_empty() {
                return Err(self.err(alloc::string::String::from(
                    "multi-table UPDATE needs at least one source table",
                )));
            }
            let head = joins.remove(0);
            // A LEFT join keeps every target row (the unmatched ones see NULL
            // on the source side), so it must NOT get the EXISTS row filter
            // the inner / comma forms use.
            let outer = matches!(head.kind, crate::ast::JoinKind::Left);
            let src = FromClause {
                primary: head.table,
                joins,
            };
            (Some(src), head.on, outer)
        } else {
            (None, None, false)
        };
        self.expect_keyword_ident("set")?;
        let mut assignments = Vec::new();
        loop {
            // `SET (a, b) = (e1, e2)` / `SET (a, b) = (SELECT x, y
            // …)` — the parenthesized multi-assignment. Expressions
            // assign positionally; a subquery RHS clones per column
            // keeping only the Nth projection item.
            if matches!(self.peek(), Token::LParen) {
                self.advance();
                let mut cols = alloc::vec![self.expect_ident_like()?];
                while matches!(self.peek(), Token::Comma) {
                    self.advance();
                    cols.push(self.expect_ident_like()?);
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' after SET column list, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if !matches!(self.peek(), Token::Eq) {
                    return Err(self.err(format!(
                        "expected `=` after SET column list, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(format!(
                        "expected '(' after SET (…) =, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if matches!(self.peek(), Token::Select) {
                    let inner = match self.parse_select_stmt()? {
                        Statement::Select(s) => s,
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected SELECT in SET (…) = (SELECT …), got {other:?}"
                            )));
                        }
                    };
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' after SET subquery, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    if inner.items.len() != cols.len() {
                        return Err(self.err(alloc::format!(
                            "SET (…) = (SELECT …) arity mismatch: {} columns, {} items",
                            cols.len(),
                            inner.items.len()
                        )));
                    }
                    for (i, col) in cols.into_iter().enumerate() {
                        let mut sub = inner.clone();
                        sub.items = alloc::vec![sub.items[i].clone()];
                        assignments.push((col, Expr::ScalarSubquery(Box::new(sub))));
                    }
                } else {
                    let mut exprs = alloc::vec![self.parse_expr(0)?];
                    while matches!(self.peek(), Token::Comma) {
                        self.advance();
                        exprs.push(self.parse_expr(0)?);
                    }
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' after SET row values, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    if exprs.len() != cols.len() {
                        return Err(self.err(alloc::format!(
                            "SET (…) = (…) arity mismatch: {} columns, {} values",
                            cols.len(),
                            exprs.len()
                        )));
                    }
                    for (col, e) in cols.into_iter().zip(exprs) {
                        assignments.push((col, e));
                    }
                }
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            // v7.39 (round 420) — MySQL's multi-table UPDATE qualifies its
            // assignment targets (`SET a.v = b.v`). `expect_ident_like`
            // SILENTLY strips a `<qual>.` prefix (it exists for PG's
            // `public.` dump qualifiers), so the qualifier has to be read off
            // the token stream first — otherwise `SET b.v = 888` would write
            // to the TARGET table's `v` while naming a source table, a
            // silent-wrong. A qualifier naming a SOURCE table means a
            // multi-TARGET update — mutating two tables in one statement —
            // which SPG does not model, so it is refused loudly.
            let set_qual: Option<String> = if mysql_from.is_some()
                && matches!(self.tokens.get(self.pos + 1), Some(Token::Dot))
            {
                match self.peek() {
                    Token::Ident(s) | Token::QuotedIdent(s) => Some(s.clone()),
                    _ => None,
                }
            } else {
                None
            };
            let col = self.expect_ident_like()?;
            if let Some(q) = set_qual {
                let names_target = q.eq_ignore_ascii_case(&table)
                    || alias.as_deref().is_some_and(|a| a.eq_ignore_ascii_case(&q));
                if !names_target {
                    return Err(self.err(alloc::format!(
                        "multi-table UPDATE can only assign to its first table \
                         ({table}); `{q}.{col}` targets another table"
                    )));
                }
            }
            // v7.37 D.53 — array element assignment target `SET arr[i] = v`,
            // desugared to `arr = __array_assign(arr, i, v)` (mirrors the
            // `__column_default` marker lowering just below). PG assigns to the
            // i-th (1-based) element, NULL-padding when i exceeds the length.
            if matches!(self.peek(), Token::LBracket) {
                self.advance();
                let index = self.parse_expr(0)?;
                // v7.39 (round 257) — the SLICE target `SET arr[lo:hi] = src`
                // (and the open `arr[lo:]`), lowered to
                // `__array_assign_slice`. Only the single-subscript form
                // parsed before, so a slice assignment was a syntax error.
                let mut slice_hi: Option<Option<Expr>> = None;
                if matches!(self.peek(), Token::Colon) {
                    self.advance();
                    slice_hi = Some(if matches!(self.peek(), Token::RBracket) {
                        None
                    } else {
                        Some(self.parse_expr(0)?)
                    });
                }
                if !matches!(self.peek(), Token::RBracket) {
                    return Err(self.err(format!(
                        "expected `]` after array subscript in UPDATE SET, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if !matches!(self.peek(), Token::Eq) {
                    return Err(self.err(format!(
                        "expected `=` after array subscript in UPDATE SET, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let value = self.parse_expr(0)?;
                // PG merges several subscript writes to the same column into one
                // array (`SET arr[1]=x, arr[3]=y`), so chain onto any prior
                // assignment to `col` rather than each overwriting the original.
                let existing = assignments.iter().position(|(c, _)| c == &col);
                let base = match existing {
                    Some(i) => assignments[i].1.clone(),
                    None => Expr::Column(ColumnName {
                        qualifier: None,
                        name: col.clone(),
                    }),
                };
                let assigned = match slice_hi {
                    None => Expr::FunctionCall {
                        name: "__array_assign".to_string(),
                        args: alloc::vec![base, index, value],
                    },
                    Some(hi) => Expr::FunctionCall {
                        name: "__array_assign_slice".to_string(),
                        args: alloc::vec![
                            base,
                            index,
                            hi.unwrap_or(Expr::Literal(crate::ast::Literal::Null)),
                            value,
                        ],
                    },
                };
                match existing {
                    Some(i) => assignments[i].1 = assigned,
                    None => assignments.push((col, assigned)),
                }
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::Eq) {
                return Err(self.err(format!(
                    "expected `=` after column name in UPDATE SET, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // `SET col = DEFAULT` — the column's declared default;
            // rides out as a marker call the update executor
            // resolves against the schema.
            let value = if matches!(self.peek(), Token::Default) {
                self.advance();
                Expr::FunctionCall {
                    name: "__column_default".to_string(),
                    args: Vec::new(),
                }
            } else {
                self.parse_expr(0)?
            };
            assignments.push((col, value));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        // `UPDATE t SET … FROM src [, …] WHERE cond` — PG's joined
        // update. Lowers onto the correlated-subquery machinery:
        // the WHERE becomes EXISTS(SELECT 1 FROM src WHERE cond)
        // and each assignment that references a FROM-list table
        // wraps into a correlated scalar subquery
        // (SELECT expr FROM src WHERE cond). Equivalent for the
        // unique-join shape (the overwhelmingly common one); a
        // multi-match, which PG resolves by arbitrary pick,
        // surfaces as a scalar-subquery cardinality error instead
        // of a silent arbitrary result.
        // v7.39 (round 420) — the MySQL multi-table form supplies the source
        // list up front (`UPDATE a, b SET …`) instead of via FROM, so it feeds
        // the SAME lowering below. Both spellings together is not legal in
        // either dialect.
        let from_clause = if let Some(fc) = mysql_from {
            if matches!(self.peek(), Token::From) {
                return Err(self.err(alloc::string::String::from(
                    "multi-table UPDATE already names its sources; drop the FROM clause",
                )));
            }
            Some(fc)
        } else if matches!(self.peek(), Token::From) {
            self.advance();
            Some(self.parse_from_clause()?)
        } else {
            None
        };
        let where_ = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        // v7.39 (round 421, fixing round 420) — the SOURCE subquery's filter
        // and the TARGET-row filter are NOT the same predicate once a LEFT
        // join is involved:
        //   * inner / comma / PG's `FROM`: the ON predicate and the WHERE are
        //     one conjunction, and the whole thing filters target rows via
        //     EXISTS.
        //   * LEFT join: only the ON predicate belongs inside the source
        //     subquery. The WHERE still filters TARGET rows (with source
        //     columns read through the correlated subquery, which yields NULL
        //     for an unmatched row — exactly LEFT-join semantics).
        // Round 420 folded ON into WHERE unconditionally and then dropped the
        // outer filter for the LEFT case, so `UPDATE a LEFT JOIN b ON … SET …
        // WHERE a.id > 1` updated EVERY row.
        let sub_where = match (mysql_on.clone(), where_.clone()) {
            _ if mysql_outer => mysql_on.clone(),
            (Some(on), Some(w)) => Some(Expr::Binary {
                lhs: Box::new(on),
                op: crate::ast::BinOp::And,
                rhs: Box::new(w),
            }),
            (Some(on), None) => Some(on),
            (None, w) => w,
        };
        // v7.39 (round 413) — MySQL `UPDATE … [ORDER BY …] [LIMIT n]`. PG
        // has no such clause on UPDATE, so this is accepted only under the
        // MySQL dialect; a PG session's `UPDATE … ORDER BY …` still errors.
        let update_order_limit = self.parse_mysql_dml_order_limit("UPDATE")?;
        let mut returning = self.parse_optional_returning()?;
        // v7.39 (round 533) — kept for the engine, which can resolve the
        // UNQUALIFIED leaves this lowering has to leave alone.
        let from_sources = from_clause.as_ref().map(|fc| {
            alloc::boxed::Box::new(crate::ast::UpdateFromSources {
                from: fc.clone(),
                sub_where: sub_where.clone(),
            })
        });
        let (assignments, where_) = if let Some(fc) = from_clause {
            let names: Vec<String> = core::iter::once(&fc.primary)
                .chain(fc.joins.iter().map(|j| &j.table))
                .flat_map(|t| {
                    t.alias
                        .clone()
                        .into_iter()
                        .chain(core::iter::once(t.name.clone()))
                })
                .collect();
            let refs_list = |e: &Expr| -> bool {
                fn walk(e: &Expr, names: &[String]) -> bool {
                    match e {
                        Expr::Column(c) => c
                            .qualifier
                            .as_deref()
                            .is_some_and(|q| names.iter().any(|n| n.eq_ignore_ascii_case(q))),
                        Expr::Binary { lhs, rhs, .. } => walk(lhs, names) || walk(rhs, names),
                        Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => walk(expr, names),
                        Expr::FunctionCall { args, .. } => args.iter().any(|a| walk(a, names)),
                        Expr::Case {
                            operand,
                            branches,
                            else_branch,
                        } => {
                            operand.as_deref().is_some_and(|o| walk(o, names))
                                || branches
                                    .iter()
                                    .any(|(w, t)| walk(w, names) || walk(t, names))
                                || else_branch.as_deref().is_some_and(|el| walk(el, names))
                        }
                        _ => false,
                    }
                }
                walk(e, &names)
            };
            let sub_select = |items: Vec<SelectItem>| SelectStatement {
                locking: None,
                ctes: Vec::new(),
                distinct: false,
                distinct_on: Vec::new(),
                items,
                from: Some(fc.clone()),
                where_: sub_where.clone(),
                group_by: None,
                group_by_all: false,
                having: None,
                unions: Vec::new(),
                order_by: Vec::new(),
                limit: None,
                offset: None,
                limit_with_ties: false,
                window_check_exprs: Vec::new(),
            };
            // v7.37 D.30 — replace each FROM-qualified column *leaf* in the
            // assignment RHS with a correlated scalar subquery, instead of
            // wrapping the whole RHS. Wrapping the whole expr moved a target-
            // column reference (`SET v = v + u.bonus`, where `v` is the target
            // table's column) inside a subquery whose FROM only has the source
            // table, so the unqualified `v` resolved against the source and
            // errored ColumnNotFound. Leaving target columns in the outer UPDATE
            // context — where they belong — fixes it; only the source columns
            // (`u.bonus`) become subqueries. A whole-expr fallback covers
            // compound variants the leaf-walk doesn't decompose.
            let make_subq = |inner: Expr| {
                Expr::ScalarSubquery(Box::new(sub_select(alloc::vec![SelectItem::Expr {
                    expr: inner,
                    alias: None,
                }])))
            };
            let assignments = assignments
                .into_iter()
                .map(|(col, mut expr)| {
                    wrap_from_leaves(&mut expr, &names, &make_subq, &refs_list);
                    (col, expr)
                })
                .collect();
            let exists = Expr::Exists {
                subquery: Box::new(sub_select(alloc::vec![SelectItem::Expr {
                    expr: Expr::Literal(Literal::Integer(1)),
                    alias: None,
                }])),
                negated: false,
            };
            // v7.39 (round 241) — RETURNING may reference the FROM-list
            // tables too (`RETURNING emp.id, dept.name`); the same
            // leaf-to-correlated-subquery lowering the assignments get.
            // Without it the qualifier died at eval with "unknown table
            // qualifier". (RETURNING was parsed before this block — the
            // lowering is a pure AST transformation.)
            if let Some(items) = returning.as_mut() {
                for item in items.iter_mut() {
                    if let SelectItem::Expr { expr, .. } = item {
                        wrap_from_leaves(expr, &names, &make_subq, &refs_list);
                    }
                }
            }
            // v7.39 (round 420, corrected in 421) — a MySQL LEFT JOIN keeps
            // EVERY matching target row: it gets no EXISTS filter, but the
            // caller's WHERE still applies, with source columns read through
            // the correlated subquery (NULL when unmatched — LEFT-join
            // semantics). `sub_where` above already excluded the WHERE from
            // the source subquery for this case.
            if mysql_outer {
                let mut outer = where_;
                if let Some(w) = outer.as_mut() {
                    wrap_from_leaves(w, &names, &make_subq, &refs_list);
                }
                (assignments, outer)
            } else {
                (assignments, Some(exists))
            }
        } else {
            (assignments, where_)
        };
        Ok(Statement::Update(crate::ast::UpdateStatement {
            ctes: Vec::new(),
            table,
            only,
            alias,
            assignments,
            from_sources,
            where_,
            order_limit: update_order_limit,
            returning,
        }))
    }

    /// v7.39 (round 432) — MySQL's `[ORDER BY …] [LIMIT n]` tail on a DML
    /// statement. UPDATE grew it in round 413 and DELETE in round 432; the
    /// clause and its meaning are identical, so both call this rather than
    /// keeping two copies that could disagree on, say, whether `LIMIT 0` is
    /// legal. PG has no such clause on either statement, so it is read only
    /// under the MySQL dialect — a PG session's `DELETE … ORDER BY …` still
    /// errors.
    ///
    /// `#[inline(never)]`: its locals would otherwise land on the statement-
    /// parsing recursion frame, which is what tipped the 512 KiB nesting
    /// stack in round 430.
    #[inline(never)]
    fn parse_mysql_dml_order_limit(
        &mut self,
        what: &str,
    ) -> Result<Option<alloc::boxed::Box<crate::ast::DmlOrderLimit>>, ParseError> {
        if !self.mysql_dialect {
            return Ok(None);
        }
        let order_by = self.parse_order_by_keys()?;
        let limit = if matches!(self.peek(), Token::Limit) {
            self.advance();
            let tok = self.advance();
            let Token::Integer(n) = tok else {
                return Err(self.err(alloc::format!(
                    "expected integer after {what} LIMIT, got {tok:?}"
                )));
            };
            // MySQL rejects the `LIMIT offset, count` form here — only a
            // single row count is legal on a DML statement.
            if matches!(self.peek(), Token::Comma) {
                return Err(self.err(alloc::format!(
                    "{what} LIMIT takes a row count, not an offset"
                )));
            }
            let n = u32::try_from(n)
                .map_err(|_| self.err(alloc::format!("{what} LIMIT out of range: {n}")))?;
            Some(n)
        } else {
            None
        };
        if order_by.is_empty() && limit.is_none() {
            return Ok(None);
        }
        Ok(Some(alloc::boxed::Box::new(crate::ast::DmlOrderLimit {
            order_by,
            limit,
        })))
    }

    /// v4.4 `DELETE FROM <table> [WHERE cond]`. Caller already consumed
    /// the leading `DELETE` ident.
    fn parse_delete_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // v7.39 (round 421) — MySQL's multi-table DELETE names its target(s)
        // BEFORE the FROM: `DELETE a FROM a JOIN b ON …`. (`DELETE FROM a
        // USING a, b WHERE …` — the third MySQL spelling — needs no special
        // parse here; it reaches the existing USING path with the target
        // repeated in the list, which the source-list peel below handles.)
        // More than one name is a multi-TARGET delete, which SPG does not
        // model; it is refused rather than half-applied.
        let mysql_pre_target: Option<String> =
            if self.mysql_dialect && !matches!(self.peek(), Token::From) {
                let first = self.expect_ident_like()?;
                if matches!(self.peek(), Token::Comma) {
                    return Err(self.err(alloc::format!(
                        "multi-table DELETE can only delete from one table; \
                     `DELETE {first}, …` names several"
                    )));
                }
                Some(first)
            } else {
                None
            };
        if !matches!(self.peek(), Token::From) {
            return Err(self.err(format!("expected FROM after DELETE, got {:?}", self.peek())));
        }
        self.advance();
        // v7.39 (round 646) — `DELETE FROM ONLY t`, same shape and same
        // lookahead as the UPDATE spelling.
        let only = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
            if s.eq_ignore_ascii_case("only"))
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            );
        if only {
            self.advance();
        }
        let table = self.expect_ident_like()?;
        // v7.39 (round 241) — `DELETE FROM t [AS] alias …`. The bare
        // spelling must not swallow the clause keywords that can follow
        // the target.
        let alias = if matches!(self.peek(), Token::As) {
            self.advance();
            Some(self.expect_ident_like()?)
        } else {
            match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s)
                    if !s.eq_ignore_ascii_case("using") && !s.eq_ignore_ascii_case("returning") =>
                {
                    let a = s.clone();
                    self.advance();
                    Some(a)
                }
                _ => None,
            }
        };
        // v7.39 (round 421) — MySQL's multi-table DELETE source list, read
        // through the SAME join grammar the FROM clause uses (see the
        // `advance()`-destroys-tokens note on `parse_from_joins`).
        let mut mysql_on: Option<Expr> = None;
        let mut mysql_outer = false;
        let mysql_using = if mysql_pre_target.is_some()
            && (matches!(self.peek(), Token::Comma) || self.peek_is_update_join_start())
        {
            let target_qual = alias.clone().unwrap_or_else(|| table.clone());
            let mut joins = self.parse_from_joins(&target_qual)?;
            if joins.is_empty() {
                return Err(self.err(alloc::string::String::from(
                    "multi-table DELETE needs at least one source table",
                )));
            }
            let head = joins.remove(0);
            mysql_outer = matches!(head.kind, crate::ast::JoinKind::Left);
            mysql_on = head.on;
            Some(FromClause {
                primary: head.table,
                joins,
            })
        } else {
            None
        };
        // The pre-FROM target must be the table the FROM names (or its
        // alias) — `DELETE b FROM a JOIN b …` would delete from a table that
        // is not the scan target.
        if let Some(t) = &mysql_pre_target {
            let names_target = t.eq_ignore_ascii_case(&table)
                || alias.as_deref().is_some_and(|a| a.eq_ignore_ascii_case(t));
            if !names_target {
                return Err(self.err(alloc::format!(
                    "DELETE target `{t}` is not the first table in the FROM clause ({table})"
                )));
            }
        }
        // `DELETE FROM t USING src [, …] WHERE cond` — PG's joined
        // delete. Same lowering as UPDATE … FROM: the WHERE
        // becomes EXISTS(SELECT 1 FROM src WHERE cond), driven per
        // target row by the correlated machinery.
        let using_clause = if let Some(fc) = mysql_using {
            Some(fc)
        } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            self.advance();
            let mut fc = self.parse_from_clause()?;
            // v7.39 (round 421) — MySQL's `DELETE FROM a USING a, b WHERE …`
            // repeats the TARGET as the first USING entry (PG's spelling
            // lists only the extra sources). Peel it so the source subquery
            // does not re-scan — and shadow — the target table.
            let primary_is_target =
                fc.primary.name.eq_ignore_ascii_case(&table) && fc.primary.alias.is_none();
            if self.mysql_dialect && primary_is_target && !fc.joins.is_empty() {
                let head = fc.joins.remove(0);
                mysql_outer = matches!(head.kind, crate::ast::JoinKind::Left);
                mysql_on = head.on;
                fc = FromClause {
                    primary: head.table,
                    joins: fc.joins,
                };
            }
            Some(fc)
        } else {
            None
        };
        let where_ = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        // v7.39 (round 432) — MySQL's `DELETE … [ORDER BY …] [LIMIT n]`,
        // read before RETURNING (MariaDB's own extension trails the LIMIT).
        let delete_order_limit = self.parse_mysql_dml_order_limit("DELETE")?;
        let mut returning = self.parse_optional_returning()?;
        let where_ = if let Some(fc) = using_clause {
            // v7.39 (round 241) — same RETURNING lowering as UPDATE…FROM:
            // a USING-table reference in RETURNING becomes a correlated
            // scalar subquery over the USING list.
            let names: Vec<String> = core::iter::once(&fc.primary)
                .chain(fc.joins.iter().map(|j| &j.table))
                .flat_map(|t| {
                    t.alias
                        .clone()
                        .into_iter()
                        .chain(core::iter::once(t.name.clone()))
                })
                .collect();
            // v7.39 (round 421) — same ON / WHERE split as UPDATE: a LEFT
            // join filters the SOURCE subquery on the ON predicate alone and
            // leaves the WHERE filtering TARGET rows (so the anti-join idiom
            // `LEFT JOIN b ON … WHERE b.id IS NULL` deletes the unmatched
            // rows); every other form folds ON and WHERE into one EXISTS.
            let sub_where = match (mysql_on.clone(), where_.clone()) {
                _ if mysql_outer => mysql_on.clone(),
                (Some(on), Some(w)) => Some(Expr::Binary {
                    lhs: Box::new(on),
                    op: crate::ast::BinOp::And,
                    rhs: Box::new(w),
                }),
                (Some(on), None) => Some(on),
                (None, w) => w,
            };
            let exists_where = sub_where.clone();
            let sub_fc = fc.clone();
            let make_subq = move |leaf: Expr| -> Expr {
                Expr::ScalarSubquery(Box::new(SelectStatement {
                    locking: None,
                    ctes: Vec::new(),
                    distinct: false,
                    distinct_on: Vec::new(),
                    items: alloc::vec![SelectItem::Expr {
                        expr: leaf,
                        alias: None,
                    }],
                    from: Some(sub_fc.clone()),
                    where_: sub_where.clone(),
                    group_by: None,
                    group_by_all: false,
                    having: None,
                    unions: Vec::new(),
                    order_by: Vec::new(),
                    limit: None,
                    offset: None,
                    limit_with_ties: false,
                    window_check_exprs: Vec::new(),
                }))
            };
            let refs = |e: &Expr| expr_refs_tables(e, &names);
            if let Some(items) = returning.as_mut() {
                for item in items.iter_mut() {
                    if let SelectItem::Expr { expr, .. } = item {
                        wrap_from_leaves(expr, &names, &make_subq, &refs);
                    }
                }
            }
            // A LEFT join deletes the target rows the WHERE selects, reading
            // source columns through the correlated subquery (NULL when
            // unmatched); no EXISTS row filter.
            if mysql_outer {
                let mut outer = where_;
                if let Some(w) = outer.as_mut() {
                    wrap_from_leaves(w, &names, &make_subq, &refs);
                }
                outer
            } else {
                Some(Expr::Exists {
                    subquery: Box::new(SelectStatement {
                        locking: None,
                        ctes: Vec::new(),
                        distinct: false,
                        distinct_on: Vec::new(),
                        items: alloc::vec![SelectItem::Expr {
                            expr: Expr::Literal(Literal::Integer(1)),
                            alias: None,
                        }],
                        from: Some(fc),
                        where_: exists_where,
                        group_by: None,
                        group_by_all: false,
                        having: None,
                        unions: Vec::new(),
                        order_by: Vec::new(),
                        limit: None,
                        offset: None,
                        limit_with_ties: false,
                        window_check_exprs: Vec::new(),
                    }),
                    negated: false,
                })
            }
        } else {
            where_
        };
        Ok(Statement::Delete(crate::ast::DeleteStatement {
            ctes: Vec::new(),
            table,
            only,
            alias,
            where_,
            order_limit: delete_order_limit,
            returning,
        }))
    }

    /// v7.17.0 Phase 3.P0-42 — parse `MERGE INTO <target> [alias]
    /// USING <source> [alias] ON <expr> WHEN [NOT] MATCHED [AND
    /// <expr>] THEN <action> [WHEN …]` after the leading `MERGE`
    /// keyword. v7.17 surface:
    ///   * source: table reference (subquery source is a follow-up)
    ///   * actions: UPDATE SET / DELETE / DO NOTHING (matched);
    ///     INSERT (cols) VALUES (vals) / DO NOTHING (not matched)
    ///   * AND-conditioned WHEN clauses; clauses tried in declaration
    ///     order
    fn parse_merge_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // INTO
        let is_into_kw = matches!(self.peek(), Token::Into)
            || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("into"));
        if !is_into_kw {
            return Err(self.err(format!("expected INTO after MERGE, got {:?}", self.peek())));
        }
        self.advance();
        let target = self.expect_ident_like()?;
        // Optional alias — bare ident before USING.
        let target_alias = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if !s.eq_ignore_ascii_case("using") => {
                Some(self.expect_ident_like()?)
            }
            _ => None,
        };
        // USING
        let is_using_kw = matches!(
            self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("using")
        );
        if !is_using_kw {
            return Err(self.err(format!(
                "expected USING after MERGE INTO target, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v7.37 D.44 — `USING (SELECT …) alias` subquery source, or `USING
        // <table> [alias]`. PG requires an alias after a subquery source.
        let (source, source_select) = if matches!(self.peek(), Token::LParen) {
            self.advance(); // (
            // v7.39 (round 768, F31-D5) — `USING (VALUES …)`: the same
            // constant-SELECT lowering the derived-table parser uses
            // (PG deletes through this form; it was a parse error).
            let inner = if matches!(self.peek(), Token::Values) {
                self.advance(); // VALUES
                Statement::Select(self.parse_values_rows_body()?)
            } else {
                self.parse_select_stmt()?
            };
            match self.advance() {
                Token::RParen => {}
                other => {
                    return Err(self.err(format!(
                        "expected ')' after MERGE USING subquery, got {other:?}"
                    )));
                }
            }
            let Statement::Select(sub) = inner else {
                return Err(self.err("MERGE USING subquery must be a SELECT".into()));
            };
            (String::new(), Some(Box::new(sub)))
        } else {
            (self.expect_ident_like()?, None)
        };
        let source_alias = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s)
                if !s.eq_ignore_ascii_case("on") && !s.eq_ignore_ascii_case("as") =>
            {
                Some(self.expect_ident_like()?)
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("as") => {
                self.advance(); // AS
                Some(self.expect_ident_like()?)
            }
            _ => None,
        };
        // v7.39 (round 768, F31-D5) — optional positional column-alias
        // list after the source alias (`s(id, v)`).
        let mut source_column_aliases: Vec<String> = Vec::new();
        if source_alias.is_some() && matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                source_column_aliases.push(self.expect_ident_like()?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in MERGE source column list, got {other:?}"
                        )));
                    }
                }
            }
        }
        if source_select.is_some() && source_alias.is_none() {
            return Err(self.err("MERGE USING (subquery) requires an alias".into()));
        }
        // ON
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(format!(
                "expected ON after MERGE … USING source, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let on = self.parse_expr(0)?;
        // One or more WHEN clauses.
        let mut clauses: Vec<crate::ast::MergeWhenClause> = Vec::new();
        loop {
            let is_when_kw = matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("when")
            );
            if !is_when_kw {
                break;
            }
            self.advance(); // WHEN
            // [NOT] MATCHED
            let matched = if matches!(self.peek(), Token::Not) {
                self.advance();
                crate::ast::MergeMatched::NotMatched
            } else {
                crate::ast::MergeMatched::Matched
            };
            let is_matched_kw = matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("matched")
            );
            if !is_matched_kw {
                return Err(self.err(format!(
                    "expected MATCHED in WHEN clause, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.39 (round 146, PG17) — `NOT MATCHED [BY TARGET | BY SOURCE]`.
            // BY TARGET is the default (a synonym); BY SOURCE flips the clause
            // to fire for target rows no source row matches.
            let mut matched = matched;
            if matches!(matched, crate::ast::MergeMatched::NotMatched) && self.peek_is_by() {
                self.advance();
                match self.peek() {
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("source") => {
                        self.advance();
                        matched = crate::ast::MergeMatched::NotMatchedBySource;
                    }
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("target") => {
                        self.advance();
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected SOURCE or TARGET after NOT MATCHED BY, got {other:?}"
                        )));
                    }
                }
            }
            // Optional AND <expr>
            let condition = if matches!(self.peek(), Token::And) {
                self.advance();
                Some(self.parse_expr(0)?)
            } else {
                None
            };
            // THEN
            let is_then_kw = matches!(
                self.peek(),
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("then")
            );
            if !is_then_kw {
                return Err(self.err(format!(
                    "expected THEN in WHEN clause, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // Action: INSERT / UPDATE / DELETE / DO NOTHING
            let action = match self.peek().clone() {
                Token::Insert => {
                    self.advance();
                    // v7.39 (read01 round 123) — the `(cols)` list is OPTIONAL,
                    // exactly like a plain INSERT: `WHEN NOT MATCHED THEN INSERT
                    // VALUES (…)` omits it and fills every column in declaration
                    // order. PG accepts this; SPG used to require the list.
                    let mut columns: Vec<String> = Vec::new();
                    if matches!(self.peek(), Token::LParen) {
                        self.advance();
                        loop {
                            columns.push(self.expect_ident_like()?);
                            if matches!(self.peek(), Token::Comma) {
                                self.advance();
                                continue;
                            }
                            break;
                        }
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' after INSERT column list, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                    }
                    // VALUES (...)
                    if !matches!(self.peek(), Token::Values) {
                        return Err(self.err(format!(
                            "expected VALUES in MERGE INSERT, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    if !matches!(self.peek(), Token::LParen) {
                        return Err(self.err(format!(
                            "expected '(' after VALUES in MERGE INSERT, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let mut values: Vec<crate::ast::Expr> = Vec::new();
                    loop {
                        values.push(self.parse_expr(0)?);
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                            continue;
                        }
                        break;
                    }
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' after MERGE INSERT values, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    // Empty column list = positional into every column, so the
                    // count is checked against the table arity at execution.
                    if !columns.is_empty() && columns.len() != values.len() {
                        return Err(self.err(format!(
                            "MERGE INSERT column count ({}) ≠ value count ({})",
                            columns.len(),
                            values.len()
                        )));
                    }
                    crate::ast::MergeAction::Insert { columns, values }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update") => {
                    self.advance();
                    // SET
                    let is_set_kw = matches!(
                        self.peek(),
                        Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("set")
                    );
                    if !is_set_kw {
                        return Err(self.err(format!(
                            "expected SET after UPDATE in MERGE, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let mut assignments: Vec<(String, crate::ast::Expr)> = Vec::new();
                    loop {
                        let col = self.expect_ident_like()?;
                        if !matches!(self.peek(), Token::Eq) {
                            return Err(self.err(format!(
                                "expected '=' in MERGE UPDATE assignment, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let expr = self.parse_expr(0)?;
                        assignments.push((col, expr));
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                            continue;
                        }
                        break;
                    }
                    crate::ast::MergeAction::Update { assignments }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete") => {
                    self.advance();
                    crate::ast::MergeAction::Delete
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("do") => {
                    self.advance();
                    let is_nothing_kw = matches!(
                        self.peek(),
                        Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("nothing")
                    );
                    if !is_nothing_kw {
                        return Err(self.err(format!(
                            "expected NOTHING after DO in MERGE clause, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    crate::ast::MergeAction::DoNothing
                }
                other => {
                    return Err(self.err(format!(
                        "expected INSERT / UPDATE / DELETE / DO NOTHING in MERGE clause, got {other:?}"
                    )));
                }
            };
            // PG's grammar simply has no INSERT production under BY SOURCE
            // (a target row already exists there) — same syntax error.
            if matches!(matched, crate::ast::MergeMatched::NotMatchedBySource)
                && matches!(action, crate::ast::MergeAction::Insert { .. })
            {
                return Err(self.err(String::from("syntax error at or near \"INSERT\"")));
            }
            clauses.push(crate::ast::MergeWhenClause {
                matched,
                condition,
                action,
            });
        }
        if clauses.is_empty() {
            return Err(self.err(String::from("MERGE requires at least one WHEN clause")));
        }
        // v7.38 (read01 U-merge) — PG rejects a WHEN clause that follows an
        // unconditional (no `AND`) WHEN of the same match kind: it could
        // never fire. Check per match kind in clause order.
        let mut seen_unconditional_matched = false;
        let mut seen_unconditional_not_matched = false;
        let mut seen_unconditional_by_source = false;
        for c in &clauses {
            let seen = match c.matched {
                crate::ast::MergeMatched::Matched => &mut seen_unconditional_matched,
                crate::ast::MergeMatched::NotMatched => &mut seen_unconditional_not_matched,
                crate::ast::MergeMatched::NotMatchedBySource => &mut seen_unconditional_by_source,
            };
            if *seen {
                return Err(self.err(String::from(
                    "unreachable WHEN clause specified after unconditional WHEN clause",
                )));
            }
            if c.condition.is_none() {
                *seen = true;
            }
        }
        // v7.39 (round 130) — optional trailing `RETURNING <projection>` (PG17+).
        let returning = self.parse_optional_returning()?;
        Ok(Statement::Merge(crate::ast::MergeStatement {
            // Attached by `parse_with_cte_then_select` when the MERGE
            // heads a WITH clause (round 149).
            ctes: Vec::new(),
            target,
            target_alias,
            source,
            source_alias,
            source_select,
            source_column_aliases,
            on,
            clauses,
            returning,
        }))
    }

    /// v7.9.4 — parse the optional trailing `RETURNING <projection>`
    /// clause on INSERT / UPDATE / DELETE. Same projection grammar
    /// as SELECT, so `RETURNING *`, `RETURNING col`,
    /// `RETURNING expr AS alias`, and `RETURNING a, b, c` all work.
    fn parse_optional_returning(
        &mut self,
    ) -> Result<Option<Vec<crate::ast::SelectItem>>, ParseError> {
        let is_returning_kw = matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("returning")
        );
        if !is_returning_kw {
            return Ok(None);
        }
        self.advance();
        let mut items = Vec::new();
        loop {
            items.push(self.parse_select_item()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        Ok(Some(items))
    }

    /// v6.0.4 — parse the tail of an ALTER statement after the
    /// leading `ALTER` keyword has been consumed. Only one form is
    /// supported in v6.0.4:
    ///
    /// ```text
    /// ALTER INDEX <name> REBUILD [WITH (encoding = <enc>)]
    /// ```
    fn parse_alter_after_keyword(&mut self) -> Result<Statement, ParseError> {
        // ALTER INDEX <name> ... | ALTER TABLE <name> SET hot_tier_bytes = <n>
        // v7.14.0 — `ALTER TABLE ONLY` modifier (PG partition-
        // exclusion) is accepted by stripping the `ONLY` keyword
        // before the table parse.
        // v7.14.0 — `ALTER SEQUENCE / ALTER VIEW / ALTER OWNER`
        // and the long PG-dump tail are accepted as no-ops.
        match self.advance() {
            Token::Index => {}
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("index") => {}
            // v6.7.2 — ALTER TABLE t SET hot_tier_bytes = X
            // v7.14.0 — ALTER TABLE ONLY t … strip the `ONLY`.
            Token::Table => {
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("only")) {
                    self.advance();
                }
                return self.parse_alter_table_after_keyword();
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("policy") => {
                return self.parse_alter_policy_after_keyword();
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("table") => {
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("only")) {
                    self.advance();
                }
                return self.parse_alter_table_after_keyword();
            }
            // v7.17.0 — ALTER SEQUENCE name <options>. Moved out
            // of the silent-noop tail.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("sequence") => {
                return self.parse_alter_sequence_after_keyword();
            }
            // v7.37 D.55 — ALTER TYPE name ADD VALUE [IF NOT EXISTS] 'label'
            // [{BEFORE | AFTER} 'existing']. Real enum evolution; other ALTER
            // TYPE forms (RENAME / OWNER / SET SCHEMA) still no-op below.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("type") => {
                // NB: the match arm consumed `TYPE` via self.advance(); the
                // cursor is now at the type name — do NOT advance again.
                let type_name = self.expect_ident_like()?;
                let is_add_value = matches!(self.peek(), Token::Ident(a) if a.eq_ignore_ascii_case("add"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(v)) if v.eq_ignore_ascii_case("value"));
                if is_add_value {
                    self.advance(); // ADD
                    self.advance(); // VALUE
                    // `IF NOT EXISTS` — NOT lexes as the keyword `Token::Not`,
                    // IF/EXISTS as identifiers.
                    let if_not_exists = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"))
                    {
                        let n1 = self.tokens.get(self.pos + 1);
                        let n2 = self.tokens.get(self.pos + 2);
                        if matches!(n1, Some(Token::Not))
                            && matches!(n2, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exists"))
                        {
                            self.advance();
                            self.advance();
                            self.advance();
                            true
                        } else {
                            false
                        }
                    } else {
                        false
                    };
                    let label = self.expect_string_literal()?;
                    let position = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("before") || s.eq_ignore_ascii_case("after"))
                    {
                        let is_before = matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("before"));
                        self.advance();
                        let anchor = self.expect_string_literal()?;
                        Some((is_before, anchor))
                    } else {
                        None
                    };
                    return Ok(Statement::AlterTypeAddValue {
                        type_name,
                        label,
                        if_not_exists,
                        position,
                    });
                }
                // v7.39 (read01 round 49) — `RENAME VALUE 'old' TO 'new'`.
                // Used to fall into the no-op tail below: accepted, silently
                // ignored. `RENAME TO <newtype>` keeps falling through.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("rename"))
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(s)) if s.eq_ignore_ascii_case("value")
                    )
                {
                    self.advance(); // RENAME
                    self.advance(); // VALUE
                    let old = self.expect_string_literal()?;
                    if matches!(self.peek(), Token::To) {
                        self.advance();
                    } else {
                        self.expect_keyword_ident("to")?;
                    }
                    let new = self.expect_string_literal()?;
                    return Ok(Statement::AlterTypeRenameValue {
                        type_name,
                        old,
                        new,
                    });
                }
                // Other ALTER TYPE forms — the ACTION stays a no-op
                // (pg_dump tail), but v7.39 (round 708) the NAME is
                // validated: `ALTER TYPE nosuch RENAME TO x` reported
                // success for a type that does not exist.
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::TypeName,
                    names: alloc::vec![type_name],
                });
            }
            // v7.14.0 — ALTER VIEW / ALTER FUNCTION /
            // ALTER DOMAIN / ALTER DATABASE / ALTER USER / ALTER
            // ROLE / ALTER SCHEMA / ALTER OWNER / ALTER DEFAULT
            // PRIVILEGES — accept as no-op so pg_dump's tail loads.
            // v7.17.0 NOTE: ALTER SEQUENCE moved out (above).
            // v7.39 (round 260) — ALTER DOMAIN is REAL now, so it leaves the
            // pg_dump no-op list below: every form used to report success
            // and change nothing, which is worse than refusing outright
            // (a migration dropping a constraint kept rejecting data).
            // NOTE: the enclosing `match self.advance()` already consumed
            // the DOMAIN keyword, so the name is next.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("domain") => {
                return self.parse_alter_domain_after_keyword();
            }
            // v7.39 (round 547) — `ALTER ROLE|USER <r> [IN DATABASE <d>]
            // SET|RESET …` and `ALTER DATABASE <d> SET|RESET …`. These
            // used to fall into the pg_dump no-op tail below, so a DBA
            // setting a per-role default was told it worked and nothing
            // happened. Intercepted here, BEFORE that tail.
            // v7.39 (round 695) — `ALTER SYSTEM SET <name> = …` / `RESET
            // <name>` / `RESET ALL`. Same reason the ROLE / DATABASE
            // interception below exists: swallowed with the no-op tail, an
            // unknown parameter name was ACCEPTED where PG18 answers
            // `unrecognized configuration parameter`. SPG applies nothing
            // either way — there is no postgresql.auto.conf — but it now
            // says so about a name it does not know.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("system") => {
                // NOTE: the scrutinee is `self.advance()`, so SYSTEM is
                // already consumed here. An extra advance eats the SET and
                // the parameter name is never seen — which is exactly the
                // bug a panic in this branch disproved: the branch WAS on
                // the path, the reading of it was wrong.
                let mut parameter = None;
                // SET <name> … | RESET <name> | RESET ALL
                if matches!(self.peek(), Token::Ident(k)
                    if k.eq_ignore_ascii_case("set") || k.eq_ignore_ascii_case("reset"))
                {
                    self.advance();
                    if let Token::Ident(n) | Token::QuotedIdent(n) = self.peek().clone()
                        && !n.eq_ignore_ascii_case("all")
                    {
                        self.advance();
                        // A dotted GUC (`plpgsql.check_asserts`) is two
                        // tokens; keep the whole name.
                        let mut full = n;
                        while matches!(self.peek(), Token::Dot) {
                            self.advance();
                            if let Token::Ident(t) | Token::QuotedIdent(t) = self.advance() {
                                full.push('.');
                                full.push_str(&t);
                            }
                        }
                        parameter = Some(full);
                    }
                }
                self.consume_until_statement_boundary();
                return Ok(Statement::AlterSystem { parameter });
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    s.to_ascii_lowercase().as_str(),
                    "role" | "user" | "database"
                ) && self.peeks_db_role_setting() =>
            {
                let is_database = s.eq_ignore_ascii_case("database");
                return self.parse_db_role_setting(is_database);
            }
            // v7.39 (round 708) — `ALTER ROLE|USER <name> [WITH attrs…]`
            // (the non-SET forms; SET/RESET took the branch above). The
            // attributes still no-op — recorded, and the ignored PASSWORD
            // is ledgered as its own follow-up — but the ROLE is validated:
            // any name was accepted for a role that does not exist.
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("role") || s.eq_ignore_ascii_case("user") =>
            {
                // NB: the enclosing `match self.advance()` already consumed
                // ROLE/USER — the round-695 trap, hit again in this round's
                // first draft (the name was eaten and WITH parsed as the
                // role). The cursor is at the name.
                let name = self.expect_ident_or_string()?;
                // v7.39 (round 750) — scan the attribute tail for
                // PASSWORD. Everything else stays a recorded no-op, but
                // a dropped credential rotation is a SECURITY bug:
                // `ALTER USER x PASSWORD 'new'` answered ALTER ROLE and
                // changed nothing, so the old password kept working.
                // ENCRYPTED/UNENCRYPTED are PG-noise prefixes; `PASSWORD
                // NULL` clears the credential.
                let mut password: Option<Option<String>> = None;
                loop {
                    match self.peek() {
                        Token::Semicolon | Token::Eof => break,
                        Token::Ident(w) if w.eq_ignore_ascii_case("password") => {
                            self.advance();
                            match self.advance() {
                                Token::String(p) => password = Some(Some(p)),
                                Token::Null => password = Some(None),
                                Token::Ident(n) if n.eq_ignore_ascii_case("null") => {
                                    password = Some(None);
                                }
                                other => {
                                    return Err(self.err(alloc::format!(
                                        "expected password string or NULL after PASSWORD, got {other:?}"
                                    )));
                                }
                            }
                        }
                        _ => {
                            self.advance();
                        }
                    }
                }
                if name.eq_ignore_ascii_case("all") {
                    // `ALTER ROLE ALL …` names every role; nothing to check.
                    return Ok(Statement::Empty);
                }
                if let Some(pw) = password {
                    return Ok(Statement::AlterRolePassword { name, password: pw });
                }
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::RoleName,
                    names: alloc::vec![name],
                });
            }
            // v7.39 (round 709) — ALTER COLLATION / TEXT SEARCH
            // CONFIGURATION / EVENT TRIGGER / LARGE OBJECT leave the no-op
            // list far enough to validate the NAME; the actions still no-op.
            // (TEXT SEARCH DICTIONARY / PARSER / TEMPLATE stay noise: SPG
            // models none of them and their dumps are rare.)
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("collation") => {
                let name = self.expect_ident_or_string()?;
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::CollationName,
                    names: alloc::vec![name],
                });
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("text")
                    && matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("search"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(k)) if k.eq_ignore_ascii_case("configuration")) =>
            {
                self.advance(); // SEARCH
                self.advance(); // CONFIGURATION
                let name = self.expect_ident_like()?;
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::TsConfigName,
                    names: alloc::vec![name],
                });
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("event")
                    && matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("trigger")) =>
            {
                self.advance(); // TRIGGER
                let name = self.expect_ident_like()?;
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::EventTriggerName,
                    names: alloc::vec![name],
                });
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("large")
                    && matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("object")) =>
            {
                self.advance(); // OBJECT
                let oid = match self.advance() {
                    Token::Integer(n) => alloc::format!("{n}"),
                    other => {
                        return Err(
                            self.err(alloc::format!("expected large object oid, got {other:?}"))
                        );
                    }
                };
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::LargeObjectOid,
                    names: alloc::vec![oid],
                });
            }
            // v7.39 (round 708) — `ALTER AGGREGATE name(args) …`. Same
            // argument-list parse as DROP AGGREGATE (round 707); the
            // action no-ops, the existence check is real.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("aggregate") => {
                // Same round-695 trap as above: AGGREGATE is already
                // consumed; the cursor is at the name.
                let name = self.expect_ident_like()?;
                let mut names = alloc::vec![name];
                if matches!(self.peek(), Token::LParen) {
                    self.advance();
                    loop {
                        match self.peek().clone() {
                            Token::RParen => {
                                self.advance();
                                break;
                            }
                            Token::Star => {
                                self.advance();
                                names.push(String::from("*"));
                            }
                            Token::Comma => {
                                self.advance();
                            }
                            _ => {
                                let mut t = self.expect_ident_like()?;
                                while let Token::Ident(nx) = self.peek() {
                                    let nx = nx.clone();
                                    self.advance();
                                    t.push(' ');
                                    t.push_str(&nx);
                                }
                                names.push(t);
                            }
                        }
                    }
                }
                self.consume_until_statement_boundary();
                return Ok(Statement::ValidateOnly {
                    kind: crate::ast::ValidateOnlyKind::AggregateName,
                    names,
                });
            }
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    s.to_ascii_lowercase().as_str(),
                    "view"
                        | "function"
                        | "database"
                        | "schema"
                        | "owner"
                        | "default"
                        | "extension"
                        | "materialized"
                        | "publication"
                        | "subscription"
                        // v7.37.17 (17.6 siblings) — additional ALTER
                        // targets pg_dump / pg_dumpall / operator DB
                        // migration scripts commonly emit. SPG has
                        // no matching machinery for any of these; the
                        // parser accepts + Empty-returns so pg_dump
                        // tail statements don't stall.
                        | "tablespace"
                        | "language"
                        | "operator"
                        | "conversion"
                        | "statistics"
                        | "server"
                        | "foreign"
                        // `text` stays for TEXT SEARCH DICTIONARY / PARSER
                        // / TEMPLATE (CONFIGURATION intercepted above).
                        | "text"
                ) =>
            {
                self.consume_until_statement_boundary();
                return Ok(Statement::Empty);
            }
            other => {
                return Err(self.err(format!(
                    "expected INDEX / TABLE / SEQUENCE / VIEW / FUNCTION / TYPE / OWNER / etc \
                     after ALTER, got {other:?}"
                )));
            }
        }
        // v7.16.2 — optional `IF EXISTS` after ALTER INDEX
        // (mailrs migrate-042 ships these). The presence of an
        // IF EXISTS makes the subsequent name lookup tolerate
        // a missing index — engine returns CommandOk no-op.
        let if_exists = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if")) {
            let next = self.tokens.get(self.pos + 1);
            if matches!(next, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exists")) {
                self.advance();
                self.advance();
                true
            } else {
                false
            }
        } else {
            false
        };
        let name = self.expect_ident_like()?;
        // v7.16.2 — RENAME TO new_name shape (mailrs migrate-042).
        // Detect BEFORE the REBUILD path so the existing REBUILD
        // arm stays untouched.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("rename")) {
            self.advance();
            if matches!(self.peek(), Token::To) {
                self.advance();
            } else {
                self.expect_keyword_ident("to")?;
            }
            let new = self.expect_ident_like()?;
            return Ok(Statement::AlterIndex(crate::ast::AlterIndexStatement {
                name,
                target: crate::ast::AlterIndexTarget::Rename { new, if_exists },
            }));
        }
        // v7.39 (round 710) — SET ( … ) / RESET ( … ) storage parameters.
        // A syntax error before; the index is validated, the params no-op.
        if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("reset"))
            || (matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("set"))
                && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)))
        {
            self.consume_until_statement_boundary();
            return Ok(Statement::AlterIndex(crate::ast::AlterIndexStatement {
                name,
                target: crate::ast::AlterIndexTarget::StorageParams,
            }));
        }
        // REBUILD
        self.expect_keyword_ident("rebuild")?;
        // Optional: WITH (encoding = <enc>)
        let encoding = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' after WITH in ALTER INDEX REBUILD, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            self.expect_keyword_ident("encoding")?;
            if !matches!(self.peek(), Token::Eq) {
                return Err(self.err(format!(
                    "expected '=' after encoding in ALTER INDEX REBUILD, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let enc_ident = match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => s,
                other => {
                    return Err(self.err(format!("expected encoding name after =, got {other:?}")));
                }
            };
            let enc = match enc_ident.to_ascii_lowercase().as_str() {
                "f32" => VecEncoding::F32,
                "sq8" => VecEncoding::Sq8,
                "half" => VecEncoding::F16,
                other => {
                    return Err(self.err(format!(
                        "unknown vector encoding {other:?} in ALTER INDEX REBUILD; supported: F32, SQ8, HALF"
                    )));
                }
            };
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(format!(
                    "expected ')' after encoding value, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            Some(enc)
        } else {
            None
        };
        Ok(Statement::AlterIndex(crate::ast::AlterIndexStatement {
            name,
            target: crate::ast::AlterIndexTarget::Rebuild { encoding },
        }))
    }

    /// v6.7.2 — `ALTER TABLE <name> SET hot_tier_bytes = <n>`. The
    /// only `SET` form currently supported; future v6.7.x can add
    /// more SET subjects without changing the dispatch shape.
    /// v7.13.2 — mailrs round-6 S1: accepts comma-separated
    /// subactions. Single-subaction shape stays a 1-element vec.
    fn parse_alter_table_after_keyword(&mut self) -> Result<Statement, ParseError> {
        let table_name = self.expect_ident_like()?;
        let mut targets: Vec<crate::ast::AlterTableTarget> = Vec::new();
        loop {
            let subaction = self.parse_alter_table_subaction()?;
            // ADD COLUMN with inline REFERENCES emits both an
            // AddColumn and an AddForeignKey subaction; the
            // helper returns 1 or 2 items.
            targets.extend(subaction);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        Ok(Statement::AlterTable(crate::ast::AlterTableStatement {
            name: table_name,
            targets,
        }))
    }

    /// Parse one ALTER TABLE subaction. Returns a Vec because
    /// inline `REFERENCES` on `ADD COLUMN` produces both an
    /// AddColumn and an AddForeignKey entry (mailrs round-6 S3).
    fn parse_alter_table_subaction(
        &mut self,
    ) -> Result<Vec<crate::ast::AlterTableTarget>, ParseError> {
        match self.peek() {
            Token::Ident(s) if s.eq_ignore_ascii_case("set") => {
                self.advance();
                // v7.37.18 (18.7-18.15) — SET ( option = value, … )
                // storage parameters: paren-prefixed; consume.
                if matches!(self.peek(), Token::LParen) {
                    self.consume_until_statement_boundary();
                    return Ok(Vec::new());
                }
                let setting = self.expect_ident_like()?;
                if setting.eq_ignore_ascii_case("hot_tier_bytes") {
                    if !matches!(self.peek(), Token::Eq) {
                        return Err(self.err(alloc::format!(
                            "expected '=' after hot_tier_bytes, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let n = self.expect_u64_literal()?;
                    return Ok(alloc::vec![crate::ast::AlterTableTarget::SetHotTierBytes(n)]);
                }
                // v7.37.18 (18.7 / 18.8 / 18.11 / 18.13 / 18.14) —
                // accept-and-no-op for ALTER TABLE SET <subject>
                // forms that pg_dump emits but SPG either treats
                // as N/A (single-tenant, single-owner, no shared
                // tablespaces) or accepts the dump-side declaration
                // without runtime effect:
                //   SET SCHEMA <name>            (18.11)
                //   SET TABLESPACE <name>        (18.8)
                //   SET LOGGED / UNLOGGED        (18.7 alt-form)
                //   SET WITHOUT CLUSTER          (18.13)
                //   SET WITHOUT OIDS             (PG legacy)
                //   SET (option = value, …)      (storage parameters)
                //   SET REPLICA IDENTITY {…}     (18.14)
                if setting.eq_ignore_ascii_case("schema")
                    || setting.eq_ignore_ascii_case("tablespace")
                    || setting.eq_ignore_ascii_case("logged")
                    || setting.eq_ignore_ascii_case("unlogged")
                    || setting.eq_ignore_ascii_case("without")
                {
                    self.consume_until_statement_boundary();
                    return Ok(Vec::new());
                }
                if setting.eq_ignore_ascii_case("replica") {
                    // SET REPLICA IDENTITY {DEFAULT|FULL|NOTHING|USING INDEX <name>}
                    self.consume_until_statement_boundary();
                    return Ok(Vec::new());
                }
                // SET (option=value, …) — storage parameters.
                if matches!(self.peek(), Token::LParen) {
                    self.consume_until_statement_boundary();
                    return Ok(Vec::new());
                }
                Err(self.err(alloc::format!(
                    "ALTER TABLE SET: unknown setting {setting:?}; supported: \
                     hot_tier_bytes / SCHEMA / TABLESPACE / LOGGED / UNLOGGED / \
                     WITHOUT CLUSTER / WITHOUT OIDS / REPLICA IDENTITY / (storage_params)"
                )))
            }
            // v7.39 (round 647) — `ALTER TABLE c INHERIT p`. Carried now,
            // not ignored: round 645 gave SPG the inheritance the
            // v7.37.18 no-op said it did not have.
            Token::Ident(s) if s.eq_ignore_ascii_case("inherit") => {
                self.advance();
                let parent = self.expect_ident_like()?;
                self.consume_until_statement_boundary();
                Ok(alloc::vec![crate::ast::AlterTableTarget::Inherit {
                    parent,
                    detach: false
                }])
            }
            // `NO INHERIT <parent>`. Guarded to NOT match `NO FORCE ROW
            // LEVEL SECURITY`, which has its own RLS arm below — without
            // the guard this swallowed NO FORCE as a no-op.
            Token::Ident(s)
                if s.eq_ignore_ascii_case("no")
                    && !matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(t)) if t.eq_ignore_ascii_case("force")
                    ) =>
            {
                self.advance();
                if matches!(self.peek(), Token::Ident(k) | Token::QuotedIdent(k)
                    if k.eq_ignore_ascii_case("inherit"))
                {
                    self.advance();
                    let parent = self.expect_ident_like()?;
                    self.consume_until_statement_boundary();
                    return Ok(alloc::vec![crate::ast::AlterTableTarget::Inherit {
                        parent,
                        detach: true
                    }]);
                }
                self.consume_until_statement_boundary();
                Ok(Vec::new())
            }
            // v7.37.18 (18.10) — ALTER TABLE OWNER TO <user>. SPG is
            // single-owner, so there is still nothing to record.
            //
            // v7.39 (round 652) — but the name now reaches the engine,
            // which refuses a role that does not exist as PG does. The
            // no-op was swallowing the whole statement, so a dump naming
            // a role this server never heard of restored clean and left
            // the table owned by whoever ran the restore.
            Token::Ident(s) if s.eq_ignore_ascii_case("owner") => {
                self.advance();
                if matches!(self.peek(), Token::To) {
                    self.advance();
                }
                let role = self.expect_ident_like()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::OwnerTo {
                    role
                }])
            }
            // v7.37.18 (18.13) — ALTER TABLE CLUSTER ON <index>.
            // PG sets a hint; SPG doesn't have clustered storage, so the
            // hint itself stays a no-op.
            //
            // v7.39 (round 652) — the index name is checked now. PG
            // errors on one that does not exist, and swallowing that let
            // a typo'd CLUSTER ON pass silently.
            Token::Ident(s) if s.eq_ignore_ascii_case("cluster") => {
                self.advance();
                // `ON` is a reserved token, not an ident.
                if !matches!(self.peek(), Token::On) {
                    return Err(self.err(alloc::format!(
                        "expected ON after CLUSTER, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let index = self.expect_ident_like()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::ClusterOn {
                    index: Some(index)
                }])
            }
            // v7.39 (read01 round 49) — ALTER TABLE REPLICA IDENTITY
            // { DEFAULT | FULL | NOTHING | USING INDEX <name> }. PG records
            // what a logical decoder puts in the old-tuple image; SPG's
            // replication is SQL-text, so there is nothing to record.
            // Accept-and-no-op (it used to be a parse error).
            Token::Ident(s) if s.eq_ignore_ascii_case("replica") => {
                self.advance();
                // v7.39 (round 710) — `REPLICA IDENTITY USING INDEX <i>`
                // validates the index; DEFAULT / FULL / NOTHING stay no-op.
                if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("identity"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(k)) if k.eq_ignore_ascii_case("using"))
                {
                    self.advance(); // IDENTITY
                    self.advance(); // USING
                    if matches!(self.peek(), Token::Index)
                        || matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("index"))
                    {
                        self.advance();
                    }
                    let index = self.expect_ident_like()?;
                    self.consume_until_statement_boundary();
                    return Ok(alloc::vec![
                        crate::ast::AlterTableTarget::ReplicaIdentityUsingIndex { index }
                    ]);
                }
                self.consume_until_statement_boundary();
                Ok(Vec::new())
            }
            // v7.37.18 (18.15) — ALTER TABLE VALIDATE CONSTRAINT <name>.
            //
            // v7.39 (round 652) — it used to consume the statement and
            // return nothing, on the stated theory that SPG validated at
            // ADD CONSTRAINT time so there was never anything left to
            // validate. Measured against PG18, ADD CONSTRAINT did not
            // scan the existing rows at all — the comment described a
            // property SPG did not have, which is why nobody looked. Both
            // halves are real now: ADD scans unless told NOT VALID, and
            // this scans what NOT VALID skipped.
            Token::Ident(s) if s.eq_ignore_ascii_case("validate") => {
                self.advance();
                self.expect_keyword_ident("constraint")?;
                let name = self.expect_ident_like()?;
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::ValidateConstraint { name }
                ])
            }
            // v7.37.18 (18.18) — RESET ( option [, …] ). Inverse of
            // SET (option = value, …). PG uses it to clear per-table
            // storage params like fillfactor or autovacuum_*. SPG
            // engine-manages those parameters; accept-and-no-op.
            Token::Ident(s) if s.eq_ignore_ascii_case("reset") => {
                self.advance();
                self.consume_until_statement_boundary();
                Ok(Vec::new())
            }
            // v7.37.18 (18.18) — OF <type_name> / NOT OF. Composite-
            // type-of binding (PG 9.0+). SPG composite types
            // (v7.37.5 ζ-B sub-commit) follow CREATE TYPE; ALTER
            // TABLE OF is rare and inverse of CREATE TABLE OF.
            // Accept-and-no-op until a customer dump round-trips it.
            Token::Ident(s) if s.eq_ignore_ascii_case("of") => {
                self.advance();
                // v7.39 (round 710) — the type name is validated now.
                let type_name = self.expect_ident_like()?;
                self.consume_until_statement_boundary();
                Ok(alloc::vec![crate::ast::AlterTableTarget::OfType {
                    type_name
                }])
            }
            // v7.37.18 (18.18) — `NOT OF` lexes NOT as Token::Not
            // (reserved keyword) rather than Token::Ident("not"),
            // so it needs its own arm. Accept-and-no-op same as OF.
            Token::Not => {
                self.advance();
                self.consume_until_statement_boundary();
                Ok(Vec::new())
            }
            // v7.39 (RLS) — FORCE ROW LEVEL SECURITY (sets relforcerowsecurity).
            Token::Ident(s) if s.eq_ignore_ascii_case("force") => {
                self.advance();
                self.expect_row_level_security()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::SetRowSecurity {
                    enabled: None,
                    force: Some(true),
                }])
            }
            // v7.39 (RLS) — NO FORCE ROW LEVEL SECURITY.
            Token::Ident(s)
                if s.eq_ignore_ascii_case("no")
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(t)) if t.eq_ignore_ascii_case("force")
                    ) =>
            {
                self.advance(); // NO
                self.advance(); // FORCE
                self.expect_row_level_security()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::SetRowSecurity {
                    enabled: None,
                    force: Some(false),
                }])
            }
            // v7.39 (RLS) — ENABLE/DISABLE ROW LEVEL SECURITY
            // (sets relrowsecurity). The guard requires the next token to be
            // `ROW` so the ENABLE/DISABLE TRIGGER arm still matches its case.
            Token::Ident(s)
                if (s.eq_ignore_ascii_case("enable") || s.eq_ignore_ascii_case("disable"))
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(t)) if t.eq_ignore_ascii_case("row")
                    ) =>
            {
                let enabled = s.eq_ignore_ascii_case("enable");
                self.advance(); // ENABLE/DISABLE
                self.expect_row_level_security()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::SetRowSecurity {
                    enabled: Some(enabled),
                    force: None,
                }])
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("add") => {
                self.advance();
                // v7.39 (round 431) — MySQL's `ALTER TABLE t ADD [UNIQUE]
                // {INDEX|KEY} [name] (cols)`, which every ORM migration
                // emits. The same grammar CREATE TABLE already accepts
                // inline (`KEY idx (a)`, prefix lengths and all), so it goes
                // through the SAME parser — an ALTER-only copy would be a
                // second place for the two to drift.
                if self.peek_mysql_inline_key_start() {
                    return Ok(match self.parse_mysql_inline_key()? {
                        Some(c) => {
                            alloc::vec![crate::ast::AlterTableTarget::AddTableConstraint(c)]
                        }
                        // FULLTEXT / SPATIAL parse and are accepted as a
                        // no-op here exactly as they are inline.
                        None => Vec::new(),
                    });
                }
                // v7.14.0 — ADD CONSTRAINT <name> { FOREIGN KEY |
                // PRIMARY KEY | UNIQUE | CHECK }. pg_dump emits
                // PRIMARY KEY this way; mysqldump emits both.
                // Peek-only dispatch (no advance) — `advance()`
                // destructively replaces consumed tokens with Eof,
                // so saved-pos restore would land on Eofs.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint"))
                {
                    // The next-but-one ident is the constraint
                    // name; the one after THAT is the kind.
                    let kind_pos = self.pos + 2;
                    let kind = self.tokens.get(kind_pos).cloned();
                    if matches!(&kind, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("foreign"))
                    {
                        let fk = self.parse_table_level_fk()?;
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddForeignKey(fk)
                        ]);
                    }
                    if matches!(&kind, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("primary"))
                    {
                        self.advance(); // CONSTRAINT
                        // v7.39 (read01 round 48) — keep the name; the engine
                        // stores it now instead of dropping it on the floor.
                        let con_name = self.expect_ident_like()?;
                        self.advance(); // PRIMARY
                        self.expect_keyword_ident("key")?;
                        let cols = self.parse_paren_ident_list("PRIMARY KEY")?;
                        // v7.39 (round 711) — the ALTER form carries the
                        // timing too (pg_dump writes it here).
                        let (deferrable, initially_deferred) =
                            self.consume_deferrable_clauses_timed()?;
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(
                                crate::ast::TableConstraint::PrimaryKey {
                                    name: Some(con_name),
                                    columns: cols,
                                    deferrable,
                                    initially_deferred,
                                }
                            )
                        ]);
                    }
                    if matches!(&kind, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("unique"))
                    {
                        self.advance(); // CONSTRAINT
                        // v7.39 (read01 round 48) — keep the name.
                        let con_name = self.expect_ident_like()?;
                        // v7.22 (mailrs round-13 gap 6) — delegate so
                        // the optional `NULLS [NOT] DISTINCT` modifier
                        // parses here too (pg_dump emits the ALTER
                        // form; semantics enforced by the engine
                        // since v7.13).
                        let mut uc = self.parse_table_level_unique()?;
                        if let crate::ast::TableConstraint::Unique { name, .. } = &mut uc {
                            *name = Some(con_name);
                        }
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(uc)
                        ]);
                    }
                    if matches!(&kind, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("check"))
                    {
                        self.advance(); // CONSTRAINT
                        // v7.39 (read01 round 48) — keep the name.
                        let con_name = self.expect_ident_like()?;
                        self.advance(); // CHECK
                        if !matches!(self.peek(), Token::LParen) {
                            return Err(self.err(alloc::format!(
                                "expected '(' after CHECK, got {:?}", self.peek()
                            )));
                        }
                        self.advance();
                        let expr = self.parse_expr(0)?;
                        if matches!(self.peek(), Token::RParen) {
                            self.advance();
                        }
                        let not_valid = self.parse_not_valid_suffix();
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(
                                crate::ast::TableConstraint::Check {
                                    name: Some(con_name),
                                    expr,
                                    not_valid,
                                }
                            )
                        ]);
                    }
                    // v7.39 (round 211) — ADD CONSTRAINT <name> EXCLUDE
                    // [USING <am>] (<col> WITH <op>[, …]). pg_dump emits
                    // exclusion constraints via this ALTER form.
                    if matches!(&kind, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exclude"))
                    {
                        self.advance(); // CONSTRAINT
                        let con_name = self.expect_ident_like()?;
                        let mut ex = self.parse_table_level_exclude()?;
                        if let crate::ast::TableConstraint::Exclude { name, .. } = &mut ex {
                            *name = Some(con_name);
                        }
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(ex)
                        ]);
                    }
                    // Unknown kind — fall through to FK path which
                    // produces a descriptive parse error.
                }
                let is_fk = matches!(
                    self.peek(),
                    Token::Ident(s) if s.eq_ignore_ascii_case("constraint")
                        || s.eq_ignore_ascii_case("foreign")
                );
                if is_fk {
                    let fk = self.parse_table_level_fk()?;
                    return Ok(alloc::vec![crate::ast::AlterTableTarget::AddForeignKey(fk)]);
                }
                // v7.14.0 — bare ADD PRIMARY KEY / UNIQUE / CHECK
                // (no CONSTRAINT prefix) — same dispatch.
                match self.peek().clone() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("primary") => {
                        self.advance();
                        self.expect_keyword_ident("key")?;
                        let cols = self.parse_paren_ident_list("PRIMARY KEY")?;
                        let (deferrable, initially_deferred) =
                            self.consume_deferrable_clauses_timed()?;
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(
                                crate::ast::TableConstraint::PrimaryKey {
                                    name: None,
                                    columns: cols,
                                    deferrable,
                                    initially_deferred,
                                }
                            )
                        ]);
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("unique") => {
                        // v7.22 — delegate (NULLS [NOT] DISTINCT).
                        let uc = self.parse_table_level_unique()?;
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(uc)
                        ]);
                    }
                    // v7.39 (round 652) — bare ADD CHECK (no CONSTRAINT
                    // prefix). The other three bare forms were here and
                    // this one was not, so it fell through to the column
                    // path and came back as "unexpected reserved keyword
                    // 'check' at start of column definition".
                    _ if self.peek_table_level_check_start() => {
                        let chk = self.parse_table_level_check()?;
                        let not_valid = self.parse_not_valid_suffix();
                        let crate::ast::TableConstraint::Check { expr, .. } = chk else {
                            unreachable!("parse_table_level_check returns Check")
                        };
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(
                                crate::ast::TableConstraint::Check {
                                    name: None,
                                    expr,
                                    not_valid,
                                }
                            )
                        ]);
                    }
                    // v7.39 (round 211) — bare ADD EXCLUDE (no CONSTRAINT prefix).
                    Token::Ident(s) if s.eq_ignore_ascii_case("exclude") => {
                        let ex = self.parse_table_level_exclude()?;
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AddTableConstraint(ex)
                        ]);
                    }
                    _ => {}
                }
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("column")) {
                    self.advance();
                }
                let mut if_not_exists = false;
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if")) {
                    self.advance();
                    if !matches!(self.peek(), Token::Not) {
                        return Err(self.err(alloc::format!(
                            "expected NOT after IF in ALTER TABLE ADD COLUMN, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exists")) {
                        return Err(self.err(alloc::format!(
                            "expected EXISTS after IF NOT in ALTER TABLE ADD COLUMN, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    if_not_exists = true;
                }
                // v7.13.2 — mailrs round-6 S3: `ADD COLUMN col TYPE
                // REFERENCES other(col) [ON DELETE …]`. parse_column_def
                // returns ColumnDef + an optional inline FK.
                let (column, col_level_fk) = self.parse_column_def_with_fk()?;
                let col_name = column.name.clone();
                let mut out = alloc::vec![crate::ast::AlterTableTarget::AddColumn {
                    column,
                    if_not_exists,
                }];
                if let Some(mut fk) = col_level_fk {
                    if fk.columns.is_empty() {
                        fk.columns.push(col_name);
                    }
                    out.push(crate::ast::AlterTableTarget::AddForeignKey(fk));
                }
                Ok(out)
            }
            Token::Drop => {
                self.advance();
                // v7.13.3 — dispatch on the next token. mailrs round-7
                // S8 closed DROP COLUMN; round-6 S7 closed
                // DROP CONSTRAINT. Both share IF EXISTS / CASCADE /
                // RESTRICT modifiers.
                //   DROP CONSTRAINT [IF EXISTS] <name> [CASCADE|RESTRICT]
                //   DROP [COLUMN] [IF EXISTS] <col> [CASCADE|RESTRICT]
                let subject = match self.peek() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("constraint") => {
                        self.advance();
                        "constraint"
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("column") => {
                        self.advance();
                        "column"
                    }
                    // v7.39 (round 431) — MySQL `DROP {INDEX|KEY} name`.
                    // `INDEX` lexes as the reserved Token::Index, so it is
                    // unambiguous. `KEY` is a plain ident, and PG allows a
                    // column literally named "key", so only read it as the
                    // keyword when a name follows it.
                    Token::Index => {
                        self.advance();
                        "index"
                    }
                    Token::Ident(s)
                        if s.eq_ignore_ascii_case("key")
                            && matches!(
                                self.tokens.get(self.pos + 1),
                                Some(Token::Ident(_) | Token::QuotedIdent(_))
                            ) =>
                    {
                        self.advance();
                        "index"
                    }
                    // PG-canonical bare `DROP <col>` without COLUMN
                    // keyword is also valid; treat any other ident
                    // as the column name.
                    Token::Ident(_) | Token::QuotedIdent(_) => "column",
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected COLUMN / CONSTRAINT after DROP in ALTER TABLE, got {other:?}"
                        )));
                    }
                };
                let mut if_exists = false;
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if")) {
                    let n1 = self.tokens.get(self.pos + 1);
                    if matches!(n1, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exists")) {
                        self.advance();
                        self.advance();
                        if_exists = true;
                    }
                }
                let name = self.expect_ident_like()?;
                let mut cascade = false;
                if matches!(
                    self.peek(),
                    Token::Ident(s) if s.eq_ignore_ascii_case("cascade")
                        || s.eq_ignore_ascii_case("restrict")
                ) {
                    if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("cascade"))
                    {
                        cascade = true;
                    }
                    self.advance();
                }
                if subject == "index" {
                    Ok(alloc::vec![crate::ast::AlterTableTarget::DropIndex {
                        name,
                        if_exists,
                    }])
                } else if subject == "constraint" {
                    Ok(alloc::vec![crate::ast::AlterTableTarget::DropForeignKey {
                        name,
                        if_exists,
                    }])
                } else {
                    Ok(alloc::vec![crate::ast::AlterTableTarget::DropColumn {
                        column: name,
                        if_exists,
                        cascade,
                    }])
                }
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("alter") => {
                self.advance();
                // v7.37.18 (18.16) — `ALTER TABLE … ALTER CONSTRAINT
                // <name> {DEFERRABLE|NOT DEFERRABLE} [INITIALLY
                // {IMMEDIATE|DEFERRED}]`. SPG enforces constraints
                // immediately; accept-and-no-op.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint")) {
                    self.advance();
                    self.consume_until_statement_boundary();
                    return Ok(Vec::new());
                }
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("column")) {
                    self.advance();
                }
                let col_name = self.expect_ident_like()?;
                match self.peek() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("type") => {
                        self.advance();
                    }
                    // v7.14.0 — pg_dump emits BIGSERIAL via
                    // `ALTER TABLE … ALTER COLUMN id SET DEFAULT
                    // nextval('seq')` (the sequence is created
                    // separately). SPG's BIGSERIAL already uses
                    // AUTO_INCREMENT; accept SET DEFAULT / DROP
                    // DEFAULT / SET NOT NULL / DROP NOT NULL as
                    // engine no-ops by consuming the tail.
                    Token::Ident(s) if s.eq_ignore_ascii_case("set") => {
                        // v7.22 (round-13 T2) — `SET DEFAULT
                        // nextval('…')` is how pg_dump spells a
                        // SERIAL column (plain integer in CREATE
                        // TABLE + this ALTER). It used to be
                        // swallowed as a no-op, which silently
                        // STRIPPED auto-increment from imported
                        // schemas — the first post-import INSERT
                        // without an explicit id then violated NOT
                        // NULL. Lower it to the auto-increment
                        // marker instead.
                        let is_default_nextval =
                            matches!(self.tokens.get(self.pos + 1), Some(Token::Default))
                                && matches!(
                                    self.tokens.get(self.pos + 2),
                                    Some(Token::Ident(f)) if f.eq_ignore_ascii_case("nextval")
                                );
                        if is_default_nextval {
                            let seq_name = self.scan_sequence_name_until_boundary();
                            return Ok(alloc::vec![
                                crate::ast::AlterTableTarget::SetColumnAutoIncrement {
                                    column: col_name,
                                    seq_name,
                                }
                            ]);
                        }
                        // v7.37.18 (18.1 + 18.2) — proper lowering.
                        self.advance(); // consume "set"
                        match self.peek().clone() {
                            Token::Default => {
                                self.advance();
                                let default_expr = self.parse_expr(0)?;
                                return Ok(alloc::vec![
                                    crate::ast::AlterTableTarget::AlterColumnSetDefault {
                                        column: col_name,
                                        default_expr,
                                    }
                                ]);
                            }
                            Token::Not => {
                                self.advance();
                                if !matches!(self.peek(), Token::Null) {
                                    return Err(self.err(alloc::format!(
                                        "expected NULL after ALTER COLUMN SET NOT, got {:?}",
                                        self.peek()
                                    )));
                                }
                                self.advance();
                                return Ok(alloc::vec![
                                    crate::ast::AlterTableTarget::AlterColumnSetNotNull {
                                        column: col_name,
                                    }
                                ]);
                            }
                            // `SET EXPRESSION AS (expr)` (PG 17) — change a
                            // stored generated column's expression and
                            // recompute existing rows.
                            Token::Ident(s) if s.eq_ignore_ascii_case("expression") => {
                                self.advance(); // EXPRESSION
                                if matches!(self.peek(), Token::As) {
                                    self.advance();
                                }
                                let expr = self.parse_expr(0)?;
                                return Ok(alloc::vec![
                                    crate::ast::AlterTableTarget::AlterColumnSetExpression {
                                        column: col_name,
                                        expr,
                                    }
                                ]);
                            }
                            other => {
                                // Other SET subjects (STATISTICS,
                                // STORAGE, COMPRESSION, …) stay no-ops —
                                // storage hints with no SPG semantics.
                                let _ = other;
                                self.consume_until_statement_boundary();
                                return Ok(Vec::new());
                            }
                        }
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("drop") => {
                        self.advance(); // consume "drop"
                        return self.parse_alter_column_drop_tail(col_name);
                    }
                    Token::Drop => {
                        self.advance(); // consume Drop token
                        return self.parse_alter_column_drop_tail(col_name);
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("add") => {
                        // v7.22 (round-13 T2) — `ALTER COLUMN c ADD
                        // GENERATED { ALWAYS | BY DEFAULT } AS
                        // IDENTITY ( … )`: pg_dump's spelling for
                        // identity columns. Same auto-increment
                        // lowering as the nextval default; the
                        // sequence options inside the parens are
                        // no-ops under SPG's max+1 semantics.
                        let is_generated = matches!(
                            self.tokens.get(self.pos + 1),
                            Some(Token::Ident(g)) if g.eq_ignore_ascii_case("generated")
                        );
                        if !is_generated {
                            return Err(self.err(alloc::format!(
                                "expected GENERATED after ALTER COLUMN {col_name} ADD, got {:?}",
                                self.tokens.get(self.pos + 1)
                            )));
                        }
                        let seq_name = self.scan_sequence_name_until_boundary();
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::SetColumnAutoIncrement {
                                column: col_name,
                                seq_name,
                            }
                        ]);
                    }
                    // v7.39 (round 220) — `RESTART [WITH n]` on an identity
                    // column: floor the next allocated value at n (bare
                    // RESTART = restart from the start value, 1).
                    Token::Ident(s) if s.eq_ignore_ascii_case("restart") => {
                        self.advance();
                        let with = if matches!(self.peek(), Token::Ident(w) if w.eq_ignore_ascii_case("with"))
                        {
                            self.advance();
                            let neg = if matches!(self.peek(), Token::Minus) {
                                self.advance();
                                true
                            } else {
                                false
                            };
                            match self.advance() {
                                Token::Integer(v) => Some(if neg { -v } else { v }),
                                other => {
                                    return Err(self.err(alloc::format!(
                                        "expected integer after RESTART WITH, got {other:?}"
                                    )));
                                }
                            }
                        } else {
                            None
                        };
                        return Ok(alloc::vec![
                            crate::ast::AlterTableTarget::AlterColumnRestart {
                                column: col_name,
                                with,
                            }
                        ]);
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected TYPE / SET / DROP / ADD after ALTER COLUMN <name>, got {other:?}"
                        )));
                    }
                }
                // v7.39 (round 713) — the type parser has consumed a
                // trailing `COLLATE <name>` since Phase 2.5, and
                // `parse_column_type_name` discarded it: `ALTER COLUMN t
                // TYPE text COLLATE "C"` parsed clean and changed
                // nothing. Keep the clause; the engine re-collates.
                let (new_type, _, _, _, coll, coll_explicit, coll_name, _, _, _, _, _) =
                    self.parse_type_with_implied_flags()?;
                let collation = if coll_explicit {
                    coll_name.map(|n| (coll, n))
                } else {
                    None
                };
                let using = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using"))
                {
                    self.advance();
                    Some(self.parse_expr(0)?)
                } else {
                    None
                };
                Ok(alloc::vec![crate::ast::AlterTableTarget::AlterColumnType {
                    column: col_name,
                    new_type,
                    using,
                    collation,
                }])
            }
            // v7.15.0 — `ALTER TABLE t RENAME [COLUMN] old TO new`.
            // PG also supports `RENAME TO new_table` for table-name
            // rename; that surface is deferred (pg_dump never emits
            // it). If the first post-RENAME ident is `TO`, the user
            // is asking for table rename — error with a clear
            // message rather than misparsing `TO` as a column name.
            Token::Ident(s) if s.eq_ignore_ascii_case("rename") => {
                self.advance();
                // v7.16.2 — `ALTER TABLE t RENAME TO new_table`
                // table-name rename (mailrs round-10 A.5 — used
                // by migrate-042's `RENAME TO email_contacts`).
                // `TO` lexes as Token::To.
                if matches!(self.peek(), Token::To)
                    || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("to"))
                {
                    self.advance();
                    let new = self.expect_ident_like()?;
                    return Ok(alloc::vec![crate::ast::AlterTableTarget::RenameTable {
                        new,
                    }]);
                }
                // v7.39 (read01 round 48) — `RENAME CONSTRAINT old TO new`.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint")) {
                    self.advance();
                    let old = self.expect_ident_like()?;
                    if matches!(self.peek(), Token::To) {
                        self.advance();
                    } else {
                        self.expect_keyword_ident("to")?;
                    }
                    let new = self.expect_ident_like()?;
                    return Ok(alloc::vec![
                        crate::ast::AlterTableTarget::RenameConstraint { old, new }
                    ]);
                }
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("column")) {
                    self.advance();
                }
                let old = self.expect_ident_like()?;
                // `TO` is a reserved keyword token; accept both
                // Token::To and Token::Ident("to") for consistency.
                if matches!(self.peek(), Token::To) {
                    self.advance();
                } else {
                    self.expect_keyword_ident("to")?;
                }
                let new = self.expect_ident_like()?;
                Ok(alloc::vec![crate::ast::AlterTableTarget::RenameColumn {
                    old,
                    new,
                }])
            }
            // v7.16.1 — `ALTER TABLE t { ENABLE | DISABLE } TRIGGER
            // { ALL | <name> }`. pg_dump --disable-triggers wraps
            // every data block with these. Real disable semantics —
            // not no-op — because reload correctness assumes the
            // triggers don't fire (rows already carry their
            // computed values from prod).
            Token::Ident(s)
                if s.eq_ignore_ascii_case("enable") || s.eq_ignore_ascii_case("disable") =>
            {
                let enabled = s.eq_ignore_ascii_case("enable");
                self.advance();
                // PG also accepts ENABLE/DISABLE { REPLICA | ALWAYS }
                // TRIGGER … and ENABLE/DISABLE RULE / ROW LEVEL
                // SECURITY. v7.16.1 only matches TRIGGER (mailrs's
                // pg_dump output) — anything else falls through to
                // the catch-all error below.
                // v7.22 (round-13 T3) — mysqldump wraps every data
                // section in `/*!40000 ALTER TABLE t DISABLE KEYS */`
                // + ENABLE KEYS (a MyISAM index-rebuild hint). SPG
                // maintains indexes incrementally — engine no-op.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("keys")) {
                    self.advance();
                    return Ok(Vec::new());
                }
                // v7.37.18 (18.12) — ENABLE/DISABLE ALWAYS TRIGGER
                // and ENABLE/DISABLE REPLICA TRIGGER. PG uses these
                // to gate triggers on session_replication_role; SPG
                // has no replica role, so the prefix is consumed and
                // treated identically to the plain ENABLE/DISABLE
                // TRIGGER form.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("always"))
                    || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("replica"))
                {
                    self.advance();
                }
                if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("trigger")) {
                    return Err(self.err(alloc::format!(
                        "expected TRIGGER after {}, got {:?}",
                        if enabled { "ENABLE" } else { "DISABLE" },
                        self.peek()
                    )));
                }
                self.advance();
                // `ALL` lexes as Token::All (reserved); also
                // accept Token::Ident("all") for symmetry.
                // v7.37.18 (18.12) — USER / REPLICA / ALWAYS post-
                // TRIGGER selectors. USER (= all user triggers) is
                // semantically ALL here; REPLICA / ALWAYS gate on
                // session_replication_role which SPG doesn't track.
                // All map to TriggerSelector::All.
                let which = if matches!(self.peek(), Token::All)
                    || matches!(self.peek(), Token::Ident(s)
                        if s.eq_ignore_ascii_case("all")
                            || s.eq_ignore_ascii_case("user")
                            || s.eq_ignore_ascii_case("replica")
                            || s.eq_ignore_ascii_case("always"))
                {
                    self.advance();
                    crate::ast::TriggerSelector::All
                } else {
                    let name = self.expect_ident_like()?;
                    crate::ast::TriggerSelector::Named(name)
                };
                Ok(alloc::vec![crate::ast::AlterTableTarget::SetTriggerEnabled {
                    which,
                    enabled,
                }])
            }
            // v7.37.16 (16.3) — ATTACH PARTITION child <bounds>
            Token::Ident(s) if s.eq_ignore_ascii_case("attach") => {
                self.advance();
                if !matches!(self.peek(), Token::Partition)
                    && !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("partition"))
                {
                    return Err(self.err(alloc::format!(
                        "expected PARTITION after ATTACH, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let child = self.expect_ident_like()?;
                let bounds = self.parse_partition_bounds_tail()?;
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::AttachPartition { child, bounds }
                ])
            }
            // v7.37.16 (16.4 + 16.5) — DETACH PARTITION child [CONCURRENTLY] [FINALIZE]
            Token::Ident(s) if s.eq_ignore_ascii_case("detach") => {
                self.advance();
                if !matches!(self.peek(), Token::Partition)
                    && !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("partition"))
                {
                    return Err(self.err(alloc::format!(
                        "expected PARTITION after DETACH, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let child = self.expect_ident_like()?;
                let mut concurrently = false;
                let mut finalize = false;
                loop {
                    match self.peek().clone() {
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("concurrently") =>
                        {
                            self.advance();
                            concurrently = true;
                        }
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("finalize") =>
                        {
                            self.advance();
                            finalize = true;
                        }
                        _ => break,
                    }
                }
                Ok(alloc::vec![crate::ast::AlterTableTarget::DetachPartition {
                    child,
                    concurrently,
                    finalize,
                }])
            }
            other => Err(self.err(alloc::format!(
                "expected SET / ADD / DROP / ALTER / RENAME / ENABLE / DISABLE / ATTACH / DETACH in ALTER TABLE, got {other:?}"
            ))),
        }
    }

    /// v7.37.16 (16.3) — parse the `FOR VALUES …` / `DEFAULT`
    /// tail used by both CREATE TABLE … PARTITION OF and ALTER
    /// TABLE … ATTACH PARTITION. Shares the same grammar as
    /// `parse_partition_of_tail`'s bounds branch.
    /// v7.37.18 (18.1 + 18.2) — parse the tail of `ALTER COLUMN
    /// col DROP …`. Accepts `DROP DEFAULT` and `DROP NOT NULL`,
    /// lowering each to the respective AlterTableTarget. Any
    /// other DROP subject (IDENTITY, EXPRESSION, etc.) stays a
    /// no-op via consume_until_statement_boundary.
    fn parse_alter_column_drop_tail(
        &mut self,
        col_name: String,
    ) -> Result<Vec<crate::ast::AlterTableTarget>, ParseError> {
        match self.peek().clone() {
            Token::Default => {
                self.advance();
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::AlterColumnDropDefault { column: col_name }
                ])
            }
            Token::Not => {
                self.advance();
                if !matches!(self.peek(), Token::Null) {
                    return Err(self.err(alloc::format!(
                        "expected NULL after ALTER COLUMN DROP NOT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::AlterColumnDropNotNull { column: col_name }
                ])
            }
            // `DROP EXPRESSION [IF EXISTS]` — de-generate a stored
            // generated column into a plain column.
            Token::Ident(s) if s.eq_ignore_ascii_case("expression") => {
                self.advance();
                // v7.39 (round 187, U10) — IF EXISTS was consumed but
                // dropped, so the engine still errored on a plain
                // column; PG's semantics are NOTICE + skip.
                let mut if_exists = false;
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if")) {
                    self.advance();
                    if matches!(self.peek(), Token::Ident(e) if e.eq_ignore_ascii_case("exists")) {
                        self.advance();
                        if_exists = true;
                    }
                }
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::AlterColumnDropExpression {
                        column: col_name,
                        if_exists,
                    }
                ])
            }
            // v7.38 (read01, T28) — `DROP IDENTITY [IF EXISTS]` — de-generate an
            // identity column into a plain column.
            Token::Ident(s) if s.eq_ignore_ascii_case("identity") => {
                self.advance();
                let mut if_exists = false;
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if")) {
                    self.advance();
                    if matches!(self.peek(), Token::Ident(e) if e.eq_ignore_ascii_case("exists")) {
                        self.advance();
                        if_exists = true;
                    }
                }
                Ok(alloc::vec![
                    crate::ast::AlterTableTarget::AlterColumnDropIdentity {
                        column: col_name,
                        if_exists,
                    }
                ])
            }
            _ => {
                self.consume_until_statement_boundary();
                Ok(Vec::new())
            }
        }
    }

    /// Parse the optional trailer of `COPY … TO STDOUT`: nothing (text
    /// format, no header), the modern `[WITH] ( opt [, opt]* )` list, or
    /// the legacy space-separated `[WITH] CSV|TEXT [HEADER] [DELIMITER
    /// 'c'] [NULL 'str'] [QUOTE 'c']` spelling.
    fn parse_copy_to_options(&mut self) -> Result<crate::ast::CopyOptions, ParseError> {
        let mut opts = crate::ast::CopyOptions::default();
        if matches!(self.peek(), Token::Eof | Token::Semicolon) {
            return Ok(opts);
        }
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
            self.advance();
        }
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                self.parse_one_copy_option(&mut opts)?;
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in COPY options, got {other:?}"
                        )));
                    }
                }
            }
        } else {
            while !matches!(self.peek(), Token::Eof | Token::Semicolon) {
                self.parse_one_copy_option(&mut opts)?;
            }
        }
        if !matches!(self.peek(), Token::Eof | Token::Semicolon) {
            return Err(self.err(alloc::format!(
                "unexpected token after COPY options: {:?}",
                self.peek()
            )));
        }
        Ok(opts)
    }

    fn parse_one_copy_option(
        &mut self,
        opts: &mut crate::ast::CopyOptions,
    ) -> Result<(), ParseError> {
        use crate::ast::CopyFormat;
        // The option keyword. NULL lexes as its own token; the rest are
        // bare identifiers.
        let kw = match self.advance() {
            Token::Null => alloc::string::String::from("NULL"),
            Token::Ident(s) => s.to_uppercase(),
            other => {
                return Err(self.err(alloc::format!(
                    "expected a COPY option keyword, got {other:?}"
                )));
            }
        };
        match kw.as_str() {
            "FORMAT" => {
                let fmt = self.expect_ident_like()?;
                match fmt.to_ascii_uppercase().as_str() {
                    "CSV" => opts.format = CopyFormat::Csv,
                    "TEXT" => opts.format = CopyFormat::Text,
                    other => {
                        return Err(self.err(alloc::format!(
                            "COPY format \"{}\" not recognized",
                            other.to_ascii_lowercase()
                        )));
                    }
                }
            }
            // Legacy bare format keywords.
            "CSV" => opts.format = CopyFormat::Csv,
            "TEXT" => opts.format = CopyFormat::Text,
            "HEADER" => {
                opts.header = match self.peek() {
                    Token::True => {
                        self.advance();
                        true
                    }
                    Token::False => {
                        self.advance();
                        false
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("on") => {
                        self.advance();
                        true
                    }
                    Token::Ident(s) if s.eq_ignore_ascii_case("off") => {
                        self.advance();
                        false
                    }
                    // Bare HEADER (no boolean) means HEADER true.
                    _ => true,
                };
            }
            // r1066 (7.38 S5.1) — pgbench 14+ loads with
            // `COPY … WITH (FREEZE ON)`. The hint's PG effect is
            // vacuum bookkeeping on a freshly created/truncated
            // table; SPG's per-statement visibility makes it a
            // faithful no-op, and rejecting it aborted `pgbench -i`
            // against the drop-in. Accept ON/OFF/bare, change nothing.
            "FREEZE" => match self.peek() {
                Token::True | Token::False => {
                    self.advance();
                }
                Token::Ident(s)
                    if s.eq_ignore_ascii_case("on") || s.eq_ignore_ascii_case("off") =>
                {
                    self.advance();
                }
                _ => {}
            },
            "DELIMITER" | "QUOTE" | "ESCAPE" => {
                let s = match self.advance() {
                    Token::String(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "COPY {kw} expects a single-character string, got {other:?}"
                        )));
                    }
                };
                // v7.39 (round 247) — PG's wording (0A000), keyword in
                // lowercase: "COPY delimiter must be a single one-byte
                // character".
                let one_byte_err = || {
                    self.err(alloc::format!(
                        "COPY {} must be a single one-byte character",
                        kw.to_ascii_lowercase()
                    ))
                };
                let mut chars = s.chars();
                let c = chars.next().ok_or_else(one_byte_err)?;
                if chars.next().is_some() || c.len_utf8() != 1 {
                    return Err(one_byte_err());
                }
                match kw.as_str() {
                    "DELIMITER" => opts.delimiter = Some(c),
                    "QUOTE" => opts.quote = Some(c),
                    _ => opts.escape = Some(c),
                }
            }
            // v7.39 (round 247) — `FORCE_QUOTE (col, …)` / `FORCE_QUOTE *`.
            "FORCE_QUOTE" => {
                if matches!(self.peek(), Token::Star) {
                    self.advance();
                    opts.force_quote = Some(Vec::new());
                } else {
                    if !matches!(self.peek(), Token::LParen) {
                        return Err(self.err(alloc::format!(
                            "expected '(' or '*' after FORCE_QUOTE, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let mut cols = Vec::new();
                    loop {
                        cols.push(self.expect_ident_like()?);
                        match self.peek() {
                            Token::Comma => {
                                self.advance();
                            }
                            Token::RParen => {
                                self.advance();
                                break;
                            }
                            other => {
                                return Err(self.err(alloc::format!(
                                    "expected ',' or ')' in FORCE_QUOTE list, got {other:?}"
                                )));
                            }
                        }
                    }
                    opts.force_quote = Some(cols);
                }
            }
            "NULL" => {
                opts.null_str = Some(match self.advance() {
                    Token::String(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "COPY NULL expects a quoted string, got {other:?}"
                        )));
                    }
                });
            }
            // v7.39 (round 265) — the two CSV FROM-side column lists. Same
            // grammar as FORCE_QUOTE; PG accepts `*` for FORCE_NOT_NULL /
            // FORCE_NULL too.
            "FORCE_NOT_NULL" | "FORCE_NULL" => {
                let cols = self.parse_copy_column_list(&kw)?;
                if kw == "FORCE_NOT_NULL" {
                    opts.force_not_null = Some(cols);
                } else {
                    opts.force_null = Some(cols);
                }
            }
            other => {
                // PG's wording, lowercased option name.
                return Err(self.err(alloc::format!(
                    "option \"{}\" not recognized",
                    other.to_ascii_lowercase()
                )));
            }
        }
        Ok(())
    }

    /// v7.39 (round 265) — `( col, … )` or `*` after a COPY column-list
    /// option (FORCE_QUOTE / FORCE_NOT_NULL / FORCE_NULL). An empty vec
    /// is the `*` spelling.
    fn parse_copy_column_list(&mut self, kw: &str) -> Result<Vec<String>, ParseError> {
        if matches!(self.peek(), Token::Star) {
            self.advance();
            return Ok(Vec::new());
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' or '*' after {kw}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut cols = Vec::new();
        loop {
            cols.push(self.expect_ident_like()?);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected ',' or ')' in {kw} list, got {other:?}"
                    )));
                }
            }
        }
        Ok(cols)
    }

    fn parse_partition_bounds_tail(
        &mut self,
    ) -> Result<crate::ast::PartitionOfBoundsAst, ParseError> {
        use crate::ast::PartitionOfBoundsAst;
        match self.peek() {
            Token::Default => {
                self.advance();
                Ok(PartitionOfBoundsAst::Default)
            }
            Token::For => {
                self.advance();
                if !matches!(self.peek(), Token::Values) {
                    return Err(
                        self.err(format!("expected VALUES after FOR, got {:?}", self.peek()))
                    );
                }
                self.advance();
                let want_with = matches!(
                    self.peek(),
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with")
                );
                if want_with {
                    self.advance();
                    if !matches!(self.peek(), Token::LParen) {
                        return Err(self.err(format!(
                            "expected '(' after FOR VALUES WITH, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let (mut modulus, mut remainder): (Option<u32>, Option<u32>) = (None, None);
                    loop {
                        let key = self.expect_ident_like()?;
                        let n = match self.peek().clone() {
                            Token::Integer(v) if u32::try_from(v).is_ok() => {
                                self.advance();
                                v as u32
                            }
                            other => {
                                return Err(self.err(format!(
                                    "FOR VALUES WITH: expected unsigned integer literal, got {other:?}"
                                )));
                            }
                        };
                        match key.to_ascii_uppercase().as_str() {
                            "MODULUS" => modulus = Some(n),
                            "REMAINDER" => remainder = Some(n),
                            other => {
                                return Err(self.err(format!(
                                    "FOR VALUES WITH: unknown key {other:?}; \
                                     expected MODULUS or REMAINDER"
                                )));
                            }
                        }
                        match self.peek() {
                            Token::Comma => {
                                self.advance();
                            }
                            Token::RParen => {
                                self.advance();
                                break;
                            }
                            other => {
                                return Err(self.err(format!(
                                    "expected ',' or ')' in FOR VALUES WITH list, got {other:?}"
                                )));
                            }
                        }
                    }
                    let modulus = modulus
                        .ok_or_else(|| self.err("FOR VALUES WITH: missing MODULUS".to_string()))?;
                    let remainder = remainder.ok_or_else(|| {
                        self.err("FOR VALUES WITH: missing REMAINDER".to_string())
                    })?;
                    if modulus == 0 {
                        return Err(self.err("FOR VALUES WITH: MODULUS must be > 0".to_string()));
                    }
                    if remainder >= modulus {
                        return Err(self.err(format!(
                            "FOR VALUES WITH: REMAINDER ({remainder}) must be < MODULUS ({modulus})"
                        )));
                    }
                    return Ok(PartitionOfBoundsAst::Hash { modulus, remainder });
                }
                match self.peek() {
                    Token::From => {
                        self.advance();
                        let lower = Box::new(self.parse_partition_bound_expr()?);
                        if !matches!(self.peek(), Token::To) {
                            return Err(self.err(format!(
                                "expected TO after FROM (...), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let upper = Box::new(self.parse_partition_bound_expr()?);
                        Ok(PartitionOfBoundsAst::Range { lower, upper })
                    }
                    Token::In => {
                        self.advance();
                        if !matches!(self.peek(), Token::LParen) {
                            return Err(self.err(format!(
                                "expected '(' after FOR VALUES IN, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let mut values = Vec::new();
                        loop {
                            values.push(self.parse_expr(0)?);
                            match self.peek() {
                                Token::Comma => {
                                    self.advance();
                                }
                                Token::RParen => {
                                    self.advance();
                                    break;
                                }
                                other => {
                                    return Err(self.err(format!(
                                        "expected ',' or ')' in FOR VALUES IN list, got {other:?}"
                                    )));
                                }
                            }
                        }
                        if values.is_empty() {
                            return Err(
                                self.err("FOR VALUES IN requires at least one literal".to_string())
                            );
                        }
                        Ok(PartitionOfBoundsAst::List { values })
                    }
                    other => Err(self.err(format!(
                        "expected FROM / IN / WITH after FOR VALUES, got {other:?}"
                    ))),
                }
            }
            other => Err(self.err(format!(
                "expected DEFAULT or FOR VALUES after ATTACH PARTITION child, got {other:?}"
            ))),
        }
    }

    /// v7.16.2 — peek for `information_schema.<tbl>` /
    /// `pg_catalog.<tbl>` triples and, if matched, consume all
    /// three tokens + return a synthetic table name the engine's
    /// SELECT path recognises as a virtual view. Returns `None`
    /// when the head doesn't look like a meta-qualified name.
    /// Used by `parse_table_ref` to bypass the
    /// `expect_ident_like` schema-strip for these specific PG
    /// meta schemas (mailrs round-10 A.3).
    fn try_peek_meta_qualified(&mut self) -> Option<(String, String)> {
        // Extract the schema name. Must be a plain ident token.
        let schema = match self.tokens.get(self.pos) {
            Some(Token::Ident(s) | Token::QuotedIdent(s)) => s.clone(),
            _ => return None,
        };
        // Dot.
        if !matches!(self.tokens.get(self.pos + 1), Some(Token::Dot)) {
            return None;
        }
        // The table-side ident may lex as a reserved keyword
        // (e.g. `Token::Tables`). Tolerate the common ones via a
        // helper that reads the trailing token's underlying name.
        let tbl = match self.tokens.get(self.pos + 2)? {
            Token::Ident(t) | Token::QuotedIdent(t) => t.clone(),
            Token::Tables => "tables".to_string(),
            // Other PG meta table names that may collide with
            // reserved keywords land here as needed.
            _ => return None,
        };
        // Strip the `pg_` prefix from `pg_catalog.pg_class`-style
        // names so the synthetic name doesn't double-prefix
        // (`__spg_pg_class`, not `__spg_pg_pg_class`).
        let (prefix, normalised) = if schema.eq_ignore_ascii_case("information_schema") {
            ("__spg_info_", tbl.to_ascii_lowercase())
        } else if schema.eq_ignore_ascii_case("pg_catalog") {
            // v7.39 (round 541) — only the catalogs SPG actually
            // synthesises are rewritten, which is what the BARE path
            // has always checked. Anything else keeps its own name and
            // takes the ordinary route: `pg_stat_activity` and friends
            // resolve through meta_view_result, and a name that is no
            // catalog at all gets PG's "relation does not exist"
            // instead of a message about a view SPG cannot materialise.
            let lowered = tbl.to_ascii_lowercase();
            if !SYNTHESISED_PG_CATALOGS.contains(&lowered.as_str()) {
                self.advance(); // schema
                self.advance(); // dot
                self.advance(); // tbl
                return Some((lowered.clone(), lowered));
            }
            let bare = lowered
                .strip_prefix("pg_")
                .map(alloc::string::String::from)
                .unwrap_or(lowered);
            ("__spg_pg_", bare)
        } else if schema.eq_ignore_ascii_case("mysql") {
            // v7.17.0 Phase 3.P0-65 — MySQL system schema
            // (`mysql.user`, `mysql.db`). Same synthetic-name
            // shape as pg_catalog.
            ("__spg_mysql_", tbl.to_ascii_lowercase())
        } else {
            return None;
        };
        self.advance(); // schema
        self.advance(); // dot
        self.advance(); // tbl
        Some((
            alloc::format!("{prefix}{normalised}"),
            tbl.to_ascii_lowercase(),
        ))
    }

    /// Unqualified PG meta-table names (`FROM pg_extension`, `FROM
    /// pg_class`) resolve the same way: PG puts `pg_catalog` at the
    /// implicit front of every search_path, so a bare reference to a
    /// known catalog table always means the catalog table. Only the
    /// names the engine actually synthesises are recognised — any
    /// other `pg_*` ident stays a user table (mailrs embed round-12).
    fn try_peek_meta_bare(&mut self) -> Option<(String, String)> {
        // v7.38 (read01 P3.21) — every catalog view SPG synthesises
        // (`__spg_pg_*`) is bare-resolvable, matching PG's implicit
        // `pg_catalog` at the front of every search_path. (pg_stat_activity
        // / pg_stat_statements / pg_locks / pg_statio_user_tables route
        // through the meta_view_result path instead, and already resolve
        // bare — they must NOT be listed here or the __spg_ rewrite would
        // mis-target them.)
        const PG_META_TABLES: &[&str] = SYNTHESISED_PG_CATALOGS;
        let name = match self.tokens.get(self.pos) {
            Some(Token::Ident(s)) => s.to_ascii_lowercase(),
            _ => return None,
        };
        // A following dot means this ident is a schema qualifier,
        // not a table name — let the qualified path handle it.
        if matches!(self.tokens.get(self.pos + 1), Some(Token::Dot)) {
            return None;
        }
        if !PG_META_TABLES.contains(&name.as_str()) {
            return None;
        }
        self.advance();
        let bare = name.strip_prefix("pg_").unwrap_or(&name);
        Some((alloc::format!("__spg_pg_{bare}"), name.clone()))
    }

    /// Consume a bare ident if its lowercase matches `kw`, else err.
    /// v7.39 (read01 round 57) — is the next token this bare keyword-ident?
    /// Peeks only; the caller advances.
    fn peek_keyword_ident(&self, kw: &str) -> bool {
        matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case(kw))
    }

    fn expect_keyword_ident(&mut self, kw: &str) -> Result<(), ParseError> {
        match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case(kw) => Ok(()),
            other => Err(ParseError {
                message: format!("expected {kw:?}, got {other:?}"),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    /// Accept either a quoted identifier (`"foo"`) or a quoted string
    /// literal (`'foo'`) — same shape used by CREATE USER for the
    /// username slot.
    fn expect_ident_or_string(&mut self) -> Result<String, ParseError> {
        match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) | Token::String(s) => Ok(s),
            other => Err(ParseError {
                message: format!("expected identifier or string, got {other:?}"),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    fn expect_string_literal(&mut self) -> Result<String, ParseError> {
        match self.advance() {
            Token::String(s) => Ok(s),
            other => Err(ParseError {
                message: format!("expected quoted string, got {other:?}"),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    fn parse_select_stmt(&mut self) -> Result<Statement, ParseError> {
        // v7.30.2 (mailrs round-25 ask 2) — derived tables /
        // subqueries recurse through here without passing
        // parse_expr; share the same nesting budget.
        self.enter_nested()?;
        let r = self.parse_select_stmt_inner();
        self.nest_depth -= 1;
        r
    }

    fn parse_select_stmt_inner(&mut self) -> Result<Statement, ParseError> {
        // Caller dispatches on Token::Select; the inner helper handles
        // the rest. ORDER BY / LIMIT bind at this top level; UNION peers
        // get a fresh bare-select parse and may not have their own ORDER
        // BY / LIMIT.
        let mut head = self.parse_bare_select()?;
        self.parse_setop_chain_into(&mut head)?;
        self.parse_select_tail_into(&mut head)?;
        Ok(Statement::Select(head))
    }

    /// v7.37.17 (17.6 siblings) — the three SQL set operations
    /// share the peer chain: UNION [ALL], EXCEPT [ALL] (a reserved
    /// token), and INTERSECT [ALL] (a bare ident — it was never
    /// reserved in SPG's lexer). PG precedence: INTERSECT binds
    /// tighter than UNION / EXCEPT — the executor folds the chain
    /// left-to-right, which is already correct for LEADING
    /// intersects; an INTERSECT pair that FOLLOWS a union/except
    /// pair nests into that previous peer, so A UNION B INTERSECT C
    /// = A ∪ (B ∩ C). Shared by the top level and parenthesized
    /// groups.
    fn parse_setop_chain_into(&mut self, head: &mut SelectStatement) -> Result<(), ParseError> {
        // A parenthesized group arrives with its own (already
        // regrouped) unions on `head`; only the pairs THIS chain
        // appends participate in the precedence regroup below —
        // nesting an outer INTERSECT into a group-internal peer
        // would dissolve the explicit grouping.
        let boundary = head.unions.len();
        loop {
            let base = match self.peek() {
                Token::Union => UnionKind::Distinct,
                Token::Except => UnionKind::Except,
                Token::Ident(s) if s.eq_ignore_ascii_case("intersect") => UnionKind::Intersect,
                _ => break,
            };
            self.advance();
            let kind = if matches!(self.peek(), Token::All) {
                self.advance();
                match base {
                    UnionKind::Distinct => UnionKind::All,
                    UnionKind::Except => UnionKind::ExceptAll,
                    _ => UnionKind::IntersectAll,
                }
            } else {
                base
            };
            let peer = self.parse_bare_select()?;
            head.unions.push((kind, peer));
        }
        let mut pairs = core::mem::take(&mut head.unions);
        let tail = pairs.split_off(boundary);
        let mut regrouped: Vec<(UnionKind, SelectStatement)> = pairs;
        for (kind, peer) in tail {
            let is_intersect = matches!(kind, UnionKind::Intersect | UnionKind::IntersectAll);
            // An intersect nests into the previous element of THIS
            // chain only; with no new previous element it stays at
            // the outer level (the left fold applies it to the
            // whole head, group included).
            match (
                is_intersect,
                regrouped.len() > boundary,
                regrouped.last_mut(),
            ) {
                (true, true, Some((_, prev))) => prev.unions.push((kind, peer)),
                _ => regrouped.push((kind, peer)),
            }
        }
        head.unions = regrouped;
        Ok(())
    }

    /// v7.37.17 (17.6 siblings) — the shared SELECT tail: ORDER BY /
    /// LIMIT / OFFSET / FETCH FIRST / FOR-lock clauses. Extracted so
    /// the top-level bare VALUES statement reuses it verbatim.
    /// v6.4.0 — parse an optional `ORDER BY <expr> [ASC|DESC] [NULLS …], …`
    /// clause into its key list (empty when no `ORDER BY` follows). Extracted
    /// (v7.39 round 135) so the grouping-set path can parse ORDER BY early,
    /// where the grouping-set universe is still in scope.
    fn parse_order_by_keys(&mut self) -> Result<Vec<OrderBy>, ParseError> {
        if !matches!(self.peek(), Token::Order) {
            return Ok(Vec::new());
        }
        self.advance();
        if !self.peek_is_by() {
            return Err(self.err(format!("expected BY after ORDER, got {:?}", self.peek())));
        }
        self.advance();
        let mut keys = Vec::new();
        loop {
            // v7.39 (round 691) — save/restore, the discipline this parser
            // already uses around `pending_sample_preds`, so a subquery inside
            // a key neither inherits nor leaks the channel.
            let saved_flag = core::mem::replace(&mut self.in_order_by_key, true);
            let saved_coll = self.order_key_collation.take();
            let parsed = self.parse_expr(0);
            self.in_order_by_key = saved_flag;
            let collation = core::mem::replace(&mut self.order_key_collation, saved_coll);
            let expr = parsed?;
            let desc = if matches!(self.peek(), Token::Desc) {
                self.advance();
                true
            } else if matches!(self.peek(), Token::Asc) {
                self.advance();
                false
            } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
                // `ORDER BY x USING <op>` — PG's operator-class spelling. SPG has
                // one ordering per type, so the btree comparison operators map
                // onto it: < / <= are ASC, > / >= are DESC. Any other operator
                // would need a custom operator class — honest error.
                self.advance();
                match self.advance() {
                    Token::Lt | Token::LtEq => false,
                    Token::Gt | Token::GtEq => true,
                    other => {
                        return Err(self.err(alloc::format!(
                            "ORDER BY USING supports the btree comparison \
                             operators (< <= > >=); got {other:?}"
                        )));
                    }
                }
            } else {
                false
            };
            // v7.24 (round-16 A) — explicit NULLS FIRST/LAST.
            let nulls_first = self.parse_optional_nulls_placement()?;
            keys.push(OrderBy {
                expr,
                desc,
                nulls_first,
                collation,
            });
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        Ok(keys)
    }

    fn parse_select_tail_into(&mut self, head: &mut SelectStatement) -> Result<(), ParseError> {
        // v7.39 (round 135) — a grouping-set query may have already parsed +
        // rewritten its ORDER BY (to reference synthetic grouping columns); if
        // no ORDER BY token is present, keep that pre-set order_by rather than
        // clobbering it with an empty list.
        let parsed_keys = self.parse_order_by_keys()?;
        head.order_by = if parsed_keys.is_empty() {
            core::mem::take(&mut head.order_by)
        } else {
            parsed_keys
        };
        // v7.39 (round 314, V39) — the row-count clauses come in EITHER
        // order. PG's grammar takes a limit clause and an offset clause
        // as an unordered pair, so `OFFSET 2 LIMIT 3` means exactly what
        // `LIMIT 3 OFFSET 2` does (measured: same rows). This used to
        // parse them in a fixed LIMIT-then-OFFSET sequence, so the other
        // spelling died on `expected end of input, got Limit`.
        //
        // Each may appear at most once, and LIMIT and FETCH FIRST are
        // two spellings of the same clause — PG rejects `LIMIT 1 LIMIT 2`,
        // `OFFSET 1 OFFSET 2` and `LIMIT 2 FETCH FIRST 3 ROWS ONLY` alike.
        // A second one is left unconsumed here, which the caller reports
        // as trailing input rather than silently taking the last.
        let mut saw_limit = false;
        let mut saw_offset = false;
        loop {
            if !saw_limit && matches!(self.peek(), Token::Limit) {
                self.advance();
                // v7.17.0 Phase 5.1 — `LIMIT NULL` / `LIMIT ALL` are
                // PG synonyms for "no limit". Treat both as None
                // (no head.limit set) so the engine's existing
                // unlimited-result path takes over. Reject was the
                // pre-5.1 behaviour and broke pg_dump-flavoured
                // tooling that occasionally emits LIMIT NULL.
                if self.consume_limit_unbounded_sentinel() {
                    head.limit = None;
                } else {
                    let first = self.parse_limit_expr("LIMIT")?;
                    // MySQL `LIMIT offset, count` — the first number is
                    // the offset when a comma follows.
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                        let count = self.parse_limit_expr("LIMIT")?;
                        head.offset = Some(first);
                        saw_offset = true;
                        head.limit = Some(count);
                    } else {
                        head.limit = Some(first);
                    }
                }
                saw_limit = true;
                continue;
            }
            if !saw_offset && matches!(self.peek(), Token::Offset) {
                self.advance();
                // PG also accepts an optional `ROW` / `ROWS` trailer
                // after the offset value (`OFFSET 10 ROWS`). The
                // FETCH-FIRST branch below relies on the same.
                let off = self.parse_limit_expr("OFFSET")?;
                self.consume_optional_rows_keyword();
                head.offset = Some(off);
                saw_offset = true;
                continue;
            }
            // v7.17.0 Phase 5.1 — `FETCH FIRST <int|$N> ROWS ONLY` is
            // the SQL-standard alias for LIMIT. PG accepts both
            // spellings interchangeably; pg_dump emits FETCH FIRST in
            // newer versions. We map it onto `head.limit` so the
            // engine path is unified.
            if !saw_limit
                && matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("fetch"))
            {
                self.advance(); // FETCH
                // `FIRST` or `NEXT` (both legal per SQL standard).
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("first") || s.eq_ignore_ascii_case("next"))
                {
                    self.advance();
                }
                // Count (optional in the bare `FETCH FIRST ROW ONLY` —
                // implicit 1 — but we always consume one if present).
                let count = if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("row") || s.eq_ignore_ascii_case("rows"))
                {
                    // Bare `FETCH FIRST ROW ONLY` = LIMIT 1.
                    crate::ast::LimitExpr::Literal(1)
                } else {
                    self.parse_limit_expr("FETCH FIRST")?
                };
                // Eat `ROW` / `ROWS` if not already consumed above.
                self.consume_optional_rows_keyword();
                // Optional `ONLY` (the spec form) — or the SQL:2008
                // `WITH TIES` form. v7.17.0 Phase 3.P0-49: the executor
                // now honours WITH TIES by extending past the LIMIT
                // truncation point through every row that shares the
                // last-kept row's ORDER BY key.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("only"))
                {
                    self.advance();
                } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("with"))
                {
                    self.advance(); // WITH
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("ties"))
                    {
                        self.advance();
                        head.limit_with_ties = true;
                    }
                }
                head.limit = Some(count);
                saw_limit = true;
                continue;
            }
            break;
        }
        // v7.17.0 Phase 3.4 — trailing row-lock clauses:
        //   FOR { UPDATE | NO KEY UPDATE | SHARE | KEY SHARE }
        //       [ OF table_name [, …] ]
        //       [ NOWAIT | SKIP LOCKED ]
        // Multiple FOR clauses may stack (PG: `FOR UPDATE OF t1
        // FOR SHARE OF t2`). SPG is a single-writer engine — every
        // SELECT already returns a consistent snapshot — so these
        // are accept-and-discard: the parser absorbs them so
        // mailrs / Rails / Django code paths that emit `SELECT
        // … FOR UPDATE` for advisory pessimistic locking load
        // without a parser error. The on-disk locking model is
        // unchanged; callers that rely on FOR UPDATE for read-
        // through-write ordering still get the right answer
        // because SPG serialises writes anyway.
        head.locking = self
            .consume_optional_for_lock_clauses()
            .map(alloc::boxed::Box::new);
        Ok(())
    }

    /// v7.17.0 Phase 3.4 — eat zero or more `FOR { UPDATE | NO KEY
    /// UPDATE | SHARE | KEY SHARE } [ OF tbl[, …] ] [ NOWAIT | SKIP
    /// LOCKED ]` trailers. Each clause is fully accepted and
    /// discarded — SPG's single-writer model already satisfies the
    /// callers' implicit ordering requirement. Stops at the first
    /// token that isn't `FOR`.
    fn consume_optional_for_lock_clauses(&mut self) -> Option<crate::ast::LockingClause> {
        // v7.39 (round 293, E3 Phase 1) — the clause is REPORTED now,
        // not discarded. PG keeps the strongest of several clauses; the
        // policy of the last one wins, which is what this loop records.
        let mut seen: Option<crate::ast::LockingClause> = None;
        while matches!(self.peek(), Token::For) {
            // v7.37.14 (A2.5-stub) — record that this query asked
            // for a row lock the parser is about to silently
            // discard. Operators surface the count via
            // `spg_sql::silent_for_update_count()` so they can
            // gauge how much of the workload depends on advisory
            // FOR UPDATE / FOR SHARE / FOR KEY SHARE semantics
            // before v7.37.15's per-row tuple locking lands.
            crate::record_silent_for_update_clause();
            self.advance(); // FOR
            // `NO KEY` prefix (PG) — `NO` is reserved-keyword-shaped
            // (`Token::Not` isn't it; PG `NO` lexes as Token::Ident).
            let mut no_key = false;
            let mut key = false;
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("no"))
            {
                self.advance(); // NO
                no_key = true;
                // The next ident should be KEY but be generous;
                // anything followed by UPDATE/SHARE is accepted.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("key"))
                {
                    self.advance(); // KEY
                }
            }
            // `KEY` prefix (PG `FOR KEY SHARE`).
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("key"))
            {
                self.advance(); // KEY
                key = true;
            }
            // Lock-strength keyword: UPDATE / SHARE. Required, but
            // we're lenient — an unexpected token here just bails
            // (we already consumed FOR; caller's downstream
            // dispatch will error if anything actually depends on
            // the trailing tokens).
            let is_update = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("update"));
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("update") || s.eq_ignore_ascii_case("share"))
            {
                self.advance();
                use crate::ast::LockStrength as LS;
                let strength = match (is_update, no_key, key) {
                    (true, true, _) => LS::NoKeyUpdate,
                    (true, _, _) => LS::Update,
                    (false, _, true) => LS::KeyShare,
                    (false, _, _) => LS::Share,
                };
                seen = Some(crate::ast::LockingClause {
                    strength,
                    of_tables: alloc::vec::Vec::new(),
                    policy: crate::ast::LockWait::Wait,
                });
            } else {
                // FOR by itself (or `FOR KEY` with nothing after) —
                // give up on the lock-clause path. We've already
                // advanced past FOR; further attempts to parse
                // here would clobber state.
                return seen;
            }
            // Optional `OF tbl[, tbl …]`. mailrs emits this when
            // joining and locking only a subset of tables.
            if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("of"))
            {
                self.advance(); // OF
                #[allow(clippy::while_let_loop)]
                loop {
                    match self.peek() {
                        Token::Ident(_) | Token::QuotedIdent(_) => {
                            // v7.39 (round 294) — the name is CAPTURED now: PG
                            // validates it against the FROM clause, and an
                            // uncaptured list silently means "lock everything".
                            let mut nm = match self.advance() {
                                Token::Ident(n) | Token::QuotedIdent(n) => n,
                                _ => alloc::string::String::new(),
                            };
                            // Optional schema-qualified `schema.table`.
                            if matches!(self.peek(), Token::Dot) {
                                self.advance();
                                if let Token::Ident(n) | Token::QuotedIdent(n) = self.peek().clone()
                                {
                                    self.advance();
                                    nm = n;
                                }
                            }
                            if let Some(c) = seen.as_mut() {
                                c.of_tables.push(nm);
                            }
                        }
                        _ => break,
                    }
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                    } else {
                        break;
                    }
                }
            }
            // Optional `NOWAIT` | `SKIP LOCKED`.
            match self.peek().clone() {
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("nowait") => {
                    self.advance();
                    if let Some(c) = seen.as_mut() {
                        c.policy = crate::ast::LockWait::NoWait;
                    }
                }
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("skip") => {
                    self.advance(); // SKIP
                    if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("locked"))
                    {
                        self.advance(); // LOCKED
                        if let Some(c) = seen.as_mut() {
                            c.policy = crate::ast::LockWait::SkipLocked;
                        }
                    }
                }
                _ => {}
            }
            // Loop: PG allows multiple FOR clauses chained.
        }
        seen
    }

    /// v7.9.24 — accept `LIMIT <int>` or `LIMIT $N`. mailrs H2.
    /// Bind value gets resolved during prepared-statement Execute;
    /// the Pratt expression parser would over-accept here (e.g.
    /// `LIMIT 5 + 5`), so we narrowly accept only the two PG forms.
    /// v7.17.0 Phase 5.1 — consume the `LIMIT NULL` / `LIMIT ALL`
    /// sentinel tokens (PG synonyms for "no limit"). Returns true
    /// when one was consumed; caller skips the regular
    /// limit-value parse and leaves `head.limit` at None.
    fn consume_limit_unbounded_sentinel(&mut self) -> bool {
        if matches!(self.peek(), Token::Null) {
            self.advance();
            return true;
        }
        if matches!(self.peek(), Token::All) {
            self.advance();
            return true;
        }
        false
    }

    /// v7.17.0 Phase 5.1 — eat an optional trailing `ROW` / `ROWS`
    /// keyword after a LIMIT / OFFSET / FETCH FIRST value, the
    /// SQL-standard shape. No-op when missing.
    fn consume_optional_rows_keyword(&mut self) {
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
            if s.eq_ignore_ascii_case("row") || s.eq_ignore_ascii_case("rows"))
        {
            self.advance();
        }
    }

    /// v7.39 (round 284) — `LIMIT` / `OFFSET` over a general expression.
    ///
    /// PG's row-count clause takes an `a_expr`, so `LIMIT 1+1` and
    /// `OFFSET 2+3` are legal; only `FETCH FIRST` is restricted to a
    /// constant, which is why that spelling keeps the token path below.
    ///
    /// Constants are folded here rather than carried into the tree: the
    /// 15+ execution paths that read the row count go through
    /// `limit_literal()`, which answers `Option<u32>` — and `None` there
    /// means "no limit". A clause the engine could not resolve would
    /// therefore return the WHOLE table instead of failing. Folding at
    /// parse time keeps that impossible; a non-constant clause is still
    /// a clean error (recorded residual — closing it wants a resolution
    /// pre-pass on the simple-query path, where `substitute_placeholders`
    /// does not run).
    fn parse_limit_expr(&mut self, label: &str) -> Result<crate::ast::LimitExpr, ParseError> {
        // PG restricts FETCH FIRST to a constant or a PARENTHESISED
        // expression: `FETCH FIRST 1+1 ROWS ONLY` is a syntax error, but
        // `FETCH FIRST (1+1) ROWS ONLY` and `FETCH FIRST (SELECT 3) ROWS
        // ONLY` both work (its grammar takes a c_expr). Both measured
        // against PG 18.4 in round 305.
        if label == "FETCH FIRST" && !matches!(self.peek(), Token::LParen) {
            return self.parse_limit_constant(label);
        }
        // One pass, no rewind: `advance()` takes each token by
        // `mem::replace`, so a consumed token reads back as Eof and this
        // parser cannot backtrack. Everything — bare literal included —
        // is therefore folded from the parsed expression rather than
        // re-read from the token stream.
        let start = self.pos;
        let e = self.parse_expr(0)?;
        if let crate::ast::Expr::Placeholder(n) = e {
            return Ok(crate::ast::LimitExpr::Placeholder(n));
        }
        let neg_label = if label == "OFFSET" { "OFFSET" } else { "LIMIT" };
        match fold_limit_constant(&e) {
            Some(Ok(v)) if v < 0 => Err(ParseError {
                message: alloc::format!("{neg_label} must not be negative"),
                token_pos: start,
            }),
            Some(Ok(v)) => u32::try_from(v)
                .map(crate::ast::LimitExpr::Literal)
                .map_err(|_| ParseError {
                    message: alloc::format!("{label} value too large: {v}"),
                    token_pos: start,
                }),
            Some(Err(message)) => Err(ParseError {
                message: message.replace("{L}", neg_label),
                token_pos: start,
            }),
            // v7.39 (round 305, V23) — not foldable at parse time
            // (`LIMIT (SELECT 4)`, `LIMIT greatest(2,3)`). Carry the
            // expression; the engine evaluates it once before dispatch.
            None => Ok(crate::ast::LimitExpr::Expr(alloc::boxed::Box::new(e))),
        }
    }

    fn parse_limit_constant(&mut self, label: &str) -> Result<crate::ast::LimitExpr, ParseError> {
        // v7.39 (round 239) — PG's row-count clause takes a bigint with its
        // coercion rules, not just an integer token: a NUMERIC rounds half
        // away from zero (`LIMIT 2.5` keeps 3 rows), a negative count is
        // refused with PG's wording ("LIMIT must not be negative", 2201W /
        // 2201X — FETCH FIRST shares LIMIT's), and a string coerces by its
        // content, failing as an input-syntax error on the value. General
        // expressions (`LIMIT 1+1`) stay unsupported — a recorded residual;
        // they need an Expr-carrying LimitExpr variant.
        let neg_label = if label == "OFFSET" { "OFFSET" } else { "LIMIT" };
        let err_at = |message: alloc::string::String, pos: usize| ParseError {
            message,
            token_pos: pos,
        };
        match self.advance() {
            Token::Integer(n) if n >= 0 => u32::try_from(n)
                .map(crate::ast::LimitExpr::Literal)
                .map_err(|_| ParseError {
                    message: alloc::format!("{label} value too large: {n}"),
                    token_pos: self.consumed_pos(),
                }),
            Token::Integer(_) => Err(err_at(
                alloc::format!("{neg_label} must not be negative"),
                self.pos.saturating_sub(1),
            )),
            Token::Numeric(t) => {
                let pos = self.pos.saturating_sub(1);
                let v: f64 = t.parse().map_err(|_| {
                    err_at(
                        alloc::format!("invalid input syntax for type bigint: \"{t}\""),
                        pos,
                    )
                })?;
                if v < 0.0 {
                    return Err(err_at(
                        alloc::format!("{neg_label} must not be negative"),
                        pos,
                    ));
                }
                // Round half away from zero — PG's numeric→bigint cast.
                // (no_std: no f64::round; v is non-negative, so truncating
                // v + 0.5 is the same thing.)
                #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)]
                let rounded = (v + 0.5) as u64;
                u32::try_from(rounded)
                    .map(crate::ast::LimitExpr::Literal)
                    .map_err(|_| err_at(alloc::format!("{label} value too large: {t}"), pos))
            }
            Token::Minus => {
                let pos = self.pos.saturating_sub(1);
                match self.peek() {
                    Token::Integer(_) | Token::Numeric(_) => {
                        self.advance();
                        Err(err_at(
                            alloc::format!("{neg_label} must not be negative"),
                            pos,
                        ))
                    }
                    other => Err(err_at(
                        alloc::format!(
                            "expected non-negative integer or $N placeholder after {label}, got {other:?}"
                        ),
                        pos,
                    )),
                }
            }
            Token::String(t) => {
                let pos = self.pos.saturating_sub(1);
                match t.trim().parse::<i64>() {
                    Ok(n) if n < 0 => Err(err_at(
                        alloc::format!("{neg_label} must not be negative"),
                        pos,
                    )),
                    Ok(n) => u32::try_from(n)
                        .map(crate::ast::LimitExpr::Literal)
                        .map_err(|_| err_at(alloc::format!("{label} value too large: {t}"), pos)),
                    Err(_) => Err(err_at(
                        alloc::format!("invalid input syntax for type bigint: \"{t}\""),
                        pos,
                    )),
                }
            }
            Token::Placeholder(n) => Ok(crate::ast::LimitExpr::Placeholder(n)),
            other => Err(ParseError {
                message: alloc::format!(
                    "expected non-negative integer or $N placeholder after {label}, got {other:?}"
                ),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    /// Parse one SELECT block without ORDER BY / LIMIT / UNION chaining —
    /// just `[DISTINCT] items [FROM] [WHERE] [GROUP BY]`. Returned with
    /// `unions` empty and `order_by` / `limit` `None`; the top-level
    /// `parse_select_stmt` is responsible for filling those in.
    /// v7.37.17 (17.6 siblings) — rewrite every `grouping(keys…)`
    /// call in the expression tree to the per-set integer bitmask
    /// (PG semantics: one bit per argument, MSB first; 1 = the key
    /// is dropped in this grouping set). Runs during the ROLLUP /
    /// CUBE / GROUPING SETS expansion, where the set is known.
    /// v7.39 (round 135) — collect the distinct `grouping(...)` calls appearing
    /// anywhere in `expr` (an ORDER BY key), without recursing into their args.
    fn collect_grouping_calls(expr: &Expr, out: &mut Vec<Expr>) {
        if let Expr::FunctionCall { name, .. } = expr
            && name.eq_ignore_ascii_case("grouping")
        {
            if !out.iter().any(|e| e == expr) {
                out.push(expr.clone());
            }
            return;
        }
        match expr {
            Expr::Binary { lhs, rhs, .. } => {
                Self::collect_grouping_calls(lhs, out);
                Self::collect_grouping_calls(rhs, out);
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } | Expr::IsNull { expr, .. } => {
                Self::collect_grouping_calls(expr, out)
            }
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::collect_grouping_calls(a, out);
                }
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(o) = operand {
                    Self::collect_grouping_calls(o, out);
                }
                for (c, v) in branches {
                    Self::collect_grouping_calls(c, out);
                    Self::collect_grouping_calls(v, out);
                }
                if let Some(x) = else_branch {
                    Self::collect_grouping_calls(x, out);
                }
            }
            _ => {}
        }
    }

    /// v7.39 (round 135) — replace each `grouping(...)` call in `expr` equal to
    /// `grp_exprs[k]` with a reference to the synthetic ordering column
    /// `__grp_ord_k` (injected per grouping-set branch).
    fn rewrite_grouping_to_col(expr: &mut Expr, grp_exprs: &[Expr]) {
        if let Expr::FunctionCall { name, .. } = expr
            && name.eq_ignore_ascii_case("grouping")
        {
            if let Some(k) = grp_exprs.iter().position(|e| e == expr) {
                *expr = Expr::Column(crate::ast::ColumnName {
                    qualifier: None,
                    name: alloc::format!("__grp_ord_{k}"),
                });
            }
            return;
        }
        match expr {
            Expr::Binary { lhs, rhs, .. } => {
                Self::rewrite_grouping_to_col(lhs, grp_exprs);
                Self::rewrite_grouping_to_col(rhs, grp_exprs);
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } | Expr::IsNull { expr, .. } => {
                Self::rewrite_grouping_to_col(expr, grp_exprs)
            }
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::rewrite_grouping_to_col(a, grp_exprs);
                }
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(o) = operand {
                    Self::rewrite_grouping_to_col(o, grp_exprs);
                }
                for (c, v) in branches {
                    Self::rewrite_grouping_to_col(c, grp_exprs);
                    Self::rewrite_grouping_to_col(v, grp_exprs);
                }
                if let Some(x) = else_branch {
                    Self::rewrite_grouping_to_col(x, grp_exprs);
                }
            }
            _ => {}
        }
    }

    /// v7.39 (round 242) — one grouping element of PG's GROUP BY grammar,
    /// as the list of key sets it contributes. A bare expression is one
    /// single-key set; `ROLLUP (u1, …, un)` the n+1 unit-prefixes (largest
    /// first); `CUBE` every unit-subset (largest first); `GROUPING SETS`
    /// the concatenation of its items' sets, where an item is itself an
    /// element, a parenthesized key list, or the empty set `()`. A
    /// ROLLUP/CUBE member in parentheses is a composite UNIT: its keys
    /// move together.
    fn parse_grouping_element(&mut self) -> Result<Vec<Vec<Expr>>, ParseError> {
        let is_kw = |t: &Token, kw: &str| matches!(t, Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case(kw));
        // ROLLUP ( … ) / CUBE ( … )
        if (is_kw(self.peek(), "rollup") || is_kw(self.peek(), "cube"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            let is_cube = is_kw(self.peek(), "cube");
            self.advance(); // ROLLUP / CUBE
            self.advance(); // (
            let mut units: Vec<Vec<Expr>> = Vec::new();
            loop {
                if matches!(self.peek(), Token::LParen) {
                    // Composite unit: (a, b) rolls up as one.
                    self.advance();
                    let mut unit = Vec::new();
                    if !matches!(self.peek(), Token::RParen) {
                        loop {
                            unit.push(self.parse_expr(0)?);
                            match self.peek() {
                                Token::Comma => {
                                    self.advance();
                                }
                                Token::RParen => break,
                                other => {
                                    return Err(self.err(format!(
                                        "expected ',' or ')' in grouping unit, got {other:?}"
                                    )));
                                }
                            }
                        }
                    }
                    self.advance(); // )
                    units.push(unit);
                } else {
                    units.push(alloc::vec![self.parse_expr(0)?]);
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in grouping list, got {other:?}"
                        )));
                    }
                }
            }
            self.advance(); // )
            let flatten = |unit_sel: &[bool]| -> Vec<Expr> {
                units
                    .iter()
                    .zip(unit_sel.iter())
                    .filter(|(_, keep)| **keep)
                    .flat_map(|(u, _)| u.iter().cloned())
                    .collect()
            };
            let n = units.len();
            if is_cube {
                let mut subsets: Vec<Vec<bool>> = (0..(1u32 << n))
                    .map(|mask| (0..n).map(|i| mask & (1 << i) != 0).collect())
                    .collect();
                subsets.sort_by_key(|sel| core::cmp::Reverse(sel.iter().filter(|b| **b).count()));
                return Ok(subsets.iter().map(|sel| flatten(sel)).collect());
            }
            return Ok((0..=n)
                .rev()
                .map(|keep| {
                    let sel: Vec<bool> = (0..n).map(|i| i < keep).collect();
                    flatten(&sel)
                })
                .collect());
        }
        // GROUPING SETS ( item [, item]* )
        if is_kw(self.peek(), "grouping")
            && matches!(self.tokens.get(self.pos + 1), Some(t) if is_kw(t, "sets"))
        {
            self.advance(); // GROUPING
            self.advance(); // SETS
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' after GROUPING SETS, got {:?}",
                    self.peek()
                )));
            }
            self.advance(); // outer (
            let mut sets: Vec<Vec<Expr>> = Vec::new();
            loop {
                if matches!(self.peek(), Token::LParen) {
                    // A parenthesized key list (or the empty set).
                    self.advance();
                    let mut set = Vec::new();
                    if !matches!(self.peek(), Token::RParen) {
                        loop {
                            set.push(self.parse_expr(0)?);
                            match self.peek() {
                                Token::Comma => {
                                    self.advance();
                                }
                                Token::RParen => break,
                                other => {
                                    return Err(self.err(format!(
                                        "expected ',' or ')' in grouping set, got {other:?}"
                                    )));
                                }
                            }
                        }
                    }
                    self.advance(); // )
                    sets.push(set);
                } else {
                    // A nested element: ROLLUP/CUBE/GROUPING SETS or a
                    // bare expression.
                    sets.extend(self.parse_grouping_element()?);
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' after a grouping set, got {other:?}"
                        )));
                    }
                }
            }
            self.advance(); // outer )
            return Ok(sets);
        }
        Ok(alloc::vec![alloc::vec![self.parse_expr(0)?]])
    }

    fn substitute_grouping_calls(expr: &mut Expr, dropped: &[Expr]) {
        // v7.38 (read01) — a reference to a key that is dropped in this grouping
        // set evaluates to NULL, at any depth. Previously only a *top-level*
        // select item equal to a dropped key was nullified, so a key nested in
        // an expression (`COALESCE(g,'TOTAL')`, `g || sum(v)`) survived as a raw
        // column and failed to resolve against the set's synthetic schema.
        if dropped.iter().any(|d| d == expr) {
            *expr = Expr::Literal(Literal::Null);
            return;
        }
        if let Expr::FunctionCall { name, args } = expr
            && name.eq_ignore_ascii_case("grouping")
        {
            let mut mask: i64 = 0;
            for a in args.iter() {
                mask <<= 1;
                if dropped.iter().any(|d| d == a) {
                    mask |= 1;
                }
            }
            // v7.39 (round 242) — wrapped in a cast, NOT a bare integer
            // literal: a bare integer in a select item is indistinguishable
            // from a positional reference once `ORDER BY 1` substitutes the
            // item back in, and the round-232 position check then read the
            // mask value as an out-of-range position. The cast changes
            // nothing semantically (grouping() is integer).
            *expr = Expr::Cast {
                expr: alloc::boxed::Box::new(Expr::Literal(Literal::Integer(mask))),
                target: crate::ast::CastTarget::Int,
            };
            return;
        }
        // Generic recursion over the common expression shapes the
        // SELECT list uses; anything without child expressions is
        // left alone.
        match expr {
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::substitute_grouping_calls(a, dropped);
                }
            }
            Expr::Binary { lhs, rhs, .. } => {
                Self::substitute_grouping_calls(lhs, dropped);
                Self::substitute_grouping_calls(rhs, dropped);
            }
            Expr::Unary { expr: inner, .. } => {
                Self::substitute_grouping_calls(inner, dropped);
            }
            Expr::Cast { expr: inner, .. } => {
                Self::substitute_grouping_calls(inner, dropped);
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(op) = operand {
                    Self::substitute_grouping_calls(op, dropped);
                }
                for (w, t) in branches {
                    Self::substitute_grouping_calls(w, dropped);
                    Self::substitute_grouping_calls(t, dropped);
                }
                if let Some(e) = else_branch {
                    Self::substitute_grouping_calls(e, dropped);
                }
            }
            // v7.38 (read01) — recurse into the remaining child-bearing shapes
            // so a dropped key nested in `IS NULL` / `LIKE` / `IN (…)` / `EXTRACT`
            // / a subscript / `ANY`/`ALL` is nullified too (`CASE WHEN g IS NULL
            // …` is the canonical rollup-total label idiom).
            Expr::IsNull { expr: inner, .. } => Self::substitute_grouping_calls(inner, dropped),
            Expr::Like { expr, pattern, .. } => {
                Self::substitute_grouping_calls(expr, dropped);
                Self::substitute_grouping_calls(pattern, dropped);
            }
            Expr::InList { expr, list, .. } => {
                Self::substitute_grouping_calls(expr, dropped);
                for item in list {
                    Self::substitute_grouping_calls(item, dropped);
                }
            }
            Expr::Extract { source, .. } => Self::substitute_grouping_calls(source, dropped),
            Expr::Array(items) => {
                for item in items {
                    Self::substitute_grouping_calls(item, dropped);
                }
            }
            Expr::ArraySubscript { target, index } => {
                Self::substitute_grouping_calls(target, dropped);
                Self::substitute_grouping_calls(index, dropped);
            }
            Expr::ArraySlice { target, lo, hi } => {
                Self::substitute_grouping_calls(target, dropped);
                if let Some(lo) = lo {
                    Self::substitute_grouping_calls(lo, dropped);
                }
                if let Some(hi) = hi {
                    Self::substitute_grouping_calls(hi, dropped);
                }
            }
            Expr::AnyAll { expr, array, .. } => {
                Self::substitute_grouping_calls(expr, dropped);
                Self::substitute_grouping_calls(array, dropped);
            }
            _ => {}
        }
    }

    fn parse_bare_select(&mut self) -> Result<SelectStatement, ParseError> {
        // v7.37.17 (17.6 siblings) — parenthesized set-operation
        // group: `( <select chain> )` usable anywhere a query block
        // is (head or peer of an outer chain). The group's own
        // unions ride the returned SelectStatement; the executor's
        // nested-peer recursion runs them.
        if matches!(self.peek(), Token::LParen)
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Select | Token::LParen | Token::Values)
            )
        {
            self.advance(); // (
            self.enter_nested()?;
            // v7.37 D.20 — a group whose head is a VALUES list:
            // `(VALUES (1),(2)) UNION (VALUES (3))`. Parse the VALUES body,
            // otherwise recurse into a nested SELECT/group head.
            let mut head = (if matches!(self.peek(), Token::Values) {
                self.advance(); // VALUES
                self.parse_values_rows_body()
            } else {
                self.parse_bare_select()
            })
            .and_then(|mut h| {
                self.parse_setop_chain_into(&mut h)?;
                Ok(h)
            });
            self.nest_depth -= 1;
            let mut head = match &mut head {
                Ok(h) => core::mem::take(h),
                Err(_) => return head,
            };
            // v7.37.17 (17.6 siblings) — group-internal tail:
            // `(A UNION B ORDER BY 1 LIMIT 5)`. Parse it into the
            // group head, then wrap the group as a derived table
            // (SELECT * FROM (group)) so the outer chain / outer
            // tail can't clobber the group's own ordering or limit.
            let has_tail = matches!(self.peek(), Token::Order | Token::Limit | Token::Offset)
                || matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("fetch"));
            if has_tail {
                self.parse_select_tail_into(&mut head)?;
                head = SelectStatement {
                    locking: None,
                    ctes: Vec::new(),
                    distinct: false,
                    distinct_on: Vec::new(),
                    items: alloc::vec![SelectItem::Wildcard],
                    from: Some(FromClause {
                        primary: TableRef {
                            name: "subquery".to_string(),
                            alias: None,
                            only: false,
                            as_of_segment: None,
                            unnest_expr: None,
                            unnest_column_aliases: Vec::new(),
                            with_ordinality: false,
                            generate_series_args: None,
                            lateral_subquery: Some(Box::new(head)),
                            jsonb_each_text_arg: None,
                            table_fn_call: None,
                            rows_from: None,
                            json_table: None,
                            scalar_fn_item: false,
                        },
                        joins: Vec::new(),
                    }),
                    where_: None,
                    group_by: None,
                    group_by_all: false,
                    having: None,
                    unions: Vec::new(),
                    order_by: Vec::new(),
                    limit: None,
                    offset: None,
                    limit_with_ties: false,
                    window_check_exprs: Vec::new(),
                };
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(format!(
                    "expected ')' after parenthesized query group, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            return Ok(head);
        }
        // `TABLE name` shorthand as a query block — valid anywhere
        // a SELECT head is (set-op peers included).
        if matches!(self.peek(), Token::Table)
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            )
        {
            return self.parse_table_shorthand();
        }
        if !matches!(self.peek(), Token::Select) {
            return Err(self.err(format!(
                "expected SELECT to start a query block, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let distinct = if matches!(self.peek(), Token::Distinct) {
            self.advance();
            true
        } else {
            false
        };
        // v7.37.17 (17.6 siblings) — `DISTINCT ON (expr [, …])`:
        // keep the first row (per ORDER BY) of each group the
        // expressions define. Django's .distinct('field') shape.
        let distinct_on: Vec<Expr> = if distinct && matches!(self.peek(), Token::On) {
            self.advance(); // ON
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' after DISTINCT ON, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut exprs = Vec::new();
            loop {
                exprs.push(self.parse_expr(0)?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in DISTINCT ON list, got {other:?}"
                        )));
                    }
                }
            }
            self.advance(); // )
            exprs
        } else {
            Vec::new()
        };
        let mut items = self.parse_select_list()?;
        // Scope the TABLESAMPLE lowering channel to this SELECT:
        // stash whatever an enclosing select accumulated, collect
        // our own FROM's predicates, restore after the combine.
        let enclosing_sample_preds = core::mem::take(&mut self.pending_sample_preds);
        let mut from = if matches!(self.peek(), Token::From) {
            self.advance();
            Some(self.parse_from_clause()?)
        } else {
            None
        };
        // v7.37 D.22 — a set-returning function in the projection with no FROM
        // (`SELECT unnest(arr)`, `SELECT 'x', generate_series(a,b)`) expands to
        // rows. Move the first SRF projection item to a FROM-position derived
        // table and replace it in the projection with a reference to its output
        // column; sibling scalar columns repeat per SRF row. PG names the output
        // column after the function (or its AS alias). Reuses the FROM-SRF
        // machinery. Only fires with no FROM — mixed SRF over a real FROM already
        // works via the targetlist-SRF path.
        // v7.39 (read01 round 69) — lower `(f(args)).*`. With no FROM it IS
        // `SELECT * FROM f(args)` — the record's fields become the columns, which
        // is exactly what the function's own row shape already is. Anywhere else
        // (per outer row, or beside other items) it would need a real record-typed
        // projection, so it says so rather than answering something else.
        if let [
            SelectItem::Expr {
                expr: Expr::FunctionCall { name, args },
                ..
            },
        ] = items.as_slice()
            && name == "__record_expand"
        {
            let Some(Expr::FunctionCall {
                name: inner_name,
                args: inner_args,
            }) = args.first()
            else {
                return Err(self.err(
                    "(<expr>).* expands a function's record — it needs a function call".into(),
                ));
            };
            if from.is_some() {
                return Err(self.err(
                    "(<fn>).* over a FROM clause is not supported — call the function in FROM"
                        .into(),
                ));
            }
            let fn_ref = TableRef {
                name: inner_name.clone(),
                alias: None,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: Vec::new(),
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: None,
                jsonb_each_text_arg: None,
                table_fn_call: Some(Box::new((
                    inner_name.to_ascii_lowercase(),
                    inner_args.clone(),
                ))),
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            };
            items = alloc::vec![SelectItem::Wildcard];
            from = Some(FromClause {
                primary: fn_ref,
                joins: Vec::new(),
            });
        }
        // v7.39 (read01 round 74) — `(f(args)).*` beside other items, or over a
        // FROM, keeps its marker: the ENGINE lowers it, because naming the
        // record's fields takes the catalog. It becomes a LATERAL of the same
        // function plus one item per declared column — the machinery rounds 65
        // and 69 already built.
        // v7.39 (read01 round 67) — the lift moves ONE SRF into FROM. With two
        // (`SELECT generate_series(1,3), generate_series(10,11)`) PG runs them in
        // LOCKSTEP, padding the shorter with NULLs — a shape the lift cannot
        // express, since the lifted one becomes a scan and the other would
        // expand per its rows (a cross product, not a zip). So when the
        // projection holds more than one top-level function call, the lift steps
        // aside and the engine's target-list expansion takes the whole list.
        let fn_call_items = items
            .iter()
            .filter(|it| {
                matches!(
                    it,
                    SelectItem::Expr {
                        expr: Expr::FunctionCall { .. },
                        ..
                    }
                )
            })
            .count();
        if from.is_none() && fn_call_items <= 1 {
            let mut found: Option<(usize, TableRef, String)> = None;
            for (i, item) in items.iter().enumerate() {
                if let SelectItem::Expr {
                    expr: Expr::FunctionCall { name, args },
                    alias,
                } = item
                {
                    let lname = name.to_ascii_lowercase();
                    let colname = alias.clone().unwrap_or_else(|| lname.clone());
                    let (unnest, gs) = match lname.as_str() {
                        "unnest" if args.len() == 1 => (Some(Box::new(args[0].clone())), None),
                        "generate_series" if (2..=3).contains(&args.len()) => {
                            (None, Some(args.clone()))
                        }
                        // v7.38 (read01) — generate_subscripts(arr, dim) in a
                        // no-FROM projection yields the 1-based subscripts, i.e.
                        // generate_series(1, array_length(arr, dim)); an invalid
                        // dimension makes array_length NULL → 0 rows, as in PG.
                        "generate_subscripts" if args.len() == 2 => (
                            None,
                            Some(alloc::vec![
                                Expr::Literal(Literal::Integer(1)),
                                Expr::FunctionCall {
                                    name: "array_length".to_string(),
                                    args: args.clone(),
                                },
                            ]),
                        ),
                        // v7.38 (read01, T-srf) — string_to_table / regexp_split_to_table
                        // in a no-FROM projection unnest their *_to_array form.
                        "string_to_table" | "regexp_split_to_table" => {
                            let array_fn = if lname == "string_to_table" {
                                "string_to_array"
                            } else {
                                "regexp_split_to_array"
                            };
                            (
                                Some(Box::new(Expr::FunctionCall {
                                    name: array_fn.to_string(),
                                    args: args.clone(),
                                })),
                                None,
                            )
                        }
                        // v7.38 (read01, T15) — jsonb/json_array_elements[_text] in
                        // a no-FROM projection expand per element. The scalar form
                        // returns the elements as a TEXT array, so unnest over the
                        // same call materialises one row each (same rewrite the
                        // FROM-clause form uses).
                        "jsonb_array_elements"
                        | "json_array_elements"
                        | "jsonb_array_elements_text"
                        | "json_array_elements_text"
                            if args.len() == 1 =>
                        {
                            (
                                Some(Box::new(Expr::FunctionCall {
                                    name: lname.clone(),
                                    args: args.clone(),
                                })),
                                None,
                            )
                        }
                        // v7.38 (read01, T15) — jsonb/json_path_query(doc, path)
                        // in a no-FROM projection expands per match (scalar form
                        // returns the matches as a TEXT array → unnest).
                        "jsonb_path_query" | "json_path_query" if args.len() == 2 => (
                            Some(Box::new(Expr::FunctionCall {
                                name: lname.clone(),
                                args: args.clone(),
                            })),
                            None,
                        ),
                        _ => continue,
                    };
                    found = Some((
                        i,
                        TableRef {
                            name: colname.clone(),
                            alias: Some(colname.clone()),
                            only: false,
                            as_of_segment: None,
                            unnest_expr: unnest,
                            unnest_column_aliases: alloc::vec![colname.clone()],
                            with_ordinality: false,
                            generate_series_args: gs,
                            lateral_subquery: None,
                            jsonb_each_text_arg: None,
                            table_fn_call: None,
                            rows_from: None,
                            json_table: None,
                            scalar_fn_item: false,
                        },
                        colname,
                    ));
                    break;
                }
            }
            if let Some((idx, tref, colname)) = found {
                from = Some(FromClause {
                    primary: tref,
                    joins: Vec::new(),
                });
                items[idx] = SelectItem::Expr {
                    expr: Expr::Column(ColumnName {
                        qualifier: None,
                        name: colname.clone(),
                    }),
                    alias: Some(colname),
                };
            }
        }
        let sample_preds = core::mem::take(&mut self.pending_sample_preds);
        let where_ = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        let where_ = sample_preds.into_iter().fold(where_, |acc, pred| {
            Some(match acc {
                Some(w) => Expr::Binary {
                    lhs: Box::new(pred),
                    op: crate::ast::BinOp::And,
                    rhs: Box::new(w),
                },
                None => pred,
            })
        });
        self.pending_sample_preds = enclosing_sample_preds;
        let mut group_by_all = false;
        // v7.37.17 (17.6 siblings) — ROLLUP / CUBE / GROUPING SETS
        // share one expansion: `grouping_sets` lists the key subsets
        // (first = primary, assigned to stmt.group_by; the rest
        // become UNION ALL peers), `grouping_universe` is the full
        // key list used to compute each peer's dropped keys.
        let mut grouping_sets: Vec<Vec<Expr>> = Vec::new();
        let mut grouping_universe: Vec<Expr> = Vec::new();
        // v7.39 (round 472) — did the GROUP BY end in MySQL's `WITH ROLLUP`?
        // A BOOL, not the key list: this frame is the statement parser's, and
        // round 430 measured that a `Vec` local here is enough on its own to
        // tip the 512 KiB nesting guard. The keys are recoverable from
        // `grouping_universe`, which a rollup fills with exactly them.
        let mut mysql_rollup = false;
        let group_by = if matches!(self.peek(), Token::Group) {
            self.advance();
            if !self.peek_is_by() {
                return Err(self.err(format!("expected BY after GROUP, got {:?}", self.peek())));
            }
            self.advance();
            // v6.4.1 — `GROUP BY ALL` shortcut. Planner expands to
            // every non-aggregate SELECT-list item later.
            if matches!(self.peek(), Token::All) {
                self.advance();
                group_by_all = true;
                None
            } else {
                // v7.39 (round 242) — PG's general grouping-element grammar:
                // GROUP BY [DISTINCT] element [, element]*, where an element
                // is a bare expression, ROLLUP (…), CUBE (…) or GROUPING
                // SETS (…) — mixed freely. Each element yields a list of
                // key sets; the query's grouping sets are the CARTESIAN
                // PRODUCT of the elements' lists (so `a, ROLLUP (b)` is
                // {(a,b),(a)}), and DISTINCT drops duplicate sets by
                // content. ROLLUP/CUBE members may be composite
                // (`ROLLUP ((a, b))` moves a and b as one unit), and a
                // GROUPING SETS item may itself be a ROLLUP/CUBE. The old
                // parser handled only a lone ROLLUP/CUBE/GS as the whole
                // clause.
                let distinct_sets = if matches!(self.peek(), Token::Distinct) {
                    self.advance();
                    true
                } else {
                    false
                };
                let mut element_sets: Vec<Vec<Vec<Expr>>> = Vec::new();
                loop {
                    element_sets.push(self.parse_grouping_element()?);
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                    } else {
                        break;
                    }
                }
                let mut total: Vec<Vec<Expr>> = alloc::vec![Vec::new()];
                for el in &element_sets {
                    let mut next: Vec<Vec<Expr>> = Vec::new();
                    for base in &total {
                        for set in el {
                            let mut merged = base.clone();
                            for k in set {
                                if !merged.iter().any(|m| m == k) {
                                    merged.push(k.clone());
                                }
                            }
                            next.push(merged);
                        }
                    }
                    total = next;
                }
                // v7.39 (round 472) — MySQL spells a rollup as a SUFFIX:
                // `GROUP BY a, b WITH ROLLUP` is PG's `GROUP BY ROLLUP(a, b)`.
                // The keys and the aggregates come out identical; the ROW
                // ORDER does not, and that is the part a report depends on.
                // MySQL interleaves each group's subtotal right after its
                // own rows (east/a, east/b, east/NULL, west/a, …, NULL/NULL)
                // where the union-of-grouping-sets expansion emits every
                // leaf first and then every subtotal. MariaDB REFUSES an
                // ORDER BY next to ROLLUP (1221), so a client cannot fix the
                // order itself — measured on MariaDB 11 and MySQL 9.7, which
                // agree on the order and disagree only on whether ORDER BY
                // is allowed (MySQL allows it; SPG allows it too, since
                // refusing would break the clients that can write it).
                if self.mysql_dialect
                    && matches!(self.peek(), Token::Ident(w) if w.eq_ignore_ascii_case("with"))
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(r)) if r.eq_ignore_ascii_case("rollup")
                    )
                {
                    self.advance(); // WITH
                    self.advance(); // ROLLUP
                    let keys = total.into_iter().next().unwrap_or_default();
                    mysql_rollup = true;
                    // n+1 prefixes, largest first — the same expansion
                    // `ROLLUP (…)` produces.
                    total = (0..=keys.len()).rev().map(|n| keys[..n].to_vec()).collect();
                }
                if distinct_sets {
                    let mut seen: Vec<Vec<String>> = Vec::new();
                    total.retain(|set| {
                        let mut key: Vec<String> =
                            set.iter().map(|e| alloc::format!("{e}")).collect();
                        key.sort();
                        if seen.contains(&key) {
                            false
                        } else {
                            seen.push(key);
                            true
                        }
                    });
                }
                if total.len() > 1 {
                    let mut universe: Vec<Expr> = Vec::new();
                    for set in &total {
                        for k in set {
                            if !universe.iter().any(|u| u == k) {
                                universe.push(k.clone());
                            }
                        }
                    }
                    grouping_universe = universe;
                    let primary = total[0].clone();
                    grouping_sets = total;
                    Some(primary)
                } else {
                    // One set (a plain GROUP BY list, or a single-set
                    // spelling like GROUPING SETS ((a, b))). An EMPTY
                    // single set — GROUPING SETS (()) — stays
                    // `Some(vec![])`: the grand-total group, which must
                    // run the aggregate path.
                    Some(total.into_iter().next().unwrap_or_default())
                }
            }
        } else {
            None
        };
        let having = if matches!(self.peek(), Token::Having) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        // `WINDOW w AS ( <window-def> ) [, ...]` — named windows.
        // OVER w parsed to a marker above; inline each definition
        // into the referencing WindowFunction nodes.
        let mut window_defs: Vec<(String, WindowDef)> = Vec::new();
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("window")) {
            self.advance();
            loop {
                let wname = self.expect_ident_like()?;
                if !matches!(self.peek(), Token::As) {
                    return Err(self.err(format!(
                        "expected AS after WINDOW {wname}, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                // v7.39 (round 229) — PG rejects a redefinition outright.
                if window_defs
                    .iter()
                    .any(|(n, _)| n.eq_ignore_ascii_case(&wname))
                {
                    return Err(self.err(alloc::format!("window \"{wname}\" is already defined")));
                }
                let def = self.parse_over_clause()?;
                // A definition may itself copy an earlier one
                // (`WINDOW w1 AS (PARTITION BY g), w2 AS (w1 ORDER BY v)`),
                // so resolve it against the defs already in scope. Same
                // copy rules as an `OVER (w1 …)` in the select list.
                let mut probe = Expr::WindowFunction {
                    name: String::new(),
                    args: Vec::new(),
                    partition_by: def.0,
                    order_by: def.1,
                    frame: def.2,
                    null_treatment: crate::ast::NullTreatment::Respect,
                    filter: None,
                };
                Self::substitute_named_windows(&mut probe, &window_defs)
                    .map_err(|m| self.err(m))?;
                let Expr::WindowFunction {
                    partition_by,
                    order_by,
                    frame,
                    ..
                } = probe
                else {
                    unreachable!("probe is a WindowFunction")
                };
                window_defs.push((wname, (partition_by, order_by, frame)));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
        }
        // v7.39 (round 705) — which definitions did anything reference?
        // The ones nothing did used to be dropped here, unexamined, so
        // `WINDOW w AS (ORDER BY nosuch)` succeeded — PG analyses every
        // definition whether referenced or not. Their key expressions ride
        // out on the statement for the engine to resolve.
        let mut window_refs: Vec<String> = Vec::new();
        if !window_defs.is_empty() {
            for it in &items {
                if let SelectItem::Expr { expr, .. } = it {
                    Self::collect_named_window_refs(expr, &mut window_refs);
                }
            }
        }
        let window_check_exprs: Vec<Expr> = window_defs
            .iter()
            .filter(|(n, _)| !window_refs.iter().any(|r| r.eq_ignore_ascii_case(n)))
            .flat_map(|(_, (partition, order, _))| {
                partition
                    .iter()
                    .cloned()
                    .chain(order.iter().map(|(e, _, _)| e.clone()))
            })
            .collect();
        if !window_defs.is_empty()
            || items
                .iter()
                .any(|it| matches!(it, SelectItem::Expr { expr, .. } if Self::expr_has_named_window(expr)))
        {
            for it in &mut items {
                if let SelectItem::Expr { expr, .. } = it {
                    Self::substitute_named_windows(expr, &window_defs)
                        .map_err(|m| self.err(m))?;
                }
            }
        }
        // `GROUP BY 1` — positional keys substitute with the Nth
        // select item's expression (same contract ORDER BY has had
        // since v6.x). Out-of-range positions error.
        let group_by = match group_by {
            Some(mut keys) => {
                for k in &mut keys {
                    if let Expr::Literal(Literal::Integer(n)) = k {
                        let idx = *n;
                        if idx < 1 || idx as usize > items.len() {
                            return Err(self.err(alloc::format!(
                                "GROUP BY position {idx} is not in select list"
                            )));
                        }
                        match &items[(idx - 1) as usize] {
                            SelectItem::Expr { expr, .. } => *k = expr.clone(),
                            SelectItem::Wildcard | SelectItem::QualifiedWildcard(_) => {
                                return Err(self.err(alloc::format!(
                                    "GROUP BY position {idx} references a wildcard item"
                                )));
                            }
                        }
                    }
                }
                Some(keys)
            }
            None => None,
        };
        let mut stmt = SelectStatement {
            locking: None,
            ctes: Vec::new(),
            distinct,
            distinct_on,
            items,
            from,
            where_,
            group_by,
            group_by_all,
            having,
            unions: Vec::new(),
            order_by: Vec::new(),
            limit: None,
            offset: None,
            limit_with_ties: false,
            window_check_exprs,
        };
        // Grouping expansion (ROLLUP / CUBE / GROUPING SETS): the
        // first set is the primary (already on stmt.group_by); each
        // further set becomes a UNION ALL peer with its dropped
        // keys (universe minus the set) replaced by NULL literals
        // in the peer's items and group_by. PG-legal: non-grouped
        // select items must be group keys or aggregates, so a
        // dropped key's occurrences in the projection are exactly
        // the ones to nullify.
        // v7.39 (round 242) — grouping() OUTSIDE an expansion: PG allows it
        // over a plain GROUP BY (every argument must be a group key; the
        // mask is then 0) and rejects anything else with 42803. SPG's
        // rewrite only ran during the ROLLUP/CUBE expansion, so a plain
        // `SELECT grouping(a) … GROUP BY a` died at eval with "unknown
        // function `grouping`".
        if grouping_sets.len() <= 1 {
            let keys: Vec<Expr> = stmt.group_by.clone().unwrap_or_default();
            let mut calls: Vec<Expr> = Vec::new();
            for item in &stmt.items {
                if let SelectItem::Expr { expr, .. } = item {
                    Self::collect_grouping_calls(expr, &mut calls);
                }
            }
            if let Some(h) = &stmt.having {
                Self::collect_grouping_calls(h, &mut calls);
            }
            for call in &calls {
                let Expr::FunctionCall { args, .. } = call else {
                    continue;
                };
                for a in args {
                    if !keys.iter().any(|k| k == a) {
                        return Err(self.err(
                            "arguments to GROUPING must be grouping expressions of the associated query level"
                                .to_string(),
                        ));
                    }
                }
            }
            if !calls.is_empty() {
                for item in &mut stmt.items {
                    if let SelectItem::Expr { expr, .. } = item {
                        Self::substitute_grouping_calls(expr, &[]);
                    }
                }
                if let Some(h) = &mut stmt.having {
                    Self::substitute_grouping_calls(h, &[]);
                }
            }
        }
        if grouping_sets.len() > 1 {
            // The primary set's own dropped keys nullify in the
            // HEAD's projection too (GROUPING SETS's first set may
            // omit keys other sets use).
            let primary = grouping_sets[0].clone();
            let head_dropped: Vec<Expr> = grouping_universe
                .iter()
                .filter(|u| !primary.iter().any(|k| k == *u))
                .cloned()
                .collect();
            for set in grouping_sets.iter().skip(1) {
                let mut peer = stmt.clone();
                peer.unions = Vec::new();
                let dropped: Vec<&Expr> = grouping_universe
                    .iter()
                    .filter(|u| !set.iter().any(|k| k == *u))
                    .collect();
                // Empty set = grand-total group: `Some(vec![])` forces
                // the aggregate path (one collapsed row) instead of a
                // per-row passthrough. See the primary-set note above.
                peer.group_by = Some(set.clone());
                let dropped_owned: Vec<Expr> = dropped.iter().map(|d| (*d).clone()).collect();
                for item in &mut peer.items {
                    if let SelectItem::Expr { expr, alias } = item {
                        if dropped.iter().any(|d| *d == expr) {
                            // v7.39 — keep the dropped key's name on the
                            // NULL literal so the UNION output column
                            // (and any top-level ORDER BY on it) still
                            // resolves.
                            if alias.is_none()
                                && let Expr::Column(c) = &expr
                            {
                                *alias = Some(c.name.clone());
                            }
                            *expr = Expr::Literal(Literal::Null);
                        } else {
                            Self::substitute_grouping_calls(expr, &dropped_owned);
                        }
                    }
                }
                if let Some(h) = &mut peer.having {
                    Self::substitute_grouping_calls(h, &dropped_owned);
                }
                stmt.unions.push((UnionKind::All, peer));
            }
            for item in &mut stmt.items {
                if let SelectItem::Expr { expr, alias } = item {
                    if head_dropped.iter().any(|d| d == expr) {
                        if alias.is_none()
                            && let Expr::Column(c) = &expr
                        {
                            *alias = Some(c.name.clone());
                        }
                        *expr = Expr::Literal(Literal::Null);
                    } else {
                        Self::substitute_grouping_calls(expr, &head_dropped);
                    }
                }
            }
            if let Some(h) = &mut stmt.having {
                Self::substitute_grouping_calls(h, &head_dropped);
            }
            // v7.39 (round 135) — GROUPING() in ORDER BY. Parse the ORDER BY now
            // (while `grouping_universe` / the per-branch sets are in scope). For
            // each grouping() call in it, inject a per-branch hidden column
            // `__grp_ord_K` carrying that branch's mask into the head + every
            // peer, and rewrite the ORDER BY to reference it. `parse_select_tail_into`
            // preserves this pre-set order_by; the engine strips `__grp_ord_*`
            // from the final output. A standalone grouping-set query has ORDER BY
            // (not an explicit set-op) next, so consuming it here is safe.
            // v7.39 (round 472) — absent the client's own ORDER BY, a MySQL
            // rollup carries the hierarchical order: sort by the grouping
            // keys with the rolled-up NULLs last, which is exactly the
            // interleaving both oracles emit. A client's own ORDER BY wins,
            // which is what MySQL does (MariaDB refuses to let one be
            // written at all).
            // The synthesised keys have to travel the SAME path a written
            // ORDER BY does: the block below is what turns a `grouping()`
            // call into the per-branch `__grp_ord_K` column the engine can
            // actually sort on. Bypassing it left a bare `grouping(text)`
            // for the evaluator to reject.
            let synthesised_or_parsed: Vec<OrderBy> = if matches!(self.peek(), Token::Order) {
                self.parse_order_by_keys()?
            } else if mysql_rollup {
                Self::mysql_rollup_order(&grouping_universe)
            } else {
                Vec::new()
            };
            if !synthesised_or_parsed.is_empty() {
                let mut order_keys = synthesised_or_parsed;
                let mut grp_exprs: Vec<Expr> = Vec::new();
                for ob in &order_keys {
                    Self::collect_grouping_calls(&ob.expr, &mut grp_exprs);
                }
                for (k, gexpr) in grp_exprs.iter().enumerate() {
                    let colname = alloc::format!("__grp_ord_{k}");
                    // Head branch (primary set) uses `head_dropped`.
                    let mut he = gexpr.clone();
                    Self::substitute_grouping_calls(&mut he, &head_dropped);
                    stmt.items.push(SelectItem::Expr {
                        expr: he,
                        alias: Some(colname.clone()),
                    });
                    // Each peer `stmt.unions[i]` corresponds to `grouping_sets[i+1]`.
                    for (i, (_, peer)) in stmt.unions.iter_mut().enumerate() {
                        let set = &grouping_sets[i + 1];
                        let dropped: Vec<Expr> = grouping_universe
                            .iter()
                            .filter(|u| !set.iter().any(|k| k == *u))
                            .cloned()
                            .collect();
                        let mut pe = gexpr.clone();
                        Self::substitute_grouping_calls(&mut pe, &dropped);
                        peer.items.push(SelectItem::Expr {
                            expr: pe,
                            alias: Some(colname.clone()),
                        });
                    }
                }
                for ob in &mut order_keys {
                    Self::rewrite_grouping_to_col(&mut ob.expr, &grp_exprs);
                }
                stmt.order_by = order_keys;
            }
        }
        Ok(stmt)
    }

    /// v7.39 (round 472) — the row order MySQL's `WITH ROLLUP` promises,
    /// as ORDER BY keys.
    ///
    /// Per key: the rollup marker, then the key. Sorting on the key alone
    /// is not enough, and a table with a NULL in it says why — MariaDB puts
    /// the DATA-NULL group where a plain GROUP BY puts it (first) and only
    /// the ROLLUP-introduced NULL last, and both print as NULL.
    /// `GROUPING(k)` is the one thing that tells them apart: 0 for every
    /// real group including the data-NULL one, 1 only for the row the
    /// rollup added. Measured on MariaDB 11 — `('a',1),(NULL,2),('b',3)`
    /// rolls up to NULL|2, a|1, b|3, NULL|6.
    ///
    /// `#[inline(never)]`: its locals must not join the statement parser's
    /// frame, which round 430 measured sitting against the nesting guard.
    #[inline(never)]
    fn mysql_rollup_order(keys: &[Expr]) -> Vec<OrderBy> {
        let mut out: Vec<OrderBy> = Vec::with_capacity(keys.len() * 2);
        for e in keys {
            out.push(OrderBy {
                expr: Expr::FunctionCall {
                    name: "grouping".into(),
                    args: alloc::vec![e.clone()],
                },
                desc: false,
                nulls_first: None,
                collation: None,
            });
            out.push(OrderBy {
                expr: e.clone(),
                desc: false,
                // MySQL orders NULL first on an ascending key.
                nulls_first: Some(true),
                collation: None,
            });
        }
        out
    }

    /// v7.39 (round 535) — `REINDEX [(opts)] { INDEX | TABLE | SCHEMA |
    /// DATABASE | SYSTEM } [CONCURRENTLY] [<name>]`.
    #[inline(never)]
    fn parse_reindex_tail(&mut self) -> Result<Statement, ParseError> {
        use crate::ast::MaintainKind;
        self.skip_paren_option_list();
        let kind = match self.peek() {
            // `TABLE` and `INDEX` lex as keywords, not identifiers.
            Token::Table | Token::Index => {
                self.advance();
                MaintainKind::ReindexRelation
            }
            Token::Ident(s) | Token::QuotedIdent(s) => match s.to_ascii_lowercase().as_str() {
                "index" | "table" => {
                    self.advance();
                    MaintainKind::ReindexRelation
                }
                "schema" => {
                    self.advance();
                    MaintainKind::ReindexSchema
                }
                "system" | "database" => {
                    self.advance();
                    MaintainKind::Whole
                }
                // PG requires the object type; anything else is the
                // caller's problem, not something to swallow.
                _ => MaintainKind::ReindexRelation,
            },
            _ => MaintainKind::Whole,
        };
        // PG bars `REINDEX … CONCURRENTLY` inside a transaction block and
        // allows the plain form, so the modifier is recorded rather than
        // skipped. It still has no effect on how the reindex runs.
        let mut concurrently = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("concurrently")) {
            self.advance();
            concurrently = true;
        }
        let target = self.take_optional_maintain_name();
        self.consume_until_statement_boundary();
        Ok(Statement::Maintain {
            kind,
            concurrently,
            target,
        })
    }

    /// v7.39 (round 535) — `CLUSTER [VERBOSE] [<table> [USING <index>]]`
    /// and `CLUSTER [VERBOSE] <index> ON <table>`.
    #[inline(never)]
    fn parse_cluster_tail(&mut self) -> Result<Statement, ParseError> {
        use crate::ast::MaintainKind;
        self.skip_paren_option_list();
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("verbose")) {
            self.advance();
        }
        let target = self.take_optional_maintain_name();
        self.consume_until_statement_boundary();
        Ok(Statement::Maintain {
            kind: if target.is_some() {
                MaintainKind::ClusterRelation
            } else {
                MaintainKind::Whole
            },
            // CLUSTER has no CONCURRENTLY form, and PG runs it inside a
            // transaction block quite happily (measured).
            concurrently: false,
            target,
        })
    }

    /// The next token as a relation / schema name, when there is one.
    fn take_optional_maintain_name(&mut self) -> Option<alloc::string::String> {
        match self.peek() {
            Token::Ident(_) | Token::QuotedIdent(_) => match self.advance() {
                Token::Ident(n) | Token::QuotedIdent(n) => Some(n),
                _ => None,
            },
            _ => None,
        }
    }

    /// A parenthesised option list, absorbed.
    fn skip_paren_option_list(&mut self) {
        if !matches!(self.peek(), Token::LParen) {
            return;
        }
        let mut depth = 0usize;
        loop {
            match self.advance() {
                Token::LParen => depth += 1,
                Token::RParen => {
                    depth -= 1;
                    if depth == 0 {
                        return;
                    }
                }
                Token::Eof => return,
                _ => {}
            }
        }
    }

    /// v7.39 (round 531) — the `LIKE` clause inside a CREATE TABLE
    /// column list.
    ///
    /// PG's option names are COMMENTS / COMPRESSION / CONSTRAINTS /
    /// DEFAULTS / GENERATED / IDENTITY / INDEXES / STATISTICS / STORAGE
    /// / ALL. The three that describe physical storage have no meaning
    /// here, so they parse and change nothing rather than making a
    /// dump that mentions them fail to load.
    ///
    /// `#[inline(never)]` because the CREATE TABLE frame sits on the
    /// parse chain the nesting sentinel is tuned against.
    #[inline(never)]
    fn parse_create_table_like(&mut self, at: usize) -> Result<crate::ast::LikeSpec, ParseError> {
        self.advance(); // LIKE
        let source = self.expect_ident_like()?;
        let mut options = crate::ast::LikeOptions::default();
        loop {
            let including = match self.peek() {
                Token::Ident(s) if s.eq_ignore_ascii_case("including") => true,
                Token::Ident(s) if s.eq_ignore_ascii_case("excluding") => false,
                _ => break,
            };
            self.advance();
            // `ALL` lexes as its own keyword, not an identifier.
            let opt = if matches!(self.peek(), Token::All) {
                self.advance();
                alloc::string::String::from("all")
            } else {
                self.expect_ident_like()?
            };
            let set = |o: &mut crate::ast::LikeOptions, on: bool| {
                o.defaults = on;
                o.constraints = on;
                o.identity = on;
                o.generated = on;
                o.indexes = on;
                o.comments = on;
            };
            match opt.to_ascii_lowercase().as_str() {
                "all" => set(&mut options, including),
                "defaults" => options.defaults = including,
                "constraints" => options.constraints = including,
                "identity" => options.identity = including,
                "generated" => options.generated = including,
                "indexes" => options.indexes = including,
                "comments" => options.comments = including,
                // No storage model to copy into.
                "storage" | "statistics" | "compression" => {}
                other => {
                    return Err(self.err(alloc::format!("unrecognized LIKE option {other:?}")));
                }
            }
        }
        Ok(crate::ast::LikeSpec {
            source,
            at,
            options,
        })
    }

    fn parse_create_table_stmt_after_create(&mut self) -> Result<Statement, ParseError> {
        // Caller already consumed CREATE; we're sitting on TABLE.
        debug_assert!(matches!(self.peek(), Token::Table));
        self.advance();
        let if_not_exists = self.consume_if_not_exists();
        let name = self.expect_ident_like()?;
        // v7.37.6-B — `CREATE TABLE c PARTITION OF parent <bounds>`
        // child shape has no column list; the child inherits its
        // columns from the parent at engine-DDL time. Detect it
        // before the `(` requirement below.
        if matches!(self.peek(), Token::Partition)
            && Self::tokens_match_ident_ci(self.tokens.get(self.pos + 1), "of")
        {
            self.advance(); // PARTITION
            self.advance(); // of
            let partition_of = self.parse_partition_of_tail()?;
            return Ok(Statement::CreateTable(CreateTableStatement {
                temporary: false,
                name,
                columns: Vec::new(),
                like_specs: Vec::new(),
                inherits: Vec::new(),
                if_not_exists,
                foreign_keys: Vec::new(),
                table_constraints: Vec::new(),
                partition_by: None,
                partition_of: Some(partition_of),
            }));
        }
        // v7.38 (read01 P6.49) — CTAS: `CREATE TABLE name AS <select>`. Reuses
        // the materialized-view materialisation path (run the SELECT, infer the
        // column types, create + populate the table) but marks the node so the
        // executor creates a plain table without a mat-view registry entry.
        if matches!(self.peek(), Token::As) {
            self.advance();
            let body_stmt = self.parse_select_stmt()?;
            let Statement::Select(body) = body_stmt else {
                return Err(self.err(format!(
                    "CREATE TABLE {name:?} AS body must be a SELECT, got {body_stmt:?}"
                )));
            };
            let with_data = self.parse_optional_with_data(true)?;
            return Ok(Statement::CreateMaterializedView(
                crate::ast::CreateMaterializedViewStatement {
                    temporary: false,
                    name,
                    if_not_exists,
                    columns: Vec::new(),
                    body,
                    with_data,
                    as_plain_table: true,
                },
            ));
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' after table name, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut columns = Vec::new();
        let mut foreign_keys: Vec<ForeignKeyConstraint> = Vec::new();
        let mut table_constraints: Vec<crate::ast::TableConstraint> = Vec::new();
        let mut like_specs: Vec<crate::ast::LikeSpec> = Vec::new();
        loop {
            // v7.39 (round 621) — `CREATE TABLE c () INHERITS (p)`, the empty
            // column list. It is how a child that adds nothing of its own is
            // written, and this loop demanded at least one entry: `syntax
            // error at or near ")"`. The child takes the parent's columns,
            // which the INHERITS clause already arranges.
            if columns.is_empty() && matches!(self.peek(), Token::RParen) {
                self.advance();
                break;
            }
            // v7.6.0 / v7.9.18 — distinguish table-level constraint
            // clauses from column definitions. Constraints start
            // with `CONSTRAINT <name> …`, `FOREIGN KEY (…)`,
            // `PRIMARY KEY (…)`, or `UNIQUE (…)`. Anything else is
            // a column.
            if self.peek_table_level_pk_start() {
                table_constraints.push(self.parse_table_level_primary_key()?);
            } else if matches!(self.peek(), Token::Like) {
                // v7.39 (round 531) — `LIKE <table> [ {INCLUDING|EXCLUDING}
                // <opt> ]*`. The source table's shape lives in the catalog,
                // so this records the clause and the engine expands it.
                like_specs.push(self.parse_create_table_like(columns.len())?);
            } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exclude")) {
                // v7.39 (round 210) — bare `EXCLUDE [USING m] (col WITH op, …)`.
                table_constraints.push(self.parse_table_level_exclude()?);
            } else if self.peek_table_level_unique_start() {
                table_constraints.push(self.parse_table_level_unique()?);
            } else if self.peek_table_level_check_start() {
                // v7.13.0 — table-level CHECK (mailrs round-5 G3).
                table_constraints.push(self.parse_table_level_check()?);
            } else if self.peek_mysql_inline_key_start() {
                // v7.14.0 — mysqldump emits inline `KEY name (cols)`,
                // `INDEX name (cols)`, `UNIQUE KEY name (cols)`,
                // `FULLTEXT KEY name (cols)`, `SPATIAL KEY name (cols)`
                // inside the column list. Skip name + paren list;
                // for UNIQUE KEY, register as a UC.
                if let Some(uc) = self.parse_mysql_inline_key()? {
                    table_constraints.push(uc);
                }
            } else if let Some(kind) = self.peek_named_table_constraint_kind() {
                // v7.22 (mailrs round-13 gap 5) — `CONSTRAINT <name>
                // { CHECK | UNIQUE | PRIMARY KEY }`: every pg_dump'd
                // CHECK is named, and the named-CONSTRAINT arm used
                // to accept FOREIGN KEY only. The name is accepted
                // and discarded — same handling as every other SPG
                // constraint name.
                self.advance(); // CONSTRAINT
                // v7.39 (read01 round 48) — the name is kept now: the schema
                // stores it, so DROP / RENAME CONSTRAINT can find it.
                let con_name = self.expect_ident_like()?;
                let mut tc = match kind {
                    NamedTableConstraintKind::Check => self.parse_table_level_check()?,
                    NamedTableConstraintKind::Unique => self.parse_table_level_unique()?,
                    NamedTableConstraintKind::PrimaryKey => self.parse_table_level_primary_key()?,
                    NamedTableConstraintKind::Exclude => self.parse_table_level_exclude()?,
                };
                match &mut tc {
                    crate::ast::TableConstraint::Check { name, .. }
                    | crate::ast::TableConstraint::Unique { name, .. }
                    | crate::ast::TableConstraint::PrimaryKey { name, .. }
                    | crate::ast::TableConstraint::Exclude { name, .. } => {
                        *name = Some(con_name);
                    }
                    _ => {}
                }
                table_constraints.push(tc);
            } else if self.peek_constraint_or_fk_start() {
                foreign_keys.push(self.parse_table_level_fk()?);
            } else {
                let (col, col_level_fk) = self.parse_column_def_with_fk()?;
                // v7.13.0 — fold inline UNIQUE / CHECK column
                // constraints into table-level entries so the
                // engine path stays uniform.
                if col.is_unique {
                    table_constraints.push(crate::ast::TableConstraint::Unique {
                        name: None,
                        columns: alloc::vec![col.name.clone()],
                        nulls_not_distinct: col.unique_nulls_not_distinct,
                        deferrable: col.constraint_deferrable,
                        initially_deferred: col.constraint_initially_deferred,
                    });
                }
                if let Some(check_expr) = col.check.clone() {
                    table_constraints.push(crate::ast::TableConstraint::Check {
                        name: None,
                        expr: check_expr,
                        not_valid: false,
                    });
                }
                columns.push(col);
                if let Some(fk) = col_level_fk {
                    foreign_keys.push(fk);
                }
            }
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(
                        self.err(format!("expected ',' or ')' in column list, got {other:?}"))
                    );
                }
            }
        }
        // v7.39 (round 531) — a `LIKE` clause brings its own columns, so
        // `CREATE TABLE k (LIKE t)` is a complete definition even though
        // nothing is written between the parentheses.
        // v7.39 (round 621) — a table with NO columns is legal: PG creates it
        // and `INSERT … DEFAULT VALUES` puts a row in it. This refused, so the
        // empty parentheses were a parse error in their own right — quite apart
        // from `CREATE TABLE c () INHERITS (p)`, which needs table inheritance
        // SPG does not have (filed separately).
        let _ = &like_specs;
        // v7.39 (round 645) — `INHERITS (p1, p2)`, PG table inheritance.
        // It sits between the column list and the MySQL table options,
        // and it was a syntax error until this round.
        let mut inherits: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::Ident(k) | Token::QuotedIdent(k)
            if k.eq_ignore_ascii_case("inherits"))
        {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected ( after INHERITS, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            loop {
                inherits.push(self.expect_ident_like()?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ) closing INHERITS, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
        }
        // v7.14.0 — consume MySQL/MariaDB table options after the
        // closing `)`. mysqldump emits things like
        // `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
        // AUTO_INCREMENT=42 ROW_FORMAT=DYNAMIC COMMENT='blog posts'`.
        // SPG accepts all forms as no-ops (each option is
        // `<ident> [=] <ident-or-string>` separated by whitespace).
        self.consume_mysql_table_options();
        // v7.38 (read01 P6.55) — PG storage parameters `WITH (opt=val, …)`.
        // SPG has no per-table reloptions, so accept and ignore them so a
        // pg_dump `CREATE TABLE … WITH (fillfactor=70, …)` restores cleanly.
        self.consume_with_reloptions();
        // v7.37.6-B — declarative-partition-parent suffix
        // (`PARTITION BY RANGE (key_col)`) sits after the column
        // list + MySQL table-options. v7.37.6-B only accepts RANGE
        // and locks the key column at one ident; the engine then
        // verifies the column type is TIMESTAMPTZ.
        let partition_by = if matches!(self.peek(), Token::Partition) {
            self.advance(); // PARTITION
            if !self.peek_is_by() {
                return Err(self.err(format!(
                    "expected BY after PARTITION, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            Some(self.parse_partition_by_tail()?)
        } else {
            None
        };
        Ok(Statement::CreateTable(CreateTableStatement {
            temporary: false,
            name,
            columns,
            like_specs,
            inherits,
            if_not_exists,
            foreign_keys,
            table_constraints,
            partition_by,
            partition_of: None,
        }))
    }

    /// v7.37.6-B — case-insensitive ident match helper for the
    /// `PARTITION OF` / `MINVALUE` / `MAXVALUE` keywords. They lex
    /// as `Token::Ident("of"/"minvalue"/"maxvalue")` because we
    /// didn't burn a global keyword slot for each (see the
    /// `Token::Partition` doc-comment in `lexer.rs`).
    fn tokens_match_ident_ci(t: Option<&Token>, want: &str) -> bool {
        matches!(t, Some(Token::Ident(s) | Token::QuotedIdent(s)) if s.eq_ignore_ascii_case(want))
    }

    /// v7.37.6-B — after `PARTITION BY`, expect `RANGE (key_col [, ...])`.
    /// v7.37.16 (16.1/16.2) — extended to LIST + HASH.
    fn parse_partition_by_tail(&mut self) -> Result<crate::ast::PartitionBySpec, ParseError> {
        use crate::ast::{PartitionBySpec, PartitionKindAst};
        let kind = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("range") => {
                self.advance();
                PartitionKindAst::Range
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("list") => {
                self.advance();
                PartitionKindAst::List
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("hash") => {
                self.advance();
                PartitionKindAst::Hash
            }
            other => {
                return Err(self.err(format!(
                    "PARTITION BY: expected RANGE / LIST / HASH, got {other:?}"
                )));
            }
        };
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' after PARTITION BY <strategy>, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut key_columns = Vec::new();
        loop {
            key_columns.push(self.expect_ident_like()?);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(self.err(format!(
                        "expected ',' or ')' in PARTITION BY key list, got {other:?}"
                    )));
                }
            }
        }
        if key_columns.is_empty() {
            return Err(self.err("PARTITION BY requires at least one key column".to_string()));
        }
        Ok(PartitionBySpec { kind, key_columns })
    }

    /// v7.37.6-B — after `PARTITION OF`, expect
    ///   <parent> FOR VALUES FROM ( <expr> ) TO ( <expr> )
    /// or
    ///   <parent> DEFAULT
    fn parse_partition_of_tail(&mut self) -> Result<crate::ast::PartitionOfSpec, ParseError> {
        use crate::ast::{PartitionOfBoundsAst, PartitionOfSpec};
        let parent_name = self.expect_ident_like()?;
        // v7.37.6-B rejects an explicit column list — the child
        // inherits from the parent. mailrs round-7 taught us that
        // CREATE TABLE-side schema reconciliation hides drift, so
        // we surface this as a parse error rather than silently
        // ignoring user columns.
        if matches!(self.peek(), Token::LParen) {
            return Err(self.err(
                "CREATE TABLE … PARTITION OF parent: explicit column list not supported \
                 at v7.37.6-B; the child inherits its columns from the parent"
                    .to_string(),
            ));
        }
        let bounds = match self.peek() {
            Token::Default => {
                self.advance();
                PartitionOfBoundsAst::Default
            }
            Token::For => {
                self.advance();
                if !matches!(self.peek(), Token::Values) {
                    return Err(
                        self.err(format!("expected VALUES after FOR, got {:?}", self.peek()))
                    );
                }
                self.advance();
                // WITH is not a reserved Token in the lexer — it lexes
                // as Token::Ident("with"). Disambiguate manually.
                let want_with = matches!(
                    self.peek(),
                    Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with")
                );
                if want_with {
                    self.advance();
                    if !matches!(self.peek(), Token::LParen) {
                        return Err(self.err(format!(
                            "expected '(' after FOR VALUES WITH, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let (mut modulus, mut remainder): (Option<u32>, Option<u32>) = (None, None);
                    loop {
                        let key = self.expect_ident_like()?;
                        let n = match self.peek().clone() {
                            Token::Integer(v) if u32::try_from(v).is_ok() => {
                                self.advance();
                                v as u32
                            }
                            other => {
                                return Err(self.err(format!(
                                    "FOR VALUES WITH: expected unsigned integer literal, got {other:?}"
                                )));
                            }
                        };
                        match key.to_ascii_uppercase().as_str() {
                            "MODULUS" => modulus = Some(n),
                            "REMAINDER" => remainder = Some(n),
                            other => {
                                return Err(self.err(format!(
                                    "FOR VALUES WITH: unknown key {other:?}; \
                                     expected MODULUS or REMAINDER"
                                )));
                            }
                        }
                        match self.peek() {
                            Token::Comma => {
                                self.advance();
                            }
                            Token::RParen => {
                                self.advance();
                                break;
                            }
                            other => {
                                return Err(self.err(format!(
                                    "expected ',' or ')' in FOR VALUES WITH list, got {other:?}"
                                )));
                            }
                        }
                    }
                    let modulus = modulus
                        .ok_or_else(|| self.err("FOR VALUES WITH: missing MODULUS".to_string()))?;
                    let remainder = remainder.ok_or_else(|| {
                        self.err("FOR VALUES WITH: missing REMAINDER".to_string())
                    })?;
                    if modulus == 0 {
                        return Err(self.err("FOR VALUES WITH: MODULUS must be > 0".to_string()));
                    }
                    if remainder >= modulus {
                        return Err(self.err(format!(
                            "FOR VALUES WITH: REMAINDER ({remainder}) \
                             must be < MODULUS ({modulus})"
                        )));
                    }
                    PartitionOfBoundsAst::Hash { modulus, remainder }
                } else {
                    match self.peek() {
                        Token::From => {
                            self.advance();
                            let lower = Box::new(self.parse_partition_bound_expr()?);
                            if !matches!(self.peek(), Token::To) {
                                return Err(self.err(format!(
                                    "expected TO after FROM (...), got {:?}",
                                    self.peek()
                                )));
                            }
                            self.advance();
                            let upper = Box::new(self.parse_partition_bound_expr()?);
                            PartitionOfBoundsAst::Range { lower, upper }
                        }
                        // v7.37.16 (16.1) — FOR VALUES IN (lit [, lit, …])
                        Token::In => {
                            self.advance();
                            if !matches!(self.peek(), Token::LParen) {
                                return Err(self.err(format!(
                                    "expected '(' after FOR VALUES IN, got {:?}",
                                    self.peek()
                                )));
                            }
                            self.advance();
                            let mut values = Vec::new();
                            loop {
                                values.push(self.parse_expr(0)?);
                                match self.peek() {
                                    Token::Comma => {
                                        self.advance();
                                    }
                                    Token::RParen => {
                                        self.advance();
                                        break;
                                    }
                                    other => {
                                        return Err(self.err(format!(
                                        "expected ',' or ')' in FOR VALUES IN list, got {other:?}"
                                    )));
                                    }
                                }
                            }
                            if values.is_empty() {
                                return Err(self.err(
                                    "FOR VALUES IN requires at least one literal".to_string(),
                                ));
                            }
                            PartitionOfBoundsAst::List { values }
                        }
                        other => {
                            return Err(self.err(format!(
                                "expected FROM / IN / WITH after FOR VALUES, got {other:?}"
                            )));
                        }
                    }
                }
            }
            other => {
                return Err(self.err(format!(
                    "expected FOR VALUES or DEFAULT after PARTITION OF parent, got {other:?}"
                )));
            }
        };
        Ok(PartitionOfSpec {
            parent_name,
            bounds,
        })
    }

    /// v7.37.6-B — a single `( <expr> )` bound. `MINVALUE` /
    /// `MAXVALUE` lex as Ident; rewrite them into FunctionCall
    /// markers (no-arg builtins) so the engine resolves them
    /// against [`spg_storage::PartitionBound::{MinValue, MaxValue}`].
    fn parse_partition_bound_expr(&mut self) -> Result<crate::ast::Expr, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' before partition bound, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let expr = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("minvalue") || s.eq_ignore_ascii_case("maxvalue") =>
            {
                let name = s.to_ascii_uppercase();
                self.advance();
                crate::ast::Expr::FunctionCall {
                    name,
                    args: Vec::new(),
                }
            }
            _ => self.parse_expr(0)?,
        };
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' after partition bound, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(expr)
    }

    /// v7.14.0 — true when the next tokens look like an inline
    /// MySQL index declaration: KEY / INDEX / UNIQUE KEY /
    /// UNIQUE INDEX / FULLTEXT [KEY|INDEX] / SPATIAL [KEY|INDEX]
    /// — each followed by an optional name + `(...)`. Critical:
    /// a column NAMED `key` / `index` (PG accepts as ident) must
    /// NOT be mistaken for the KEY constraint shape. We disambig
    /// by requiring the keyword to be followed by either `(` or
    /// `<ident> (`.
    fn peek_mysql_inline_key_start(&self) -> bool {
        let cur = self.peek();
        // Shapes:
        //   KEY (cols)
        //   KEY name (cols)
        //   INDEX (cols)
        //   INDEX name (cols)
        //   UNIQUE KEY [name] (cols)
        //   UNIQUE INDEX [name] (cols)
        //   FULLTEXT [KEY|INDEX] [name] (cols)
        //   SPATIAL [KEY|INDEX] [name] (cols)
        let after_keyword_followed_by_paren_or_ident_paren = |skip: usize| -> bool {
            // tokens at skip = the position AFTER the index-form
            // keywords (KEY/INDEX) have been consumed.
            match self.tokens.get(skip) {
                Some(Token::LParen) => true,
                Some(Token::Ident(_) | Token::QuotedIdent(_)) => {
                    matches!(self.tokens.get(skip + 1), Some(Token::LParen))
                }
                _ => false,
            }
        };
        // `INDEX` lexes as Token::Index (reserved), not as
        // Token::Ident("index"). Both shapes count as a KEY/INDEX
        // start; the peek helper below handles either.
        let is_key_or_index_tok = |t: &Token| -> bool {
            matches!(t, Token::Index)
                || matches!(t, Token::Ident(s) if s.eq_ignore_ascii_case("key") || s.eq_ignore_ascii_case("index"))
        };
        match cur {
            Token::Index => after_keyword_followed_by_paren_or_ident_paren(self.pos + 1),
            Token::Ident(s) if s.eq_ignore_ascii_case("key") || s.eq_ignore_ascii_case("index") => {
                after_keyword_followed_by_paren_or_ident_paren(self.pos + 1)
            }
            Token::Ident(s)
                if s.eq_ignore_ascii_case("fulltext") || s.eq_ignore_ascii_case("spatial") =>
            {
                let nxt = self.tokens.get(self.pos + 1);
                let after_after = if nxt.is_some_and(is_key_or_index_tok) {
                    self.pos + 2
                } else {
                    self.pos + 1
                };
                after_keyword_followed_by_paren_or_ident_paren(after_after)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("unique") => {
                let nxt = self.tokens.get(self.pos + 1);
                if !nxt.is_some_and(is_key_or_index_tok) {
                    return false;
                }
                after_keyword_followed_by_paren_or_ident_paren(self.pos + 2)
            }
            _ => false,
        }
    }

    /// v7.14.0 — parse the MySQL inline KEY/INDEX form. Returns
    /// Some(TableConstraint::Unique) for UNIQUE KEY (so SPG
    /// enforces uniqueness on INSERT). v7.15.0: plain KEY/INDEX
    /// returns Some(TableConstraint::Index) so the engine builds
    /// a real BTree index on the leading column (mysqldump
    /// `KEY idx_posts_author (author_id)` shape).
    /// FULLTEXT / SPATIAL still return None — accepted-as-no-op
    /// (the storage layer has no matching AM).
    fn parse_mysql_inline_key(
        &mut self,
    ) -> Result<Option<crate::ast::TableConstraint>, ParseError> {
        // Detect UNIQUE prefix.
        let is_unique = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("unique"))
        {
            self.advance();
            true
        } else {
            false
        };
        // Consume FULLTEXT / SPATIAL prefix and record which one
        // it was. v7.17.0 Phase 2.2 — FULLTEXT routes through a
        // dedicated TableConstraint variant so the engine can
        // build a tsvector-GIN; SPATIAL still has no matching
        // AM, so it falls back to accept-as-no-op.
        let mut is_fulltext = false;
        let mut is_spatial = false;
        if let Token::Ident(s) = self.peek().clone() {
            if s.eq_ignore_ascii_case("fulltext") {
                self.advance();
                is_fulltext = true;
            } else if s.eq_ignore_ascii_case("spatial") {
                self.advance();
                is_spatial = true;
            }
        }
        // KEY / INDEX keyword. `INDEX` lexes as Token::Index
        // (reserved); accept either token shape.
        match self.peek() {
            Token::Index => {
                self.advance();
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("key") || s.eq_ignore_ascii_case("index") => {
                self.advance();
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected KEY/INDEX in inline index declaration, got {other:?}"
                )));
            }
        }
        // Optional index name (an ident before the `(`).
        // v7.15.0 — capture the name when present so the engine
        // builds the secondary index under the user's chosen
        // name (matches mysqldump's `KEY idx_x (col)` shape).
        let mut idx_name: Option<String> = None;
        if matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            if let Token::Ident(s) | Token::QuotedIdent(s) = self.advance() {
                idx_name = Some(s);
            }
        }
        // Optional `USING BTREE` / `USING HASH` (MySQL).
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            self.advance();
            if matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_)) {
                self.advance();
            }
        }
        // Required column list `(col [, col]*)`.
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' in inline KEY/INDEX, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut cols: Vec<String> = Vec::new();
        while let Token::Ident(s) | Token::QuotedIdent(s) = self.peek().clone() {
            self.advance();
            cols.push(s);
            // Skip optional `(length)` per-column prefix.
            if matches!(self.peek(), Token::LParen) {
                let mut depth = 1usize;
                self.advance();
                while depth > 0 {
                    match self.peek() {
                        Token::LParen => depth += 1,
                        Token::RParen => depth -= 1,
                        Token::Eof => break,
                        _ => {}
                    }
                    self.advance();
                }
            }
            // Skip optional ASC / DESC.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("asc") || s.eq_ignore_ascii_case("desc"))
                || matches!(self.peek(), Token::Asc | Token::Desc)
            {
                self.advance();
            }
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        if matches!(self.peek(), Token::RParen) {
            self.advance();
        }
        // Trailing options on the inline index — comment / etc.
        // Skip until comma or `)`.
        while !matches!(self.peek(), Token::Comma | Token::RParen | Token::Eof) {
            self.advance();
        }
        if cols.is_empty() {
            return Ok(None);
        }
        if is_unique {
            // Carry the captured idx_name on UNIQUE too so future
            // engine work can name the underlying BTree
            // accordingly; today the unique-constraint installer
            // synthesises the name itself, but Display round-trip
            // benefits from preserving it.
            Ok(Some(crate::ast::TableConstraint::Unique {
                name: idx_name,
                columns: cols,
                nulls_not_distinct: false,
                // MySQL inline UNIQUE KEY has no deferral vocabulary.
                deferrable: false,
                initially_deferred: false,
            }))
        } else if is_fulltext {
            // v7.17.0 Phase 2.2 — MySQL `FULLTEXT KEY` now
            // routes through `TableConstraint::FulltextIndex`;
            // the engine builds a tsvector-GIN over each named
            // column so MATCH AGAINST gets a real inverted
            // index instead of a silently-dropped declaration.
            Ok(Some(crate::ast::TableConstraint::FulltextIndex {
                name: idx_name,
                columns: cols,
            }))
        } else if is_spatial {
            // SPG has no native SPATIAL AM. Accept-as-no-op
            // (declaration is parsed, but no index is built).
            Ok(None)
        } else {
            // v7.15.0 — plain KEY / INDEX builds a real BTree
            // secondary index.
            Ok(Some(crate::ast::TableConstraint::Index {
                name: idx_name,
                columns: cols,
            }))
        }
    }

    /// v7.14.0 — consume MySQL/MariaDB table-options tail after
    /// the closing `)`: ENGINE=..., DEFAULT CHARSET=...,
    /// COLLATE=..., AUTO_INCREMENT=N, ROW_FORMAT=..., COMMENT='...'
    /// (in any order, separated by whitespace).
    /// v7.38 (read01 P6.55) — consume and discard a PG `WITH (opt=val, …)`
    /// storage-parameter clause on CREATE TABLE. SPG has no per-table
    /// reloptions; accepting them keeps pg_dump restores working. `WITH` is a
    /// bare ident here, and only the parenthesised form is reloptions (so this
    /// never eats a `WITH DATA` / `WITH CHECK OPTION` trailer).
    fn consume_with_reloptions(&mut self) {
        let is_with = matches!(
            self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("with")
        );
        if !is_with || !matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) {
            return;
        }
        self.advance(); // WITH
        self.advance(); // (
        let mut depth = 1u32;
        while depth > 0 && !matches!(self.peek(), Token::Eof) {
            match self.peek() {
                Token::LParen => depth += 1,
                Token::RParen => depth -= 1,
                _ => {}
            }
            self.advance();
        }
    }

    fn consume_mysql_table_options(&mut self) {
        loop {
            // Heuristic: a table option is an ident (or `DEFAULT`
            // reserved keyword) followed by `=` and an
            // ident / string / integer.
            let name_lc = match self.peek().clone() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                Token::Default => alloc::string::String::from("default"),
                _ => break,
            };
            let known = matches!(
                name_lc.as_str(),
                "engine"
                    | "default"
                    | "charset"
                    | "collate"
                    | "auto_increment"
                    | "row_format"
                    | "comment"
                    | "pack_keys"
                    | "stats_persistent"
                    | "stats_auto_recalc"
                    | "stats_sample_pages"
                    | "key_block_size"
                    | "tablespace"
                    | "min_rows"
                    | "max_rows"
                    | "checksum"
                    | "delay_key_write"
                    | "insert_method"
                    | "data"
                    | "index"
                    | "encryption"
                    | "compression"
            );
            if !known {
                break;
            }
            self.advance(); // option name
            // `DEFAULT` optional prefix is followed by `CHARSET` /
            // `COLLATE`; consume the next ident too.
            if name_lc == "default" {
                if matches!(self.peek(), Token::Ident(_) | Token::QuotedIdent(_)) {
                    self.advance();
                }
            }
            if matches!(self.peek(), Token::Eq) {
                self.advance();
            }
            match self.peek() {
                Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_) | Token::Integer(_) => {
                    self.advance();
                }
                _ => {}
            }
        }
    }

    /// v7.9.18 — true when the next tokens are `PRIMARY KEY (…)`.
    /// PRIMARY and KEY are bare idents; we look-ahead 2 to be
    /// sure (otherwise a column literally named `primary` would
    /// be mistaken).
    fn peek_table_level_pk_start(&self) -> bool {
        let cur = self.peek();
        let nxt = self.tokens.get(self.pos + 1);
        let nxt2 = self.tokens.get(self.pos + 2);
        let is_primary = matches!(cur, Token::Ident(s) if s.eq_ignore_ascii_case("primary"));
        let is_key = matches!(nxt, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("key"));
        let is_lparen = matches!(nxt2, Some(Token::LParen));
        is_primary && is_key && is_lparen
    }

    /// v7.9.18 — true when the next tokens are `UNIQUE (…)`.
    /// v7.13.0 — also matches `UNIQUE NULLS [NOT] DISTINCT (…)`
    /// (mailrs round-5 G10).
    fn peek_table_level_unique_start(&self) -> bool {
        let cur = self.peek();
        let is_unique = matches!(cur, Token::Ident(s) if s.eq_ignore_ascii_case("unique"));
        if !is_unique {
            return false;
        }
        let n1 = self.tokens.get(self.pos + 1);
        // Plain `UNIQUE (…)`.
        if matches!(n1, Some(Token::LParen)) {
            return true;
        }
        // `UNIQUE NULLS [NOT] DISTINCT (…)`.
        let is_nulls = matches!(n1, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("nulls"));
        if !is_nulls {
            return false;
        }
        let n2 = self.tokens.get(self.pos + 2);
        let n3 = self.tokens.get(self.pos + 3);
        let n4 = self.tokens.get(self.pos + 4);
        // `UNIQUE NULLS DISTINCT (…)` — 4 tokens before `(`.
        if matches!(n2, Some(Token::Distinct)) && matches!(n3, Some(Token::LParen)) {
            return true;
        }
        // `UNIQUE NULLS NOT DISTINCT (…)` — 5 tokens before `(`.
        if matches!(n2, Some(Token::Not))
            && matches!(n3, Some(Token::Distinct))
            && matches!(n4, Some(Token::LParen))
        {
            return true;
        }
        false
    }

    fn parse_table_level_primary_key(&mut self) -> Result<crate::ast::TableConstraint, ParseError> {
        self.advance(); // PRIMARY
        self.advance(); // KEY
        let columns = self.parse_paren_ident_list("PRIMARY KEY")?;
        // v7.39 (round 711) — the trailer's values are CARRIED now; round
        // 621 consumed and dropped them (the storing half of F08).
        let (deferrable, initially_deferred) = self.consume_deferrable_clauses_timed()?;
        Ok(crate::ast::TableConstraint::PrimaryKey {
            name: None,
            columns,
            deferrable,
            initially_deferred,
        })
    }

    fn parse_table_level_unique(&mut self) -> Result<crate::ast::TableConstraint, ParseError> {
        self.advance(); // UNIQUE
        // v7.13.0 — optional `NULLS NOT DISTINCT` modifier
        // (mailrs round-5 G10, PG 15+ surface). Default behaviour
        // is `NULLS DISTINCT` per the SQL standard.
        let mut nulls_not_distinct = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nulls")) {
            let n1 = self.tokens.get(self.pos + 1);
            let n2 = self.tokens.get(self.pos + 2);
            let is_not = matches!(n1, Some(Token::Not));
            let is_distinct = matches!(n2, Some(Token::Distinct));
            if is_not && is_distinct {
                self.advance(); // NULLS
                self.advance(); // NOT
                self.advance(); // DISTINCT
                nulls_not_distinct = true;
            } else if matches!(n1, Some(Token::Distinct)) {
                self.advance(); // NULLS
                self.advance(); // DISTINCT
            }
        }
        let columns = self.parse_paren_ident_list("UNIQUE")?;
        let (deferrable, initially_deferred) = self.consume_deferrable_clauses_timed()?;
        Ok(crate::ast::TableConstraint::Unique {
            name: None,
            columns,
            nulls_not_distinct,
            deferrable,
            initially_deferred,
        })
    }

    /// v7.13.0 — table-level `CHECK (<expr>)` constraint
    /// (mailrs round-5 G3). Consumes `CHECK` then a parenthesised
    /// expression.
    /// v7.39 (round 210) — `EXCLUDE [USING <method>] ( <col> WITH <op>
    /// [, <col> WITH <op>]* ) [WHERE (...)]`. The operator is read as a
    /// standalone token spelling (`&&`, `=`, `@>`, `<@`, `&<`, `&>`).
    /// v7.39 (round 652) — the optional `NOT VALID` suffix on a
    /// constraint added by ALTER TABLE. `NOT` alone is not enough to
    /// commit: `NOT` starts no other suffix here, but reading both
    /// tokens before advancing keeps the caller's error message intact
    /// if someone writes `NOT NULL` by mistake.
    fn parse_not_valid_suffix(&mut self) -> bool {
        if !matches!(self.peek(), Token::Not) {
            return false;
        }
        if !matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("valid"))
        {
            return false;
        }
        self.advance();
        self.advance();
        true
    }

    fn parse_table_level_exclude(&mut self) -> Result<crate::ast::TableConstraint, ParseError> {
        self.advance(); // EXCLUDE
        // Optional `USING <method>`.
        let mut method = None;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            self.advance();
            method = Some(match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                other => {
                    return Err(self.err(alloc::format!(
                        "expected index method after USING, got {other:?}"
                    )));
                }
            });
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after EXCLUDE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut elements: Vec<(String, String)> = Vec::new();
        loop {
            let col = match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) => s,
                other => {
                    return Err(self.err(alloc::format!(
                        "expected column name in EXCLUDE, got {other:?}"
                    )));
                }
            };
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
                return Err(self.err(alloc::format!(
                    "expected WITH after EXCLUDE column, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let op = match self.advance() {
                Token::InetOverlap => String::from("&&"),
                Token::Intersects => String::from("?#"),
                Token::IsBelow => String::from("<^"),
                Token::IsAbove => String::from(">^"),
                Token::PatternLt => String::from("~<~"),
                Token::PatternLtEq => String::from("~<=~"),
                Token::PatternGt => String::from("~>~"),
                Token::PatternGtEq => String::from("~>=~"),
                Token::TsMatchOld => String::from("@@@"),
                Token::Eq => String::from("="),
                Token::JsonContains => String::from("@>"),
                Token::JsonContainedBy => String::from("<@"),
                Token::OverLeft => String::from("&<"),
                Token::OverRight => String::from("&>"),
                other => {
                    return Err(self.err(alloc::format!(
                        "unsupported EXCLUDE operator {other:?} (SPG supports &&, =, @>, <@, &<, &>)"
                    )));
                }
            };
            elements.push((col, op));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close EXCLUDE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(crate::ast::TableConstraint::Exclude {
            name: None,
            method,
            elements,
        })
    }

    fn parse_table_level_check(&mut self) -> Result<crate::ast::TableConstraint, ParseError> {
        self.advance(); // CHECK
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after CHECK, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let expr = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close CHECK predicate, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // A CHECK written inside CREATE TABLE cannot be NOT VALID: there
        // are no existing rows for PG to skip, so it rejects the suffix.
        Ok(crate::ast::TableConstraint::Check {
            name: None,
            expr,
            not_valid: false,
        })
    }

    /// v7.13.0 — `true` when the next token is `CHECK` (a bare ident).
    fn peek_table_level_check_start(&self) -> bool {
        matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("check"))
    }

    /// v7.22 (round-13 gap 5) — `Some(kind)` when the next tokens are
    /// `CONSTRAINT <name> { CHECK | UNIQUE | PRIMARY }`. FOREIGN stays
    /// on the dedicated FK path (`parse_table_level_fk` consumes its
    /// own CONSTRAINT prefix).
    fn peek_named_table_constraint_kind(&self) -> Option<NamedTableConstraintKind> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint")) {
            return None;
        }
        // tokens[pos+1] is the constraint name (any ident-like);
        // tokens[pos+2] is the kind keyword.
        match self.tokens.get(self.pos + 2) {
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("check") => {
                Some(NamedTableConstraintKind::Check)
            }
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("unique") => {
                Some(NamedTableConstraintKind::Unique)
            }
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("primary") => {
                Some(NamedTableConstraintKind::PrimaryKey)
            }
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exclude") => {
                Some(NamedTableConstraintKind::Exclude)
            }
            _ => None,
        }
    }

    fn parse_paren_ident_list(&mut self, ctx: &str) -> Result<Vec<String>, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after {ctx}, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut out = Vec::new();
        loop {
            out.push(self.expect_ident_like()?);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected ',' or ')' in {ctx} list, got {other:?}"
                    )));
                }
            }
        }
        if out.is_empty() {
            return Err(self.err(alloc::format!("{ctx} requires at least one column")));
        }
        Ok(out)
    }

    /// v7.6.0 — true when the next tokens are `CONSTRAINT <name>
    /// FOREIGN KEY` or bare `FOREIGN KEY`. Both introduce a
    /// table-level FK; a column def never starts with either keyword
    /// (column names are not in this reserved set).
    fn peek_constraint_or_fk_start(&self) -> bool {
        let is_constraint_kw = matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("constraint")
        );
        let is_foreign_kw = matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("foreign")
        );
        is_constraint_kw || is_foreign_kw
    }

    /// v7.6.0 — parse a table-level FK clause:
    /// `[CONSTRAINT <name>] FOREIGN KEY (<col>[,<col>]*) REFERENCES
    /// <tbl> [(<pcol>[,<pcol>]*)] [ON DELETE <action>] [ON UPDATE <action>]`.
    fn parse_table_level_fk(&mut self) -> Result<ForeignKeyConstraint, ParseError> {
        let mut name: Option<String> = None;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint")) {
            self.advance();
            name = Some(self.expect_ident_like()?);
        }
        // `FOREIGN`
        match self.advance() {
            Token::Ident(s) if s.eq_ignore_ascii_case("foreign") => {}
            other => return Err(self.err(format!("expected FOREIGN, got {other:?}"))),
        }
        // `KEY`
        match self.advance() {
            Token::Ident(s) if s.eq_ignore_ascii_case("key") => {}
            other => return Err(self.err(format!("expected KEY after FOREIGN, got {other:?}"))),
        }
        // `(col, col, ...)`
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' after FOREIGN KEY, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut columns = Vec::new();
        loop {
            columns.push(self.expect_ident_like()?);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(self.err(format!(
                        "expected ',' or ')' in FK column list, got {other:?}"
                    )));
                }
            }
        }
        if columns.is_empty() {
            return Err(self.err("FOREIGN KEY requires at least one column".into()));
        }
        let (
            parent_table,
            parent_columns,
            on_delete,
            on_update,
            match_type,
            deferrable,
            initially_deferred,
        ) = self.parse_references_tail(columns.len())?;
        Ok(ForeignKeyConstraint {
            name,
            columns,
            parent_table,
            parent_columns,
            on_delete,
            on_update,
            match_type,
            deferrable,
            initially_deferred,
        })
    }

    /// v7.6.0 — parse the tail `REFERENCES <tbl> [(<pcol>...)] [ON
    /// DELETE <action>] [ON UPDATE <action>]`. `expected_arity` is
    /// the local column count, used to default the parent column
    /// list when omitted (SQL spec: parent's PK is implied).
    fn parse_references_tail(
        &mut self,
        expected_arity: usize,
    ) -> Result<
        (
            String,
            Vec<String>,
            FkAction,
            FkAction,
            crate::ast::MatchType,
            // v7.39 (round 288) — deferrable, initially_deferred.
            bool,
            bool,
        ),
        ParseError,
    > {
        match self.advance() {
            Token::Ident(s) if s.eq_ignore_ascii_case("references") => {}
            other => return Err(self.err(format!("expected REFERENCES, got {other:?}"))),
        }
        let parent_table = self.expect_ident_like()?;
        let mut parent_columns: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                parent_columns.push(self.expect_ident_like()?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in REFERENCES column list, got {other:?}"
                        )));
                    }
                }
            }
        }
        if !parent_columns.is_empty() && parent_columns.len() != expected_arity {
            return Err(self.err(format!(
                "FK arity mismatch: {} local column(s) vs {} parent column(s)",
                expected_arity,
                parent_columns.len()
            )));
        }
        // Optional `MATCH {SIMPLE | FULL | PARTIAL}`. PG's grammar puts
        // it between the referenced column list and the ON / DEFERRABLE
        // trailers. SPG implements MATCH SIMPLE semantics (the FK check
        // is skipped when any referencing column is NULL), so SIMPLE —
        // the default, and the only spelling pg_dump emits — is accepted
        // as a no-op. MATCH FULL / MATCH PARTIAL need the per-FK
        // mixed-NULL rule, which is not wired yet; reject them honestly
        // rather than silently applying SIMPLE (PG itself errors on
        // MATCH PARTIAL as "not yet implemented").
        let mut match_type = crate::ast::MatchType::Simple;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("match")) {
            self.advance();
            // `FULL` is a reserved keyword token (FULL OUTER JOIN);
            // SIMPLE / PARTIAL arrive as bare identifiers.
            let kind = match self.advance() {
                Token::Full => "FULL".to_string(),
                Token::Ident(s) => s.to_uppercase(),
                other => {
                    return Err(self.err(format!(
                        "expected FULL, PARTIAL or SIMPLE after MATCH, got {other:?}"
                    )));
                }
            };
            match kind.as_str() {
                "SIMPLE" => {} // Default — match_type stays Simple.
                // v7.38 (read01, T29) — MATCH FULL: the check is skipped only
                // when ALL referencing columns are NULL; a mixed-NULL key errors.
                "FULL" => match_type = crate::ast::MatchType::Full,
                "PARTIAL" => {
                    return Err(self.err("MATCH PARTIAL not yet implemented".to_string()));
                }
                _ => {
                    return Err(self.err(format!(
                        "expected FULL, PARTIAL or SIMPLE after MATCH, got {kind}"
                    )));
                }
            }
        }
        // v7.6.7 / v7.17.0 Phase 3.1 — interleave `[NOT] DEFERRABLE
        // [INITIALLY {DEFERRED | IMMEDIATE}]` and `ON DELETE
        // <action>` / `ON UPDATE <action>` in either order. PG /
        // pg_dump emits the timing clause AFTER the ON clauses
        // (`ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED`),
        // but the SQL spec allows either order. We loop over
        // every possible trailer and dispatch on the next token,
        // stopping when nothing matches. Phase 3.1 changes the
        // bare DEFERRABLE form from hard-error to accept-as-
        // immediate; SPG is single-writer with no deferred-
        // constraint window so the runtime semantics are always
        // immediate even when INITIALLY DEFERRED is requested.
        // PG's default referential action (no ON DELETE / ON UPDATE
        // clause) is NO ACTION, not RESTRICT — the two enforce
        // identically in SPG (single-writer, no deferred window; see the
        // shared match arm in constraints.rs) but information_schema.
        // referential_constraints must report NO ACTION to match PG.
        let mut on_delete = FkAction::NoAction;
        let mut on_update = FkAction::NoAction;
        let mut seen_on_delete = false;
        let mut seen_on_update = false;
        let mut deferrable = false;
        let mut initially_deferred = false;
        loop {
            // DEFERRABLE / NOT DEFERRABLE / INITIALLY shapes.
            let before = self.pos;
            let (d, idef) = self.consume_deferrable_clauses_timed()?;
            if self.pos != before {
                deferrable = d;
                initially_deferred = idef;
                continue;
            }
            // ON DELETE / ON UPDATE.
            if !matches!(self.peek(), Token::On) {
                break;
            }
            self.advance();
            let which = self.advance();
            let action = self.parse_fk_action()?;
            match which {
                Token::Ident(ref s) if s.eq_ignore_ascii_case("delete") => {
                    if seen_on_delete {
                        return Err(self.err("ON DELETE specified twice".into()));
                    }
                    seen_on_delete = true;
                    on_delete = action;
                }
                Token::Ident(ref s) if s.eq_ignore_ascii_case("update") => {
                    if seen_on_update {
                        return Err(self.err("ON UPDATE specified twice".into()));
                    }
                    seen_on_update = true;
                    on_update = action;
                }
                other => {
                    return Err(
                        self.err(format!("expected DELETE or UPDATE after ON, got {other:?}"))
                    );
                }
            }
        }
        Ok((
            parent_table,
            parent_columns,
            on_delete,
            on_update,
            match_type,
            deferrable,
            initially_deferred,
        ))
    }

    /// v7.6.0 — parse `CASCADE | RESTRICT | SET NULL | SET DEFAULT |
    /// NO ACTION`.
    fn parse_fk_action(&mut self) -> Result<FkAction, ParseError> {
        match self.advance() {
            Token::Ident(s) if s.eq_ignore_ascii_case("cascade") => Ok(FkAction::Cascade),
            Token::Ident(s) if s.eq_ignore_ascii_case("restrict") => Ok(FkAction::Restrict),
            Token::Ident(s) if s.eq_ignore_ascii_case("set") => match self.advance() {
                Token::Null => Ok(FkAction::SetNull),
                Token::Default => Ok(FkAction::SetDefault),
                other => Err(self.err(format!(
                    "expected NULL or DEFAULT after SET in FK action, got {other:?}"
                ))),
            },
            Token::Ident(s) if s.eq_ignore_ascii_case("no") => match self.advance() {
                Token::Ident(s) if s.eq_ignore_ascii_case("action") => Ok(FkAction::NoAction),
                other => Err(self.err(format!(
                    "expected ACTION after NO in FK action, got {other:?}"
                ))),
            },
            other => Err(self.err(format!(
                "expected CASCADE | RESTRICT | SET NULL | SET DEFAULT | NO ACTION, got {other:?}"
            ))),
        }
    }

    /// Recognise the optional `IF NOT EXISTS` prefix shared by `CREATE
    /// TABLE` and `CREATE INDEX`. Returns `true` if consumed.
    fn consume_if_not_exists(&mut self) -> bool {
        // `IF` arrives as a bare Ident (we don't reserve it because it
        // also appears mid-expression in PG, though we don't support
        // those forms yet).
        let looks_like_if = matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"));
        if !looks_like_if {
            return false;
        }
        // Peek one ahead before committing: only consume IF when it's
        // actually `IF NOT EXISTS`.
        if !matches!(self.tokens.get(self.pos + 1), Some(Token::Not)) {
            return false;
        }
        if !matches!(
            self.tokens.get(self.pos + 2),
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exists")
        ) {
            return false;
        }
        self.advance(); // IF
        self.advance(); // NOT
        self.advance(); // EXISTS
        true
    }

    /// v7.12.4 — `IF EXISTS` modifier for DROP statements.
    /// Consumes IF EXISTS as a pair; returns false otherwise
    /// without consuming any tokens.
    /// v7.39 (RLS) — consume the `ROW LEVEL SECURITY` keyword triple after
    /// ENABLE/DISABLE/FORCE/NO FORCE.
    fn expect_row_level_security(&mut self) -> Result<(), ParseError> {
        for kw in ["row", "level", "security"] {
            if !matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case(kw))
            {
                return Err(self.err(alloc::format!(
                    "expected {} in ROW LEVEL SECURITY, got {:?}",
                    kw.to_ascii_uppercase(),
                    self.peek()
                )));
            }
            self.advance();
        }
        Ok(())
    }

    fn consume_if_exists(&mut self) -> bool {
        let looks_like_if = matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("if"));
        if !looks_like_if {
            return false;
        }
        if !matches!(
            self.tokens.get(self.pos + 1),
            Some(Token::Ident(s)) if s.eq_ignore_ascii_case("exists")
        ) {
            return false;
        }
        self.advance(); // IF
        self.advance(); // EXISTS
        true
    }

    /// v7.9.14 — consume `ASC | DESC | NULLS FIRST | NULLS LAST`
    /// qualifiers after an index column ref. ASC / DESC are
    /// reserved tokens; NULLS / FIRST / LAST are bare idents.
    /// We accept and discard them since single-column BTree
    /// stores rows in natural key order today.
    /// v7.24 (round-16 A) — `NULLS FIRST` / `NULLS LAST` after an
    /// ORDER BY key. Returns None when absent.
    fn parse_optional_nulls_placement(&mut self) -> Result<Option<bool>, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nulls")) {
            return Ok(None);
        }
        self.advance();
        match self.advance() {
            Token::Ident(s) if s.eq_ignore_ascii_case("first") => Ok(Some(true)),
            Token::Ident(s) if s.eq_ignore_ascii_case("last") => Ok(Some(false)),
            other => Err(self.err(alloc::format!(
                "expected FIRST or LAST after NULLS, got {other:?}"
            ))),
        }
    }

    /// v7.39 (round 537) — the per-column ordering clause, REPORTED now
    /// rather than discarded.
    ///
    /// SPG's index does not scan in a direction — column ordering is
    /// intrinsic to the storage — but `pg_indexes.indexdef` is a
    /// reproduction of the DDL, and dropping the clause meant
    /// `CREATE INDEX i ON t (a DESC NULLS LAST)` read back as `(a)`. A
    /// dump lost it, and a schema diff saw drift on every run.
    fn consume_optional_index_column_qualifiers(&mut self) -> crate::ast::IndexColumnOrder {
        let mut order = crate::ast::IndexColumnOrder::default();
        loop {
            match self.peek() {
                Token::Asc => {
                    self.advance();
                }
                Token::Desc => {
                    order.descending = true;
                    self.advance();
                }
                Token::Ident(s) if s.eq_ignore_ascii_case("nulls") => {
                    let look = self.tokens.get(self.pos + 1);
                    if matches!(
                        look,
                        Some(Token::Ident(k)) if k.eq_ignore_ascii_case("first")
                            || k.eq_ignore_ascii_case("last")
                    ) {
                        self.advance();
                        order.nulls_first = Some(matches!(
                            self.advance(),
                            Token::Ident(k) if k.eq_ignore_ascii_case("first")
                        ));
                    } else {
                        break;
                    }
                }
                _ => break,
            }
        }
        order
    }

    fn parse_create_index_stmt_after_create(
        &mut self,
        is_unique: bool,
    ) -> Result<Statement, ParseError> {
        // Caller consumed CREATE (and the optional UNIQUE); we're on INDEX.
        debug_assert!(matches!(self.peek(), Token::Index));
        self.advance();
        // v7.37.17 (17.6 partial) — CONCURRENTLY noise word (PG 8.2+).
        // SPG's CREATE INDEX is synchronous end-to-end today (real
        // CONCURRENTLY variant with restartable scans queues with
        // v7.39 indexes epic), so the modifier has no runtime effect
        // — same accept-and-no-op shape as v7.37.16.5 DETACH
        // PARTITION CONCURRENTLY and v7.37.19.8 REFRESH MATERIALIZED
        // VIEW CONCURRENTLY.
        let mut concurrently = false;
        if matches!(
            self.peek(),
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("concurrently")
        ) {
            self.advance();
            concurrently = true;
        }
        let if_not_exists = self.consume_if_not_exists();
        // v7.39 (read01 round 93) — the index name is optional (PG since
        // forever): `CREATE INDEX ON t (a)` lets the server pick a name.
        // When the token after `[IF NOT EXISTS]` is already `ON`, no name
        // was given; leave it empty and the engine derives a PG-style
        // `<table>_<cols>_idx` name at CREATE time (with collision counter).
        let name = if matches!(self.peek(), Token::On) {
            String::new()
        } else {
            self.expect_ident_like()?
        };
        if !matches!(self.peek(), Token::On) {
            return Err(self.err(format!(
                "expected ON after CREATE INDEX <name>, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let table = self.expect_ident_like()?;
        // Optional `USING <method>` — only recognised method in v2.0 is
        // `hnsw` (a single-layer NSW graph for kNN). `USING` is the bare
        // ident `using` (we don't promote it to a reserved keyword
        // because it isn't reserved anywhere else in our SQL surface).
        let mut method_name: Option<String> = None;
        let method = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            self.advance();
            let m = self.expect_ident_like()?;
            method_name = Some(m.to_ascii_lowercase());
            match m.to_ascii_lowercase().as_str() {
                "hnsw" => IndexMethod::Hnsw,
                "btree" => IndexMethod::BTree,
                "brin" => IndexMethod::Brin,
                // v7.12.3 — real GIN inverted index over `tsvector`.
                // v7.9.26b's `USING gin` → BTree silent fallback is
                // gone; the engine validates that the indexed column
                // is `tsvector` at CREATE INDEX time.
                "gin" => IndexMethod::Gin,
                // v7.9.26b — PG `pg_dump` emits `USING gist` /
                // `USING spgist` / `USING hash` for their built-in
                // AMs that SPG doesn't have a matching
                // implementation for; degrade to BTree on the
                // leading column so the schema loads + the index
                // catalogue stays consistent. Operator pays the
                // planner cost only for the queries that would have
                // used the specialised AM.
                "gist" | "spgist" | "hash" => IndexMethod::BTree,
                // v7.11.3 — pgvector ships both `ivfflat` and
                // `hnsw`. Customers shouldn't have to choose
                // their on-disk index method based on what SPG
                // implements; accept `ivfflat` as a synonym for
                // `hnsw` so PG schemas using either method drop
                // in. The vector distance op (`<->` / `<#>` /
                // `<=>`) at query time still picks the metric.
                "ivfflat" => IndexMethod::Hnsw,
                other => {
                    return Err(self.err(alloc::format!(
                        "unknown index method {other:?}; supported: hnsw, btree, brin, gin (gist/spgist/hash accepted as BTree fallback)"
                    )));
                }
            }
        } else {
            IndexMethod::BTree
        };
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' before indexed column, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v6.8.2 — accept either a bare column ident (legacy) or
        // an expression `fn(col, …)` for expression indexes.
        // Distinguish by peeking the token *after* the current
        // ident: `ident )` is the legacy column-only path;
        // anything else triggers the Pratt expression parser.
        // (`advance()` uses `mem::replace` to nil out the current
        // slot, so we can't save+rewind cleanly — peek-ahead via
        // direct index avoids the mutation.)
        let mut opclass: Option<String> = None;
        let mut key_collation: Option<String> = None;
        let (column, expression): (String, Option<Expr>) = match self.peek().clone() {
            // Single column with `)` immediately after — fast path.
            // v7.9.29 — also: bare column followed by `,` (the
            // multi-column form `(a, b, c)`). Without this branch
            // the leading ident gets pulled into `parse_expr`
            // which then sets `expression = Some(Column(a))` and
            // breaks Display round-trip on the multi-column shape.
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::RParen | Token::Comma)
                ) =>
            {
                self.advance();
                (s, None)
            }
            // v7.9.22 — single column followed by a pgvector
            // opclass ident: `(col vector_cosine_ops)`. mailrs G5.
            // v7.15.0 — capture the opclass instead of discarding
            // it so the engine can dispatch (e.g. `gin_trgm_ops`
            // → real trigram-shingle GIN over a TEXT column).
            // Vector/HNSW opclasses still take their distance
            // metric from the query operator (`<->` / `<#>` /
            // `<=>`), so for those callers the opclass stays
            // informational.
            // v7.22 (mailrs round-13 gap 7) — pg_dump qualifies the
            // opclass: `(embedding public.vector_cosine_ops)`. Strip
            // the schema and dispatch on the bare opclass, the same
            // treatment table/type names get.
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(_) | Token::QuotedIdent(_))
                ) && matches!(self.tokens.get(self.pos + 2), Some(Token::Dot))
                    && matches!(
                        self.tokens.get(self.pos + 3),
                        Some(Token::Ident(op) | Token::QuotedIdent(op))
                            if is_vector_opclass_name(op)
                    ) =>
            {
                self.advance(); // column name
                self.advance(); // schema qualifier
                self.advance(); // dot
                let op_tok = self.advance();
                if let Token::Ident(op) | Token::QuotedIdent(op) = op_tok {
                    opclass = Some(op.to_ascii_lowercase());
                }
                (s, None)
            }
            // r1038 — an operator class is recognised by its POSITION, not
            // by a list of names. It used to be `is_vector_opclass_name`,
            // so `USING gin (doc jsonb_path_ops)` — ordinary PG, and what
            // sentori's migration wrote — was a syntax error while
            // `USING gin (doc)` parsed. Anything sitting between a column
            // name and a `,` `)` ASC DESC NULLS COLLATE is an opclass;
            // two bare identifiers in a row are not valid there otherwise.
            Token::Ident(s) | Token::QuotedIdent(s)
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(op) | Token::QuotedIdent(op))
                        if is_vector_opclass_name(op) || Self::opclass_position_follows(
                            self.tokens.get(self.pos + 2)
                        )
                ) =>
            {
                self.advance(); // column name
                // Capture the opclass token, lower-cased for
                // case-insensitive engine dispatch.
                let op_tok = self.advance();
                if let Token::Ident(op) | Token::QuotedIdent(op) = op_tok {
                    opclass = Some(op.to_ascii_lowercase());
                }
                (s, None)
            }
            Token::Ident(_) | Token::QuotedIdent(_) => {
                // v7.39 (round 538) — an explicit COLLATE on the key,
                // read by LOOKAHEAD because `parse_expr` absorbs the
                // clause as a no-op (SPG orders text by bytes, which is
                // the C collation, so it changes nothing to honour). PG
                // still PRINTS it: an explicitly written `"C"` and the
                // collation a column inherits are different collation
                // OBJECTS even where they sort identically, which is why
                // `(a COLLATE "C")` shows on a C-collation database too.
                if matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(w)) if w.eq_ignore_ascii_case("collate")
                ) {
                    key_collation = match self.tokens.get(self.pos + 2) {
                        Some(Token::Ident(n) | Token::QuotedIdent(n) | Token::String(n)) => {
                            Some(n.clone())
                        }
                        _ => None,
                    };
                }
                let key_expr = self.parse_expr(0)?;
                let primary = extract_first_column(&key_expr).ok_or_else(|| {
                    self.err("expression index key must reference at least one column".into())
                })?;
                (primary, Some(key_expr))
            }
            // v7.37.43-T4 — parenthesised expression index key
            // `CREATE INDEX … ON t ((payload->'bundle'->>'id'))`.
            // PG's CREATE INDEX requires the expression to be in
            // its own parens to disambiguate function calls from
            // column lists, so this `LParen` is the inner open-paren
            // of an expression key. parse_expr handles the recursive
            // descent and consumes the matching `RParen`.
            Token::LParen => {
                let key_expr = self.parse_expr(0)?;
                let primary = extract_first_column(&key_expr).ok_or_else(|| {
                    self.err("expression index key must reference at least one column".into())
                })?;
                (primary, Some(key_expr))
            }
            other => {
                return Err(self.err(format!(
                    "expected column ident or expression, got {other:?}"
                )));
            }
        };
        // v7.9.14 — accept extra comma-separated columns inside
        // the index key parens (`CREATE INDEX … (a, b, c)`).
        // mailrs F2. Each extra column may carry an optional
        // `ASC` / `DESC` / `NULLS FIRST` / `NULLS LAST` clause
        // — parsed and discarded; SPG doesn't honour direction
        // on a BTree index today (column ordering is intrinsic
        // to the storage). v7.10 will widen to genuine composite
        // index keys.
        let mut extra_columns: Vec<String> = Vec::new();
        // The leading column may also have ASC/DESC after it — and that
        // one is the column SPG indexes, so its clause is kept.
        let key_order = self.consume_optional_index_column_qualifiers();
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            let extra = self.expect_ident_like()?;
            let _ = self.consume_optional_index_column_qualifiers();
            extra_columns.push(extra);
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' after indexed column / expression, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v6.8.0 — optional `INCLUDE (col1, col2, …)` clause for
        // index-only-scan annotation. Bare ident (not a reserved
        // keyword) so we test by case-insensitive string match.
        let included_columns = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("include"))
        {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!("expected '(' after INCLUDE, got {:?}", self.peek())));
            }
            self.advance();
            let mut cols = Vec::new();
            loop {
                cols.push(self.expect_ident_like()?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in INCLUDE list, got {other:?}"
                        )));
                    }
                }
            }
            cols
        } else {
            Vec::new()
        };
        // v7.11.3 — accept and discard PG `WITH (k = v, ...)` index
        // storage parameters. pgvector emits `WITH (lists = N)` for
        // ivfflat and `WITH (m = N, ef_construction = M)` for hnsw;
        // SPG's HNSW picks its own parameters today (tunable via
        // env vars), so the WITH clause is informational and dropped.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' after WITH in CREATE INDEX, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            loop {
                if matches!(self.peek(), Token::RParen) {
                    self.advance();
                    break;
                }
                // Drain `key = value` or bare `key` tokens.
                let _ = self.advance(); // key
                if matches!(self.peek(), Token::Eq) {
                    self.advance();
                    let _ = self.advance(); // value (int / string / ident)
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in WITH (…) clause, got {other:?}"
                        )));
                    }
                }
            }
        }
        // v7.39 (read01 round 52) — optional `NULLS [NOT] DISTINCT` (PG 15+),
        // which sits between the key list and the WHERE clause.
        let mut nulls_not_distinct = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nulls")) {
            let n1 = self.tokens.get(self.pos + 1);
            let n2 = self.tokens.get(self.pos + 2);
            if matches!(n1, Some(Token::Not)) && matches!(n2, Some(Token::Distinct)) {
                self.advance(); // NULLS
                self.advance(); // NOT
                self.advance(); // DISTINCT
                nulls_not_distinct = true;
            } else if matches!(n1, Some(Token::Distinct)) {
                self.advance(); // NULLS
                self.advance(); // DISTINCT
            }
        }
        // v6.8.1 — optional `WHERE <expr>` partial-index predicate.
        let partial_predicate = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        // v7.9.29 — UNIQUE on a vector index (HNSW) makes no
        // sense: uniqueness over an ANN structure has no clean
        // semantics. Reject early. (BRIN UNIQUE is similarly
        // meaningless — block both.)
        if is_unique && !matches!(method, IndexMethod::BTree) {
            return Err(self.err(alloc::format!(
                "UNIQUE is only supported on BTree indexes, got USING {:?}",
                method
            )));
        }
        Ok(Statement::CreateIndex(CreateIndexStatement {
            concurrently,
            name,
            key_order,
            key_collation,
            table,
            column,
            nulls_not_distinct,
            method,
            if_not_exists,
            included_columns,
            partial_predicate,
            extra_columns: extra_columns.clone(),
            expression,
            is_unique,
            opclass,
            method_name,
        }))
    }

    /// v7.6.0 — wraps `parse_column_def` and consumes an optional
    /// column-level `REFERENCES ...` clause. The trailing FK is
    /// normalised into table-level shape (single-element columns +
    /// parent_columns) so the engine sees one uniform constraint list.
    fn parse_column_def_with_fk(
        &mut self,
    ) -> Result<(ColumnDef, Option<ForeignKeyConstraint>), ParseError> {
        let col = self.parse_column_def()?;
        // v7.39 (round 308, V29) — an explicitly named inline FK:
        // `col INT CONSTRAINT fk_a REFERENCES tbl(pcol)`. The column-def
        // loop leaves this spelling intact precisely so the name can be
        // kept here; PG reports it in violation messages and matches it
        // in `SET CONSTRAINTS`.
        let declared_name = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint"))
        {
            self.advance();
            Some(self.expect_ident_like()?)
        } else {
            None
        };
        // Inline form: `col INT REFERENCES tbl(pcol) [ON DELETE ...] [ON UPDATE ...]`.
        let inline_references = matches!(
            self.peek(),
            Token::Ident(s) if s.eq_ignore_ascii_case("references")
        );
        if !inline_references {
            return Ok((col, None));
        }
        let (
            parent_table,
            parent_columns,
            on_delete,
            on_update,
            match_type,
            deferrable,
            initially_deferred,
        ) = self.parse_references_tail(1)?;
        let fk = ForeignKeyConstraint {
            name: declared_name,
            columns: vec![col.name.clone()],
            parent_table,
            parent_columns,
            on_delete,
            on_update,
            match_type,
            deferrable,
            initially_deferred,
        };
        Ok((col, Some(fk)))
    }

    /// v7.13.0 — parse a column type (consuming the type ident and
    /// any trailing parameters / `[]`), without surrounding column
    /// constraints. Used by ALTER COLUMN TYPE (mailrs round-5 G8).
    /// Returns the resolved `ColumnTypeName` plus implied
    /// `(auto_increment, not_null)` flags from PG SERIAL family
    /// shorthands — callers that don't expect those (ALTER COLUMN
    /// TYPE) can discard them.
    fn parse_column_type_name(&mut self) -> Result<ColumnTypeName, ParseError> {
        let (ty, _, _, _, _, _, _, _, _, _, _, _) = self.parse_type_with_implied_flags()?;
        Ok(ty)
    }

    #[allow(clippy::type_complexity)]
    fn parse_type_with_implied_flags(
        &mut self,
    ) -> Result<
        (
            ColumnTypeName,
            bool,
            bool,
            Option<String>,
            Collation,
            // v7.39 (round 370, M4 P4a) — was `COLLATE` written explicitly?
            bool,
            // v7.39 (round 676) — the collation NAME as written, which the
            // `Collation` enum above cannot carry.
            Option<String>,
            bool,
            // v7.17.0 Phase 3.P0-36 — MySQL inline ENUM variant
            // list captured at type-parse time. None for all
            // non-ENUM types.
            Option<Vec<String>>,
            // v7.17.0 Phase 3.P0-37 — MySQL inline SET variant
            // list. Distinct from ENUM (subset semantics).
            Option<Vec<String>>,
            // v7.39 (round 386, epic P1) — declared TINYINT / MEDIUMINT
            // width, lost when the type collapses to SmallInt / Int.
            Option<MysqlIntWidth>,
            // v7.39 (round 424) — declared fractional-seconds precision of a
            // MySQL temporal column (bare spelling = 0). None under PG.
            Option<u8>,
        ),
        ParseError,
    > {
        let mut ty_ident = match self.advance() {
            Token::Ident(s) => s,
            // v7.37.5 β-P2 — `INTERVAL` lexes as a reserved keyword
            // (Token::Interval) since v7.9.25 to drive the `INTERVAL
            // '<span>'` literal grammar. As a column type it lands
            // here directly; downstream resolution still uses the
            // canonical lowercase string.
            Token::Interval => "interval".to_string(),
            other => {
                return Err(ParseError {
                    message: format!("expected column type, got {other:?}"),
                    token_pos: self.consumed_pos(),
                });
            }
        };
        // v7.22 (mailrs round-13 gap 4) — schema-qualified type names:
        // pg_dump qualifies extension types (`public.vector(1024)`).
        // SPG is single-namespace; drop the schema and resolve the
        // bare type — same treatment table names already get.
        while matches!(self.peek(), Token::Dot) {
            self.advance();
            ty_ident = self.expect_ident_like()?;
        }
        let mut implied_auto_increment = false;
        let mut implied_not_null = false;
        let mut user_type_ref: Option<String> = None;
        // v7.17.0 Phase 3.P0-36 — MySQL inline ENUM('a','b','c')
        // value list, captured here and bubbled up through the
        // ColumnDef so the engine can attach it to the column
        // schema (and validate INSERT cells against it).
        let mut inline_enum_variants: Option<Vec<String>> = None;
        // v7.17.0 Phase 3.P0-37 — MySQL inline SET variant list.
        let mut inline_set_variants: Option<Vec<String>> = None;
        // v7.39 (round 386, type-fidelity epic P1) — the declared MySQL
        // narrow-int width (TINYINT / MEDIUMINT), captured before the type
        // collapses to SmallInt / Int. Only under the MySQL dialect.
        let mut mysql_int_width: Option<MysqlIntWidth> = None;
        // v7.39 (round 424) — the declared fractional-seconds precision of a
        // MySQL temporal column. Set by the temporal arms below; stays None
        // for PG (whose temporal columns keep full microseconds).
        let mut mysql_fsp: Option<u8> = None;
        let mut ty = match ty_ident.as_str() {
            // PG SERIAL family. Implies NOT NULL + AUTO_INCREMENT.
            "smallserial" | "serial2" => {
                implied_auto_increment = true;
                implied_not_null = true;
                ColumnTypeName::SmallInt
            }
            "serial" | "serial4" => {
                implied_auto_increment = true;
                implied_not_null = true;
                ColumnTypeName::Int
            }
            "bigserial" | "serial8" => {
                implied_auto_increment = true;
                implied_not_null = true;
                ColumnTypeName::BigInt
            }
            // MySQL flavours we accept by aliasing to the closest SPG
            // type. TINYINT covers MySQL's i8 — held inside SMALLINT
            // since SPG doesn't have a dedicated i8. MEDIUMINT (MySQL
            // 24-bit) → INT. UNSIGNED modifiers are consumed below
            // without semantic effect.
            // v7.38 (read01 P4.19-sibling) — `int2` / `int4` / `int8` are
            // PG's internal type names; pg_dump and hand-written PG schemas
            // use them interchangeably with smallint / int / bigint (the cast
            // path already accepted them, only the column grammar didn't).
            "smallint" | "int2" => {
                // v7.14.0 — MySQL display-width on integers
                // (`SMALLINT(5)`, `INT(11)`, `BIGINT(20)`). The
                // parenthesised number is purely cosmetic — it
                // doesn't change storage. Accept + discard.
                self.consume_optional_paren_size();
                ColumnTypeName::SmallInt
            }
            // v7.17.0 Phase 4.3 — MySQL `TINYINT(1)` is the
            // canonical encoding for BOOLEAN. Every MySQL driver
            // (JDBC `tinyInt1isBit=true`, PHP `mysql_field_type`,
            // .NET `MySqlConnection`, sqlx) maps it to bit. Pre-
            // 4.3 SPG classified TINYINT(1) as SmallInt, which
            // gave the customer i16-shaped values where the app
            // expected bool — a Tier-A silent type drift on
            // mysqldump restores. Now: `TINYINT(1)` → Bool;
            // `TINYINT` (no width) and `TINYINT(N)` for N ≠ 1
            // stay SmallInt (the legacy width-agnostic path).
            "tinyint" => {
                let width = self.peek_optional_paren_size_value();
                self.consume_optional_paren_size();
                if width == Some(1) {
                    ColumnTypeName::Bool
                } else {
                    // v7.39 (round 386, epic P1) — TINYINT is i8; record the
                    // lost width so the write path can enforce -128..127.
                    if self.mysql_dialect {
                        mysql_int_width = Some(MysqlIntWidth::Tiny);
                    }
                    ColumnTypeName::SmallInt
                }
            }
            "mediumint" => {
                self.consume_optional_paren_size();
                // v7.39 (round 386, epic P1) — MEDIUMINT is 24-bit; record it.
                if self.mysql_dialect {
                    mysql_int_width = Some(MysqlIntWidth::Medium);
                }
                ColumnTypeName::Int
            }
            "int" | "integer" | "int4" => {
                self.consume_optional_paren_size();
                ColumnTypeName::Int
            }
            "bigint" | "int8" => {
                self.consume_optional_paren_size();
                ColumnTypeName::BigInt
            }
            // v7.13.0 — `DOUBLE PRECISION` (PG canonical spelling)
            // (mailrs round-5 G6). Consume the optional `PRECISION`
            // tail when the type keyword was `double` / `DOUBLE`.
            //
            // v7.39 (round 269) — REAL is 32-bit, not "the same as our
            // FLOAT". `FLOAT(p)` picks the width the way PG does:
            // p in 1..=24 is real, 25..=53 is double precision, and
            // anything else is an error.
            "float" | "double" | "real" => {
                if ty_ident.eq_ignore_ascii_case("double")
                    && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("precision"))
                {
                    self.advance();
                }
                if ty_ident.eq_ignore_ascii_case("real") {
                    // v7.39 (round 274) — the two dialects genuinely
                    // disagree: PG's REAL is 4-byte, MySQL's REAL is a
                    // synonym for DOUBLE (8-byte). Round 269 made REAL
                    // 32-bit globally and thereby narrowed the stored
                    // precision of every MySQL REAL column.
                    if self.mysql_dialect {
                        ColumnTypeName::Float
                    } else {
                        ColumnTypeName::Real
                    }
                } else if ty_ident.eq_ignore_ascii_case("float")
                    && self.mysql_dialect
                    && matches!(self.peek(), Token::LParen)
                    && self.peek_paren_has_comma()
                {
                    // v7.39 (round 360) — MySQL's `FLOAT(m,d)` / `DOUBLE(m,d)`
                    // display form (`FLOAT(10,2)`), which PG has no
                    // equivalent of. It was `syntax error at or near ","`,
                    // so the whole CREATE failed. The digits are a display
                    // hint only; SPG stores the full double.
                    self.consume_optional_paren_size();
                    ColumnTypeName::Float
                } else if ty_ident.eq_ignore_ascii_case("float")
                    && matches!(self.peek(), Token::LParen)
                {
                    // PG words the two bounds differently, and
                    // parse_paren_size already rejects a zero.
                    let p = self.parse_paren_size("FLOAT")?;
                    if p > 53 {
                        return Err(self.err(String::from(
                            "precision for type float must be less than 54 bits",
                        )));
                    }
                    if p <= 24 {
                        ColumnTypeName::Real
                    } else {
                        ColumnTypeName::Float
                    }
                } else {
                    ColumnTypeName::Float
                }
            }
            // v7.13.0 — `FLOAT8` (PG short form) maps the same as FLOAT.
            "float4" => ColumnTypeName::Real,
            "float8" => ColumnTypeName::Float,
            "text" => ColumnTypeName::Text,
            // v7.39 (round 360) — MySQL's sized TEXT and BLOB families.
            // `LONGTEXT`, `BLOB` and `VARBINARY` appear in nearly every
            // real MySQL schema and NONE of them existed: the CREATE
            // failed outright with `type "blob" does not exist`, so the
            // table was never made. The sizes differ only in MySQL's
            // maximum length, which SPG does not cap, so they collapse
            // onto TEXT and BYTEA the way the unsized spellings do.
            "tinytext" | "mediumtext" | "longtext" => ColumnTypeName::Text,
            "blob" | "tinyblob" | "mediumblob" | "longblob" => ColumnTypeName::Bytes,
            // `VARBINARY(n)` / `BINARY(n)` — a length that SPG does not
            // enforce, consumed so the declaration parses.
            "varbinary" | "binary" => {
                self.consume_optional_paren_size();
                ColumnTypeName::Bytes
            }
            "name" => ColumnTypeName::Name,
            "xid" => ColumnTypeName::Xid,
            "oid" => ColumnTypeName::Oid,
            "xid8" => ColumnTypeName::Xid8,
            "bool" | "boolean" => ColumnTypeName::Bool,
            // v7.39 (round 620) — an UNBOUNDED `varchar` is the same type as
            // an unbounded `character varying`, which the arm below has always
            // read as text. Only the short spelling demanded a length, so
            // `CREATE TABLE t (x VARCHAR)` — as ordinary a line of DDL as
            // there is — failed on `VARCHAR type requires (N)` while the long
            // spelling of the same thing was accepted. The same asymmetry
            // round 613 closed on the CAST side, here on the DDL side.
            "varchar" => {
                if matches!(self.peek(), Token::LParen) {
                    ColumnTypeName::Varchar(self.parse_paren_size("VARCHAR")?)
                } else {
                    ColumnTypeName::Text
                }
            }
            // v7.39 (bpchar epic) — bare `char` = char(1), same as bare
            // `character` below (SQL standard).
            "char" => {
                if matches!(self.peek(), Token::LParen) {
                    ColumnTypeName::Char(self.parse_paren_size("CHAR")?)
                } else {
                    ColumnTypeName::Char(1)
                }
            }
            // pg_dump's canonical spellings: `character varying(n)` = varchar,
            // `character(n)` = char, bare `character` = char(1). Unbounded
            // `character varying` maps to text.
            "character" => {
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("varying")) {
                    self.advance();
                    if matches!(self.peek(), Token::LParen) {
                        ColumnTypeName::Varchar(self.parse_paren_size("VARCHAR")?)
                    } else {
                        ColumnTypeName::Text
                    }
                } else if matches!(self.peek(), Token::LParen) {
                    ColumnTypeName::Char(self.parse_paren_size("CHAR")?)
                } else {
                    ColumnTypeName::Char(1)
                }
            }
            "vector" => {
                let dim = self.parse_paren_size("VECTOR")?;
                let encoding = self.parse_optional_vector_encoding()?;
                ColumnTypeName::Vector { dim, encoding }
            }
            // v7.39 (round 345, M5) — `DECIMAL` and `DEC` are the SQL
            // standard's own spellings of NUMERIC, and PG 18.4 accepts both
            // (measured: `DECIMAL(10,2)` and `DEC(5,1)` both report as
            // `numeric`). Only `NUMERIC` parsed, so `CREATE TABLE t (a
            // DECIMAL(10,2))` — how nearly every money column is written,
            // in either dialect — was a syntax error and the table was
            // never created. `FIXED` is MySQL's alias alone, so it is
            // taken only in that dialect.
            "numeric" | "decimal" | "dec" => {
                let (precision, scale) = self.parse_optional_numeric_params()?;
                ColumnTypeName::Numeric(precision, scale)
            }
            "fixed" if self.mysql_dialect => {
                let (precision, scale) = self.parse_optional_numeric_params()?;
                ColumnTypeName::Numeric(precision, scale)
            }
            "date" => ColumnTypeName::Date,
            // MySQL's `DATETIME` is the same domain as standard
            // `TIMESTAMP` — accept both spellings.
            "timestamp" | "datetime" => {
                // pg_dump emits `TIMESTAMP(6) WITH TIME ZONE` — the optional
                // fractional-seconds precision comes BEFORE the `WITH/WITHOUT
                // TIME ZONE` clause, so consume it first.
                // v7.39 (round 424) — under MySQL the precision is SEMANTIC
                // (it truncates on write and pads on render), so capture it;
                // a bare spelling means precision 0 there. PG stores µs always
                // and keeps `None`.
                let n = self.take_optional_paren_size();
                if self.mysql_dialect {
                    mysql_fsp = Some(n.unwrap_or(0).min(6));
                }
                // v7.14.0 — PG canonical `TIMESTAMP WITH TIME ZONE`
                // / `TIMESTAMP WITHOUT TIME ZONE`. pg_dump emits
                // the full form. SPG canonicalises:
                //   - WITH TIME ZONE    → Timestamptz
                //   - WITHOUT TIME ZONE → Timestamp
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
                {
                    self.advance(); // WITH
                    self.advance(); // TIME
                    self.advance(); // ZONE
                    ColumnTypeName::Timestamptz
                } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("without"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
                {
                    self.advance(); // WITHOUT
                    self.advance(); // TIME
                    self.advance(); // ZONE
                    ColumnTypeName::Timestamp
                } else {
                    // A second `(precision)` cannot legally follow, but the
                    // old grammar tolerated it; keep that tolerance.
                    self.consume_optional_paren_size();
                    ColumnTypeName::Timestamp
                }
            }
            // v7.9.2 — `TIMESTAMPTZ` and full PG spelling
            // `TIMESTAMP WITH TIME ZONE`. Same storage as TIMESTAMP;
            // only PG-wire OID differs.
            "timestamptz" => {
                self.consume_optional_paren_size();
                ColumnTypeName::Timestamptz
            }
            // v4.9: JSON / JSONB. Stored as raw text — no parse-time
            // validation. We accept the JSONB spelling too because
            // most PG clients default to it; SPG doesn't distinguish
            // the two (no path-operator perf advantage to model).
            "json" => ColumnTypeName::Json,
            "jsonb" => ColumnTypeName::Jsonb,
            // v7.10.4 — PG `BYTEA` and the SPG `BYTES` alias both
            // surface here. Same storage shape; mapping happens at
            // the engine side via the ColumnTypeName → DataType
            // resolver. Literal forms are handled at coerce_value
            // time so the lexer stays untouched.
            "bytea" | "bytes" => ColumnTypeName::Bytes,
            // v7.17.0 Phase 7 — PG network address types
            // v7.17.0 had a Text-backed fallback here for
            // `inet` / `cidr` / `macaddr`. v7.37.5 ζ-A promoted
            // each to a first-class type; the keywords are
            // bound below in the ζ-A block.
            // v7.12.0 — PG full-text search types. mailrs G-CRIT-3.
            // The actual `to_tsvector` / `@@` / `ts_rank` surface
            // arrives in v7.12.1+; the type itself loads here so
            // mailrs's `scripts/init-schema.sql` runs unmodified.
            "tsvector" => ColumnTypeName::TsVector,
            "tsquery" => ColumnTypeName::TsQuery,
            // v7.17.0 — PG `UUID`. Wire OID 2950. The drop-in PG
            // surface for Django / Rails / Hibernate's default
            // PK pattern.
            "uuid" => ColumnTypeName::Uuid,
            // v7.37.5 β-P2 — PG `INTERVAL` as a column type.
            // Storage = three-field {months, days, micros}, catalog
            // tag 34, FILE_VERSION 48+, wire OID 1186. Prior to this
            // line `INTERVAL` was parser-rejected at CREATE TABLE.
            "interval" => {
                // pg_dump emits field-qualified forms like `INTERVAL DAY TO
                // SECOND` and an optional `(p)` precision. SPG stores the full
                // {months,days,micros}; consume + ignore the qualifier/precision.
                while matches!(self.peek(), Token::To)
                    || matches!(self.peek(), Token::Ident(s) if matches!(
                        s.to_ascii_lowercase().as_str(),
                        "year" | "month" | "day" | "hour" | "minute" | "second"
                    ))
                {
                    self.advance();
                }
                self.consume_optional_paren_size();
                ColumnTypeName::Interval
            }
            // v7.17.0 Phase 3.P0-32 — PG `TIME` (without time zone).
            // i64 microseconds since 00:00:00. Wire OID 1083.
            // pg_dump emits `TIME(6)` and `TIME(6) WITH TIME ZONE`.
            "time" => {
                // v7.39 (round 424) — MySQL TIME carries a semantic
                // fractional-seconds precision, bare meaning 0.
                let n = self.take_optional_paren_size();
                if self.mysql_dialect {
                    mysql_fsp = Some(n.unwrap_or(0).min(6));
                }
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
                {
                    self.advance();
                    self.advance();
                    self.advance();
                    ColumnTypeName::TimeTz
                } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("without"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
                {
                    self.advance();
                    self.advance();
                    self.advance();
                    ColumnTypeName::Time
                } else {
                    ColumnTypeName::Time
                }
            }
            // v7.17.0 Phase 3.P0-33 — MySQL `YEAR`. u16 in
            // 1901..=2155 + zero-year sentinel 0. Wire = INT4.
            "year" => ColumnTypeName::Year,
            // v7.17.0 Phase 3.P0-34 — PG `TIMETZ` / `TIME WITH
            // TIME ZONE`. i64 us + i32 offset_secs. Wire OID 1266.
            "timetz" => ColumnTypeName::TimeTz,
            // v7.17.0 Phase 3.P0-35 — PG `MONEY` — i64 cents.
            // Wire OID 790.
            "money" => ColumnTypeName::Money,
            // v7.17.0 Phase 3.P0-38 — PG range types.
            "int4range" => ColumnTypeName::Range(RangeKindAst::Int4),
            "int8range" => ColumnTypeName::Range(RangeKindAst::Int8),
            "numrange" => ColumnTypeName::Range(RangeKindAst::Num),
            "tsrange" => ColumnTypeName::Range(RangeKindAst::Ts),
            "tstzrange" => ColumnTypeName::Range(RangeKindAst::TsTz),
            "daterange" => ColumnTypeName::Range(RangeKindAst::Date),
            // v7.37.5 δ — PG 14+ multirange keywords.
            "int4multirange" => ColumnTypeName::Multirange(RangeKindAst::Int4),
            "int8multirange" => ColumnTypeName::Multirange(RangeKindAst::Int8),
            "nummultirange" => ColumnTypeName::Multirange(RangeKindAst::Num),
            "tsmultirange" => ColumnTypeName::Multirange(RangeKindAst::Ts),
            "tstzmultirange" => ColumnTypeName::Multirange(RangeKindAst::TsTz),
            "datemultirange" => ColumnTypeName::Multirange(RangeKindAst::Date),
            // v7.37.5 ε — PG geometry scalar keywords.
            "point" => ColumnTypeName::Point,
            "lseg" => ColumnTypeName::Lseg,
            "path" => ColumnTypeName::Path,
            "box" => ColumnTypeName::PgBox,
            "polygon" => ColumnTypeName::Polygon,
            "line" => ColumnTypeName::Line,
            "circle" => ColumnTypeName::Circle,
            // v7.37.5 ζ-A — network / bit / xml / "char" keywords.
            "inet" => ColumnTypeName::Inet,
            "cidr" => ColumnTypeName::Cidr,
            "macaddr" => ColumnTypeName::Macaddr,
            "macaddr8" => ColumnTypeName::Macaddr8,
            // `bit`, `bit(N)`, `bit varying`, `bit varying(N)`. SPG carries the
            // width in the value, so the optional `(N)` typmod is accepted and
            // ignored (the column stores whatever width it's given).
            "bit" => {
                let varying = matches!(
                    self.peek(),
                    Token::Ident(k) if k.eq_ignore_ascii_case("varying")
                );
                if varying {
                    self.advance();
                }
                // v7.39 (round 281) — the length used to be parsed and
                // dropped, so `bit(3)` accepted a five-bit string.
                let n = if matches!(self.peek(), Token::LParen) {
                    self.parse_paren_size("BIT")?
                } else {
                    0
                };
                if varying {
                    ColumnTypeName::BitVarying(n)
                } else {
                    ColumnTypeName::Bit(n)
                }
            }
            "varbit" => {
                let n = if matches!(self.peek(), Token::LParen) {
                    self.parse_paren_size("VARBIT")?
                } else {
                    0
                };
                ColumnTypeName::BitVarying(n)
            }
            "xml" => ColumnTypeName::Xml,
            // v7.17.0 Phase 3.P0-39 — PG hstore extension type.
            "hstore" => ColumnTypeName::Hstore,
            // v7.17.0 Phase 3.P0-36 — MySQL inline ENUM
            // `ENUM('a','b','c')`. Storage is TEXT; the value
            // list lands on `inline_enum_variants` for the
            // engine to validate INSERT cells against. Empty
            // value list is a parse error (matches MySQL).
            "enum" => {
                // Expect the opening `(`.
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after ENUM, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let mut variants: Vec<String> = Vec::new();
                loop {
                    match self.advance() {
                        Token::String(s) => variants.push(s),
                        other => {
                            return Err(self.err(alloc::format!(
                                "ENUM(...) expects string literal variants, got {other:?}"
                            )));
                        }
                    }
                    match self.peek() {
                        Token::Comma => {
                            self.advance();
                            continue;
                        }
                        Token::RParen => {
                            self.advance();
                            break;
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected ',' or ')' in ENUM(...), got {other:?}"
                            )));
                        }
                    }
                }
                if variants.is_empty() {
                    return Err(self.err("ENUM(...) must declare at least one variant".into()));
                }
                inline_enum_variants = Some(variants);
                // Storage is plain TEXT; the variant list lives on
                // the ColumnSchema side.
                ColumnTypeName::Text
            }
            // v7.17.0 Phase 3.P0-37 — MySQL inline SET
            // `SET('a','b','c')`. Same parse shape as ENUM;
            // semantics differ (subset rather than pick-one).
            "set" => {
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after SET, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let mut variants: Vec<String> = Vec::new();
                loop {
                    match self.advance() {
                        Token::String(s) => variants.push(s),
                        other => {
                            return Err(self.err(alloc::format!(
                                "SET(...) expects string literal variants, got {other:?}"
                            )));
                        }
                    }
                    match self.peek() {
                        Token::Comma => {
                            self.advance();
                            continue;
                        }
                        Token::RParen => {
                            self.advance();
                            break;
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected ',' or ')' in SET(...), got {other:?}"
                            )));
                        }
                    }
                }
                if variants.is_empty() {
                    return Err(self.err("SET(...) must declare at least one variant".into()));
                }
                inline_set_variants = Some(variants);
                ColumnTypeName::Text
            }
            _other => {
                // v7.17.0 Phase 1.4 — unknown ident → defer
                // resolution to the engine. Stored as Text in
                // ColumnTypeName + the original name carried as
                // `user_type_ref` so CREATE TABLE can look up
                // user-defined enum / domain types.
                user_type_ref = Some(ty_ident.clone());
                ColumnTypeName::Text
            }
        };
        // v7.17.0 Phase 4.4 — MySQL's `UNSIGNED` modifier sits
        // right after the type keyword. Pre-4.4 SPG consumed +
        // discarded the keyword, leaving a customer column
        // declared `id INT UNSIGNED NOT NULL` silently accepting
        // negative values — a Tier-A correctness drift where
        // application invariants (auto-increment-IDs never
        // negative) silently broke on cutover. Now: capture as
        // a column flag, persist on the schema, enforce at
        // INSERT / UPDATE time.
        let is_unsigned = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("unsigned"))
        {
            self.advance();
            true
        } else {
            false
        };
        // v7.14.0 — mysqldump emits `<type> CHARACTER SET <name>` and
        // `<type> COLLATE <name>` post-fixes on text columns. SPG
        // stores text as UTF-8 always so CHARACTER SET is still a
        // no-op. v7.17.0 Phase 2.5 — COLLATE no longer drops the
        // name: it gets classified into a `Collation` variant the
        // engine consults at WHERE-eval time. PG `default` /
        // `pg_catalog.default` / `C` / `POSIX` collations all
        // resolve to `Binary` (the prior behaviour); `_ci` /
        // `case_insensitive` / `nocase` shift to CaseInsensitive.
        // The schema-qualifier form (`pg_catalog.default`) lexes
        // as `Ident '.' Ident` — peek for the `.` and consume both
        // halves so it's treated as one collation name. PG's
        // `IDENT.IDENT` collation form (which can appear here) is
        // resolved by Collation::from_collation_name on the bare
        // identifier after the dot.
        let mut collation = Collation::Binary;
        // v7.39 (round 370, M4 P4a) — whether an explicit `COLLATE <name>`
        // clause was written. The engine needs this to tell an explicit
        // `COLLATE utf8mb4_bin` (byte-wise) apart from a column with no
        // clause at all: both resolve to `Collation::Binary`, but under the
        // MySQL dialect the latter takes the folding default collation.
        let mut collation_explicit = false;
        let mut collation_name: Option<alloc::string::String> = None;
        loop {
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("character"))
                && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("set"))
            {
                self.advance(); // CHARACTER
                self.advance(); // SET
                if matches!(
                    self.peek(),
                    Token::Ident(_) | Token::QuotedIdent(_) | Token::String(_)
                ) {
                    self.advance();
                }
                continue;
            }
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("collate")) {
                self.advance(); // COLLATE
                // Accept Ident / QuotedIdent / String AND the
                // keyword-tokenised `Default` (PG `pg_catalog.default`
                // and bare `DEFAULT` collation names — `default` is a
                // reserved word so the lexer hands back Token::Default
                // not Token::Ident).
                let read_collation_atom = |this: &mut Self| -> Option<alloc::string::String> {
                    match this.peek().clone() {
                        Token::Ident(s) | Token::QuotedIdent(s) | Token::String(s) => {
                            this.advance();
                            Some(s)
                        }
                        Token::Default => {
                            this.advance();
                            Some(alloc::string::String::from("default"))
                        }
                        _ => None,
                    }
                };
                let raw = if let Some(head) = read_collation_atom(self) {
                    // Schema-qualified PG form: `pg_catalog.default`.
                    if matches!(self.peek(), Token::Dot) {
                        self.advance();
                        let tail = read_collation_atom(self).unwrap_or_default();
                        alloc::format!("{head}.{tail}")
                    } else {
                        head
                    }
                } else {
                    alloc::string::String::new()
                };
                if !raw.is_empty() {
                    collation_explicit = true;
                    // v7.39 (round 676) — keep the name too. The enum below
                    // folds C / POSIX / en_US / default into one value, and
                    // `pg_attribute.attcollation` has to tell them apart.
                    // The schema qualifier goes: PG's `pg_catalog.default`
                    // and a bare `default` name the same collation.
                    // v7.39 (round 679) — strip a SCHEMA qualifier, not an
                    // encoding suffix. Round 676 used `rsplit('.')` for
                    // both, and `COLLATE "en_US.utf8"` came out as `utf8`:
                    // PG writes `pg_catalog.default` (qualifier) and
                    // `en_US.utf8` (locale + encoding) with the same
                    // separator. Only `pg_catalog.` is a qualifier, and it
                    // is the only one PG's own dumps emit.
                    let bare = raw.trim_matches(|c: char| c == '"' || c == '\'');
                    let bare = bare.strip_prefix("pg_catalog.").unwrap_or(bare);
                    collation_name = Some(alloc::string::String::from(bare));
                    let parsed = Collation::from_collation_name(&raw);
                    // Last COLLATE clause wins, but `Binary` from a
                    // bare keyword like `default` should not
                    // silently downgrade a stronger one set earlier
                    // on the same column. v7.17 only ships one
                    // non-Binary variant so a simple OR is enough.
                    if parsed != Collation::Binary {
                        collation = parsed;
                    }
                }
                continue;
            }
            break;
        }
        // v7.10.10 — postfix `[]` widens the base type to its array
        // type. PG accepts `TYPE[]` after any base type and so does
        // SPG now (round-753 probe: INT[] / NUMERIC[] / TIMESTAMP[]
        // all through; the old "only TEXT[]" note was stale).
        if matches!(self.peek(), Token::LBracket) {
            self.advance();
            if !matches!(self.peek(), Token::RBracket) {
                return Err(self.err(alloc::format!(
                    "TEXT[] takes no dimension; got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.11.13 — widened to INT[] and BIGINT[] in addition
            // to TEXT[]. Other base types (BOOL[], NUMERIC[], etc.)
            // still error here.
            ty = match ty {
                ColumnTypeName::Text => ColumnTypeName::TextArray,
                ColumnTypeName::Int => ColumnTypeName::IntArray,
                ColumnTypeName::BigInt => ColumnTypeName::BigIntArray,
                // v7.37.5 β-P4 — INTERVAL[] via the same postfix
                // `[]` grammar. Wire OID 1187.
                ColumnTypeName::Interval => ColumnTypeName::IntervalArray,
                // v7.37.5 γ — full PG array-of-scalar family.
                ColumnTypeName::Bool => ColumnTypeName::BoolArray,
                ColumnTypeName::SmallInt => ColumnTypeName::SmallIntArray,
                ColumnTypeName::Float => ColumnTypeName::FloatArray,
                // NUMERIC(p, s) loses its precision params at the
                // array level (matches PG: `NUMERIC[]` is untyped,
                // per-element precision flows through values).
                ColumnTypeName::Numeric(_, _) => ColumnTypeName::NumericArray,
                ColumnTypeName::Date => ColumnTypeName::DateArray,
                ColumnTypeName::Timestamp => ColumnTypeName::TimestampArray,
                ColumnTypeName::Timestamptz => ColumnTypeName::TimestamptzArray,
                ColumnTypeName::Uuid => ColumnTypeName::UuidArray,
                ColumnTypeName::Json => ColumnTypeName::JsonArray,
                ColumnTypeName::Jsonb => ColumnTypeName::JsonbArray,
                ColumnTypeName::Bytes => ColumnTypeName::BytesArray,
                // VARCHAR(n)[] / CHAR(n)[] drop the length cap at
                // the array level (matches PG semantics where the
                // element precision is per-row, not column-wide).
                ColumnTypeName::Varchar(_) => ColumnTypeName::VarcharArray,
                ColumnTypeName::Char(_) => ColumnTypeName::CharArray,
                // v7.37.5 ζ-A — MONEY[] (OID 791) ship-triage
                // follow-up.
                ColumnTypeName::Money => ColumnTypeName::MoneyArray,
                other => {
                    return Err(self.err(alloc::format!("{other:?}[] not yet supported")));
                }
            };
            // v7.17.0 Phase 3.P0-40 — second `[]` widens 1D → 2D
            // for INT/TEXT/BIGINT. Anything else is an error.
            if matches!(self.peek(), Token::LBracket) {
                self.advance();
                if !matches!(self.peek(), Token::RBracket) {
                    return Err(self.err(alloc::format!(
                        "TYPE[][] second dimension takes no size; got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                ty = match ty {
                    ColumnTypeName::IntArray => ColumnTypeName::IntArray2D,
                    ColumnTypeName::BigIntArray => ColumnTypeName::BigIntArray2D,
                    ColumnTypeName::TextArray => ColumnTypeName::TextArray2D,
                    // v7.39 (read01 round 75) — bool[][].
                    ColumnTypeName::BoolArray => ColumnTypeName::BoolArray2D,
                    other => {
                        return Err(self.err(alloc::format!(
                            "v7.17 2D arrays support INT[][] / BIGINT[][] / \
                             TEXT[][] only; got {other:?}"
                        )));
                    }
                };
            }
        }
        Ok((
            ty,
            implied_auto_increment,
            implied_not_null,
            user_type_ref,
            collation,
            collation_explicit,
            collation_name,
            is_unsigned,
            inline_enum_variants,
            inline_set_variants,
            mysql_int_width,
            mysql_fsp,
        ))
    }

    fn parse_column_def(&mut self) -> Result<ColumnDef, ParseError> {
        // v7.20 — PG reserves the table-constraint keywords, so a
        // BARE `UNIQUE` / `PRIMARY` / … in column position is a
        // malformed constraint clause (e.g. `UNIQUE a` missing its
        // parens), not a column named "unique". Since v7.17's
        // unknown-type leniency (`user_type_ref`) such a clause
        // would otherwise parse as a column with a user-defined
        // type — silently accepting invalid DDL. Quoted
        // identifiers ("unique" / `unique`) remain valid names.
        if let Token::Ident(s) = self.peek()
            && [
                "unique",
                "primary",
                "foreign",
                "constraint",
                "check",
                "references",
                "exclude",
            ]
            .iter()
            .any(|kw| s.eq_ignore_ascii_case(kw))
        {
            return Err(self.err(alloc::format!(
                "unexpected reserved keyword '{s}' at start of column definition \
                 (malformed table constraint?)"
            )));
        }
        let name = self.expect_ident_like()?;
        let (
            ty,
            implied_auto_increment,
            implied_not_null,
            user_type_ref,
            collation,
            collation_explicit,
            collation_name,
            is_unsigned,
            inline_enum_variants,
            inline_set_variants,
            mysql_int_width,
            mysql_fsp,
        ) = self.parse_type_with_implied_flags()?;
        // Column constraints: `DEFAULT <expr>`, `NOT NULL`, and the
        // MySQL-flavoured `AUTO_INCREMENT` may appear in any order;
        // each at most once.
        let mut default: Option<Expr> = None;
        let mut nullable = !implied_not_null;
        let mut nullability_seen = implied_not_null;
        let mut auto_increment = implied_auto_increment;
        let mut is_primary_key = false;
        let mut is_unique = false;
        let mut unique_nulls_not_distinct = false;
        let mut constraint_deferrable = false;
        let mut constraint_initially_deferred = false;
        let mut check: Option<Expr> = None;
        let mut on_update_runtime: Option<Expr> = None;
        let mut generated_stored_expr: Option<Box<Expr>> = None;
        let mut identity_always = false;
        loop {
            // v7.22 (mailrs round-13 gap 3) — PG 18 catalogs
            // not-null constraints by name and pg_dump emits them
            // inline: `id bigint CONSTRAINT contacts_id_not_null1
            // NOT NULL`. Accept and discard the name; whatever
            // constraint follows is parsed by the arms below.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("constraint")) {
                // v7.39 (round 308, V29) — a name on an inline
                // REFERENCES belongs to the FOREIGN KEY, and the caller
                // (`parse_column_def_with_fk`) is what builds it, so
                // leave the whole clause for it. Dropping the name here
                // is what made `CONSTRAINT fk_a REFERENCES …` come back
                // as the synthesised `c_pid_fkey` — which then could
                // not be matched by `SET CONSTRAINTS fk_a`. Peek only:
                // `advance()` takes tokens by `mem::replace`, so there
                // is no rewinding once consumed.
                if matches!(
                    self.tokens.get(self.pos + 2),
                    Some(Token::Ident(s)) if s.eq_ignore_ascii_case("references")
                ) {
                    break;
                }
                self.advance();
                let _name = self.expect_ident_like()?;
                continue;
            }
            // v7.39 (round 379) — MySQL's SHORT generated-column form
            // omits `GENERATED ALWAYS`: `<col> <type> AS (<expr>)
            // [STORED | VIRTUAL]`. mysqldump emits the long form (handled
            // below), but hand-written schemas and app migrations use this.
            // STORED / VIRTUAL is optional (MySQL defaults to VIRTUAL);
            // SPG computes-and-stores either way, like the long form.
            if matches!(self.peek(), Token::As) {
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after AS in a generated column, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let expr = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after AS (<expr>), got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if matches!(self.peek(), Token::Ident(s)
                    if s.eq_ignore_ascii_case("stored") || s.eq_ignore_ascii_case("virtual"))
                {
                    self.advance();
                }
                generated_stored_expr = Some(alloc::boxed::Box::new(expr));
                continue;
            }
            // v7.22 (round-13 T2) — inline `GENERATED { ALWAYS |
            // BY DEFAULT } AS IDENTITY [(seq options)]` (PG 10+;
            // the modern replacement for SERIAL in hand-written
            // schemas). Both flavours map onto the auto-increment
            // machinery — SPG's serial semantics ≈ BY DEFAULT;
            // ALWAYS's reject-explicit-values nuance is documented
            // leniency. Generated EXPRESSION columns
            // (`AS (expr) STORED`) are not supported: error loudly
            // instead of silently storing NULLs.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("generated")) {
                self.advance();
                let mut saw_generated_always = false;
                match self.peek().clone() {
                    Token::Ident(s) if s.eq_ignore_ascii_case("always") => {
                        self.advance();
                        saw_generated_always = true;
                    }
                    Token::Ident(b) | Token::QuotedIdent(b) if b.eq_ignore_ascii_case("by") => {
                        self.advance();
                        if !matches!(self.peek(), Token::Default) {
                            return Err(self.err(alloc::format!(
                                "expected DEFAULT after GENERATED BY, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ALWAYS or BY DEFAULT after GENERATED, got {other:?}"
                        )));
                    }
                }
                if !matches!(self.peek(), Token::As) {
                    return Err(self.err(alloc::format!(
                        "expected AS after GENERATED ALWAYS/BY DEFAULT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                // v7.37.7(sentori Epic 3 P1)— `GENERATED ALWAYS AS
                // ( <expr> ) STORED` stored computed-column. The
                // expression is captured for the engine to recompute
                // on every INSERT / UPDATE. v7.37.7 accepts the
                // STORED keyword only; PG also has VIRTUAL, which
                // v7.37.7 carves out (sentori only uses STORED).
                if matches!(self.peek(), Token::LParen) {
                    self.advance();
                    let expr = self.parse_expr(0)?;
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(alloc::format!(
                            "expected ')' after GENERATED ALWAYS AS (<expr>), got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let stored = match self.peek() {
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("stored") =>
                        {
                            self.advance();
                            true
                        }
                        // v7.38 (read01 P4.14) — accept PG 18's VIRTUAL
                        // generated columns. SPG computes them on write and
                        // persists like STORED; the two are observably
                        // identical for query results (the value, recompute
                        // on base-column change, and NOT NULL enforcement all
                        // match), so a PG 18 schema/dump using VIRTUAL loads
                        // and behaves correctly. The compute-on-read storage
                        // saving is an invisible internal difference.
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if s.eq_ignore_ascii_case("virtual") =>
                        {
                            self.advance();
                            false
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected STORED or VIRTUAL after GENERATED ALWAYS AS (<expr>), \
                                 got {other:?}"
                            )));
                        }
                    };
                    let _ = stored; // STORED / VIRTUAL both compute-and-store.
                    generated_stored_expr = Some(Box::new(expr));
                    continue;
                }
                self.expect_keyword_ident("identity")?;
                // Optional `(START WITH 1 INCREMENT BY 1 …)` —
                // consume the balanced parens and discard (SPG's
                // auto-increment is max+1-scan based).
                if matches!(self.peek(), Token::LParen) {
                    let mut depth = 0usize;
                    loop {
                        match self.advance() {
                            Token::LParen => depth += 1,
                            Token::RParen => {
                                depth -= 1;
                                if depth == 0 {
                                    break;
                                }
                            }
                            Token::Eof => {
                                return Err(self.err(
                                    "unterminated sequence-options parens after IDENTITY".into(),
                                ));
                            }
                            _ => {}
                        }
                    }
                }
                auto_increment = true;
                // v7.38 (read01) — remember the ALWAYS flavour so the engine
                // can reject explicit non-DEFAULT INSERT values (unless
                // OVERRIDING SYSTEM VALUE) the way PG does.
                identity_always = saw_generated_always;
                // PG identity columns are implicitly NOT NULL.
                nullable = false;
                continue;
            }
            // v7.17.0 Phase 2.1 — MySQL `ON UPDATE
            // CURRENT_TIMESTAMP[(N)]`. Only CURRENT_TIMESTAMP
            // is accepted today. The "ON" token is an Ident
            // (not reserved) — peek before consuming.
            if matches!(self.peek(), Token::On)
                && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("update"))
            {
                self.advance(); // ON
                self.advance(); // update
                // Accept CURRENT_TIMESTAMP / CURRENT_TIMESTAMP(N).
                let next = self.peek().clone();
                match next {
                    Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("current_timestamp") =>
                    {
                        self.advance();
                        // Optional `(N)` precision.
                        if matches!(self.peek(), Token::LParen) {
                            self.advance();
                            if !matches!(self.peek(), Token::Integer(_)) {
                                return Err(self.err(alloc::format!(
                                    "expected integer precision inside CURRENT_TIMESTAMP(…), got {:?}",
                                    self.peek()
                                )));
                            }
                            self.advance();
                            if !matches!(self.peek(), Token::RParen) {
                                return Err(self.err(alloc::format!(
                                    "expected ')' after CURRENT_TIMESTAMP precision, got {:?}",
                                    self.peek()
                                )));
                            }
                            self.advance();
                        }
                        on_update_runtime = Some(Expr::FunctionCall {
                            name: "now".into(),
                            args: Vec::new(),
                        });
                        continue;
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "v7.17 only supports ON UPDATE CURRENT_TIMESTAMP, got {other:?}"
                        )));
                    }
                }
            }
            if matches!(self.peek(), Token::Default) {
                if default.is_some() {
                    return Err(self.err("DEFAULT specified twice".into()));
                }
                self.advance();
                default = Some(self.parse_expr(0)?);
                continue;
            }
            // v7.39 (round 621) — `NOT DEFERRABLE` shares this arm's leading
            // token with NOT NULL and sits EARLIER in the loop than the
            // deferrability arm, so without the lookahead it was reported as
            // "NOT NULL specified twice" (or "expected NULL after NOT").
            if matches!(self.peek(), Token::Not)
                && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("deferrable"))
            {
                // NOT DEFERRABLE — explicit immediate; nothing to carry.
                self.consume_optional_deferrable_clauses()?;
                continue;
            }
            if matches!(self.peek(), Token::Not) {
                if nullability_seen {
                    return Err(self.err("NOT NULL specified twice".into()));
                }
                self.advance();
                if !matches!(self.peek(), Token::Null) {
                    return Err(self.err(format!(
                        "expected NULL after NOT in column def, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                nullable = false;
                nullability_seen = true;
                continue;
            }
            // v7.14.0 — MySQL accepts a bare `NULL` as an explicit
            // "this column is nullable" marker (the default in
            // standard SQL anyway). mysqldump emits it routinely
            // (`col TYPE NULL DEFAULT NULL` for nullable
            // timestamps etc). Accept + no-op.
            if matches!(self.peek(), Token::Null) {
                if nullability_seen && !nullable {
                    // v7.39 (round 761, F31 tranche 2 #31) — PG's
                    // sentence, PG18-measured (the table name is the
                    // caller's; the column half is exact).
                    return Err(self.err(alloc::format!(
                        "conflicting NULL/NOT NULL declarations for column \"{name}\""
                    )));
                }
                self.advance();
                nullable = true;
                nullability_seen = true;
                continue;
            }
            // `AUTO_INCREMENT` or its abbreviated form `AUTOINCREMENT`
            // arrives as a bare Ident. Match either, case-insensitive.
            if let Token::Ident(s) = self.peek()
                && (s.eq_ignore_ascii_case("auto_increment")
                    || s.eq_ignore_ascii_case("autoincrement"))
            {
                if auto_increment {
                    return Err(self.err("AUTO_INCREMENT specified twice".into()));
                }
                self.advance();
                auto_increment = true;
                continue;
            }
            // v7.9.13 — inline `PRIMARY KEY` column constraint
            // (mailrs F1). Implies `NOT NULL`. The engine creates
            // a BTree index for the PK column at CREATE TABLE time
            // so FK parent-side index lookups resolve.
            // v7.39 (round 621) — `[NOT] DEFERRABLE [INITIALLY {DEFERRED |
            // IMMEDIATE}]` after an inline PK / UNIQUE / REFERENCES. Every
            // spelling was a parse error, so a pg_dump carrying one stopped
            // mid-restore. The clauses are consumed by the same helper the FK
            // path has used since round 288 and recorded nowhere: SPG enforces
            // the constraint IMMEDIATELY either way, which fails earlier than
            // PG inside a transaction that violates-then-repairs — a refusal,
            // not a wrong answer. True deferral is the open remainder of F08.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("deferrable") || s.eq_ignore_ascii_case("initially"))
                || (matches!(self.peek(), Token::Not)
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s)) if s.eq_ignore_ascii_case("deferrable")))
            {
                // v7.39 (round 711) — CARRIED now (the storing half of
                // F08); round 621 only consumed.
                let (d, idef) = self.consume_deferrable_clauses_timed()?;
                constraint_deferrable |= d;
                constraint_initially_deferred |= idef;
                continue;
            }
            if let Token::Ident(s) = self.peek()
                && s.eq_ignore_ascii_case("primary")
            {
                if is_primary_key {
                    return Err(self.err("PRIMARY KEY specified twice".into()));
                }
                // Peek-ahead for the required `KEY` token.
                let next = self.tokens.get(self.pos + 1);
                let next_is_key = matches!(
                    next,
                    Some(Token::Ident(k)) if k.eq_ignore_ascii_case("key")
                );
                if !next_is_key {
                    return Err(self.err(format!(
                        "expected KEY after PRIMARY in column def, got {:?}",
                        next
                    )));
                }
                self.advance(); // PRIMARY
                self.advance(); // KEY
                is_primary_key = true;
                if nullability_seen && nullable {
                    return Err(self.err(
                        "column declared NULL but inline PRIMARY KEY implies NOT NULL".into(),
                    ));
                }
                nullable = false;
                nullability_seen = true;
                continue;
            }
            // v7.13.0 — inline `UNIQUE` column constraint
            // (mailrs round-5 G2). Fold into a single-column
            // table-level UNIQUE at CREATE TABLE post-process time.
            if let Token::Ident(s) = self.peek()
                && s.eq_ignore_ascii_case("unique")
            {
                if is_unique {
                    return Err(self.err("UNIQUE specified twice".into()));
                }
                self.advance();
                is_unique = true;
                // v7.38 (read01 P4.19) — optional `NULLS [NOT] DISTINCT`
                // (PG 15+); default is NULLS DISTINCT per the SQL standard.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nulls")) {
                    let n1 = self.tokens.get(self.pos + 1);
                    let n2 = self.tokens.get(self.pos + 2);
                    if matches!(n1, Some(Token::Not)) && matches!(n2, Some(Token::Distinct)) {
                        self.advance(); // NULLS
                        self.advance(); // NOT
                        self.advance(); // DISTINCT
                        unique_nulls_not_distinct = true;
                    } else if matches!(n1, Some(Token::Distinct)) {
                        self.advance(); // NULLS
                        self.advance(); // DISTINCT
                    }
                }
                continue;
            }
            // v7.13.0 — inline `CHECK (<expr>)` column constraint
            // (mailrs round-5 G3). PG semantics: column-level
            // CHECK is equivalent to a table-level CHECK. Multiple
            // inline CHECKs on the same column AND together.
            if let Token::Ident(s) = self.peek()
                && s.eq_ignore_ascii_case("check")
            {
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after CHECK in column def, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let pred = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' to close CHECK predicate, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                check = Some(match check.take() {
                    Some(prev) => Expr::Binary {
                        op: BinOp::And,
                        lhs: Box::new(prev),
                        rhs: Box::new(pred),
                    },
                    None => pred,
                });
                continue;
            }
            break;
        }
        Ok(ColumnDef {
            name,
            ty,
            nullable,
            default,
            auto_increment,
            is_primary_key,
            is_unique,
            unique_nulls_not_distinct,
            constraint_deferrable,
            constraint_initially_deferred,
            check,
            user_type_ref,
            on_update_runtime,
            collation,
            collation_explicit,
            collation_name,
            is_unsigned,
            inline_enum_variants,
            inline_set_variants,
            generated_stored_expr,
            identity_always,
            mysql_int_width,
            mysql_fsp,
        })
    }

    /// `NUMERIC` may appear without parameters, with one (precision
    /// only, scale=0), or with both. Returns `(precision, scale)` with
    /// 0 = unspecified for the bare form.
    fn parse_optional_numeric_params(&mut self) -> Result<(u16, i16), ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            // Bare `NUMERIC` — PG treats this as "unlimited precision";
            // we surface it as precision=0 to mean "unconstrained" so
            // the engine doesn't need a separate variant.
            return Ok((0, 0));
        }
        self.advance();
        // v7.39 (round 272) — PG's declared precision runs to 1000, and
        // it words the out-of-range case with the value it saw. SPG
        // capped at 38 (i128's width), so a `numeric(50,10)` column PG
        // accepts failed to parse at all; values wider than i128 are
        // carried by the arbitrary-precision form.
        let precision = match self.advance() {
            Token::Integer(n) if (1..=1000).contains(&n) => {
                u16::try_from(n).expect("range-checked")
            }
            Token::Integer(n) => {
                return Err(ParseError {
                    message: format!("NUMERIC precision {n} must be between 1 and 1000"),
                    token_pos: self.consumed_pos(),
                });
            }
            other => {
                return Err(ParseError {
                    message: format!(
                        "NUMERIC precision must be an integer in 1..=1000, got {other:?}"
                    ),
                    token_pos: self.consumed_pos(),
                });
            }
        };
        // v7.39 (round 273) — PG's declared scale runs -1000..=1000 and is
        // NOT bounded by the precision (`numeric(10,11)` is legal; a value
        // then overflows). A negative scale rounds to tens / hundreds / …
        let scale = if matches!(self.peek(), Token::Comma) {
            self.advance();
            let neg = if matches!(self.peek(), Token::Minus) {
                self.advance();
                true
            } else {
                false
            };
            match self.advance() {
                Token::Integer(n) => {
                    let signed = if neg { -n } else { n };
                    if !(-1000..=1000).contains(&signed) {
                        return Err(ParseError {
                            message: format!(
                                "NUMERIC scale {signed} must be between -1000 and 1000"
                            ),
                            token_pos: self.consumed_pos(),
                        });
                    }
                    i16::try_from(signed).expect("range-checked")
                }
                other => {
                    return Err(ParseError {
                        message: format!("NUMERIC scale must be an integer, got {other:?}"),
                        token_pos: self.consumed_pos(),
                    });
                }
            }
        } else {
            0
        };
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' to close NUMERIC params, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok((precision, scale))
    }

    /// Parse `(N)` where `N` is a positive integer literal — used by the
    /// `VARCHAR`/`CHAR`/`VECTOR` column types. `label` is the type name
    /// for the error message.
    /// v6.0.1: parse the optional `USING <encoding>` clause that
    /// follows `VECTOR(N)` in a column definition. Missing clause
    /// → `VecEncoding::F32` (pre-v6 default). Unknown encoding
    /// ident → `ParseError` listing the encodings recognised today.
    fn parse_optional_vector_encoding(&mut self) -> Result<VecEncoding, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            return Ok(VecEncoding::F32);
        }
        // v7.13.2 — mailrs round-6 S6: `USING` after a vector type
        // overlaps with `ALTER COLUMN TYPE … USING <expr>`. Only
        // consume the token when the very next token is a known
        // vector-encoding keyword (SQ8 / HALF). Otherwise leave
        // `USING` for the caller — it's the rewrite-expression form.
        let n1 = self.tokens.get(self.pos + 1);
        let next_is_encoding = matches!(
            n1,
            Some(Token::Ident(s))
                if s.eq_ignore_ascii_case("sq8") || s.eq_ignore_ascii_case("half")
        );
        if !next_is_encoding {
            return Ok(VecEncoding::F32);
        }
        self.advance();
        let enc_ident = match self.advance() {
            Token::Ident(s) => s,
            other => {
                return Err(self.err(format!(
                    "expected vector encoding after USING, got {other:?}"
                )));
            }
        };
        match enc_ident.to_ascii_lowercase().as_str() {
            "sq8" => Ok(VecEncoding::Sq8),
            // v6.0.3: `HALF` (pgvector convention) selects IEEE-754
            // binary16 per-element storage.
            "half" => Ok(VecEncoding::F16),
            other => Err(self.err(format!(
                "unknown vector encoding {other:?}; supported: SQ8, HALF"
            ))),
        }
    }

    /// v7.17.0 Phase 4.3 — peek at the MySQL display-width
    /// without consuming it. Returns `Some(N)` when the next
    /// tokens are `( <int> )`; None otherwise. Used by the
    /// TINYINT classifier to decide whether to map to Bool or
    /// SmallInt.
    fn peek_optional_paren_size_value(&self) -> Option<i64> {
        if !matches!(self.peek(), Token::LParen) {
            return None;
        }
        let next = self.tokens.get(self.pos + 1)?;
        let n = match next {
            Token::Integer(n) => *n,
            _ => return None,
        };
        if !matches!(self.tokens.get(self.pos + 2), Some(Token::RParen)) {
            return None;
        }
        Some(n)
    }

    /// v7.14.0 — consume an optional MySQL display-width
    /// parenthesised number after an integer type, returning
    /// nothing. `TINYINT(1)` etc.
    /// v7.39 (round 360) — does the parenthesised group ahead contain a
    /// comma, i.e. is it MySQL's `(m,d)` rather than PG's `(p)`?
    fn peek_paren_has_comma(&self) -> bool {
        let mut i = self.pos + 1;
        let mut depth = 1usize;
        while depth > 0 {
            match self.tokens.get(i) {
                Some(Token::LParen) => depth += 1,
                Some(Token::RParen) => depth -= 1,
                Some(Token::Comma) if depth == 1 => return true,
                None | Some(Token::Eof) => return false,
                _ => {}
            }
            i += 1;
        }
        false
    }

    /// v7.39 (round 424) — the same optional `(N)` modifier, but RETURNING
    /// the number. Temporal columns need it: MySQL's `DATETIME(3)` declares a
    /// fractional-seconds precision that drives write truncation and render
    /// padding, where `consume_optional_paren_size` throws it away.
    /// `Some(0)` for an explicit `(0)`, `None` when no modifier is written.
    fn take_optional_paren_size(&mut self) -> Option<u8> {
        let Some(Token::Integer(n)) = self
            .tokens
            .get(self.pos + 1)
            .filter(|_| matches!(self.peek(), Token::LParen))
            .cloned()
        else {
            self.consume_optional_paren_size();
            return None;
        };
        if !matches!(self.tokens.get(self.pos + 2), Some(Token::RParen)) {
            self.consume_optional_paren_size();
            return None;
        }
        self.consume_optional_paren_size();
        u8::try_from(n).ok()
    }

    fn consume_optional_paren_size(&mut self) {
        if !matches!(self.peek(), Token::LParen) {
            return;
        }
        self.advance();
        // Skip until matching RParen (allow nested or any tokens).
        let mut depth = 1usize;
        while depth > 0 {
            match self.peek() {
                Token::LParen => depth += 1,
                Token::RParen => depth -= 1,
                Token::Eof => return,
                _ => {}
            }
            self.advance();
        }
    }

    fn parse_paren_size(&mut self, label: &str) -> Result<u32, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("{label} type requires (N), got {:?}", self.peek())));
        }
        self.advance();
        let n = match self.advance() {
            Token::Integer(n) if n > 0 => u32::try_from(n).map_err(|_| ParseError {
                message: format!("{label} size too large: {n}"),
                token_pos: self.consumed_pos(),
            })?,
            other => {
                return Err(ParseError {
                    message: format!("expected positive integer {label} size, got {other:?}"),
                    token_pos: self.consumed_pos(),
                });
            }
        };
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' after {label} size, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(n)
    }

    /// v7.39 (round 406) — the `ON CONFLICT DO NOTHING` clause that MySQL's
    /// `INSERT IGNORE` lowers to: a bare target (arbitrate on every unique
    /// key, like MySQL) whose action skips conflicting rows.
    /// v7.39 (round 419) — resolve the conflict clause for ANY of the four
    /// INSERT source forms (VALUES / SELECT / parenthesized source / WITH).
    /// Before this the MySQL upsert lowerings (`ON DUPLICATE KEY UPDATE`,
    /// `REPLACE INTO`) were wired into the VALUES branch ONLY, so the very
    /// common bulk-upsert spellings —
    ///     INSERT INTO t SELECT … ON DUPLICATE KEY UPDATE c = VALUES(c)
    ///     REPLACE INTO t SELECT …
    /// — were a parse error / a duplicate-key failure respectively.
    ///
    /// Precedence: an explicitly written clause beats a statement-level flag.
    /// `ON DUPLICATE KEY UPDATE` first, then PG's own `ON CONFLICT`, then the
    /// implicit `REPLACE` and `IGNORE` lowerings.
    fn parse_insert_conflict_clause(
        &mut self,
        replace: bool,
        ignore: bool,
    ) -> Result<Option<crate::ast::OnConflictClause>, ParseError> {
        if let Some(c) = self.parse_optional_on_duplicate_key()? {
            return Ok(Some(c));
        }
        if let Some(c) = self.parse_optional_on_conflict()? {
            return Ok(Some(c));
        }
        if replace {
            // REPLACE INTO = delete-then-insert, which PG spells as
            // `ON CONFLICT DO UPDATE SET` over every column; the engine
            // reads an empty assignment list as "take the incoming row".
            return Ok(Some(crate::ast::OnConflictClause {
                target_columns: Vec::new(),
                index_where: None,
                constraint_name: None,
                mysql_lowered: true,
                action: crate::ast::OnConflictAction::Update {
                    assignments: Vec::new(),
                    where_: None,
                },
            }));
        }
        if ignore {
            return Ok(Some(Self::insert_ignore_clause()));
        }
        Ok(None)
    }

    /// v7.39 (round 419, extracted from the VALUES branch) — MySQL's
    /// `ON DUPLICATE KEY UPDATE col = expr [, …]`. Bare target (MySQL
    /// watches every unique key, which `mysql_lowered` records); `VALUES(col)`
    /// in an assignment is MySQL's spelling of `EXCLUDED.col`.
    fn parse_optional_on_duplicate_key(
        &mut self,
    ) -> Result<Option<crate::ast::OnConflictClause>, ParseError> {
        if !(matches!(self.peek(), Token::On)
            && matches!(self.tokens.get(self.pos + 1),
                Some(Token::Ident(s)) if s.eq_ignore_ascii_case("duplicate")))
        {
            return Ok(None);
        }
        self.advance(); // ON
        self.advance(); // DUPLICATE
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("key")) {
            return Err(self.err(format!(
                "expected KEY after ON DUPLICATE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("update")) {
            return Err(self.err(format!(
                "expected UPDATE after ON DUPLICATE KEY, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut assignments: Vec<(String, Expr)> = Vec::new();
        loop {
            let col = self.expect_ident_like()?;
            if !matches!(self.peek(), Token::Eq) {
                return Err(self.err(format!(
                    "expected '=' in ON DUPLICATE KEY UPDATE, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut expr = self.parse_expr(0)?;
            Self::rewrite_mysql_values_refs(&mut expr);
            assignments.push((col, expr));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        Ok(Some(crate::ast::OnConflictClause {
            target_columns: Vec::new(),
            index_where: None,
            constraint_name: None,
            mysql_lowered: true,
            action: crate::ast::OnConflictAction::Update {
                assignments,
                where_: None,
            },
        }))
    }

    fn insert_ignore_clause() -> crate::ast::OnConflictClause {
        crate::ast::OnConflictClause {
            target_columns: Vec::new(),
            index_where: None,
            constraint_name: None,
            mysql_lowered: true,
            action: crate::ast::OnConflictAction::Nothing,
        }
    }

    fn parse_insert_stmt(&mut self, replace: bool) -> Result<Statement, ParseError> {
        debug_assert!(
            matches!(self.peek(), Token::Insert)
                || (replace
                    && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("replace")))
        );
        self.advance();
        // v7.39 (round 406) — MySQL `INSERT IGNORE INTO t …` skips a row that
        // would raise a duplicate-key error instead of failing the statement,
        // i.e. `ON CONFLICT DO NOTHING` over every unique key. IGNORE is a
        // plain ident to the lexer; only the MySQL dialect accepts it here.
        let ignore = self.mysql_dialect
            && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("ignore"));
        if ignore {
            self.advance();
        }
        if !matches!(self.peek(), Token::Into) {
            return Err(self.err(format!("expected INTO after INSERT, got {:?}", self.peek())));
        }
        self.advance();
        let table = self.expect_ident_like()?;
        // v7.39 (round 240) — `INSERT INTO t AS alias`: PG's insert_target
        // grammar requires the AS keyword here (a bare identifier would be
        // ambiguous with a column list). The alias is what the ON CONFLICT
        // DO UPDATE expressions refer to the target row by.
        let alias = if matches!(self.peek(), Token::As) {
            self.advance();
            Some(self.expect_ident_like()?)
        } else {
            None
        };
        // v7.39 (round 428) — MySQL's SET-form INSERT:
        //     INSERT INTO t SET a = 1, b = 'x'
        // It is exactly `INSERT INTO t (a, b) VALUES (1, 'x')` — omitted
        // columns take their DEFAULT, `SET a = DEFAULT` is legal, and it
        // composes with IGNORE / ON DUPLICATE KEY UPDATE / REPLACE (all
        // measured). So it lowers to the column list + one VALUES row and
        // rejoins the ordinary path, which already handles every one of
        // those. PG has no such spelling, hence the dialect gate.
        if self.mysql_dialect
            && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("set"))
        {
            self.advance(); // SET
            let mut names = Vec::new();
            let mut values = Vec::new();
            loop {
                names.push(self.expect_ident_like()?);
                if !matches!(self.peek(), Token::Eq) {
                    return Err(self.err(alloc::format!(
                        "expected '=' in INSERT … SET, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                // `SET a = DEFAULT` rides the same `__column_default` marker
                // the VALUES-row and UPDATE-SET paths use; the INSERT
                // executor resolves it against the target column.
                if matches!(self.peek(), Token::Default) {
                    self.advance();
                    values.push(Expr::FunctionCall {
                        name: "__column_default".to_string(),
                        args: Vec::new(),
                    });
                } else {
                    values.push(self.parse_expr(0)?);
                }
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            let on_conflict = self.parse_insert_conflict_clause(replace, ignore)?;
            let returning = self.parse_optional_returning()?;
            return Ok(Statement::Insert(InsertStatement {
                ctes: Vec::new(),
                table,
                alias,
                columns: Some(names),
                rows: alloc::vec![values],
                select_source: None,
                // MySQL's SET form has no `OVERRIDING …` clause (that is
                // PG's identity-column spelling).
                overriding: Overriding::None,
                mysql_ignore: ignore,
                on_conflict,
                returning,
            }));
        }
        // Optional column list — `INSERT INTO t (a, b) VALUES ...`.
        // v7.39 (round 151) — a SELECT or WITH right after the paren is
        // a parenthesized query source instead (PG select_with_parens:
        // `INSERT INTO t (SELECT …)` / `INSERT INTO t (WITH … SELECT …)`);
        // both keywords are reserved in PG, so no column list can start
        // with them.
        let columns = if matches!(self.peek(), Token::LParen) {
            self.advance();
            if matches!(self.peek(), Token::Select) || self.peek_is_with_kw() {
                let select_stmt = if self.peek_is_with_kw() {
                    self.advance();
                    self.parse_nested_with_select()?
                } else {
                    match self.parse_select_stmt()? {
                        Statement::Select(s) => s,
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected SELECT in parenthesized INSERT source, got {other:?}"
                            )));
                        }
                    }
                };
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' after parenthesized INSERT source, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let on_conflict = self.parse_insert_conflict_clause(replace, ignore)?;
                let returning = self.parse_optional_returning()?;
                return Ok(Statement::Insert(InsertStatement {
                    ctes: Vec::new(),
                    table,
                    alias: alias.clone(),
                    columns: None,
                    rows: Vec::new(),
                    select_source: Some(Box::new(select_stmt)),
                    on_conflict,
                    returning,
                    overriding: Overriding::None,
                    mysql_ignore: ignore,
                }));
            }
            let mut names = Vec::new();
            loop {
                names.push(self.expect_ident_like()?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in INSERT column list, got {other:?}"
                        )));
                    }
                }
            }
            Some(names)
        } else {
            None
        };
        // PG 10+ `OVERRIDING {SYSTEM | USER} VALUE` — pg_dump emits
        // OVERRIDING SYSTEM VALUE for its identity columns. The clause
        // is captured on the statement so the engine can apply PG's
        // GENERATED ALWAYS / BY DEFAULT interaction (v7.38, read01).
        let overriding = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("overriding"))
        {
            self.advance();
            let which = self.expect_ident_like()?;
            let ov = if which.eq_ignore_ascii_case("system") {
                Overriding::System
            } else if which.eq_ignore_ascii_case("user") {
                Overriding::User
            } else {
                return Err(self.err(format!(
                    "expected SYSTEM or USER after OVERRIDING, got {which:?}"
                )));
            };
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("value")) {
                return Err(self.err(format!(
                    "expected VALUE after OVERRIDING {}, got {:?}",
                    which.to_ascii_uppercase(),
                    self.peek()
                )));
            }
            self.advance();
            ov
        } else {
            Overriding::None
        };
        // `INSERT INTO t DEFAULT VALUES` — a single row made
        // entirely of column defaults. Lower to the permuted
        // column-list path with an empty list: every schema column
        // is unmapped, so the engine fills each from its default
        // (serials advance, plain defaults evaluate, the rest NULL).
        if matches!(self.peek(), Token::Default) {
            self.advance();
            if !matches!(self.peek(), Token::Values) {
                return Err(self.err(format!(
                    "expected VALUES after DEFAULT in INSERT, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            if columns.is_some() {
                return Err(self.err("DEFAULT VALUES cannot follow an INSERT column list".into()));
            }
            let on_conflict = self.parse_insert_conflict_clause(replace, ignore)?;
            let returning = self.parse_optional_returning()?;
            return Ok(Statement::Insert(InsertStatement {
                ctes: Vec::new(),
                table,
                alias: alias.clone(),
                columns: Some(Vec::new()),
                rows: alloc::vec![Vec::new()],
                select_source: None,
                on_conflict,
                returning,
                overriding,
                mysql_ignore: ignore,
            }));
        }
        // v7.13.0 — `INSERT INTO t [(cols)] SELECT …` (mailrs
        // round-5 G4). Dispatch on VALUES vs SELECT. v7.39 (round 151)
        // — a WITH-headed source query (`INSERT INTO t WITH c AS (…)
        // SELECT …`) heads the SOURCE select, as in PG (the statement's
        // own WITH comes before INSERT).
        if matches!(self.peek(), Token::Select) || self.peek_is_with_kw() {
            let select_stmt = if self.peek_is_with_kw() {
                self.advance();
                self.parse_nested_with_select()?
            } else {
                match self.parse_select_stmt()? {
                    Statement::Select(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected SELECT after INSERT INTO ... target, got {other:?}"
                        )));
                    }
                }
            };
            let on_conflict = self.parse_insert_conflict_clause(replace, ignore)?;
            let returning = self.parse_optional_returning()?;
            return Ok(Statement::Insert(InsertStatement {
                ctes: Vec::new(),
                table,
                alias: alias.clone(),
                columns,
                rows: Vec::new(),
                select_source: Some(Box::new(select_stmt)),
                on_conflict,
                returning,
                overriding,
                mysql_ignore: ignore,
            }));
        }
        if !matches!(self.peek(), Token::Values) {
            return Err(self.err(format!(
                "expected VALUES or SELECT after table name, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after VALUES, got {:?}", self.peek())));
        }
        let mut rows = Vec::new();
        loop {
            // Each iteration consumes one `(expr, expr, …)` tuple.
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' for next VALUES tuple, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut tuple = Vec::new();
            loop {
                // v7.38 (read01) — `INSERT INTO t VALUES (…, DEFAULT, …)` uses
                // the column's declared default for that slot. Rides out as the
                // same `__column_default` marker call the UPDATE `SET c = DEFAULT`
                // path uses; the INSERT executor resolves it per target column.
                if matches!(self.peek(), Token::Default) {
                    self.advance();
                    tuple.push(Expr::FunctionCall {
                        name: "__column_default".to_string(),
                        args: Vec::new(),
                    });
                } else {
                    tuple.push(self.parse_expr(0)?);
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected ',' or ')' in VALUES tuple, got {other:?}"
                        )));
                    }
                }
            }
            if tuple.is_empty() {
                return Err(self.err("INSERT VALUES tuple requires at least one value".into()));
            }
            rows.push(tuple);
            // Continue with comma-separated tuples.
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        // MySQL `ON DUPLICATE KEY UPDATE col = expr [, …]` — lowers
        // to ON CONFLICT DO UPDATE with an empty conflict target
        // (the engine picks the table's first unique index, which
        // matches MySQL's any-unique-key behaviour for the common
        // single-key case). `VALUES(col)` in the assignments is
        // MySQL's spelling of EXCLUDED.col.
        let on_conflict = self.parse_insert_conflict_clause(replace, ignore)?;
        let returning = self.parse_optional_returning()?;
        Ok(Statement::Insert(InsertStatement {
            ctes: Vec::new(),
            table,
            alias,
            columns,
            rows,
            select_source: None,
            on_conflict,
            returning,
            overriding,
            mysql_ignore: ignore,
        }))
    }

    /// MySQL's `VALUES(col)` inside ON DUPLICATE KEY UPDATE reads
    /// the incoming row's value — exactly PG's EXCLUDED.col.
    fn rewrite_mysql_values_refs(e: &mut Expr) {
        match e {
            Expr::FunctionCall { name, args }
                if name.eq_ignore_ascii_case("values")
                    && args.len() == 1
                    && matches!(&args[0], Expr::Column(c) if c.qualifier.is_none()) =>
            {
                let Expr::Column(c) = &args[0] else {
                    unreachable!("guarded above");
                };
                *e = Expr::Column(crate::ast::ColumnName {
                    qualifier: Some("EXCLUDED".to_string()),
                    name: c.name.clone(),
                });
            }
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::rewrite_mysql_values_refs(a);
                }
            }
            Expr::Binary { lhs, rhs, .. } => {
                Self::rewrite_mysql_values_refs(lhs);
                Self::rewrite_mysql_values_refs(rhs);
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => {
                Self::rewrite_mysql_values_refs(expr);
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(op) = operand {
                    Self::rewrite_mysql_values_refs(op);
                }
                for (w, t) in branches {
                    Self::rewrite_mysql_values_refs(w);
                    Self::rewrite_mysql_values_refs(t);
                }
                if let Some(el) = else_branch {
                    Self::rewrite_mysql_values_refs(el);
                }
            }
            _ => {}
        }
    }

    /// v7.9.7 — parse the optional `ON CONFLICT (cols) DO …`
    /// clause sitting between the INSERT body and the trailing
    /// RETURNING. All keywords come in as bare idents; `ON` is
    /// a reserved Token though.
    fn parse_optional_on_conflict(
        &mut self,
    ) -> Result<Option<crate::ast::OnConflictClause>, ParseError> {
        if !matches!(self.peek(), Token::On) {
            return Ok(None);
        }
        // Peek further: we want exactly "ON CONFLICT ...". If the
        // next ident isn't "conflict", let some other parser handle.
        let next_is_conflict = matches!(
            self.tokens.get(self.pos + 1),
            Some(Token::Ident(s) | Token::QuotedIdent(s)) if s.eq_ignore_ascii_case("conflict")
        );
        if !next_is_conflict {
            return Ok(None);
        }
        self.advance(); // ON
        self.advance(); // CONFLICT
        // v7.37.17 (17.6 siblings) — `ON CONSTRAINT <name>` names
        // the constraint instead of listing columns (the pg_dump
        // form); the engine resolves it.
        let mut constraint_name: Option<String> = None;
        if matches!(self.peek(), Token::On) {
            self.advance(); // ON
            match self.advance() {
                Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("constraint") => {
                }
                other => {
                    return Err(self.err(alloc::format!(
                        "expected CONSTRAINT after ON CONFLICT ON, got {other:?}"
                    )));
                }
            }
            constraint_name = Some(self.expect_ident_like()?);
        }
        // Optional `(col [, col]*)` target list.
        let mut target_columns: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            loop {
                target_columns.push(self.expect_ident_like()?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => {
                        self.advance();
                        break;
                    }
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in ON CONFLICT target list, got {other:?}"
                        )));
                    }
                }
            }
        }
        // v7.39 (round 240) — optional index predicate after the target
        // list: `ON CONFLICT (col) WHERE pred DO …`. PG uses it to infer a
        // PARTIAL unique index; SPG's arbiters are full indexes, which
        // satisfy any predicate, so it is parsed and carried but not
        // consulted (recorded residual: partial-unique-index arbiters).
        let index_where = if !target_columns.is_empty() && matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        // Required `DO`.
        match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("do") => {}
            other => {
                return Err(self.err(alloc::format!(
                    "expected DO after ON CONFLICT [(…)], got {other:?}"
                )));
            }
        }
        // Action: NOTHING | UPDATE SET …
        let action = match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("nothing") => {
                crate::ast::OnConflictAction::Nothing
            }
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update") => {
                self.parse_on_conflict_update_action()?
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected NOTHING or UPDATE after ON CONFLICT DO, got {other:?}"
                )));
            }
        };
        Ok(Some(crate::ast::OnConflictClause {
            target_columns,
            index_where,
            constraint_name,
            mysql_lowered: false,
            action,
        }))
    }

    /// v7.9.7 — tail of `ON CONFLICT … DO UPDATE`: parse
    /// `SET col = expr [, …] [WHERE cond]`. Caller already
    /// consumed `UPDATE`.
    fn parse_on_conflict_update_action(
        &mut self,
    ) -> Result<crate::ast::OnConflictAction, ParseError> {
        // `SET`
        match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("set") => {}
            other => {
                return Err(self.err(alloc::format!(
                    "expected SET after ON CONFLICT DO UPDATE, got {other:?}"
                )));
            }
        }
        let mut assignments: Vec<(String, Expr)> = Vec::new();
        loop {
            let col = self.expect_ident_like()?;
            if !matches!(self.peek(), Token::Eq) {
                return Err(self.err(alloc::format!(
                    "expected `=` after column in ON CONFLICT DO UPDATE SET, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let value = self.parse_expr(0)?;
            assignments.push((col, value));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        let where_ = if matches!(self.peek(), Token::Where) {
            self.advance();
            Some(self.parse_expr(0)?)
        } else {
            None
        };
        Ok(crate::ast::OnConflictAction::Update {
            assignments,
            where_,
        })
    }

    fn parse_select_list(&mut self) -> Result<Vec<SelectItem>, ParseError> {
        let mut items = Vec::new();
        // v7.39 (round 341, V66) — PG's target list may be EMPTY
        // (`opt_target_list: target_list | /*EMPTY*/`): `SELECT FROM t`
        // answers one zero-column row per row of t, and a bare `SELECT`
        // answers a single zero-column row. SPG required at least one
        // item, so both were syntax errors. Recognised by the token that
        // follows — nothing that can start an expression appears here.
        if self.select_list_is_empty_here() {
            return Ok(items);
        }
        loop {
            items.push(self.parse_select_item()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        Ok(items)
    }

    /// Is the target list empty at this point — i.e. does the next token
    /// end the SELECT's item list rather than start an item?
    fn select_list_is_empty_here(&self) -> bool {
        match self.peek() {
            Token::From
            | Token::Where
            | Token::Group
            | Token::Having
            | Token::Order
            | Token::Limit
            | Token::Offset
            | Token::Semicolon
            | Token::RParen
            | Token::Union
            | Token::Except
            | Token::Eof => true,
            // `FETCH FIRST … ROWS ONLY` and `WINDOW w AS …` are spelled
            // with unreserved keywords, so they arrive as plain idents.
            Token::Ident(s) => {
                s.eq_ignore_ascii_case("fetch")
                    || s.eq_ignore_ascii_case("window")
                    || s.eq_ignore_ascii_case("intersect")
            }
            _ => false,
        }
    }

    fn parse_select_item(&mut self) -> Result<SelectItem, ParseError> {
        if matches!(self.peek(), Token::Star) {
            self.advance();
            return Ok(SelectItem::Wildcard);
        }
        // v7.39 (read01 round 128) — qualified wildcard `qualifier.*`. Intercept
        // BEFORE `parse_expr`, which would treat `q.` as a qualified column and
        // choke on the `*` ("expected identifier, got Star"). The lookahead is
        // `<ident> . *` with nothing binding tighter.
        if let Token::Ident(q) | Token::QuotedIdent(q) = self.peek().clone() {
            if matches!(self.tokens.get(self.pos + 1), Some(Token::Dot))
                && matches!(self.tokens.get(self.pos + 2), Some(Token::Star))
            {
                self.advance(); // qualifier
                self.advance(); // .
                self.advance(); // *
                return Ok(SelectItem::QualifiedWildcard(q));
            }
        }
        let start_tok = self.pos;
        let expr = self.parse_expr(0)?;
        let end_tok = self.consumed_pos();
        // v7.39 (read01 round 69) — `(f(args)).*`: expand the RECORD a
        // multi-column function returns into columns. Marked here and lowered in
        // `parse_bare_select`, where the FROM clause is in hand.
        if matches!(self.peek(), Token::Dot)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Star))
        {
            self.advance(); // .
            self.advance(); // *
            return Ok(SelectItem::Expr {
                expr: Expr::FunctionCall {
                    name: "__record_expand".to_string(),
                    args: alloc::vec![expr],
                },
                alias: None,
            });
        }
        let alias = match self.parse_optional_alias()? {
            Some(a) => Some(a),
            None => self.mysql_item_label(&expr, start_tok, end_tok),
        };
        Ok(SelectItem::Expr { expr, alias })
    }

    /// v7.39 (round 506) — the name MariaDB 11 gives a projection item that
    /// carries no `AS`, filled in here so every downstream path reports it
    /// without knowing the rule. `None` leaves the item un-aliased, which is
    /// what a PG session always gets.
    ///
    /// Measured against MariaDB 11, three rules and no more:
    ///
    /// | item             | label      | why                          |
    /// |------------------|------------|------------------------------|
    /// | `lbl.a`          | `a`        | a column reports its name    |
    /// | `'it''s'`        | `it's`     | a string reports its VALUE   |
    /// | `a  +  b`        | `a  +  b`  | anything else, source text   |
    ///
    /// The third is why this lives in the parser at all: the label is the
    /// text the client WROTE, down to the spacing, so it cannot be printed
    /// back out of the parsed shape. `COUNT( * )` names itself `COUNT( * )`.
    ///
    /// Comments survive, and that is right: through a `mariadb` CLI both
    /// servers answer `a  + b` for `SELECT a /* c */ + b`, but that is the
    /// CLIENT stripping the comment before it sends. Asked over the raw
    /// protocol, MariaDB answers `a /* c */ + b` — byte for byte what this
    /// produces.
    fn mysql_item_label(&self, expr: &Expr, start_tok: usize, end_tok: usize) -> Option<String> {
        if !self.mysql_dialect {
            return None;
        }
        match expr {
            // A column already reports its own name downstream; naming it
            // again here would only re-state the qualifier the label drops.
            Expr::Column(_) => None,
            Expr::Literal(Literal::String(v)) => Some(v.clone()),
            _ => self.source_span(start_tok, end_tok).map(str::to_string),
        }
    }

    /// v7.37.17 (17.6 siblings) — parse `(row), (row), …` after a
    /// consumed VALUES keyword. Each row lowers to a constant SELECT
    /// with PG's default column1..columnN names; subsequent rows
    /// chain as UNION ALL peers. Shared by the FROM-position
    /// `( VALUES … )` arm and the top-level bare VALUES statement.
    fn parse_values_rows_body(&mut self) -> Result<SelectStatement, ParseError> {
        let mut row_selects: Vec<SelectStatement> = Vec::new();
        loop {
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected '(' to start a VALUES row, got {:?}",
                    self.peek()
                )));
            }
            self.advance(); // (
            let mut items: Vec<SelectItem> = Vec::new();
            loop {
                let expr = self.parse_expr(0)?;
                items.push(SelectItem::Expr {
                    expr,
                    alias: Some(alloc::format!("column{}", items.len() + 1)),
                });
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in VALUES row, got {other:?}"
                        )));
                    }
                }
            }
            self.advance(); // )
            row_selects.push(SelectStatement {
                locking: None,
                ctes: Vec::new(),
                distinct: false,
                distinct_on: Vec::new(),
                items,
                from: None,
                where_: None,
                group_by: None,
                group_by_all: false,
                having: None,
                unions: Vec::new(),
                order_by: Vec::new(),
                limit: None,
                offset: None,
                limit_with_ties: false,
                window_check_exprs: Vec::new(),
            });
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        let mut head = row_selects.remove(0);
        head.unions = row_selects
            .into_iter()
            .map(|s| (UnionKind::All, s))
            .collect();
        Ok(head)
    }

    fn parse_table_ref(&mut self) -> Result<TableRef, ParseError> {
        // v7.39 (round 621) — `FROM ONLY <table>` excludes a table's
        // children. It was read as a table NAMED `only`, so the query
        // failed on `relation "only" does not exist`.
        //
        // v7.39 (round 644) — and it is no longer a no-op. Round 621
        // absorbed the keyword, reasoning that SPG's children are
        // separate relations a plain scan does not descend into, so ONLY
        // already described the scan. That stopped being true when a
        // partition parent started unioning its children: measured,
        // `SELECT count(*) FROM ONLY <partitioned parent>` answered 2
        // where PG answers 0. The flag is carried now.
        let mut only = false;
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("only"))
            && matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Ident(_) | Token::QuotedIdent(_))
            )
        {
            only = true;
            self.advance();
        }
        // `LATERAL generate_series(...)` / `LATERAL unnest(...)` —
        // for these SRFs the keyword is noise at parse time: the
        // join executor already substitutes outer-column references
        // into unnest_expr / generate_series_args per outer row
        // (v7.37.43-T4.5 substitute_outer_in_table_ref), and PG
        // licences the correlation even without the keyword. Absorb
        // it and fall through to the SRF arms below.
        // v7.39 (read01 round 69) — `LATERAL <fn>(args)` for ANY function, not
        // just the four builtin SRFs: a user set-returning function on a JOIN's
        // right side is the whole point of LATERAL. The keyword stays noise at
        // parse time — the join executor substitutes the outer row into the
        // call's arguments per outer row.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("lateral"))
            && matches!(
                self.tokens.get(self.pos + 1),
                // The json_each family has its OWN `LATERAL …` arm below, which
                // needs to see the keyword — absorbing it here would send those
                // calls down the generic table-function channel instead.
                Some(Token::Ident(s) | Token::QuotedIdent(s)) if !is_json_each_name(s)
            )
            && matches!(self.tokens.get(self.pos + 2), Some(Token::LParen))
        {
            self.advance(); // LATERAL
        }
        // v7.37.43-T4.5 — `LATERAL jsonb_each_text(<expr>)` —
        // set-returning function whose argument may reference a
        // preceding FROM item. We rewrite this to
        // `LATERAL (SELECT key, value FROM jsonb_each_text(<expr>)
        // AS __srf__) AS <alias>` so the existing LATERAL subquery
        // executor handles per-outer-row evaluation and the
        // SRF-primary jsonb_each_text path handles the inner
        // materialisation. Sentori 0067 backfill is the dogfood
        // shape.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("lateral"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s) | Token::QuotedIdent(s)) if is_json_each_name(s))
            && matches!(self.tokens.get(self.pos + 2), Some(Token::LParen))
        {
            self.advance(); // LATERAL
            let each_fn = match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                _ => unreachable!(),
            };
            self.advance(); // jsonb_each[_text] / json_each[_text]
            self.advance(); // (
            let arg = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after LATERAL {each_fn}() argument, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let alias = alias_ident.clone().unwrap_or_else(|| each_fn.clone());
            // Synthesise: SELECT __srf__.key AS <key_alias>, __srf__.value AS <value_alias>
            //               FROM jsonb_each_text(<arg>) AS __srf__
            // PG's `AS kv(key, value)` column-alias list maps
            // positions to names; default to (key, value) when
            // omitted (matching the SRF's natural column names).
            let srf_alias = "__srf__".to_string();
            let key_alias = column_aliases
                .first()
                .cloned()
                .unwrap_or_else(|| "key".to_string());
            let value_alias = column_aliases
                .get(1)
                .cloned()
                .unwrap_or_else(|| "value".to_string());
            let inner_select = crate::ast::SelectStatement {
                locking: None,
                ctes: Vec::new(),
                distinct: false,
                distinct_on: Vec::new(),
                items: alloc::vec![
                    crate::ast::SelectItem::Expr {
                        expr: crate::ast::Expr::Column(crate::ast::ColumnName {
                            qualifier: Some(srf_alias.clone()),
                            name: "key".to_string(),
                        }),
                        alias: Some(key_alias),
                    },
                    crate::ast::SelectItem::Expr {
                        expr: crate::ast::Expr::Column(crate::ast::ColumnName {
                            qualifier: Some(srf_alias.clone()),
                            name: "value".to_string(),
                        }),
                        alias: Some(value_alias),
                    },
                ],
                from: Some(crate::ast::FromClause {
                    primary: TableRef {
                        name: srf_alias.clone(),
                        alias: Some(srf_alias.clone()),
                        only: false,
                        as_of_segment: None,
                        unnest_expr: None,
                        unnest_column_aliases: Vec::new(),
                        with_ordinality: false,
                        generate_series_args: None,
                        lateral_subquery: None,
                        jsonb_each_text_arg: Some((each_fn, Box::new(arg))),
                        table_fn_call: None,
                        rows_from: None,
                        json_table: None,
                        scalar_fn_item: false,
                    },
                    joins: Vec::new(),
                }),
                where_: None,
                group_by: None,
                group_by_all: false,
                having: None,
                unions: Vec::new(),
                order_by: Vec::new(),
                limit: None,
                offset: None,
                limit_with_ties: false,
                window_check_exprs: Vec::new(),
            };
            return Ok(TableRef {
                name: alias.clone(),
                alias: Some(alias),
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: Vec::new(),
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: Some(Box::new(inner_select)),
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            });
        }
        // v7.37.43-T4.5 — bare `CROSS JOIN jsonb_each_text(t.col)`
        // without an explicit `LATERAL` keyword is the same shape
        // PG accepts (SRF naturally licences lateral correlation).
        // We mirror the LATERAL rewrite when the argument syntactic-
        // ally references an outer column (Column { qualifier:
        // Some(_), … }). For simplicity we apply the rewrite
        // whenever the SRF directly follows JOIN/CROSS JOIN/comma
        // in the FROM-list — caller-side join parsing positions
        // this peek correctly.
        // (Implementation note: detection lives below; the LATERAL
        // branch above already covers the explicit form; the bare
        // form falls through to the plain SRF arm and the engine
        // treats it as a constant-arg SRF if no outer reference is
        // present.)
        // v7.17.0 Phase 3.P0-41 — `LATERAL ( SELECT … )` derived
        // table. Detect at the head so it claims precedence over
        // every other table-ref shape (unnest / generate_series /
        // bare ident); the lateral subquery itself follows the
        // regular SELECT grammar.
        // v7.37.17 (17.6 siblings) — `FROM ( VALUES (…), (…) ) [AS]
        // t(cols)`. Each row lowers to a constant SELECT with PG's
        // default column1..columnN names; subsequent rows chain as
        // UNION ALL peers. The result rides the derived-table
        // lateral_subquery channel — zero executor work.
        if matches!(self.peek(), Token::LParen)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Values))
        {
            self.advance(); // (
            self.advance(); // VALUES
            let head = self.parse_values_rows_body()?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after VALUES list, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| "values".to_string());
            return Ok(TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: column_aliases,
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: Some(Box::new(head)),
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            });
        }
        // v7.37.17 (17.6 siblings) — plain derived table:
        // `FROM ( SELECT … ) [AS] alias`. Rides the same
        // lateral_subquery channel the explicit LATERAL form uses —
        // an uncorrelated inner SELECT executes identically. The
        // inner parse carries UNION tails (they live on
        // SelectStatement.unions).
        // v7.37 D.20 — the derived-table inner may itself be a
        // parenthesized set-operation group (`FROM ((SELECT…) UNION
        // (SELECT…)) s`) or a CTE (`FROM (WITH … SELECT …) z`), not just a
        // bare `(SELECT …)`. parse_one_statement already routes a leading
        // `(` set-op group (its LParen arm) and a leading WITH
        // (parse_with_cte_then_select), so widen the second-token gate to
        // Select | LParen | WITH.
        // v7.39 (round 869) — `Table` joins that gate. `TABLE t` is
        // PG's spelling of `SELECT * FROM t` and is accepted wherever a
        // SELECT is, so `FROM (TABLE t) x` has to parse. The desugaring
        // has existed since the shorthand landed and `parse_bare_select`
        // already routes it ("valid anywhere a SELECT head is"); what was
        // missing is this second-token gate, and the CTE body's dispatch
        // below. Round 868 found both by putting the shorthand in a
        // subquery — the top-level forms had been the only ones tested.
        if matches!(self.peek(), Token::LParen)
            && (matches!(
                self.tokens.get(self.pos + 1),
                Some(Token::Select | Token::LParen | Token::Table)
            ) || matches!(self.tokens.get(self.pos + 1),
                    Some(Token::Ident(s) | Token::QuotedIdent(s)) if s.eq_ignore_ascii_case("with")))
        {
            self.advance(); // (
            let inner = match self.parse_one_statement()? {
                Statement::Select(s) => s,
                other => {
                    return Err(self.err(alloc::format!(
                        "expected SELECT inside derived table ( … ), got {other:?}"
                    )));
                }
            };
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after derived-table subquery, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // `AS t(a, b)` column-alias list rides the
            // unnest_column_aliases field (same positional-rename
            // contract the unnest SRFs use).
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident
                .clone()
                .unwrap_or_else(|| "subquery".to_string());
            return Ok(TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: column_aliases,
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: Some(Box::new(inner)),
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            });
        }
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("lateral"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance(); // LATERAL
            self.advance(); // (
            // Parse the inner SELECT.
            let inner = match self.parse_one_statement()? {
                Statement::Select(s) => s,
                other => {
                    return Err(self.err(alloc::format!(
                        "expected SELECT inside LATERAL ( … ), got {other:?}"
                    )));
                }
            };
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after LATERAL subquery, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.37 D.28 — `LATERAL (…) AS t(cols)` column-alias list (also how a
            // `(VALUES …) t(g)` derived table round-trips through view-body
            // Display, which renders on the lateral_subquery channel).
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| "lateral".to_string());
            return Ok(TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: column_aliases,
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: Some(Box::new(inner)),
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            });
        }
        // v7.37.43-T4.5 — `jsonb_each_text(<expr>)` set-returning
        // function as a FROM item. Emits one row per (key, value)
        // pair in the JSONB object argument as TEXT columns. May
        // be wrapped in CROSS JOIN LATERAL when the argument
        // references a preceding FROM item (sentori migration
        // 0067 backfill shape: `CROSS JOIN LATERAL
        // jsonb_each_text(t.json_col) AS kv(key, value)`).
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if is_json_each_name(s))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            let each_fn = match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                _ => unreachable!(),
            };
            self.advance(); // jsonb_each[_text] / json_each[_text]
            self.advance(); // (
            let arg = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after {each_fn}() argument, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| each_fn.clone());
            return Ok(TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                // `AS t(k, v)` renames key/value positionally, same as the
                // LATERAL-position form already does.
                unnest_column_aliases: column_aliases,
                with_ordinality: false,
                generate_series_args: None,
                lateral_subquery: None,
                jsonb_each_text_arg: Some((each_fn, Box::new(arg))),
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            });
        }
        // `jsonb_to_recordset(J) AS t(a int, b text)` / `jsonb_to_record`
        // (+ json_ variants) — record-returning JSON functions with a
        // column-definition list. Desugar to a derived table that
        // projects each declared column from the JSON via `->>` + a cast,
        // over `jsonb_array_elements(J)` for the *set (per-element) form.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if is_json_to_record_name(s))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            return self.parse_json_to_record_from();
        }
        // v7.38 (T15) — `regexp_matches(s, pat[, flags])` as a FROM item. Each
        // row is a text[] of capture groups, so it cannot desugar to unnest
        // (that would flatten the array). Wrap it as a derived table
        // `(SELECT regexp_matches(args)) AS <alias>(<col>)` — the SELECT-list
        // SRF path already emits one text[] row per match. PG names the column
        // `regexp_matches`; an `AS a(col)` alias overrides it.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("regexp_matches"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance(); // fn name
            self.advance(); // (
            let mut fn_args: Vec<Expr> = Vec::new();
            loop {
                fn_args.push(self.parse_expr(0)?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after regexp_matches() arguments, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.39 (read01 round 78) — WITH ORDINALITY sits BEFORE the alias
            // (`f(x) WITH ORDINALITY AS t(v, o)`), and this arm never looked for
            // it, so it died on the `with` token while every other table function
            // accepted it.
            let with_ordinality = self.absorb_with_ordinality();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let table_alias = alias_ident
                .clone()
                .unwrap_or_else(|| "regexp_matches".to_string());
            // PG names a single-column function's output column after the ALIAS
            // when one is given (`FROM regexp_matches(…) AS m` → column `m`), so
            // `m` reads as that column and not as a whole-row composite. Naming
            // it after the function regardless made `SELECT m[1] FROM … AS m`
            // subscript a record.
            let col_name = column_aliases
                .first()
                .cloned()
                .or_else(|| alias_ident.clone())
                .unwrap_or_else(|| "regexp_matches".to_string());
            let inner = crate::ast::SelectStatement {
                locking: None,
                ctes: Vec::new(),
                distinct: false,
                distinct_on: Vec::new(),
                items: alloc::vec![SelectItem::Expr {
                    expr: Expr::FunctionCall {
                        name: "regexp_matches".to_string(),
                        args: fn_args,
                    },
                    alias: Some(col_name),
                }],
                from: None,
                where_: None,
                group_by: None,
                group_by_all: false,
                having: None,
                unions: Vec::new(),
                order_by: Vec::new(),
                limit: None,
                offset: None,
                limit_with_ties: false,
                window_check_exprs: Vec::new(),
            };
            return Ok(TableRef {
                name: table_alias.clone(),
                alias: Some(table_alias),
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: column_aliases,
                with_ordinality,
                generate_series_args: None,
                lateral_subquery: Some(Box::new(inner)),
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                // regexp_matches returns text[], a base type: `SELECT m FROM
                // regexp_matches(…) AS m` is the array, not a composite wrapping it.
                scalar_fn_item: true,
            });
        }
        // v7.37.17 (17.6 siblings) — `jsonb_array_elements[_text](<expr>)`
        // / json_ variants as a FROM item. Rewritten into
        // `unnest(<same fn>(<expr>))`: the scalar form returns the
        // elements as a TEXT array, and the existing unnest SRF path
        // materialises one row per element. PG's natural column name
        // is `value`; an `AS a(col)` column-alias list overrides it.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("jsonb_array_elements")
                    || s.eq_ignore_ascii_case("json_array_elements")
                    || s.eq_ignore_ascii_case("jsonb_array_elements_text")
                    || s.eq_ignore_ascii_case("json_array_elements_text")
                    || s.eq_ignore_ascii_case("jsonb_object_keys")
                    || s.eq_ignore_ascii_case("json_object_keys")
                    || s.eq_ignore_ascii_case("jsonb_path_query")
                    || s.eq_ignore_ascii_case("json_path_query")
                    || s.eq_ignore_ascii_case("generate_subscripts")
                    || s.eq_ignore_ascii_case("string_to_table")
                    || s.eq_ignore_ascii_case("regexp_split_to_table"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            let fn_name = match self.peek() {
                Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
                _ => unreachable!(),
            };
            self.advance(); // fn name
            self.advance(); // (
            let mut fn_args: Vec<Expr> = Vec::new();
            loop {
                fn_args.push(self.parse_expr(0)?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after {fn_name}() arguments, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let with_ordinality = self.absorb_with_ordinality();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| fn_name.clone());
            // PG's natural column name: the array-elements SRFs
            // declare an OUT parameter `value`; jsonb_object_keys
            // and generate_subscripts have none, so the column is
            // named after the function. A bare table alias on a
            // single-column SRF renames the column too (PG: `FROM
            // generate_subscripts(a, 1) AS s` projects column s) —
            // except for the OUT-parameter SRFs, whose column stays
            // `value` under a bare alias.
            let natural_col = if fn_name.ends_with("_array_elements")
                || fn_name.ends_with("_array_elements_text")
            {
                "value".to_string()
            } else {
                alias_ident.clone().unwrap_or_else(|| fn_name.clone())
            };
            let mut srf_cols = alloc::vec![column_aliases.first().cloned().unwrap_or(natural_col)];
            // Keep any further entries — the second names the
            // ordinality column under WITH ORDINALITY.
            srf_cols.extend(column_aliases.into_iter().skip(1));
            // The *_to_table SRFs are row-streams over the existing
            // *_to_array scalars — map the call target; the display
            // name (alias / column defaults) keeps the SRF spelling.
            let call_name = match fn_name.as_str() {
                "string_to_table" => "string_to_array".to_string(),
                "regexp_split_to_table" => "regexp_split_to_array".to_string(),
                _ => fn_name,
            };
            // v7.38 (read01, T-srf/T-lateral) — an SRF argument that references a
            // preceding FROM item (bare or qualified column) is correlated;
            // route it through the per-outer-row lateral channel.
            let expr = crate::ast::Expr::FunctionCall {
                name: call_name,
                args: fn_args,
            };
            let correlated = Self::expr_has_any_column(&expr);
            let tref = TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: Some(Box::new(expr)),
                unnest_column_aliases: srf_cols,
                with_ordinality,
                generate_series_args: None,
                lateral_subquery: None,
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                // Each of these returns a BASE type (jsonb / text / int), so the item's
                // row type is that scalar: `SELECT j FROM jsonb_array_elements('[1]') j`
                // is `1`, not `(1)`. WITH ORDINALITY makes it a real two-column item.
                scalar_fn_item: !with_ordinality,
            };
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // `ROWS FROM ( srf(args) [, srf(args)]* )` — SQL-standard
        // explicit parallel-zip syntax. Each entry lowers to its
        // array-returning scalar form (unnest(x) → x itself; the
        // FROM-SRF rewrite family → their scalar array calls) and
        // the list rides the multi-arg unnest zip channel:
        // NULL-padded to the longest, WITH ORDINALITY appends the
        // counter. generate_series has no scalar array form and
        // errors honestly.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("rows"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::From))
            && matches!(self.tokens.get(self.pos + 2), Some(Token::LParen))
        {
            self.advance(); // ROWS
            self.advance(); // FROM
            self.advance(); // (
            let mut entries: Vec<Expr> = Vec::new();
            // v7.39 (read01 round 74) — the generic channel, filled in parallel.
            // Used only when some entry has no array form.
            let mut generic: Vec<(String, Vec<Expr>)> = Vec::new();
            loop {
                let fn_name = self.expect_ident_like()?.to_ascii_lowercase();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after {fn_name} in ROWS FROM, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let mut fn_args: Vec<Expr> = Vec::new();
                if !matches!(self.peek(), Token::RParen) {
                    loop {
                        fn_args.push(self.parse_expr(0)?);
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                            continue;
                        }
                        break;
                    }
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after {fn_name}() arguments in ROWS FROM, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let entry = match fn_name.as_str() {
                    "unnest" => {
                        if fn_args.len() != 1 {
                            return Err(
                                self.err("unnest inside ROWS FROM takes exactly one array".into())
                            );
                        }
                        fn_args.pop().expect("len checked")
                    }
                    "jsonb_array_elements"
                    | "json_array_elements"
                    | "jsonb_array_elements_text"
                    | "json_array_elements_text"
                    | "jsonb_object_keys"
                    | "json_object_keys"
                    | "generate_subscripts" => crate::ast::Expr::FunctionCall {
                        name: fn_name,
                        args: fn_args,
                    },
                    "string_to_table" => crate::ast::Expr::FunctionCall {
                        name: "string_to_array".to_string(),
                        args: fn_args,
                    },
                    "regexp_split_to_table" => crate::ast::Expr::FunctionCall {
                        name: "regexp_split_to_array".to_string(),
                        args: fn_args,
                    },
                    // v7.39 (read01 round 74) — an SRF with no array form
                    // (`generate_series`, a user `RETURNS SETOF` function) has no
                    // scalar expression to zip, so the WHOLE list switches to the
                    // rows_from channel, which runs each function and zips the
                    // rows themselves. The all-array case keeps the old lowering:
                    // it is well-trodden and this must not disturb it.
                    _ => {
                        generic.push((fn_name, fn_args));
                        if matches!(self.peek(), Token::Comma) {
                            self.advance();
                            continue;
                        }
                        break;
                    }
                };
                generic.push((
                    // The array-able entries carry their lowered expr along, so a
                    // MIXED list still works: the engine sees the scalar array
                    // form and unnests it.
                    "__array".to_string(),
                    alloc::vec![entry.clone()],
                ));
                entries.push(entry);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' to close ROWS FROM, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let with_ordinality = self.absorb_with_ordinality();
            let (alias_ident, unnest_column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| "rows".to_string());
            // v7.39 (read01 round 74) — some entry had no array form, so the whole
            // list rides the generic channel.
            if generic.iter().any(|(n, _)| n != "__array") {
                let correlated = generic
                    .iter()
                    .any(|(_, a)| a.iter().any(Self::expr_has_any_column));
                let tref = TableRef {
                    name,
                    alias: alias_ident,
                    only: false,
                    as_of_segment: None,
                    unnest_expr: None,
                    unnest_column_aliases,
                    with_ordinality,
                    generate_series_args: None,
                    lateral_subquery: None,
                    jsonb_each_text_arg: None,
                    table_fn_call: None,
                    rows_from: Some(generic),
                    json_table: None,
                    scalar_fn_item: false,
                };
                return Ok(if correlated {
                    Self::wrap_correlated_srf(tref)
                } else {
                    tref
                });
            }
            let correlated = entries.iter().any(Self::expr_has_any_column);
            let expr = if entries.len() == 1 {
                entries.pop().expect("len checked")
            } else {
                crate::ast::Expr::FunctionCall {
                    name: "__unnest_zip".to_string(),
                    args: entries,
                }
            };
            let tref = TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: Some(Box::new(expr)),
                unnest_column_aliases,
                with_ordinality,
                generate_series_args: None,
                lateral_subquery: None,
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            };
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // v7.11.7 — `FROM unnest(<expr>) [AS] <alias>` set-returning
        // source. Detect at the head before the bare-ident fallback;
        // unnest is not a reserved token.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("unnest"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance(); // unnest
            self.advance(); // (
            let mut srf_args = alloc::vec![self.parse_expr(0)?];
            while matches!(self.peek(), Token::Comma) {
                self.advance();
                srf_args.push(self.parse_expr(0)?);
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after unnest() argument, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // Multi-arg unnest(a, b, …) zips the arrays in
            // parallel, NULL-padding to the longest (PG's ROWS
            // FROM shorthand). Lower onto the unnest channel as an
            // internal marker call the executors unpack.
            let expr = if srf_args.len() == 1 {
                srf_args.pop().expect("len checked")
            } else {
                crate::ast::Expr::FunctionCall {
                    name: "__unnest_zip".to_string(),
                    args: srf_args,
                }
            };
            let with_ordinality = self.absorb_with_ordinality();
            let (alias_ident, unnest_column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident.clone().unwrap_or_else(|| "unnest".to_string());
            let correlated = Self::expr_has_any_column(&expr);
            let tref = TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: Some(Box::new(expr)),
                unnest_column_aliases,
                with_ordinality,
                generate_series_args: None,
                lateral_subquery: None,
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            };
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // v7.39 (round 205, JSON_TABLE epic) — `JSON_TABLE(doc, '$path'
        // COLUMNS (...))` has bespoke syntax (a COLUMNS clause the
        // generic table-fn arg parser can't read), so it is intercepted
        // here BEFORE the generic dispatch. The doc expr may reference
        // outer columns (implicit LATERAL) — same correlated-wrap rule.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("json_table"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            let tref = self.parse_json_table_ref()?;
            let correlated = tref
                .json_table
                .as_deref()
                .is_some_and(|jt| Self::expr_has_any_column(&jt.doc));
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // v7.39 (read01 partitionfuncs.c) — generic FROM-position table
        // functions dispatched by name (`pg_partition_tree('t')`,
        // `pg_partition_ancestors('t')`). Same head-detection shape as
        // unnest; the engine executor owns the row shape per function.
        // v7.39 (read01 round 65) — and a USER function in FROM position
        // (`FROM rows_of(2)`). The SRFs with their own FROM pipeline
        // (generate_series / unnest / the json_each family) keep it — their arms
        // sit further down, so they are excluded here by name rather than by
        // ordering. Anything else that is an ident followed by `(` is a table
        // function; the engine executor decides whether it is a builtin, a
        // set-returning user function, or an error.
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if !s.eq_ignore_ascii_case("generate_series")
                    && !s.eq_ignore_ascii_case("unnest")
                    && !is_json_each_name(s))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            // Body out-of-line — this parse sits on the FROM/subquery
            // recursion chain (debug frame-cliff discipline).
            // v7.39 (read01 round 69) — a call whose arguments reference an outer
            // column (`t JOIN LATERAL dbl(t.id)`) is CORRELATED: it runs once per
            // outer row, so it rides the lateral channel. Same rule the unnest
            // arm uses.
            let tref = self.parse_table_fn_ref()?;
            let correlated = tref
                .table_fn_call
                .as_deref()
                .is_some_and(|(_, args)| args.iter().any(Self::expr_has_any_column));
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // v7.17.0 Phase 3.10 — `FROM generate_series(start, stop
        // [, step])` set-returning source. Same shape as unnest:
        // detect at the head, parse the comma-separated arg list,
        // dispatch downstream through the engine's set-returning
        // path. Supports integer triplets (mailrs's `WITH row_no AS
        // (SELECT * FROM generate_series(1, N))` pattern) and
        // TIMESTAMP + INTERVAL triplets (the Tier-A audit's
        // date-range iteration pattern, which pre-3.10 had no
        // direct equivalent in SPG).
        if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("generate_series"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance(); // generate_series
            self.advance(); // (
            let mut args: Vec<Expr> = Vec::new();
            loop {
                args.push(self.parse_expr(0)?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after generate_series() arguments, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            if args.len() < 2 || args.len() > 3 {
                return Err(self.err(alloc::format!(
                    "generate_series() expects 2 or 3 arguments (start, stop [, step]); got {}",
                    args.len()
                )));
            }
            let with_ordinality = self.absorb_with_ordinality();
            let (alias_ident, column_aliases) = self.parse_optional_alias_with_columns()?;
            let name = alias_ident
                .clone()
                .unwrap_or_else(|| "generate_series".to_string());
            let correlated = args.iter().any(Self::expr_has_any_column);
            let tref = TableRef {
                name,
                alias: alias_ident,
                only: false,
                as_of_segment: None,
                unnest_expr: None,
                unnest_column_aliases: column_aliases,
                with_ordinality,
                generate_series_args: Some(args),
                lateral_subquery: None,
                jsonb_each_text_arg: None,
                table_fn_call: None,
                rows_from: None,
                json_table: None,
                scalar_fn_item: false,
            };
            return Ok(if correlated {
                Self::wrap_correlated_srf(tref)
            } else {
                tref
            });
        }
        // v7.16.2 — preserve information_schema / pg_catalog
        // qualifiers (mailrs round-10 A.3). The generic
        // `expect_ident_like` strip silently drops the schema;
        // we want the engine to recognise these PG meta tables
        // and synthesise rows from the live catalog. Produce a
        // synthetic name (`__spg_info_columns` etc.) so the
        // engine's SELECT-side router can dispatch without
        // clashing with any user-defined `columns` table.
        let (name, meta_original) = if let Some((synth, orig)) = self.try_peek_meta_qualified() {
            (synth, Some(orig))
        } else if let Some((synth, orig)) = self.try_peek_meta_bare() {
            (synth, Some(orig))
        } else {
            (self.expect_ident_like()?, None)
        };
        // v6.10.2 — optional `AS OF SEGMENT '<id>'` cold-tier
        // time-travel clause. Parse BEFORE the alias so the
        // alias can still ride at the tail (`tbl AS OF SEGMENT
        // '5' alias`). `AS` is a reserved keyword token, while
        // `OF` and `SEGMENT` are bare idents.
        let as_of_segment = if matches!(self.peek(), Token::As)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(s) | Token::QuotedIdent(s)) if s.eq_ignore_ascii_case("of"))
        {
            self.advance(); // AS
            self.advance(); // OF
            let kw = match self.peek().clone() {
                Token::Ident(s) | Token::QuotedIdent(s) => s,
                other => {
                    return Err(self.err(format!("expected SEGMENT after AS OF, got {other:?}")));
                }
            };
            if !kw.eq_ignore_ascii_case("segment") {
                return Err(self.err(format!(
                    "expected SEGMENT after AS OF, got {kw:?}; v6.10.2 supports SEGMENT only"
                )));
            }
            self.advance();
            // Segment id literal — accept either a string or
            // integer for operator ergonomics.
            let id = match self.advance() {
                Token::String(s) => s
                    .parse::<u32>()
                    .map_err(|e| self.err(format!("AS OF SEGMENT id parse: {e}")))?,
                Token::Integer(n) => u32::try_from(n)
                    .map_err(|e| self.err(format!("AS OF SEGMENT id parse: {e}")))?,
                other => {
                    return Err(self.err(format!(
                        "expected segment id literal after AS OF SEGMENT, got {other:?}"
                    )));
                }
            };
            Some(id)
        } else {
            None
        };
        // TABLESAMPLE is not a reserved token — keep the bare-ident
        // alias rule from swallowing it (`FROM t TABLESAMPLE …`).
        let alias = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("tablesample"))
        {
            None
        } else {
            self.parse_optional_alias()?
        };
        // r1052 — a catalog name rewritten to its synthetic form keeps
        // the WRITTEN name as the relation's alias, so `pg_cast.oid`
        // still binds after `pg_cast` became `__spg_pg_cast`. PG
        // semantics: the visible name of `pg_catalog.pg_cast` IS
        // `pg_cast`. Without this, every table-name-qualified column
        // on a synthesised catalog answered "missing FROM-clause
        // entry" — which is the wall pg_dump hit on its first
        // pg_proc/pg_cast query.
        let alias = match (&alias, &meta_original) {
            (None, Some(orig)) if *orig != name => Some(orig.clone()),
            _ => alias,
        };
        // `TABLESAMPLE BERNOULLI(p) | SYSTEM(p)` follows the alias
        // (PG grammar). BERNOULLI lowers to a per-row
        // `random() < p/100` conjunct on the enclosing SELECT's
        // WHERE — exact row-level Bernoulli semantics. SYSTEM
        // shares the lowering: SPG has no page structure to
        // sample, and the row-level form returns the same expected
        // fraction. REPEATABLE(seed) promises a deterministic
        // sample SPG cannot honour yet — honest error rather than
        // a silently ignored seed.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("tablesample")) {
            self.advance();
            let method = self.expect_ident_like()?;
            if !method.eq_ignore_ascii_case("bernoulli") && !method.eq_ignore_ascii_case("system") {
                return Err(self.err(alloc::format!(
                    "TABLESAMPLE method {method:?} not supported; use BERNOULLI or SYSTEM"
                )));
            }
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected '(' after TABLESAMPLE {}, got {:?}",
                    method.to_ascii_uppercase(),
                    self.peek()
                )));
            }
            self.advance();
            let percent = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after TABLESAMPLE percentage, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // REPEATABLE(seed) → a deterministic per-row draw seeded by
            // `seed`, so the sample is stable across repeats and rescans.
            // Non-REPEATABLE keeps the non-deterministic `random()` draw.
            let mut sample_seed: Option<Expr> = None;
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("repeatable")) {
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' after REPEATABLE, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let seed = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after REPEATABLE seed, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                sample_seed = Some(seed);
            }
            let draw = match sample_seed {
                Some(seed) => Expr::FunctionCall {
                    name: "__tsm_fract".to_string(),
                    args: alloc::vec![seed],
                },
                None => Expr::FunctionCall {
                    name: "random".to_string(),
                    args: Vec::new(),
                },
            };
            self.pending_sample_preds.push(Expr::Binary {
                lhs: Box::new(draw),
                op: crate::ast::BinOp::Lt,
                rhs: Box::new(Expr::Binary {
                    lhs: Box::new(percent),
                    op: crate::ast::BinOp::Div,
                    rhs: Box::new(Expr::Literal(crate::ast::Literal::Float(100.0))),
                }),
            });
        }
        Ok(TableRef {
            name,
            alias,
            only,
            as_of_segment,
            unnest_expr: None,
            unnest_column_aliases: Vec::new(),
            with_ordinality: false,
            generate_series_args: None,
            lateral_subquery: None,
            jsonb_each_text_arg: None,
            table_fn_call: None,
            rows_from: None,
            json_table: None,
            scalar_fn_item: false,
        })
    }

    /// v7.13.2 — mailrs round-6 S5. Like `parse_optional_alias`
    /// but also accepts `AS alias(col [, col, …])` — the
    /// PG-standard table-function column-list form. The column
    /// list is only honoured when paired with `UNNEST(...)` in
    /// the parent; other call sites currently discard it.
    /// True when the expression tree contains a qualified column
    /// reference (`t.col`) — the syntactic marker that an SRF
    /// argument correlates with a preceding FROM item.
    fn expr_has_qualified_column(e: &Expr) -> bool {
        match e {
            Expr::Column(c) => c.qualifier.is_some(),
            Expr::Binary { lhs, rhs, .. } => {
                Self::expr_has_qualified_column(lhs) || Self::expr_has_qualified_column(rhs)
            }
            Expr::Unary { expr, .. } => Self::expr_has_qualified_column(expr),
            Expr::Cast { expr, .. } => Self::expr_has_qualified_column(expr),
            Expr::FunctionCall { args, .. } => args.iter().any(Self::expr_has_qualified_column),
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                operand
                    .as_deref()
                    .is_some_and(Self::expr_has_qualified_column)
                    || branches.iter().any(|(w, t)| {
                        Self::expr_has_qualified_column(w) || Self::expr_has_qualified_column(t)
                    })
                    || else_branch
                        .as_deref()
                        .is_some_and(Self::expr_has_qualified_column)
            }
            _ => false,
        }
    }

    /// v7.38 (read01, T-lateral) — like `expr_has_qualified_column` but also
    /// counts a bare (unqualified) column. A set-returning function has no
    /// input columns of its own, so ANY column in its arguments is an outer
    /// (correlated) reference — `generate_series(1, n)` correlates on `n`.
    fn expr_has_any_column(e: &Expr) -> bool {
        match e {
            Expr::Column(_) => true,
            Expr::Binary { lhs, rhs, .. } => {
                Self::expr_has_any_column(lhs) || Self::expr_has_any_column(rhs)
            }
            Expr::Unary { expr, .. } => Self::expr_has_any_column(expr),
            Expr::Cast { expr, .. } => Self::expr_has_any_column(expr),
            Expr::FunctionCall { args, .. } => args.iter().any(Self::expr_has_any_column),
            // v7.39 (round 759, F31-B8b) — a column INSIDE an array
            // constructor or subscript fell to the `_ => false` arm, so
            // `unnest(ARRAY[x, x + 1])` never wrapped into the lateral
            // channel and the eager peer eval answered `column "x" does
            // not exist` (the substitution walker already recurses both
            // shapes; only this detector was blind to them).
            Expr::Array(items) => items.iter().any(Self::expr_has_any_column),
            Expr::ArraySubscript { target, index } => {
                Self::expr_has_any_column(target) || Self::expr_has_any_column(index)
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                operand.as_deref().is_some_and(Self::expr_has_any_column)
                    || branches
                        .iter()
                        .any(|(w, t)| Self::expr_has_any_column(w) || Self::expr_has_any_column(t))
                    || else_branch
                        .as_deref()
                        .is_some_and(Self::expr_has_any_column)
            }
            _ => false,
        }
    }

    /// Wrap a correlated SRF table ref (`unnest(t.col)` /
    /// `generate_series(1, t.n)`) into the lateral_subquery
    /// channel: `SELECT * FROM <srf>` executes per outer row with
    /// outer references substituted (v7.37.43-T4.5 machinery).
    /// Uncorrelated SRFs stay on their plain channels.
    fn wrap_correlated_srf(srf: TableRef) -> TableRef {
        let name = srf.name.clone();
        let alias = srf.alias.clone();
        let inner = crate::ast::SelectStatement {
            locking: None,
            ctes: Vec::new(),
            distinct: false,
            distinct_on: Vec::new(),
            items: alloc::vec![crate::ast::SelectItem::Wildcard],
            from: Some(crate::ast::FromClause {
                primary: srf,
                joins: Vec::new(),
            }),
            where_: None,
            group_by: None,
            group_by_all: false,
            having: None,
            unions: Vec::new(),
            order_by: Vec::new(),
            limit: None,
            offset: None,
            limit_with_ties: false,
            window_check_exprs: Vec::new(),
        };
        TableRef {
            name,
            alias,
            only: false,
            as_of_segment: None,
            unnest_expr: None,
            unnest_column_aliases: Vec::new(),
            with_ordinality: false,
            generate_series_args: None,
            lateral_subquery: Some(Box::new(inner)),
            jsonb_each_text_arg: None,
            table_fn_call: None,
            rows_from: None,
            json_table: None,
            scalar_fn_item: false,
        }
    }

    /// True when the expression tree contains an unresolved
    /// `OVER w` marker (see parse_over_clause).
    fn expr_has_named_window(e: &Expr) -> bool {
        match e {
            Expr::WindowFunction { partition_by, .. } => matches!(
                partition_by.as_slice(),
                [Expr::Column(c)] if matches!(
                    c.qualifier.as_deref(),
                    Some("__named_window__") | Some("__named_window_ref__")
                )
            ),
            Expr::Binary { lhs, rhs, .. } => {
                Self::expr_has_named_window(lhs) || Self::expr_has_named_window(rhs)
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => Self::expr_has_named_window(expr),
            Expr::FunctionCall { args, .. } => args.iter().any(Self::expr_has_named_window),
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                operand.as_deref().is_some_and(Self::expr_has_named_window)
                    || branches.iter().any(|(w, t)| {
                        Self::expr_has_named_window(w) || Self::expr_has_named_window(t)
                    })
                    || else_branch
                        .as_deref()
                        .is_some_and(Self::expr_has_named_window)
            }
            _ => false,
        }
    }

    /// v7.39 (round 705) — the NAMES the expression references through the
    /// `OVER w` markers, so `parse_bare_select` can tell which WINDOW
    /// definitions nothing referenced. Traversal mirrors
    /// `expr_has_named_window` above.
    fn collect_named_window_refs(e: &Expr, into: &mut Vec<String>) {
        match e {
            Expr::WindowFunction { partition_by, .. } => {
                if let [Expr::Column(c)] = partition_by.as_slice()
                    && matches!(
                        c.qualifier.as_deref(),
                        Some("__named_window__") | Some("__named_window_ref__")
                    )
                {
                    into.push(c.name.clone());
                }
            }
            Expr::Binary { lhs, rhs, .. } => {
                Self::collect_named_window_refs(lhs, into);
                Self::collect_named_window_refs(rhs, into);
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => {
                Self::collect_named_window_refs(expr, into);
            }
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::collect_named_window_refs(a, into);
                }
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(o) = operand.as_deref() {
                    Self::collect_named_window_refs(o, into);
                }
                for (w, t) in branches {
                    Self::collect_named_window_refs(w, into);
                    Self::collect_named_window_refs(t, into);
                }
                if let Some(eb) = else_branch.as_deref() {
                    Self::collect_named_window_refs(eb, into);
                }
            }
            _ => {}
        }
    }

    /// Inline named-window definitions into the `OVER w` markers.
    /// An unknown name errors (PG: window "w" does not exist).
    #[allow(clippy::type_complexity)]
    fn substitute_named_windows(
        e: &mut Expr,
        defs: &[(
            String,
            (
                Vec<Expr>,
                Vec<(Expr, bool, Option<bool>)>,
                Option<WindowFrame>,
            ),
        )],
    ) -> Result<(), String> {
        match e {
            Expr::WindowFunction {
                partition_by,
                order_by,
                frame,
                ..
            } => {
                // `is_copy` distinguishes `OVER (w1 …)` (a refinable copy)
                // from the bare `OVER w1` (a plain reference).
                let named = match partition_by.as_slice() {
                    [Expr::Column(c)] => match c.qualifier.as_deref() {
                        Some("__named_window__") => Some((c.name.clone(), false)),
                        Some("__named_window_ref__") => Some((c.name.clone(), true)),
                        _ => None,
                    },
                    _ => None,
                };
                if let Some((wname, is_copy)) = named {
                    let Some((_, def)) = defs.iter().find(|(n, _)| n.eq_ignore_ascii_case(&wname))
                    else {
                        return Err(alloc::format!("window {wname:?} does not exist"));
                    };
                    if !is_copy {
                        *partition_by = def.0.clone();
                        *order_by = def.1.clone();
                        *frame = def.2.clone();
                        return Ok(());
                    }
                    // v7.39 (round 229) — PG's copy rules, probed against
                    // 18.4: a copy inherits the partitioning, may supply an
                    // ordering only when the base has none, and may not copy
                    // a base that already carries a frame (its own frame
                    // would be ambiguous with the inherited one).
                    if !def.1.is_empty() && !order_by.is_empty() {
                        return Err(alloc::format!(
                            "cannot override ORDER BY clause of window \"{wname}\""
                        ));
                    }
                    if def.2.is_some() {
                        return Err(alloc::format!(
                            "cannot copy window \"{wname}\" because it has a frame clause"
                        ));
                    }
                    *partition_by = def.0.clone();
                    if order_by.is_empty() {
                        *order_by = def.1.clone();
                    }
                }
                Ok(())
            }
            Expr::Binary { lhs, rhs, .. } => {
                Self::substitute_named_windows(lhs, defs)?;
                Self::substitute_named_windows(rhs, defs)
            }
            Expr::Unary { expr, .. } | Expr::Cast { expr, .. } => {
                Self::substitute_named_windows(expr, defs)
            }
            Expr::FunctionCall { args, .. } => {
                for a in args {
                    Self::substitute_named_windows(a, defs)?;
                }
                Ok(())
            }
            Expr::Case {
                operand,
                branches,
                else_branch,
            } => {
                if let Some(op) = operand {
                    Self::substitute_named_windows(op, defs)?;
                }
                for (w, t) in branches {
                    Self::substitute_named_windows(w, defs)?;
                    Self::substitute_named_windows(t, defs)?;
                }
                if let Some(el) = else_branch {
                    Self::substitute_named_windows(el, defs)?;
                }
                Ok(())
            }
            _ => Ok(()),
        }
    }

    /// SQL-standard `TABLE name` shorthand — builds the equivalent
    /// `SELECT * FROM name` head. Callers own set-op chain / tail
    /// composition.
    fn parse_table_shorthand(&mut self) -> Result<SelectStatement, ParseError> {
        debug_assert!(matches!(self.peek(), Token::Table));
        self.advance(); // TABLE
        let tname = self.expect_ident_like()?;
        Ok(SelectStatement {
            locking: None,
            ctes: Vec::new(),
            distinct: false,
            distinct_on: Vec::new(),
            items: alloc::vec![SelectItem::Wildcard],
            from: Some(FromClause {
                primary: TableRef {
                    name: tname,
                    alias: None,
                    only: false,
                    as_of_segment: None,
                    unnest_expr: None,
                    unnest_column_aliases: Vec::new(),
                    with_ordinality: false,
                    generate_series_args: None,
                    lateral_subquery: None,
                    jsonb_each_text_arg: None,
                    table_fn_call: None,
                    rows_from: None,
                    json_table: None,
                    scalar_fn_item: false,
                },
                joins: Vec::new(),
            }),
            where_: None,
            group_by: None,
            group_by_all: false,
            having: None,
            unions: Vec::new(),
            order_by: Vec::new(),
            limit: None,
            offset: None,
            limit_with_ties: false,
            window_check_exprs: Vec::new(),
        })
    }

    /// `jsonb_to_recordset(J) AS t(c1 t1, c2 t2, …)` (and record / json_
    /// variants) → a derived table that reads each declared column out of
    /// the JSON with `(row ->> 'ci')::ti`. The *set form iterates
    /// `jsonb_array_elements(J)` (one row per element, column `value`);
    /// the scalar *record form projects a single row straight off `J`.
    /// Rides the existing lateral-subquery channel, so no new executor or
    /// AST is needed.
    fn parse_json_to_record_from(&mut self) -> Result<TableRef, ParseError> {
        use crate::ast::{
            BinOp, ColumnName, Expr, FromClause, Literal, SelectItem, SelectStatement,
        };
        let fn_name = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
            _ => unreachable!("caller guarded is_json_to_record_name"),
        };
        self.advance(); // fn name
        self.advance(); // (
        let mut arg = self.parse_expr(0)?;
        // populate_record(base, json): the base only carries the record
        // type here — the JSON argument is the second expression.
        let mut base: Option<Expr> = None;
        if matches!(self.peek(), Token::Comma) {
            self.advance();
            base = Some(arg);
            arg = self.parse_expr(0)?;
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' after {fn_name}() argument, got {:?}",
                self.peek()
            )));
        }
        self.advance(); // )
        let is_set = fn_name.ends_with("recordset");
        // `[AS] alias ( col type [, …] )` column-definition list.
        if matches!(self.peek(), Token::As) {
            self.advance();
        }
        let alias_opt = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) => {
                let a = s.clone();
                self.advance();
                Some(a)
            }
            _ => None,
        };
        // v7.39 (read01 round 76) — the populate family's canonical PG
        // spelling carries no column list at all: the row shape comes from
        // the BASE argument's declared type (`jsonb_populate_record(NULL::t,
        // j)`). The parser has no catalog, so hand the two arguments to the
        // engine's table-function channel, which does. Only `*_to_record*`
        // (whose base is bare `record`) genuinely requires the list.
        if !matches!(self.peek(), Token::LParen) {
            if let Some(base_expr) = base {
                let alias = alias_opt.unwrap_or_else(|| fn_name.clone());
                return Ok(TableRef {
                    name: alias.clone(),
                    alias: Some(alias),
                    only: false,
                    as_of_segment: None,
                    unnest_expr: None,
                    unnest_column_aliases: Vec::new(),
                    with_ordinality: false,
                    generate_series_args: None,
                    lateral_subquery: None,
                    jsonb_each_text_arg: None,
                    table_fn_call: Some(Box::new((fn_name, alloc::vec![base_expr, arg]))),
                    rows_from: None,
                    json_table: None,
                    scalar_fn_item: false,
                });
            }
            return Err(self.err(alloc::format!(
                "expected '(' to start the {fn_name} column-definition list, got {:?}",
                self.peek()
            )));
        }
        let Some(alias) = alias_opt else {
            return Err(self.err(alloc::format!(
                "{fn_name}(...) needs a column-definition list, e.g. AS t(a int, b text)"
            )));
        };
        self.advance(); // (
        let mut coldefs: Vec<(String, crate::ast::CastTarget)> = Vec::new();
        loop {
            let col = self.expect_ident_like()?;
            let ty = self.parse_cast_target()?;
            coldefs.push((col, ty));
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            if matches!(self.peek(), Token::RParen) {
                self.advance();
                break;
            }
            return Err(self.err(alloc::format!(
                "expected ',' or ')' in {fn_name} column list, got {:?}",
                self.peek()
            )));
        }
        if coldefs.is_empty() {
            return Err(self.err(alloc::format!(
                "{fn_name} column-definition list must declare at least one column"
            )));
        }
        // Per column: (base ->> 'col')::type AS col. The base is the
        // per-element `value` column for the *set form, or the argument
        // itself for the scalar record form.
        let items: Vec<SelectItem> = coldefs
            .into_iter()
            .map(|(col, ty)| {
                let base = if is_set {
                    Expr::Column(ColumnName {
                        qualifier: None,
                        name: "value".to_string(),
                    })
                } else {
                    arg.clone()
                };
                SelectItem::Expr {
                    expr: Expr::Cast {
                        expr: Box::new(Expr::Binary {
                            lhs: Box::new(base),
                            op: BinOp::JsonGetText,
                            rhs: Box::new(Expr::Literal(Literal::String(col.clone()))),
                        }),
                        target: ty,
                    },
                    alias: Some(col),
                }
            })
            .collect();
        let from = if is_set {
            let elem_fn = if fn_name.starts_with("jsonb") {
                "jsonb_array_elements"
            } else {
                "json_array_elements"
            };
            Some(FromClause {
                primary: TableRef {
                    name: "value".to_string(),
                    alias: None,
                    only: false,
                    as_of_segment: None,
                    unnest_expr: Some(Box::new(Expr::FunctionCall {
                        name: elem_fn.to_string(),
                        args: alloc::vec![arg],
                    })),
                    unnest_column_aliases: alloc::vec!["value".to_string()],
                    with_ordinality: false,
                    generate_series_args: None,
                    lateral_subquery: None,
                    jsonb_each_text_arg: None,
                    table_fn_call: None,
                    rows_from: None,
                    json_table: None,
                    scalar_fn_item: false,
                },
                joins: Vec::new(),
            })
        } else {
            None
        };
        let inner = SelectStatement {
            locking: None,
            ctes: Vec::new(),
            distinct: false,
            distinct_on: Vec::new(),
            items,
            from,
            where_: None,
            group_by: None,
            group_by_all: false,
            having: None,
            unions: Vec::new(),
            order_by: Vec::new(),
            limit: None,
            offset: None,
            limit_with_ties: false,
            window_check_exprs: Vec::new(),
        };
        Ok(TableRef {
            name: alias.clone(),
            alias: Some(alias),
            only: false,
            as_of_segment: None,
            unnest_expr: None,
            unnest_column_aliases: Vec::new(),
            with_ordinality: false,
            generate_series_args: None,
            lateral_subquery: Some(Box::new(inner)),
            jsonb_each_text_arg: None,
            table_fn_call: None,
            rows_from: None,
            json_table: None,
            scalar_fn_item: false,
        })
    }

    /// Absorb `WITH ORDINALITY` after an SRF call in FROM position.
    /// Returns true when the clause was present. `WITH` alone (a
    /// CTE can never start here) is not enough — the ORDINALITY
    /// ident must follow, so a stray WITH still errors downstream.
    fn absorb_with_ordinality(&mut self) -> bool {
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with"))
            && matches!(self.tokens.get(self.pos + 1),
                Some(Token::Ident(s)) if s.eq_ignore_ascii_case("ordinality"))
        {
            self.advance();
            self.advance();
            true
        } else {
            false
        }
    }

    /// v7.39 (read01 partitionfuncs.c) — parse a FROM-position table
    /// function reference (`pg_partition_tree('t') [AS a(c, …)]`).
    /// Out-of-line: the caller sits on the FROM recursion chain.
    #[inline(never)]
    fn parse_table_fn_ref(&mut self) -> Result<TableRef, ParseError> {
        let fn_name = match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) => s.to_ascii_lowercase(),
            _ => unreachable!("caller peeked an ident"),
        };
        self.advance(); // (
        let mut args: Vec<Expr> = Vec::new();
        if !matches!(self.peek(), Token::RParen) {
            loop {
                args.push(self.parse_expr(0)?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' after {fn_name}() arguments, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // v7.39 (read01 round 68) — `f(args) WITH ORDINALITY AS a(x, n)`: the
        // counter column rides after the function's own, and the alias list
        // names it.
        let with_ordinality = self.absorb_with_ordinality();
        let (alias_ident, unnest_column_aliases) = self.parse_optional_alias_with_columns()?;
        let name = alias_ident.clone().unwrap_or_else(|| fn_name.clone());
        Ok(TableRef {
            name,
            alias: alias_ident,
            only: false,
            as_of_segment: None,
            unnest_expr: None,
            unnest_column_aliases,
            with_ordinality,
            generate_series_args: None,
            lateral_subquery: None,
            jsonb_each_text_arg: None,
            table_fn_call: Some(Box::new((fn_name, args))),
            rows_from: None,
            json_table: None,
            scalar_fn_item: false,
        })
    }

    /// v7.39 (round 205, JSON_TABLE) — parse
    /// `JSON_TABLE(<doc>, '<row_path>' [PASSING …] COLUMNS (<coldefs>))
    /// [AS <alias>]`. The COLUMNS list is a recursive tree (NESTED
    /// PATH nests another COLUMNS). Out-of-line (FROM recursion chain).
    #[inline(never)]
    fn parse_json_table_ref(&mut self) -> Result<TableRef, ParseError> {
        self.advance(); // json_table
        self.advance(); // (
        let doc = Box::new(self.parse_expr(0)?);
        self.expect_comma_json_table()?;
        let row_path = self.parse_json_string_literal("JSON_TABLE row path")?;
        // Optional `PASSING <expr> AS <name> [, …]`.
        let mut passing: Vec<(String, Expr)> = Vec::new();
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("passing")) {
            self.advance();
            loop {
                let e = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::As) {
                    return Err(self.err("expected AS after JSON_TABLE PASSING value".into()));
                }
                self.advance();
                let vname = match self.advance() {
                    Token::Ident(s) | Token::QuotedIdent(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected PASSING variable name, got {other:?}"
                        )));
                    }
                };
                passing.push((vname, e));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
        }
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("columns")) {
            return Err(self.err("expected COLUMNS in JSON_TABLE".into()));
        }
        self.advance();
        let columns = self.parse_json_table_columns()?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close JSON_TABLE, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let alias_ident = self.parse_optional_alias()?;
        let name = alias_ident
            .clone()
            .unwrap_or_else(|| String::from("json_table"));
        Ok(TableRef {
            name,
            alias: alias_ident,
            only: false,
            as_of_segment: None,
            unnest_expr: None,
            unnest_column_aliases: Vec::new(),
            with_ordinality: false,
            generate_series_args: None,
            lateral_subquery: None,
            jsonb_each_text_arg: None,
            table_fn_call: None,
            rows_from: None,
            json_table: Some(Box::new(crate::ast::JsonTable {
                doc,
                row_path,
                columns,
                passing,
            })),
            scalar_fn_item: false,
        })
    }

    fn expect_comma_json_table(&mut self) -> Result<(), ParseError> {
        if !matches!(self.peek(), Token::Comma) {
            return Err(self.err(alloc::format!(
                "expected ',' after JSON_TABLE document, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(())
    }

    fn parse_json_string_literal(&mut self, what: &str) -> Result<String, ParseError> {
        match self.advance() {
            Token::String(s) => Ok(s),
            other => Err(self.err(alloc::format!(
                "expected {what} string literal, got {other:?}"
            ))),
        }
    }

    /// v7.39 (round 205) — `( <coldef> [, <coldef>]* )`.
    #[inline(never)]
    fn parse_json_table_columns(
        &mut self,
    ) -> Result<alloc::vec::Vec<crate::ast::JsonTableColumn>, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err("expected '(' after COLUMNS".into()));
        }
        self.advance();
        let mut cols = Vec::new();
        loop {
            cols.push(self.parse_json_table_one_column()?);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' after JSON_TABLE COLUMNS, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(cols)
    }

    fn parse_json_table_one_column(&mut self) -> Result<crate::ast::JsonTableColumn, ParseError> {
        use crate::ast::{JsonTableColumn, JsonTableOnBehavior};
        // NESTED [PATH] '<p>' COLUMNS (...)
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("nested")) {
            self.advance();
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("path")) {
                self.advance();
            }
            let path = self.parse_json_string_literal("NESTED PATH")?;
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("columns")) {
                return Err(self.err("expected COLUMNS after NESTED PATH".into()));
            }
            self.advance();
            let columns = self.parse_json_table_columns()?;
            return Ok(JsonTableColumn::Nested { path, columns });
        }
        // <name> ...
        let name = match self.advance() {
            Token::Ident(s) | Token::QuotedIdent(s) => s,
            other => {
                return Err(self.err(alloc::format!("expected column name, got {other:?}")));
            }
        };
        // <name> FOR ORDINALITY
        if matches!(self.peek(), Token::For) {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("ordinality")) {
                return Err(self.err("expected ORDINALITY after FOR".into()));
            }
            self.advance();
            return Ok(JsonTableColumn::Ordinality { name });
        }
        // <name> <type> [FORMAT JSON] {PATH '<p>' | EXISTS [PATH '<p>']} [WITH WRAPPER] [ON …]
        let ty = self.parse_column_type_name()?;
        let mut format_json = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("format")) {
            self.advance();
            if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("json")) {
                return Err(self.err("expected JSON after FORMAT".into()));
            }
            self.advance();
            format_json = true;
        }
        let mut exists = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exists")) {
            self.advance();
            exists = true;
        }
        let mut path = alloc::format!("$.{name}");
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("path")) {
            self.advance();
            path = self.parse_json_string_literal("column PATH")?;
        }
        if !exists && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("format")) {
            // `FORMAT JSON` after PATH (alternate placement).
            self.advance();
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("json")) {
                self.advance();
            }
            format_json = true;
        }
        let mut wrapper = false;
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with")) {
            self.advance();
            // optional CONDITIONAL/UNCONDITIONAL
            if matches!(self.peek(), Token::Ident(s)
                if s.eq_ignore_ascii_case("unconditional")
                    || s.eq_ignore_ascii_case("conditional"))
            {
                self.advance();
            }
            if !matches!(self.peek(), Token::Ident(s)
                if s.eq_ignore_ascii_case("wrapper") || s.eq_ignore_ascii_case("array"))
            {
                return Err(self.err("expected WRAPPER after WITH".into()));
            }
            self.advance();
            // optional `ARRAY` after `WRAPPER`, or `WRAPPER` after `ARRAY`
            if matches!(self.peek(), Token::Ident(s)
                if s.eq_ignore_ascii_case("wrapper") || s.eq_ignore_ascii_case("array"))
            {
                self.advance();
            }
            wrapper = true;
        }
        // ON EMPTY / ON ERROR clauses (two, in any order).
        let mut on_empty = JsonTableOnBehavior::Null;
        let mut on_error = JsonTableOnBehavior::Null;
        for _ in 0..2 {
            let behavior = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("error"))
            {
                self.advance();
                Some(JsonTableOnBehavior::Error)
            } else if matches!(self.peek(), Token::Null) {
                self.advance();
                Some(JsonTableOnBehavior::Null)
            } else if matches!(self.peek(), Token::Default) {
                self.advance();
                Some(JsonTableOnBehavior::Default(Box::new(self.parse_expr(0)?)))
            } else {
                None
            };
            let Some(behavior) = behavior else { break };
            // `ON {EMPTY|ERROR}`
            if !matches!(self.peek(), Token::On) {
                return Err(self.err("expected ON after JSON_TABLE column behavior".into()));
            }
            self.advance();
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("empty")) {
                self.advance();
                on_empty = behavior;
            } else if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("error")) {
                self.advance();
                on_error = behavior;
            } else {
                return Err(self.err("expected EMPTY or ERROR after ON".into()));
            }
        }
        Ok(JsonTableColumn::Regular {
            name,
            ty,
            path,
            exists,
            format_json,
            wrapper,
            on_empty,
            on_error,
        })
    }

    fn parse_optional_alias_with_columns(
        &mut self,
    ) -> Result<(Option<String>, Vec<String>), ParseError> {
        let alias = self.parse_optional_alias()?;
        if alias.is_none() {
            return Ok((None, Vec::new()));
        }
        let mut cols: Vec<String> = Vec::new();
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            while let Token::Ident(s) | Token::QuotedIdent(s) = self.peek().clone() {
                self.advance();
                cols.push(s);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if matches!(self.peek(), Token::RParen) {
                self.advance();
            }
        }
        Ok((alias, cols))
    }

    /// v7.37.16 — parse a `left(str, n)` / `right(str, n)` function call
    /// whose keyword token was already consumed and whose `(` is the
    /// current token. Factored out of `parse_atom` (and marked
    /// `#[inline(never)]`) so its `Vec`/loop locals stay OFF the giant
    /// recursive `parse_atom` frame — inlining them there enlarges the
    /// per-nesting-level stack cost that `MAX_NEST_DEPTH` is tuned
    /// against, risking an overflow before the budget triggers.
    #[inline(never)]
    fn parse_lr_string_function_call(&mut self, name: &str) -> Result<Expr, ParseError> {
        self.advance(); // (
        let mut args = Vec::new();
        if !matches!(self.peek(), Token::RParen) {
            loop {
                args.push(self.parse_expr(0)?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ')' in {name}() args, got {other:?}"
                        )));
                    }
                }
            }
        }
        self.advance(); // )
        Ok(Expr::FunctionCall {
            name: name.into(),
            args,
        })
    }

    /// FROM-clause: a primary table reference plus zero-or-more joined
    /// peers expressed via either `, <table>` (cross-product, no ON) or
    /// `[INNER|LEFT|RIGHT [OUTER]|FULL [OUTER]|CROSS] JOIN <table> [ON expr]`.
    /// v1.10 keeps the join list flat (left-associative nested-loop
    /// semantics).
    fn parse_from_clause(&mut self) -> Result<FromClause, ParseError> {
        let primary = self.parse_table_ref()?;
        let primary_qual = primary
            .alias
            .clone()
            .unwrap_or_else(|| primary.name.clone());
        let joins = self.parse_from_joins(&primary_qual)?;
        Ok(FromClause { primary, joins })
    }

    /// v7.39 (round 420) — the join tail of a FROM clause, factored out of
    /// [`Self::parse_from_clause`] so MySQL's multi-table UPDATE can read the
    /// SAME grammar after its target table has already been consumed.
    /// (`advance()` destroys the tokens it returns — `mem::replace(.., Eof)`
    /// — so re-parsing by rewinding `self.pos` is not possible; the tail must
    /// be parsed forward, once.)
    /// `left_primary_qual` is the qualifier (alias, else name) of whatever
    /// sits to the LEFT of the first join — the FROM primary, or the UPDATE
    /// target in the MySQL multi-table form. It only feeds the `USING (…)`
    /// desugaring, which needs a name for the left side of each equality.
    fn parse_from_joins(&mut self, left_primary_qual: &str) -> Result<Vec<FromJoin>, ParseError> {
        let mut joins = Vec::new();
        loop {
            // `, <table>` — cross-product with no ON.
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                let table = self.parse_table_ref()?;
                joins.push(FromJoin {
                    kind: JoinKind::Cross,
                    table,
                    on: None,
                    using_cols: None,
                    natural: false,
                });
                continue;
            }
            // v7.37.16 — optional leading `NATURAL` before the join
            // kind: `NATURAL JOIN`, `NATURAL LEFT JOIN`, etc. NATURAL is
            // not a lexer keyword (it arrives as a bare Ident), so match
            // it case-insensitively here. When present, no ON/USING
            // clause is allowed — the common columns are resolved at
            // execution time.
            let natural = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("natural"));
            if natural {
                self.advance();
            }
            // Explicit JOIN syntax. Accept INNER JOIN, LEFT [OUTER] JOIN,
            // CROSS JOIN, and bare JOIN (defaults to INNER).
            let kind =
                match self.peek() {
                    Token::Inner => {
                        self.advance();
                        if !matches!(self.peek(), Token::Join) {
                            return Err(self
                                .err(format!("expected JOIN after INNER, got {:?}", self.peek())));
                        }
                        self.advance();
                        JoinKind::Inner
                    }
                    Token::Left => {
                        self.advance();
                        if matches!(self.peek(), Token::Outer) {
                            self.advance();
                        }
                        if !matches!(self.peek(), Token::Join) {
                            return Err(self.err(format!(
                                "expected JOIN after LEFT [OUTER], got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        JoinKind::Left
                    }
                    Token::Cross => {
                        self.advance();
                        if !matches!(self.peek(), Token::Join) {
                            return Err(self
                                .err(format!("expected JOIN after CROSS, got {:?}", self.peek())));
                        }
                        self.advance();
                        JoinKind::Cross
                    }
                    // v7.37.16 — RIGHT [OUTER] JOIN. OUTER is optional noise.
                    Token::Right => {
                        self.advance();
                        if matches!(self.peek(), Token::Outer) {
                            self.advance();
                        }
                        if !matches!(self.peek(), Token::Join) {
                            return Err(self.err(format!(
                                "expected JOIN after RIGHT [OUTER], got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        JoinKind::Right
                    }
                    // v7.37.16 — FULL [OUTER] JOIN. OUTER is optional noise.
                    Token::Full => {
                        self.advance();
                        if matches!(self.peek(), Token::Outer) {
                            self.advance();
                        }
                        if !matches!(self.peek(), Token::Join) {
                            return Err(self.err(format!(
                                "expected JOIN after FULL [OUTER], got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        JoinKind::FullOuter
                    }
                    Token::Join => {
                        self.advance();
                        JoinKind::Inner
                    }
                    _ => break,
                };
            let table = self.parse_table_ref()?;
            // v7.37.7 C.1 — USING (col_list) sugar. Desugars to
            // `prev_table.col1 = table.col1 AND prev_table.col2 = table.col2 …`
            // where prev_table is the most-recent left-side table
            // (the previous join's table if any, else the FROM primary).
            // PG semantics around column merging are richer (USING'd
            // cols become deduplicated single output columns); for
            // sugar purposes the predicate-only form covers the
            // baseline corpus shape and chained `… JOIN x USING (k)
            // JOIN y USING (k)` calls.
            // v7.37.16 — NATURAL joins carry no ON/USING clause; the
            // common columns resolve at execution time.
            if natural {
                joins.push(FromJoin {
                    kind,
                    table,
                    on: None,
                    using_cols: None,
                    natural: true,
                });
                continue;
            }
            let using_match = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("using"));
            // v7.37.16 — capture the USING column list (in addition to
            // the ON desugar below) so the executor can perform PG's
            // column-merge on the output side.
            let mut using_cols: Option<Vec<String>> = None;
            let on = if matches!(self.peek(), Token::On) {
                self.advance();
                Some(self.parse_expr(0)?)
            } else if using_match {
                self.advance();
                if !matches!(self.peek(), Token::LParen) {
                    return Err(
                        self.err(format!("expected '(' after USING, got {:?}", self.peek()))
                    );
                }
                self.advance();
                let mut cols: Vec<String> = Vec::new();
                loop {
                    match self.peek().clone() {
                        Token::Ident(s) | Token::QuotedIdent(s) => {
                            self.advance();
                            cols.push(s);
                        }
                        other => {
                            return Err(self.err(format!(
                                "expected column name inside USING (…), got {other:?}"
                            )));
                        }
                    }
                    match self.peek() {
                        Token::Comma => {
                            self.advance();
                            continue;
                        }
                        Token::RParen => {
                            self.advance();
                            break;
                        }
                        other => {
                            return Err(self.err(format!(
                                "expected ',' or ')' inside USING (…), got {other:?}"
                            )));
                        }
                    }
                }
                if cols.is_empty() {
                    return Err(self.err("USING (…) requires at least one column".to_string()));
                }
                using_cols = Some(cols.clone());
                // Pick the left-side alias: prev join's table if any,
                // else FROM primary. Use alias when present, else
                // table name (PG-equivalent qualifier).
                let left_qual: String = joins
                    .last()
                    .map(|j| {
                        j.table
                            .alias
                            .clone()
                            .unwrap_or_else(|| j.table.name.clone())
                    })
                    .unwrap_or_else(|| alloc::string::String::from(left_primary_qual));
                let right_qual = table.alias.clone().unwrap_or_else(|| table.name.clone());
                let mut iter = cols.into_iter().map(|c| Expr::Binary {
                    lhs: alloc::boxed::Box::new(Expr::Column(crate::ast::ColumnName {
                        qualifier: Some(left_qual.clone()),
                        name: c.clone(),
                    })),
                    op: crate::ast::BinOp::Eq,
                    rhs: alloc::boxed::Box::new(Expr::Column(crate::ast::ColumnName {
                        qualifier: Some(right_qual.clone()),
                        name: c,
                    })),
                });
                let first = iter.next().expect("at least one col");
                Some(iter.fold(first, |acc, pred| Expr::Binary {
                    lhs: alloc::boxed::Box::new(acc),
                    op: crate::ast::BinOp::And,
                    rhs: alloc::boxed::Box::new(pred),
                }))
            } else if kind == JoinKind::Cross {
                None
            } else {
                return Err(self.err(format!(
                    "expected ON or USING after {:?} JOIN, got {:?}",
                    kind,
                    self.peek()
                )));
            };
            joins.push(FromJoin {
                kind,
                table,
                on,
                using_cols,
                natural: false,
            });
        }
        Ok(joins)
    }

    /// Optional alias after an expression or table:
    /// `AS <ident>` is unambiguous; a bare `<ident>` directly after is also
    /// accepted (PG-style implicit alias). Returns `None` if the next token
    /// is not alias-shaped (e.g. comma, FROM, WHERE, semicolon, EOF, operator).
    fn parse_optional_alias(&mut self) -> Result<Option<String>, ParseError> {
        if matches!(self.peek(), Token::As) {
            self.advance();
            // v7.39 (round 340, V56) — after AS the next token MUST be an
            // identifier. This used to return None and "let the caller
            // surface the error on the next expectation", but when AS is
            // the LAST token there is no next expectation: `SELECT 1 AS`
            // parsed clean and silently dropped the alias. PG rejects it.
            if let Token::Ident(_) | Token::QuotedIdent(_) = self.peek() {
                return self.expect_ident_like().map(Some);
            }
            return Err(self.err(alloc::format!(
                "expected an alias after AS, got {:?}",
                self.peek()
            )));
        }
        // v7.17.0 Phase 1.3 — implicit alias (no `AS`). PG's
        // grammar reserves a long list of follow-keywords from the
        // alias slot. SPG's bareword approximation: skip a small
        // set of idents that would otherwise be swallowed as the
        // table alias and break trailing clauses like CREATE
        // MATERIALIZED VIEW … WITH [NO] DATA or future ON
        // CONFLICT WHERE shapes.
        if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek() {
            if is_alias_stopword(s) {
                return Ok(None);
            }
            return Ok(self.expect_ident_like().ok());
        }
        Ok(None)
    }

    /// Pratt loop. `min_prec` is the minimum binary-op precedence we'll accept.
    fn parse_expr(&mut self, min_prec: u8) -> Result<Expr, ParseError> {
        // v7.30.2 (mailrs round-25 ask 2) — nesting budget: a parse
        // error beats a stack overflow (an overflow aborts the
        // embedding host process).
        self.enter_nested()?;
        let r = self.parse_expr_inner(min_prec);
        self.nest_depth -= 1;
        r
    }

    /// `OPERATOR([schema.]<op>)` — PG's explicit-operator spelling.
    /// When the upcoming tokens form one, return the underlying
    /// operator token and the position just past the closing paren
    /// so the binary loop can dispatch on the plain operator.
    fn peek_explicit_operator(&self) -> Option<(usize, Token)> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("operator")) {
            return None;
        }
        if !matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) {
            return None;
        }
        let mut i = self.pos + 2;
        // Optional schema qualifier (pg_catalog.<op> etc.).
        if matches!(self.tokens.get(i), Some(Token::Ident(_)))
            && matches!(self.tokens.get(i + 1), Some(Token::Dot))
        {
            i += 2;
        }
        let op_tok = self.tokens.get(i)?.clone();
        if !matches!(self.tokens.get(i + 1), Some(Token::RParen)) {
            return None;
        }
        Some((i + 2, op_tok))
    }

    /// PG operator symbols that lower onto function calls in
    /// binary position: `~` / `~*` / `!~` / `!~*` (regex match
    /// family → regexp_like, comparison rung), `^@` (starts_with,
    /// comparison rung), `^` (power, tighter than `*`), `#`
    /// (integer XOR via `(a|b) - (a&b)` — the AND bits are a
    /// subset of the OR bits so the subtraction never borrows).
    fn try_symbol_operator(
        &mut self,
        lhs: &Expr,
        min_prec: u8,
    ) -> Result<Option<Expr>, ParseError> {
        enum Sym {
            Regex { ci: bool, negated: bool },
            Like { ci: bool, negated: bool },
            StartsWith,
            Power,
            Xor,
            RangeAdjacent,
        }
        // v7.39 (IS-precedence knife) — the low-precedence postfix
        // predicates ride this existing leaf call (zero new frame slots
        // on the nesting chain).
        if let Some(e) = self.parse_postfix_predicate(lhs, min_prec)? {
            return Ok(Some(e));
        }
        let (sym, prec): (Sym, u8) = match self.peek() {
            Token::Tilde => (
                Sym::Regex {
                    ci: false,
                    negated: false,
                },
                5,
            ),
            Token::TildeStar => (
                Sym::Regex {
                    ci: true,
                    negated: false,
                },
                5,
            ),
            Token::NotTilde => (
                Sym::Regex {
                    ci: false,
                    negated: true,
                },
                5,
            ),
            Token::NotTildeStar => (
                Sym::Regex {
                    ci: true,
                    negated: true,
                },
                5,
            ),
            // v7.37 D.25 — PG operator spellings of LIKE/ILIKE.
            Token::DoubleTilde => (
                Sym::Like {
                    ci: false,
                    negated: false,
                },
                5,
            ),
            Token::DoubleTildeStar => (
                Sym::Like {
                    ci: true,
                    negated: false,
                },
                5,
            ),
            Token::NotDoubleTilde => (
                Sym::Like {
                    ci: false,
                    negated: true,
                },
                5,
            ),
            Token::NotDoubleTildeStar => (
                Sym::Like {
                    ci: true,
                    negated: true,
                },
                5,
            ),
            Token::CaretAt => (Sym::StartsWith, 5),
            // PG `^` is exponentiation; MySQL `^` is bitwise XOR (and binds
            // tighter than `* / & |`, which the prec-9 rung preserves —
            // v7.39 round 407: +1 from the pre-XOR ladder's rung 8).
            Token::Caret if self.mysql_dialect => (Sym::Xor, 9),
            Token::Caret => (Sym::Power, 9),
            // v7.39 (round 760, F31-B1) — `#` is a generic operator too:
            // PG answers `5 # 3 + 1` as `5 # 4` = 1 (additive first).
            Token::Hash => (Sym::Xor, 6),
            Token::Adjacent => (Sym::RangeAdjacent, 5),
            _ => return Ok(None),
        };
        if prec < min_prec {
            return Ok(None);
        }
        self.advance();
        let rhs = self.parse_expr(prec + 1)?;
        let out = match sym {
            Sym::Regex { ci, negated } => {
                let mut args = alloc::vec![lhs.clone(), rhs];
                if ci {
                    args.push(Expr::Literal(Literal::String(String::from("i"))));
                }
                maybe_not(
                    Expr::FunctionCall {
                        name: String::from("regexp_like"),
                        args,
                    },
                    negated,
                )
            }
            Sym::Like { ci, negated } => Expr::Like {
                expr: alloc::boxed::Box::new(lhs.clone()),
                pattern: alloc::boxed::Box::new(rhs),
                negated,
                case_insensitive: ci,
            },
            Sym::StartsWith => Expr::FunctionCall {
                name: String::from("starts_with"),
                args: alloc::vec![lhs.clone(), rhs],
            },
            Sym::Power => Expr::FunctionCall {
                name: String::from("power"),
                args: alloc::vec![lhs.clone(), rhs],
            },
            // `#` bitwise XOR — a real operator now (was desugared to
            // `(a|b)-(a&b)`, algebraically identical for integers but
            // undefined for bit strings; the direct op handles both).
            Sym::Xor => Expr::Binary {
                lhs: Box::new(lhs.clone()),
                op: BinOp::BitXor,
                rhs: Box::new(rhs),
            },
            // range `-|-` "is adjacent to" — lowered to a catalog function.
            Sym::RangeAdjacent => Expr::FunctionCall {
                name: String::from("range_adjacent"),
                args: alloc::vec![lhs.clone(), rhs],
            },
        };
        Ok(Some(out))
    }

    /// v7.39 (IS-precedence knife) — the LOW-precedence postfix
    /// predicates, moved out of the tight postfix-cast loop: PG binds
    /// `IS [NOT] NULL/TRUE/FALSE/UNKNOWN/DISTINCT FROM/JSON/NORMALIZED`
    /// looser than EVERY binary operator (only NOT/AND/OR are looser),
    /// and BETWEEN/IN/LIKE/ILIKE/SIMILAR at the comparison rung — so
    /// `1 + 1 IS NULL` is `(1+1) IS NULL`, not `1 + (1 IS NULL)`.
    /// Returns Ok(consumed expr) when a predicate fired, Err(expr back)
    /// when nothing at this position belongs to the family. Out-of-line
    /// (`inline(never)`): the caller sits on the per-nesting-level frame
    /// chain that MAX_NEST_DEPTH is tuned against.
    #[inline(never)]
    fn parse_postfix_predicate(
        &mut self,
        lhs: &Expr,
        min_prec: u8,
    ) -> Result<Option<Expr>, ParseError> {
        // Reached through try_symbol_operator (an existing leaf call of
        // the binary loop) so NO new stack slots land on the per-nesting
        // frame chain; the lhs clones only when a predicate actually
        // consumes it.
        match self.peek() {
            // v7.39 (round 407) — IS is rung 4, the BETWEEN/IN/LIKE
            // comparison family rung 5 (each +1 from the pre-XOR ladder).
            Token::Is if min_prec <= 4 => {}
            Token::Between | Token::In | Token::Like if min_prec <= 5 => {}
            Token::Not
                if min_prec <= 5
                    && matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Between | Token::In | Token::Like)
                    ) => {}
            Token::Not | Token::Ident(_)
                if min_prec <= 5
                    && (matches!(self.peek(), Token::Ident(s)
                            if s.eq_ignore_ascii_case("ilike")
                                || (self.mysql_dialect
                                    && (s.eq_ignore_ascii_case("regexp")
                                        || s.eq_ignore_ascii_case("rlike")))
                                || (s.eq_ignore_ascii_case("similar")
                                    && matches!(self.tokens.get(self.pos + 1), Some(Token::To))))
                        || (matches!(self.peek(), Token::Not)
                            && matches!(self.tokens.get(self.pos + 1),
                                Some(Token::Ident(s)) if s.eq_ignore_ascii_case("ilike")
                                    || (self.mysql_dialect
                                        && (s.eq_ignore_ascii_case("regexp")
                                            || s.eq_ignore_ascii_case("rlike")))
                                    || s.eq_ignore_ascii_case("similar")))) => {}
            _ => return Ok(None),
        }
        let mut expr = lhs.clone();
        // IS family: rung 4 (NOT's operand parses at 4, so `NOT x IS NULL`
        // still groups as NOT (x IS NULL); OR/XOR/AND at 1-3 stay outside).
        if min_prec <= 4 {
            if matches!(self.peek(), Token::Is) {
                self.advance();
                let negated = if matches!(self.peek(), Token::Not) {
                    self.advance();
                    true
                } else {
                    false
                };
                // v7.9.27b — `IS [NOT] DISTINCT FROM <rhs>`.
                // mailrs pg_dump.
                if matches!(self.peek(), Token::Distinct) {
                    self.advance();
                    if !matches!(self.peek(), Token::From) {
                        return Err(self.err(format!(
                            "expected FROM after IS{} DISTINCT, got {:?}",
                            if negated { " NOT" } else { "" },
                            self.peek()
                        )));
                    }
                    self.advance();
                    // Right-hand side: parse at the same precedence
                    // tier as comparison (rung 5) so `x IS DISTINCT FROM a + b`
                    // groups as `x IS DISTINCT FROM (a + b)`.
                    let rhs = self.parse_expr(5)?;
                    let op = if negated {
                        BinOp::IsNotDistinctFrom
                    } else {
                        BinOp::IsDistinctFrom
                    };
                    expr = Expr::Binary {
                        op,
                        lhs: Box::new(expr),
                        rhs: Box::new(rhs),
                    };
                    {
                        return Ok(Some(expr));
                    }
                }
                // v7.37.17 (17.6 siblings) — SQL:2016 / PG 16
                // `IS [NOT] JSON [VALUE|OBJECT|ARRAY|SCALAR]`.
                // Lowers onto pg_is_json(x, kind); NOT wraps the
                // call in a logical negation.
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("json"))
                {
                    self.advance(); // JSON
                    let kind = match self.peek() {
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if matches!(
                                s.to_ascii_lowercase().as_str(),
                                "value" | "object" | "array" | "scalar"
                            ) =>
                        {
                            let k = s.to_ascii_lowercase();
                            self.advance();
                            k
                        }
                        _ => "value".to_string(),
                    };
                    let call = Expr::FunctionCall {
                        name: "pg_is_json".to_string(),
                        args: alloc::vec![expr, Expr::Literal(Literal::String(kind)),],
                    };
                    expr = if negated {
                        Expr::Unary {
                            op: UnOp::Not,
                            expr: Box::new(call),
                        }
                    } else {
                        call
                    };
                    {
                        return Ok(Some(expr));
                    }
                }
                // v7.38 (read01 sweep) — SQL:2016 `x IS [NOT] [form]
                // NORMALIZED` (form ∈ NFC/NFD/NFKC/NFKD, default NFC).
                // Lowers onto is_normalized(x [, 'FORM']); NOT negates.
                {
                    let form_kw = match self.peek() {
                        Token::Ident(s) | Token::QuotedIdent(s)
                            if matches!(
                                s.to_ascii_uppercase().as_str(),
                                "NFC" | "NFD" | "NFKC" | "NFKD"
                            ) && matches!(
                                self.tokens.get(self.pos + 1),
                                Some(Token::Ident(n) | Token::QuotedIdent(n))
                                    if n.eq_ignore_ascii_case("normalized")
                            ) =>
                        {
                            Some(s.to_ascii_uppercase())
                        }
                        _ => None,
                    };
                    let bare_normalized = form_kw.is_none()
                        && matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                        if s.eq_ignore_ascii_case("normalized"));
                    if form_kw.is_some() || bare_normalized {
                        if form_kw.is_some() {
                            self.advance(); // form keyword
                        }
                        self.advance(); // NORMALIZED
                        let mut args = alloc::vec![expr];
                        if let Some(f) = form_kw {
                            args.push(Expr::Literal(Literal::String(f)));
                        }
                        let call = Expr::FunctionCall {
                            name: "is_normalized".to_string(),
                            args,
                        };
                        expr = if negated {
                            Expr::Unary {
                                op: UnOp::Not,
                                expr: Box::new(call),
                            }
                        } else {
                            call
                        };
                        {
                            return Ok(Some(expr));
                        }
                    }
                }
                // `x IS [NOT] TRUE | FALSE | UNKNOWN` — the
                // three-valued boolean tests. IS TRUE/FALSE never
                // return NULL, so they lower to CASE forms whose
                // ELSE catches the NULL branch; IS UNKNOWN on a
                // boolean is exactly IS NULL.
                if matches!(self.peek(), Token::True | Token::False)
                    || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("unknown"))
                {
                    let tok = self.advance();
                    let test = match tok {
                        Token::True => Some(true),
                        Token::False => Some(false),
                        _ => None, // UNKNOWN
                    };
                    // v7.39 (round 328, V45) — kept as what the user
                    // wrote. These used to be lowered here into `CASE` /
                    // `IS NULL`; the semantics were right but the AST no
                    // longer knew the form, so `CHECK ((a > 1) IS TRUE)`
                    // was echoed back as
                    // `CHECK ((CASE WHEN (a > 1) THEN TRUE ELSE FALSE END))`.
                    expr = Expr::BoolTest {
                        expr: Box::new(expr),
                        value: test,
                        negated,
                    };
                    {
                        return Ok(Some(expr));
                    }
                }
                if !matches!(self.peek(), Token::Null) {
                    return Err(self.err(format!(
                    "expected NULL, DISTINCT, JSON, TRUE, FALSE or UNKNOWN after IS{}, got {:?}",
                    if negated { " NOT" } else { "" },
                    self.peek()
                )));
                }
                self.advance();
                expr = Expr::IsNull {
                    expr: Box::new(expr),
                    negated,
                };
                {
                    return Ok(Some(expr));
                }
            }
        }
        // BETWEEN / IN / LIKE / ILIKE / SIMILAR: comparison rung (5).
        if min_prec <= 5 {
            // `x [NOT] BETWEEN a AND b`, `x [NOT] IN (...)`, `x [NOT] LIKE p`.
            // Look one token ahead so a stray `NOT` not followed by any of
            // these flows through to the early return below untouched.
            let negated = if matches!(self.peek(), Token::Not) {
                let next = self.tokens.get(self.pos + 1);
                matches!(next, Some(Token::Between | Token::In | Token::Like))
                    || matches!(next, Some(Token::Ident(s)) if s.eq_ignore_ascii_case("ilike")
                    || (self.mysql_dialect
                        && (s.eq_ignore_ascii_case("regexp") || s.eq_ignore_ascii_case("rlike")))
                    || s.eq_ignore_ascii_case("similar"))
            } else {
                false
            };
            if negated {
                self.advance();
            }
            if matches!(self.peek(), Token::Between) {
                expr = self.parse_between_tail(expr, negated)?;
                {
                    return Ok(Some(expr));
                }
            }
            if matches!(self.peek(), Token::In) {
                if self.suppress_in_tail && !negated {
                    // POSITION(sub IN str) — IN belongs to the
                    // enclosing function syntax; stop here.
                    {
                        return Ok(None);
                    }
                }
                expr = self.parse_in_tail(expr, negated)?;
                {
                    return Ok(Some(expr));
                }
            }
            // v7.39 (read01 regexp.c) — `x [NOT] SIMILAR TO p [ESCAPE e]`
            // lowers onto the internal __similar_to(expr, pat[, esc]) call
            // (the SQL→regex transform runs inside, in the backtracking-
            // friendly shape SPG's matcher needs).
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("similar"))
                && matches!(self.tokens.get(self.pos + 1), Some(Token::To))
            {
                self.advance(); // SIMILAR
                self.advance(); // TO
                let pattern = self.parse_expr(6)?;
                let mut args = alloc::vec![expr, pattern];
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("escape")) {
                    self.advance();
                    args.push(self.parse_expr(6)?);
                }
                let call = Expr::FunctionCall {
                    name: "__similar_to".to_string(),
                    args,
                };
                expr = maybe_not(call, negated);
                {
                    return Ok(Some(expr));
                }
            }
            if matches!(self.peek(), Token::Like) {
                self.advance();
                // `x [NOT] LIKE ANY/ALL (ARRAY[...])` — quantified LIKE.
                if let Some(q) = self.try_like_any_all(&expr, negated, false)? {
                    expr = q;
                    {
                        return Ok(Some(expr));
                    }
                }
                // Pattern at the same precedence as other comparison RHSes —
                // 5 leaves AND/OR alone so `a LIKE 'x%' AND b` parses right.
                let mut pattern = self.parse_expr(6)?;
                // `ESCAPE 'c'` — rewrite a literal pattern to the
                // default backslash escape at parse time. Custom
                // escapes on non-literal patterns would need
                // matcher support; error honestly.
                if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("escape")) {
                    self.advance();
                    let esc = self.parse_expr(6)?;
                    pattern = Self::rewrite_like_escape(pattern, esc).map_err(|m| self.err(m))?;
                }
                expr = Expr::Like {
                    expr: Box::new(expr),
                    pattern: Box::new(pattern),
                    negated,
                    case_insensitive: false,
                };
                {
                    return Ok(Some(expr));
                }
            }
            // v7.25 (round-17) — ILIKE: case-insensitive LIKE. The
            // keyword reaches us as a plain identifier.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("ilike")) {
                self.advance();
                if let Some(q) = self.try_like_any_all(&expr, negated, true)? {
                    expr = q;
                    {
                        return Ok(Some(expr));
                    }
                }
                let pattern = self.parse_expr(6)?;
                expr = Expr::Like {
                    expr: Box::new(expr),
                    pattern: Box::new(pattern),
                    negated,
                    case_insensitive: true,
                };
                {
                    return Ok(Some(expr));
                }
            }
            // v7.39 (round 380) — MySQL's REGEXP / RLIKE regex-match
            // operator (RLIKE is the alias). It is a keyword, not `~`, and
            // matches case-insensitively under the default collation, so it
            // lowers onto the same `regexp_like(expr, pattern, 'i')` the
            // `~*` operator uses, wrapped in NOT when negated.
            if self.mysql_dialect
                && matches!(self.peek(), Token::Ident(s)
                    if s.eq_ignore_ascii_case("regexp") || s.eq_ignore_ascii_case("rlike"))
            {
                self.advance();
                let pattern = self.parse_expr(6)?;
                let call = Expr::FunctionCall {
                    name: String::from("regexp_like"),
                    args: alloc::vec![
                        expr,
                        pattern,
                        Expr::Literal(Literal::String(String::from("i"))),
                    ],
                };
                return Ok(Some(maybe_not(call, negated)));
            }
        }
        let _ = expr;
        Ok(None)
    }

    fn parse_expr_inner(&mut self, min_prec: u8) -> Result<Expr, ParseError> {
        let mut lhs = self.parse_unary()?;
        let mut chain_len = 0usize;
        loop {
            // OPERATOR([schema.]op) reduces to its underlying
            // operator token before the normal dispatch.
            let explicit = self.peek_explicit_operator();
            let dispatch = match &explicit {
                Some((_, tok)) => self.binop_here(tok),
                None => self.binop_here(self.peek()),
            };
            let Some((op, prec)) = dispatch else {
                // v7.39 (round 539) — `OPERATOR(pg_catalog.~)` and the rest
                // of the symbol family. `binop_here` answers None for them
                // because they lower onto function calls rather than a
                // BinOp, and the fallback below reads `self.peek()` — the
                // word OPERATOR, not the operator. `pg_dump` writes every
                // catalog predicate this way, so its first query failed
                // and no dump ran:
                //
                //   AND c.relname OPERATOR(pg_catalog.~) '^(t)$'
                //
                // Collapsing the wrapper to the operator it names puts the
                // token where the fallback already looks.
                if let Some((next, op_tok)) = explicit {
                    self.tokens.splice(self.pos..next, [op_tok]);
                }
                if let Some(e) = self.try_symbol_operator(&lhs, min_prec)? {
                    lhs = e;
                    chain_len += 1;
                    if chain_len > MAX_BINARY_CHAIN {
                        return Err(self.err(alloc::format!(
                            "more than {MAX_BINARY_CHAIN} chained binary operators"
                        )));
                    }
                    continue;
                }
                break;
            };
            if prec < min_prec {
                break;
            }
            // v7.30.2 (mailrs round-25 ask 2) — the chain builds
            // iteratively but evaluates and drops recursively;
            // depth beyond the budget overflows worker stacks.
            chain_len += 1;
            if chain_len > MAX_BINARY_CHAIN {
                return Err(self.err(alloc::format!(
                    "more than {MAX_BINARY_CHAIN} chained binary operators; rewrite long OR-equality chains as IN (…)"
                )));
            }
            match explicit {
                Some((end_pos, _)) => self.pos = end_pos,
                None => {
                    self.advance();
                }
            }
            // v7.10.12 — `x <op> ANY(arr)` / `x <op> ALL(arr)`.
            // ANY is a bare ident; ALL is a reserved Token. Both
            // require an immediate `(` to disambiguate from
            // identifier columns named `any` / `all`.
            let any_kind = match self.peek() {
                Token::All if matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) => {
                    Some(false)
                }
                Token::Ident(s) | Token::QuotedIdent(s)
                    if (s.eq_ignore_ascii_case("any")
                        || s.eq_ignore_ascii_case("some")
                        || s.eq_ignore_ascii_case("all"))
                        && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) =>
                {
                    Some(!s.eq_ignore_ascii_case("all"))
                }
                _ => None,
            };
            if let Some(is_any) = any_kind {
                lhs = self.parse_any_all_rhs(lhs, op, is_any)?;
                continue;
            }
            let rhs = self.parse_expr(prec + 1)?;
            lhs = Expr::Binary {
                lhs: Box::new(lhs),
                op,
                rhs: Box::new(rhs),
            };
        }
        Ok(lhs)
    }

    /// `x <op> ANY (…)` / `ALL (…)`, both the quantified-subquery form
    /// and the array form.
    ///
    /// `#[inline(never)]` and out of `parse_expr_inner`, which sits on the
    /// frame chain `MAX_NEST_DEPTH` is tuned against: a debug build gives
    /// this block's `Expr` temporaries and four `format!` sites slots in
    /// that frame on every level of `((((1))))`, which never reaches it.
    #[inline(never)]
    fn parse_any_all_rhs(
        &mut self,
        lhs: Expr,
        op: BinOp,
        is_any: bool,
    ) -> Result<Expr, ParseError> {
        self.advance(); // ident
        self.advance(); // (
        // `x op ANY (SELECT …)` — the quantified-subquery
        // form. `= ANY` is exactly IN; the other operators
        // lower onto EXISTS over the subquery as a derived
        // table, comparing against its single projection
        // aliased __v (x's columns resolve correlated).
        // ALL is the negated-EXISTS complement; a NULL
        // element makes PG return NULL where this lowering
        // returns true — the NOT NULL column case (the
        // practical one) is exact.
        if matches!(self.peek(), Token::Select) || self.peek_is_with_kw() {
            // v7.39 (round 153) — `ANY (WITH … SELECT …)` is
            // legal PG too (round-151 sibling). Out-of-line
            // (#[inline(never)] helper) — this sits on
            // parse_expr's recursive frame and the two-armed
            // SELECT temporary blew the nesting-budget stack.
            let mut sub = self.parse_any_all_select_body()?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after ANY/ALL subquery, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            if sub.items.len() != 1 {
                return Err(self.err(alloc::format!(
                    "ANY/ALL subquery must return one column, got {}",
                    sub.items.len()
                )));
            }
            if is_any && matches!(op, BinOp::Eq) {
                return Ok(Expr::InSubquery {
                    expr: Box::new(lhs),
                    subquery: Box::new(sub),
                    negated: false,
                });
            }
            // The engine's subquery resolvers materialise
            // the single-column result into an ARRAY the
            // existing AnyAll three-valued eval consumes.
            return Ok(Expr::AnyAll {
                expr: Box::new(lhs),
                op,
                array: Box::new(Expr::ScalarSubquery(Box::new(sub))),
                is_any,
            });
        }
        let arr = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' after ANY/ALL argument, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(Expr::AnyAll {
            expr: Box::new(lhs),
            op,
            array: Box::new(arr),
            is_any,
        })
    }

    /// v7.39 (read01 geo_ops.c) — prefix `@@` (center-of). Out-of-line
    /// from `parse_unary` (see the frame-budget note at MAX_NEST_DEPTH).
    #[inline(never)]
    fn parse_prefix_center(&mut self) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(9)?;
        Ok(build_center_call(e))
    }

    /// v7.39 (round 508) — a prefix operator that IS a function: `@ x` is
    /// `abs(x)`, `# p` is `npoints(p)`, `@-@ p` is `length(p)`. Binds like
    /// unary minus.
    ///
    /// `#[inline(never)]` for the same reason as its neighbours: parse_unary
    /// sits on the recursive frame chain MAX_NEST_DEPTH is tuned against, so
    /// the Expr-sized local stays out of that frame.
    #[inline(never)]
    fn parse_prefix_call(&mut self, name: &str) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(9)?;
        Ok(Expr::FunctionCall {
            name: alloc::string::String::from(name),
            args: alloc::vec![e],
        })
    }

    /// v7.39 (read01 geo_ops.c) — prefix `?|` (vertical) / `?-`
    /// (horizontal). Out-of-line from `parse_unary` (frame budget).
    #[inline(never)]
    fn parse_prefix_geom_axis(&mut self, vertical: bool) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(9)?;
        Ok(Expr::FunctionCall {
            name: alloc::string::String::from(if vertical {
                "isvertical"
            } else {
                "ishorizontal"
            }),
            args: alloc::vec![e],
        })
    }

    /// v7.39 (round 355, M13) — `BINARY <expr>`, lowered onto the same
    /// cast the `CAST(x AS BINARY)` spelling produces. It binds tightly:
    /// MariaDB reads `BINARY 1 + 1` as `(BINARY 1) + 1` = 2.
    #[inline(never)]
    fn parse_binary_prefix(&mut self) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(9)?;
        Ok(Expr::Cast {
            expr: Box::new(e),
            target: CastTarget::Named("binary".to_string()),
        })
    }

    /// The prefix operators that share one shape: take the token, parse
    /// an operand at `prec`, wrap it.
    ///
    /// `#[inline(never)]`, and one function instead of five arms, for the
    /// reason the neighbouring `parse_prefix_*` helpers give: `parse_unary`
    /// sits on the frame chain `MAX_NEST_DEPTH` is tuned against, and a
    /// debug build gives EVERY arm's locals a slot in the frame, whichever
    /// arm runs. `((((1))))` reaches none of these arms and was carrying
    /// five `Expr`-sized locals per level for them anyway.
    #[inline(never)]
    fn parse_unary_op(&mut self, op: UnOp, prec: u8) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(prec)?;
        Ok(Expr::Unary {
            op,
            expr: Box::new(e),
        })
    }

    /// Unary minus. Out-of-line for the frame reason on `parse_unary_op`,
    /// and separate from it because of the literal folding below and the
    /// `format!` temporaries that folding needs.
    #[inline(never)]
    fn parse_prefix_minus(&mut self) -> Result<Expr, ParseError> {
        self.advance();
        // v7.39 (round 549) — fold the sign into an integer literal that
        // only fits once it is negative.
        //
        // `9223372036854775808` is one past i64::MAX, so the lexer hands
        // it over as a NUMERIC and `-` on a numeric stays numeric. PG
        // folds the sign first, so `-9223372036854775808` is a bigint
        // there — and `-9223372036854775808 - 1` raises "bigint out of
        // range" where SPG quietly answered -9223372036854775809, a value
        // no bigint can hold. The arithmetic itself was already checked;
        // only the literal's type was wrong.
        if let Token::Numeric(lit) = self.peek()
            && let Ok(folded) = alloc::format!("-{lit}").parse::<i64>()
        {
            self.advance();
            return Ok(Expr::Literal(Literal::Integer(folded)));
        }
        // Unary minus binds tighter than `*`/`/` (now at prec 7 after
        // `<->` slotted into 5 and arithmetic shifted up).
        let e = self.parse_expr(9)?;
        Ok(Expr::Unary {
            op: UnOp::Neg,
            expr: Box::new(e),
        })
    }

    /// tsquery `!!` prefix negation, lowered to the catalog function.
    /// Binds like unary minus. Out-of-line for the frame reason on
    /// `parse_unary_op`.
    #[inline(never)]
    fn parse_prefix_tsquery_not(&mut self) -> Result<Expr, ParseError> {
        self.advance();
        let e = self.parse_expr(9)?;
        Ok(Expr::FunctionCall {
            name: String::from("tsquery_not"),
            args: alloc::vec![e],
        })
    }

    fn parse_unary(&mut self) -> Result<Expr, ParseError> {
        match self.peek() {
            // NOT binds tighter than AND / XOR / OR but looser than
            // comparisons — its operand takes everything ≥ the comparison
            // rung (4), leaving AND (3) / XOR (2) / OR (1) outside so
            // `NOT a AND b` groups as `(NOT a) AND b`. (v7.39 round 407:
            // was rung 3, behaviour-identical when 3 was unused; AND now
            // occupies 3, so this must be 4 to keep NOT tighter than AND.)
            Token::Not => self.parse_unary_op(UnOp::Not, 4),
            // v7.39 (round 355, M13) — MySQL's `BINARY <expr>` prefix.
            // The body is out-of-line: `parse_unary` is one of the three
            // frames the parser's MAX_NEST_DEPTH is tuned against, and an
            // inline arm here overflowed the native stack in
            // `nesting_budget_errors_cleanly` — the guard test caught it,
            // exactly as the eval-side cliff did in rounds 346 and 351.
            Token::Ident(w) if self.mysql_dialect && w.eq_ignore_ascii_case("binary") => {
                self.parse_binary_prefix()
            }
            // v7.39 (round 353, M10) — MySQL's `!`. It binds TIGHTER than
            // arithmetic, unlike NOT: MariaDB answers 1 for `!1 + 1`
            // (`(!1)+1`) and 0 for `NOT 1 + 1` (`NOT (1+1)`), measured.
            Token::Bang => self.parse_unary_op(UnOp::Not, 9),
            Token::Minus => self.parse_prefix_minus(),
            // v7.39 (round 507) — unary `+`, which SPG did not have. `+1`
            // worked only because the lexer reads it as one signed literal;
            // `+ 1`, `+a`, `+(1)` and `1 + +1` were syntax errors, and both
            // PG18 and MariaDB take all of them. Binds like unary minus.
            Token::Plus => self.parse_unary_op(UnOp::Plus, 9),
            // Bitwise NOT binds like unary minus.
            Token::Tilde => self.parse_unary_op(UnOp::BitNot, 9),
            // v7.39 (read01 geo_ops.c) — prefix `@@` is PG's geometric
            // "center of" operator; desugars to center(x). The whole arm
            // is out-of-line: parse_unary sits on the per-nesting-level
            // frame chain that MAX_NEST_DEPTH is tuned against, so no
            // Expr-sized local may live in this frame.
            Token::TsMatch => self.parse_prefix_center(),
            // v7.39 (round 508) — the prefix operators that are named
            // functions in disguise: `@ x` is abs, `# p` is npoints, `@-@ p`
            // is length. Out-of-line for the same nesting-frame reason as
            // parse_prefix_center — parse_unary sits on the recursive cycle
            // MAX_NEST_DEPTH is tuned against, so no Expr-sized local may
            // live in this frame.
            Token::At => self.parse_prefix_call("abs"),
            Token::Hash => self.parse_prefix_call("npoints"),
            Token::AtMinusAt => self.parse_prefix_call("length"),
            // v7.39 (read01 geo_ops.c) — prefix `?|` / `?-`: "is vertical" /
            // "is horizontal" (lseg / line); desugars to the existing
            // isvertical()/ishorizontal() functions. Out-of-line for the
            // same nesting-frame reason as parse_prefix_center.
            Token::JsonKeysAny => self.parse_prefix_geom_axis(true),
            Token::GeomHoriz => self.parse_prefix_geom_axis(false),
            Token::DoubleBang => self.parse_prefix_tsquery_not(),
            _ => self.parse_atom(),
        }
    }

    /// Parse a parenthesised scalar subquery body after the caller has consumed
    /// `(` and confirmed the next token is SELECT (or WITH, when `is_with`).
    /// v7.37 D.43 — `#[inline(never)]` keeps the large `Statement` local and the
    /// SELECT/WITH parse machinery off `parse_atom`'s stack frame; parse_atom sits
    /// on the recursive `((…))` cycle whose depth budget is tuned to that frame.
    /// v7.39 (read01 round 105) — is the current position `( <subquery-start>`,
    /// i.e. an `ARRAY(<subquery>)` and not `ARRAY[...]`? A subquery starts with
    /// SELECT, VALUES, or WITH (WITH lexes as a bare ident).
    /// `#[inline(never)]`: keeps this guard's locals off parse_atom's frame,
    /// which sits on the recursive nesting-budget cycle (a few extra bytes there
    /// tips the deep-nesting test into a stack overflow).
    #[inline(never)]
    fn array_subquery_ahead(&self) -> bool {
        if !matches!(self.peek(), Token::LParen) {
            return false;
        }
        matches!(
            self.tokens.get(self.pos + 1),
            Some(Token::Select | Token::Values)
        ) || matches!(
            self.tokens.get(self.pos + 1),
            Some(Token::Ident(w) | Token::QuotedIdent(w)) if w.eq_ignore_ascii_case("with")
        )
    }

    /// v7.10.10 — `ARRAY[expr, …]` literal body. The `array` ident is consumed
    /// and the current token is `[`. `#[inline(never)]` so its `Vec`/loop
    /// locals stay off parse_atom's recursive frame (round 105).
    #[inline(never)]
    fn parse_array_literal_body(&mut self) -> Result<Expr, ParseError> {
        self.advance(); // consume `[`
        let mut items: Vec<Expr> = Vec::new();
        if !matches!(self.peek(), Token::RBracket) {
            loop {
                // Inside `ARRAY[...]`, a nested `[...]` is a sub-array
                // (`ARRAY[[1,2],[3,4]]`), not a pgvector literal.
                if matches!(self.peek(), Token::LBracket) {
                    items.push(self.parse_array_bracket_body()?);
                } else {
                    items.push(self.parse_expr(0)?);
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RBracket => break,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ']' in ARRAY literal, got {other:?}"
                        )));
                    }
                }
            }
        }
        self.advance(); // consume `]`
        Ok(Expr::Array(items))
    }

    /// v7.39 (read01 round 105) — parse `ARRAY(<subquery>)`. The `array` ident
    /// is already consumed; the current token is `(`. Desugars to a scalar
    /// subquery `SELECT array_agg(c) FROM (<subquery>) AS t(c)`, which collects
    /// the subquery's single-column rows in order — reusing the existing
    /// ScalarSubquery machinery rather than adding an AST node. `#[inline(never)]`
    /// keeps the large `Statement` local off parse_atom's recursive frame.
    #[inline(never)]
    fn parse_array_subquery(&mut self) -> Result<Expr, ParseError> {
        self.advance(); // consume `(`
        let is_with = matches!(self.peek(), Token::Ident(w) | Token::QuotedIdent(w)
            if w.eq_ignore_ascii_case("with"));
        let sub = if is_with {
            self.advance(); // WITH
            self.parse_with_cte_then_select()?
        } else {
            self.parse_select_stmt()?
        };
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close ARRAY(subquery), got {:?}",
                self.peek()
            )));
        }
        self.advance(); // consume `)`
        // Reuse the parser to build the array_agg wrapper from the subquery's
        // canonical text — avoids hand-constructing the derived-table AST.
        let wrapper = alloc::format!(
            "SELECT array_agg(\"__spg_arr_c\") FROM ({sub}) AS \"__spg_arr_t\"(\"__spg_arr_c\")"
        );
        let stmt = parse_statement(&wrapper)
            .map_err(|e| self.err(alloc::format!("ARRAY(subquery): {}", e.message)))?;
        let Statement::Select(sel) = stmt else {
            return Err(self.err("ARRAY(subquery) did not desugar to a SELECT".into()));
        };
        Ok(Expr::ScalarSubquery(alloc::boxed::Box::new(sel)))
    }

    #[inline(never)]
    fn parse_paren_scalar_subquery(&mut self, is_with: bool) -> Result<Expr, ParseError> {
        let inner = if is_with {
            self.advance(); // WITH
            self.parse_with_cte_then_select()?
        } else {
            self.parse_select_stmt()?
        };
        match self.advance() {
            Token::RParen => {
                let Statement::Select(s) = inner else {
                    return Err(ParseError {
                        message: "scalar subquery body must be a SELECT".into(),
                        token_pos: self.consumed_pos(),
                    });
                };
                Ok(Expr::ScalarSubquery(Box::new(s)))
            }
            other => Err(ParseError {
                message: format!("expected ')' after scalar subquery, got {other:?}"),
                token_pos: self.consumed_pos(),
            }),
        }
    }

    /// `B'1010'` / `X'1F'` bit-string (PG) or binary-string (MySQL)
    /// literals. The lexer splits them into an ident + string; recombine
    /// here. Out-of-line and returning `Option` so `parse_atom` — the
    /// recursive frame the 768 KiB stack budget is tuned against — pays no
    /// frame for the `body` / `bits` strings and their char loops (the
    /// round-367 frame cliff, M20).
    #[inline(never)]
    fn try_parse_bit_string_literal(&mut self) -> Option<Result<Expr, ParseError>> {
        let is_hex = match self.peek() {
            Token::Ident(p) if p.eq_ignore_ascii_case("x") => true,
            Token::Ident(p) if p.eq_ignore_ascii_case("b") => false,
            _ => return None,
        };
        if !matches!(self.tokens.get(self.pos + 1), Some(Token::String(_))) {
            return None;
        }
        self.advance();
        let Token::String(body) = self.advance() else {
            unreachable!("guarded above");
        };
        // v7.39 (round 367, M20) — in the MySQL dialect `X'…'` and `b'…'`
        // are BINARY STRINGS, not PG bit strings. `X'41'` is the byte 0x41
        // (hex pairs, even count required — MariaDB errors on an odd
        // count); `b'1010'` packs its bits big-endian, left-padded to a
        // byte. Lower both onto the bytea cast.
        if self.mysql_dialect {
            if is_hex {
                if body.len() % 2 == 1 {
                    return Some(Err(self.err(alloc::format!(
                        "invalid hex string literal X'{body}': odd digit count"
                    ))));
                }
                for c in body.chars() {
                    if !c.is_ascii_hexdigit() {
                        return Some(Err(
                            self.err(alloc::format!("invalid hexadecimal digit {c:?} in X'…'"))
                        ));
                    }
                }
                return Some(self.finish_postfix_casts(hex_literal_to_bytea_expr(&body)));
            }
            if let Some(bad) = body.chars().find(|c| *c != '0' && *c != '1') {
                return Some(Err(
                    self.err(alloc::format!("invalid binary digit {bad:?} in b'…'"))
                ));
            }
            return Some(self.finish_postfix_casts(bits_literal_to_bytea_expr(&body)));
        }
        let bits = if is_hex {
            let mut out = String::with_capacity(body.len() * 4);
            for c in body.chars() {
                let Some(d) = c.to_digit(16) else {
                    return Some(Err(self.err(alloc::format!(
                        "invalid hexadecimal digit {c:?} in X'…' bit string"
                    ))));
                };
                out.push_str(&alloc::format!("{d:04b}"));
            }
            out
        } else {
            if let Some(bad) = body.chars().find(|c| *c != '0' && *c != '1') {
                return Some(Err(self.err(alloc::format!(
                    "invalid binary digit {bad:?} in B'…' bit string"
                ))));
            }
            body
        };
        // Route through the postfix-cast loop so a chained cast like
        // `B'1010'::int` attaches onto the implicit `::bit` cast instead
        // of erroring at the `::`.
        // v7.39 (read01 varbit.c) — a distinct internal target: a B'...'
        // literal keeps its exact length, while an explicit `::bit` cast is
        // bit(1) with pad/truncate semantics (PG).
        Some(self.finish_postfix_casts(Expr::Cast {
            expr: Box::new(Expr::Literal(Literal::String(bits))),
            target: CastTarget::Named("__bit_literal".to_string()),
        }))
    }

    fn parse_atom(&mut self) -> Result<Expr, ParseError> {
        if let Some(res) = self.try_parse_bit_string_literal() {
            return res;
        }
        let tok_pos = self.pos;
        match self.advance() {
            Token::Integer(n) => Ok(Expr::Literal(Literal::Integer(n))),
            Token::Float(x) => Ok(Expr::Literal(Literal::Float(x))),
            // v7.38 (read01) — dotted / over-i64 literal → exact NUMERIC (PG),
            // carrying the source mantissa + scale so no precision is lost. A
            // literal too wide for i128 falls back to double precision.
            // Out-of-line (#[inline(never)]) — this arm sits on the
            // parse_expr recursion chain; its expansion locals must not
            // widen the recursive frame (debug frame-cliff discipline).
            Token::Numeric(s) => match numeric_token_to_literal(s) {
                Ok(lit) => Ok(Expr::Literal(lit)),
                Err(msg) => Err(self.err(msg)),
            },
            Token::String(s) => Ok(Expr::Literal(Literal::String(s))),
            // v7.39 (round 367, M20) — a MySQL `0x…` binary-string literal
            // (the lexer only emits this token in the MySQL dialect). Lower
            // onto the existing bytea cast; out-of-line to keep this arm off
            // the parse recursion frame.
            Token::HexBytes(s) => Ok(hex_literal_to_bytea_expr(&s)),
            Token::True => Ok(Expr::Literal(Literal::Bool(true))),
            Token::False => Ok(Expr::Literal(Literal::Bool(false))),
            Token::Null => Ok(Expr::Literal(Literal::Null)),
            // v6.1.1 — `$N` placeholder. The actual Value lookup
            // happens in the engine eval path against the prepared-
            // statement bind buffer.
            Token::Placeholder(n) => Ok(Expr::Placeholder(n)),
            Token::LParen => {
                // v4.10: `(SELECT ...)` in expression position is a
                // scalar subquery; otherwise it's a parenthesised
                // expression. Peek for SELECT keyword to dispatch.
                // v7.37 D.43 — also accept `(WITH [RECURSIVE] … SELECT …)`; WITH
                // lexes as Ident("with") (not a reserved token). The subquery body
                // is parsed in `parse_paren_scalar_subquery` (marked #[inline(never)]
                // so its large `Statement` local stays out of parse_atom's stack
                // frame — parse_atom is on the recursive `((…))` cycle and the
                // nesting budget is tuned to its frame size).
                let is_with = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("with"));
                if matches!(self.peek(), Token::Select) || is_with {
                    self.parse_paren_scalar_subquery(is_with)
                } else {
                    let e = self.parse_expr(0)?;
                    // `(a, b, …)` — a row constructor. Valid only
                    // in front of a comparison operator or [NOT]
                    // IN; both expand at parse time (lexicographic
                    // comparison / OR'd row equalities).
                    if matches!(self.peek(), Token::Comma) {
                        let mut row = alloc::vec![e];
                        while matches!(self.peek(), Token::Comma) {
                            self.advance();
                            row.push(self.parse_expr(0)?);
                        }
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(alloc::format!(
                                "expected ')' after row constructor, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        // A bare `(a, b, …)` row constructor can carry postfix
                        // (`::text`, `.field`) just like `ROW(a, b, …)`; the
                        // early return here skips parse_atom's tail postfix
                        // pass, so fold casts in explicitly. For the
                        // comparison / predicate forms nothing postfix follows,
                        // so this is a no-op.
                        return self
                            .parse_row_comparison_tail(row)
                            .and_then(|e| self.finish_postfix_casts(e));
                    }
                    match self.advance() {
                        Token::RParen => Ok(e),
                        other => Err(ParseError {
                            message: format!("expected ')', got {other:?}"),
                            token_pos: self.consumed_pos(),
                        }),
                    }
                }
            }
            Token::LBracket => self.parse_vector_literal_body(),
            Token::Extract => self.parse_extract_atom(),
            Token::Interval => self.parse_interval_atom(),
            // `LEFT` / `RIGHT` are reserved-keyword tokens because the
            // grammar dedicates arms for `LEFT [OUTER] JOIN` /
            // `RIGHT [OUTER] JOIN`. When followed by `(` we're in
            // expression position calling the PG `left(string, n)` /
            // `right(string, n)` function; rebuild the AST as a regular
            // function call so the engine's apply_function dispatch picks
            // it up. Delegated to a #[inline(never)] helper so its locals
            // don't bloat this recursive `parse_atom` frame (the nesting
            // budget in `enter_nested` is tuned to parse_atom's size).
            Token::Left if matches!(self.peek(), Token::LParen) => {
                self.parse_lr_string_function_call("left")
            }
            Token::Right if matches!(self.peek(), Token::LParen) => {
                self.parse_lr_string_function_call("right")
            }
            // v4.10: EXISTS / NOT EXISTS. EXISTS isn't a reserved
            // token; we match on the bare ident. NOT is a token
            // (consumed in the comparison rung), but `EXISTS (...)`
            // at the top of an expression starts here.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("exists") => {
                self.parse_exists_atom(false)
            }
            // v7.13.0 — `CASE [<operand>] WHEN <cond> THEN <val>
            // [WHEN ...] [ELSE <val>] END` (mailrs round-5 G9).
            // CASE is a bare ident; we dispatch on lowercase match.
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("case") => {
                self.parse_case_atom()
            }
            // v7.37.17 (17.6 siblings) — PG typed datetime literals:
            // `DATE '2003-01-02'` / `TIMESTAMP '…'` / `TIMESTAMPTZ
            // '…'`. Lower onto the ::cast node so the existing
            // runtime text→date/timestamp paths do the parsing. The
            // string must follow immediately, else the ident stays a
            // plain column reference.
            Token::Ident(s)
                if typed_literal_cast_target(&s.to_ascii_lowercase()).is_some()
                    && matches!(self.peek(), Token::String(_)) =>
            {
                let target =
                    typed_literal_cast_target(&s.to_ascii_lowercase()).expect("guard checked");
                let Token::String(lit) = self.advance() else {
                    unreachable!("peek guaranteed a string token");
                };
                Ok(Expr::Cast {
                    expr: Box::new(Expr::Literal(Literal::String(lit))),
                    target,
                })
            }
            // v7.39 (round 221) — the SQL-standard long spellings:
            // `TIME [WITHOUT|WITH] TIME ZONE '…'` / `TIMESTAMP [WITHOUT|WITH]
            // TIME ZONE '…'`. Consume the modifier and lower to the same
            // typed-literal cast (`timetz` / `timestamptz` for WITH).
            Token::Ident(s)
                if (s.eq_ignore_ascii_case("time") || s.eq_ignore_ascii_case("timestamp"))
                    && matches!(self.peek(), Token::Ident(w) if w.eq_ignore_ascii_case("with")
                        || w.eq_ignore_ascii_case("without"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::Ident(t)) if t.eq_ignore_ascii_case("time"))
                    && matches!(self.tokens.get(self.pos + 2), Some(Token::Ident(z)) if z.eq_ignore_ascii_case("zone"))
                    && matches!(self.tokens.get(self.pos + 3), Some(Token::String(_))) =>
            {
                let with_tz = matches!(self.peek(), Token::Ident(w) if w.eq_ignore_ascii_case("with"));
                self.advance(); // WITH / WITHOUT
                self.advance(); // TIME
                self.advance(); // ZONE
                let Token::String(lit) = self.advance() else {
                    unreachable!("guard checked a string token");
                };
                let base = s.to_ascii_lowercase();
                let target = match (base.as_str(), with_tz) {
                    ("time", true) => CastTarget::Named(alloc::string::String::from("timetz")),
                    ("time", false) => CastTarget::Named(alloc::string::String::from("time")),
                    (_, true) => CastTarget::Timestamptz,
                    (_, false) => CastTarget::Timestamp,
                };
                Ok(Expr::Cast {
                    expr: Box::new(Expr::Literal(Literal::String(lit))),
                    target,
                })
            }
            // v7.39 (read01 round 105) — `ARRAY(<subquery>)` constructor:
            // gathers the subquery's single-column rows (in its row order)
            // into an array. Desugared to `array_agg` over the subquery as a
            // derived table; out-of-line to keep parse_atom's frame small (it
            // sits on the recursive nesting-budget cycle).
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("array") && self.array_subquery_ahead() =>
            {
                self.parse_array_subquery()
            }
            // v7.10.10 — `ARRAY[expr, expr, …]` constructor. ARRAY
            // is not a reserved token; we match by case-insensitive
            // ident. The opening `[` must follow immediately. v7.39 (read01
            // round 105) — the body moved out-of-line so its `Vec`/loop locals
            // leave parse_atom's frame (which sits on the nesting-budget cycle).
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("array") && matches!(self.peek(), Token::LBracket) =>
            {
                self.parse_array_literal_body()
            }
            // v7.17.0 Phase 2.2 — MySQL `MATCH(col, ...) AGAINST
            // ('term' [IN BOOLEAN MODE | IN NATURAL LANGUAGE MODE])`.
            // We special-case before the generic ident dispatch so
            // the AGAINST clause never reaches the function-call
            // loop (which would mis-read `(cols) AGAINST` as a
            // call with no trailing modifier). The shape is
            // rewritten to a Boolean OR over per-column
            // `to_tsvector('simple', col) @@ plainto_tsquery('simple',
            // term)` so the existing FTS evaluator handles
            // semantics — the fulltext-GIN built at CREATE TABLE
            // time is currently a "real index that survives dump
            // round-trip"; the planner hook that actually uses
            // it for posting-list intersection lands in a later
            // sub-phase (Phase 2.2b) without touching this surface.
            Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("match") && matches!(self.peek(), Token::LParen) =>
            {
                self.parse_match_against_atom()
            }
            Token::Ident(s) | Token::QuotedIdent(s) => self.finish_ident_atom(s),
            // v7.37.43-T4 — PG-unreserved keywords are legal column /
            // alias names in expression context too. `release` appears
            // in sentori `0003_partition_events.sql` as both a column
            // reference (SELECT … release …) and an INSERT column list
            // entry. Mirrors `expect_ident_like`'s expansion of the
            // identifier set.
            other if unreserved_keyword_text(&other).is_some() => {
                let s = unreserved_keyword_text(&other).unwrap();
                self.finish_ident_atom(s)
            }
            // v7.39 (round 331, V50) — `@@var` in an EXPRESSION. It parsed
            // only inside `SET` before, so `SELECT @@autocommit` — which
            // every MySQL connector asks at handshake — was a parse error.
            // MariaDB accepts the bare, `@@session.` and `@@global.`
            // spellings alike and answers from the session's own value.
            Token::SessionVar(v) => {
                // v7.39 (round 430) — ONE `@` is a MySQL USER variable, which
                // has nothing to do with a `@@` engine setting: its own
                // per-session namespace, and an unset one reads NULL instead
                // of raising. Stripping every `@` (as this did) made `@x` and
                // `@@x` the same node, so `SELECT @x` answered "Unknown
                // system variable".
                Ok(variable_ref_atom(&v))
            }
            other => Err(ParseError {
                message: format!("unexpected token {other:?} in expression"),
                token_pos: tok_pos,
            }),
        }
        // After parsing the atom, fold any postfix `::vector` casts.
        .and_then(|atom| self.finish_postfix_casts(atom))
    }

    /// Postfix operators on an atom: `::TYPE` cast and `IS [NOT] NULL`.
    /// Both bind tighter than any binary op.
    /// Shared cast-target parser for postfix `::TYPE` and the
    /// standard `CAST(expr AS TYPE)` form (v7.25, round-17).
    /// If the next tokens are `( N )`, consume them and return the canonical
    /// `base(N)` name so a temporal cast (`::timestamp(2)`) carries its
    /// fractional-seconds precision into `CastTarget::Named`; otherwise `None`.
    fn consume_temporal_typmod(&mut self, base: &str) -> Option<alloc::string::String> {
        if !matches!(self.peek(), Token::LParen) {
            return None;
        }
        self.advance(); // (
        let n = match self.advance() {
            Token::Integer(n) => n,
            _ => return Some(base.to_string()), // malformed → drop precision
        };
        if matches!(self.peek(), Token::RParen) {
            self.advance();
        }
        Some(alloc::format!("{base}({n})"))
    }

    fn parse_cast_target(&mut self) -> Result<CastTarget, ParseError> {
        // r1052 — `::pg_catalog.regproc` and friends: pg_dump
        // schema-qualifies every cast target, and `pg_catalog.X` names
        // exactly the builtin type X. Consume the qualifier and let
        // the ordinary target parse decide.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("pg_catalog"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::Dot))
        {
            self.advance();
            self.advance();
        }
        let target = match self.advance() {
            Token::Ident(s) => match s.to_ascii_lowercase().as_str() {
                "int" | "integer" | "int4" => {
                    if matches!(self.peek(), Token::LBracket)
                        && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
                    {
                        self.advance();
                        self.advance();
                        CastTarget::IntArray
                    } else {
                        CastTarget::Int
                    }
                }
                "bigint" | "int8" => {
                    if matches!(self.peek(), Token::LBracket)
                        && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
                    {
                        self.advance();
                        self.advance();
                        CastTarget::BigIntArray
                    } else {
                        CastTarget::BigInt
                    }
                }
                "float" | "double" => CastTarget::Float,
                "text" => {
                    // v7.10.11 — `::TEXT[]` widens to TextArray.
                    if matches!(self.peek(), Token::LBracket)
                        && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
                    {
                        self.advance();
                        self.advance();
                        CastTarget::TextArray
                    } else {
                        CastTarget::Text
                    }
                }
                "bool" | "boolean" => CastTarget::Bool,
                "vector" => CastTarget::Vector,
                "date" => CastTarget::Date,
                // v7.38 (read01) — `::timestamp(N)` carries its fractional-
                // seconds precision through the Named path (the engine rounds
                // the sub-second field); bare `::timestamp` keeps the fast arm.
                "timestamp" | "datetime" => match self.consume_temporal_typmod("timestamp") {
                    Some(named) => CastTarget::Named(named),
                    None => CastTarget::Timestamp,
                },
                "timestamptz" => match self.consume_temporal_typmod("timestamptz") {
                    Some(named) => CastTarget::Named(named),
                    None => CastTarget::Timestamptz,
                },
                "interval" => CastTarget::Interval,
                "json" => CastTarget::Json,
                "jsonb" => CastTarget::Jsonb,
                // v7.39 (round 694) — these have dedicated CastTarget
                // variants, so they never reached the postfix `[]` handling
                // further down and `::regtype[]` was a SYNTAX error at the
                // `]`. PG has an array type for every scalar; take the
                // suffix here and hand the canonical `<ty>_array` name to
                // the engine, the same shape every other array cast uses.
                "regtype" if self.peek_postfix_array_brackets() => {
                    self.advance();
                    self.advance();
                    CastTarget::Named(alloc::string::String::from("regtype_array"))
                }
                "regclass" if self.peek_postfix_array_brackets() => {
                    self.advance();
                    self.advance();
                    CastTarget::Named(alloc::string::String::from("regclass_array"))
                }
                "regtype" => CastTarget::RegType,
                "regclass" => CastTarget::RegClass,
                // v7.12.0 — `::tsvector` / `::tsquery`.
                // Engine decodes the LHS text via the PG
                // external form parser.
                // v7.39 (round 352, M8) — MySQL's own cast targets.
                // `CAST(x AS SIGNED)` / `UNSIGNED`, with the optional
                // `INTEGER` / `INT` tail MariaDB also accepts. PG has no
                // such type, so they are taken only in that dialect and
                // fall through to the "type does not exist" arm otherwise.
                "signed" | "unsigned" if self.mysql_dialect => {
                    if matches!(self.peek(), Token::Ident(k)
                        if k.eq_ignore_ascii_case("integer") || k.eq_ignore_ascii_case("int"))
                    {
                        self.advance();
                    }
                    CastTarget::Named(s.to_ascii_lowercase())
                }
                // v7.39 (round 352, M8) — `CAST(x AS CHAR)` is UNBOUNDED
                // in MySQL: MariaDB answers '123' where the SQL-standard
                // reading (PG's, and SPG's) is `char(1)` and answers '1'.
                // Truncating a number to its first digit is a wrong answer
                // with no error, so the MySQL session gets MySQL's reading.
                "char" if self.mysql_dialect && !matches!(self.peek(), Token::LParen) => {
                    CastTarget::Text
                }
                "tsvector" => CastTarget::TsVector,
                "tsquery" => CastTarget::TsQuery,
                // v7.17.0 — `::uuid`. Engine decodes the LHS
                // text via `spg_storage::parse_uuid_str`.
                "uuid" => CastTarget::Uuid,
                // v7.18 — `::bytea`. Engine decodes the LHS
                // text via the PG hex form (`'\xdeadbeef'`)
                // or escape form (`'\\x05\\x00'`). Closes
                // mailrs D-pre #3 reverse-acceptance gap.
                "bytea" => CastTarget::Bytea,
                // v7.37.5 ship triage — generic typed-cast escape.
                // Anything the long-tail PG type ident table knows
                // about(network/bit/geometry/multirange/etc.)flows
                // through `CastTarget::Named(canonical)`; the engine
                // resolves via `column_type_to_data_type` and dispatches
                // through the typed `coerce_value` path. Truly
                // unrecognised idents still hit the error arm below
                // because the engine rejects them.
                other => {
                    // Optional `(N[, M])` precision args — `::numeric(10,2)`,
                    // `::varchar(255)`, etc. Capture into the canonical
                    // `name(p,s)` form so `type_name_to_data_type` can
                    // reconstruct the `DataType::Numeric { precision,
                    // scale }` (and similar param-carrying types).
                    let mut name = other.to_string();
                    // v7.39 (round 281) — `::bit varying(3)` is two
                    // words; fold the tail in so the typmod reaches the
                    // type resolver instead of tripping the parser.
                    if name.eq_ignore_ascii_case("bit")
                        && matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("varying"))
                    {
                        self.advance();
                        name = alloc::string::String::from("varbit");
                    }
                    // v7.39 (round 613) — `::character varying` is the same
                    // two-word shape and had no fold, so the `varying` was
                    // left behind and the cast became a bare `character`,
                    // which is `char(1)`: `'ab'::CHARACTER VARYING` answered
                    // `a` where PG answers `ab`. Silently, and for a spelling
                    // pg_dump writes.
                    if name.eq_ignore_ascii_case("character")
                        && matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("varying"))
                    {
                        self.advance();
                        name = alloc::string::String::from("varchar");
                    }
                    if matches!(self.peek(), Token::LParen) {
                        let mut buf = alloc::string::String::from("(");
                        let mut depth = 0usize;
                        loop {
                            match self.advance() {
                                Token::LParen => {
                                    depth += 1;
                                    if depth > 1 {
                                        buf.push('(');
                                    }
                                }
                                Token::RParen => {
                                    depth -= 1;
                                    if depth == 0 {
                                        buf.push(')');
                                        break;
                                    }
                                    buf.push(')');
                                }
                                Token::Comma => buf.push(','),
                                Token::Integer(n) => buf.push_str(&alloc::format!("{n}")),
                                // v7.39 (round 273) — a minus used to fall
                                // into the catch-all below and vanish, so
                                // `::numeric(10,-2)` reached the engine as
                                // the text `numeric(10,2)` and silently
                                // rounded to two DECIMALS instead of to
                                // hundreds. A dropped token is not a
                                // no-op when it carries a sign.
                                Token::Minus => buf.push('-'),
                                Token::Eof => break,
                                _ => {}
                            }
                        }
                        name.push_str(&buf);
                    }
                    // Optional postfix `[]` widens to the array form —
                    // `::BOOL[]`, `::NUMERIC[]`, `::SMALLINT[]`, etc.
                    // The engine's `type_name_to_data_type` recognises
                    // the canonical `<ty>_array` form.
                    if matches!(self.peek(), Token::LBracket)
                        && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
                    {
                        self.advance();
                        self.advance();
                        name.push_str("_array");
                    }
                    CastTarget::Named(name)
                }
            },
            Token::Interval => CastTarget::Interval,
            // v7.39 — a quoted type name: `::"char"` is PG's 1-byte
            // "char" (oid 18, SPG Char1 — distinct from bare `char`
            // = char(1)); other quoted names resolve like idents.
            Token::QuotedIdent(q) => {
                if q.eq_ignore_ascii_case("char") {
                    CastTarget::Named("char1".into())
                } else {
                    CastTarget::Named(q.to_ascii_lowercase())
                }
            }
            other => {
                return Err(ParseError {
                    message: format!("expected type ident after `::`, got {other:?}"),
                    token_pos: self.consumed_pos(),
                });
            }
        };
        // v7.37.5 ship triage — postfix `[]` widens a scalar cast
        // target to its array sibling. Closed-enum arms (Bool /
        // SmallInt / Numeric / Float / Date / …) didn't carry the
        // explicit widening that Text / Int / BigInt did, so
        // `::BOOL[]` / `::NUMERIC[]` etc. surfaced as a parse
        // error. The widening here mirrors the per-arm Text /
        // Int / BigInt logic above + folds the new ζ-A first-class
        // types through `CastTarget::Named("<ty>_array")`.
        if matches!(self.peek(), Token::LBracket)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
        {
            let widened = match &target {
                CastTarget::Bool => Some(CastTarget::Named("bool_array".to_string())),
                CastTarget::Date => Some(CastTarget::Named("date_array".to_string())),
                // v7.39 (round 326, V43) — the two temporal types stay
                // distinct. Both used to widen to `timestamptz_array`, so
                // `::timestamp[]` named the wrong target in its own error
                // message and lost the zone-less identity on the way.
                CastTarget::Timestamp => Some(CastTarget::Named("timestamp_array".to_string())),
                CastTarget::Timestamptz => Some(CastTarget::Named("timestamptz_array".to_string())),
                CastTarget::Uuid => Some(CastTarget::Named("uuid_array".to_string())),
                CastTarget::Json | CastTarget::Jsonb => {
                    Some(CastTarget::Named("jsonb_array".to_string()))
                }
                CastTarget::Bytea => Some(CastTarget::Named("bytea_array".to_string())),
                CastTarget::Interval => Some(CastTarget::Named("interval_array".to_string())),
                CastTarget::Float => Some(CastTarget::Named("float_array".to_string())),
                CastTarget::Named(name) => {
                    let mut a = name.clone();
                    a.push_str("_array");
                    Some(CastTarget::Named(a))
                }
                // Int / BigInt / Text / Vector / TsVector / TsQuery /
                // RegType / RegClass / TextArray / IntArray /
                // BigIntArray already finalised — leave as is.
                _ => None,
            };
            if let Some(w) = widened {
                self.advance();
                self.advance();
                return Ok(w);
            }
        }
        Ok(target)
    }

    fn finish_postfix_casts(&mut self, mut expr: Expr) -> Result<Expr, ParseError> {
        loop {
            // v7.38 (read01, T9) — composite field access `(expr).field`.
            // A bare `a.b` is consumed as a qualified column inside the ident
            // atom, so a Dot only survives to this postfix position when the
            // base was a parenthesised expression (`(e).id`, `(row(1,2)).f1`).
            // `.*` whole-row expansion is not handled here (projection-level).
            if matches!(self.peek(), Token::Dot)
                && matches!(
                    self.tokens.get(self.pos + 1),
                    Some(Token::Ident(_) | Token::QuotedIdent(_))
                )
            {
                self.advance(); // .
                let field = match self.advance() {
                    Token::Ident(s) | Token::QuotedIdent(s) => s,
                    other => {
                        return Err(
                            self.err(format!("expected a field name after '.', got {other:?}"))
                        );
                    }
                };
                expr = Expr::FieldAccess {
                    base: Box::new(expr),
                    field,
                };
                continue;
            }
            if matches!(self.peek(), Token::DoubleColon) {
                self.advance();
                // v7.9.25 / v7.9.26 — broaden the postfix `::` cast
                // target set to include INTERVAL (reserved Token),
                // TIMESTAMPTZ, and PG catalog regtype / regclass.
                // mailrs follow-up H3a + H3b.
                let target = self.parse_cast_target()?;
                expr = Expr::Cast {
                    expr: Box::new(expr),
                    target,
                };
                continue;
            }
            // v7.10.12 — `arr[i]` subscript. PG 1-based; engine
            // returns NULL for out-of-range. Multiple subscripts
            // chain: `a[i][j]` parses left-to-right.
            if matches!(self.peek(), Token::LBracket) {
                self.advance();
                // `[lo:hi]` / `[:hi]` / `[lo:]` — array slice. A
                // bare index stays a subscript.
                let lo = if matches!(self.peek(), Token::Colon) {
                    None
                } else {
                    Some(self.parse_expr(0)?)
                };
                if matches!(self.peek(), Token::Colon) {
                    self.advance();
                    let hi = if matches!(self.peek(), Token::RBracket) {
                        None
                    } else {
                        Some(Box::new(self.parse_expr(0)?))
                    };
                    if !matches!(self.peek(), Token::RBracket) {
                        return Err(self.err(alloc::format!(
                            "expected ']' after array slice, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    expr = Expr::ArraySlice {
                        target: Box::new(expr),
                        lo: lo.map(Box::new),
                        hi,
                    };
                    continue;
                }
                let index = lo.expect("non-colon branch parsed an index");
                if !matches!(self.peek(), Token::RBracket) {
                    return Err(self.err(alloc::format!(
                        "expected ']' after array index, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                expr = Expr::ArraySubscript {
                    target: Box::new(expr),
                    index: Box::new(index),
                };
                continue;
            }
            // `expr AT TIME ZONE zone` — lowers to PG's own function
            // form timezone(zone, expr); the scalar implements the
            // offset shift (named zones error there — no tzdata).
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("at"))
                && matches!(self.tokens.get(self.pos + 1),
                    Some(Token::Ident(s)) if s.eq_ignore_ascii_case("time"))
                && matches!(self.tokens.get(self.pos + 2),
                    Some(Token::Ident(s)) if s.eq_ignore_ascii_case("zone"))
            {
                self.advance(); // AT
                self.advance(); // TIME
                self.advance(); // ZONE
                // Zone at comparison precedence so AND/OR stay out.
                let zone = self.parse_expr(6)?;
                expr = Expr::FunctionCall {
                    name: "timezone".to_string(),
                    args: alloc::vec![zone, expr],
                };
                continue;
            }
            // `expr COLLATE "name"` — SPG's single text ordering IS
            // byte order, i.e. the C collation. The byte-order
            // spellings absorb as no-ops; a locale collation would
            // silently sort differently from PG, so it errors
            // honestly instead.
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("collate")) {
                self.advance();
                let mut cname = match self.advance() {
                    Token::Ident(s) | Token::QuotedIdent(s) | Token::String(s) => s,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected collation name after COLLATE, got {other:?}"
                        )));
                    }
                };
                // v7.39 (round 539) — a SCHEMA-QUALIFIED collation, which
                // is how `pg_dump` writes the default one:
                // `… COLLATE pg_catalog.default`. Reading a single token
                // left the SCHEMA as the name, so the clause was refused
                // as an unsupported locale collation and no dump ran.
                if matches!(self.peek(), Token::Dot) {
                    self.advance();
                    cname = match self.advance() {
                        Token::Ident(s) | Token::QuotedIdent(s) | Token::String(s) => s,
                        // `default` lexes as a KEYWORD, and it is the name
                        // pg_dump writes — the same trap round 535 hit with
                        // TABLE / INDEX / FULL.
                        Token::Default => alloc::string::String::from("default"),
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected collation name after COLLATE, got {other:?}"
                            )));
                        }
                    };
                }
                let lc = cname.to_ascii_lowercase();
                // v7.39 (round 371, M4 P4b) — a per-expression MySQL
                // collation override. `… COLLATE utf8mb4_bin` (any `_bin`
                // family / `binary`) forces byte-wise, which is exactly
                // what `BINARY expr` does — lower onto that so every fold
                // site (comparison, LIKE, ORDER BY) suppresses via
                // `is_binary_coerced`. A `_ci` family override folds, and
                // under the MySQL dialect the default already folds, so it
                // absorbs as a no-op; likewise the C / byte-order spellings.
                if self.mysql_dialect && (lc.ends_with("_bin") || lc == "binary") {
                    expr = Expr::Cast {
                        expr: alloc::boxed::Box::new(expr),
                        target: CastTarget::Named("binary".to_string()),
                    };
                    continue;
                }
                let mysql_ci = self.mysql_dialect
                    && (lc.ends_with("_ci")
                        || matches!(lc.as_str(), "case_insensitive" | "nocase"));
                // v7.39 (round 691/692) — inside an ORDER BY key EVERY name
                // goes to the lowering channel, the byte-order spellings
                // included. Round 691 recorded only the names the old
                // allow-list rejected, which left `ORDER BY a COLLATE "C"`
                // absorbed as a no-op — and once a column could declare a
                // collation, absorbing the clause meant the COLUMN's
                // collation won where the query had asked for bytes.
                if self.in_order_by_key && !mysql_ci {
                    self.order_key_collation = Some(cname);
                    continue;
                }
                if !matches!(
                    lc.as_str(),
                    "c" | "posix" | "default" | "ucs_basic" | "pg_c_utf8"
                ) && !mysql_ci
                {
                    return Err(self.err(alloc::format!(
                        "COLLATE {cname:?}: SPG orders text by bytes (the C \
                         collation); locale collations are not supported yet — \
                         use COLLATE \"C\" or drop the clause"
                    )));
                }
                continue;
            }
            return Ok(expr);
        }
    }

    /// v7.39 (round 696) — a comma-separated list of bare names, stopping at
    /// the first token that is not one. Schema qualifiers collapse to the
    /// last part, which is what every other name path here does (SPG is
    /// single-schema).
    fn take_comma_separated_names(&mut self) -> Vec<String> {
        let mut out = Vec::new();
        while let Token::Ident(n) | Token::QuotedIdent(n) = self.peek().clone() {
            self.advance();
            let mut last = n;
            while matches!(self.peek(), Token::Dot) {
                self.advance();
                if let Token::Ident(t) | Token::QuotedIdent(t) = self.advance() {
                    last = t;
                }
            }
            out.push(last);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        out
    }

    /// v7.39 (round 694) — is the next token pair a postfix `[]`?
    ///
    /// The general cast-target path tests this inline; the types with their
    /// own `CastTarget` variant need it as a guard on their match arm,
    /// which is what this exists for.
    fn peek_postfix_array_brackets(&self) -> bool {
        matches!(self.peek(), Token::LBracket)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::RBracket))
    }

    /// Parse the operator tail after a `(a, b, …)` row constructor
    /// and expand at parse time. `=` is the conjunction of element
    /// equalities; `<>` its negation; the order operators expand
    /// lexicographically; `[NOT] IN ( (row), … )` ORs the row
    /// equalities. Anything else (a bare row value, a subquery
    /// RHS) errors honestly — SPG has no composite runtime value.
    fn parse_row_comparison_tail(&mut self, row: Vec<Expr>) -> Result<Expr, ParseError> {
        fn row_eq(lhs: &[Expr], rhs: &[Expr]) -> Expr {
            let mut it = lhs.iter().zip(rhs.iter()).map(|(l, r)| Expr::Binary {
                lhs: Box::new(l.clone()),
                op: BinOp::Eq,
                rhs: Box::new(r.clone()),
            });
            let first = it.next().expect("row has at least two elements");
            it.fold(first, |acc, e| Expr::Binary {
                lhs: Box::new(acc),
                op: BinOp::And,
                rhs: Box::new(e),
            })
        }
        // Lexicographic (a,b) OP (c,d):
        //   a STRICT c OR (a = c AND (b OP d))  — recursing right.
        fn row_lex(lhs: &[Expr], rhs: &[Expr], strict: BinOp, last: BinOp) -> Expr {
            if lhs.len() == 1 {
                return Expr::Binary {
                    lhs: Box::new(lhs[0].clone()),
                    op: last,
                    rhs: Box::new(rhs[0].clone()),
                };
            }
            let head_strict = Expr::Binary {
                lhs: Box::new(lhs[0].clone()),
                op: strict,
                rhs: Box::new(rhs[0].clone()),
            };
            let head_eq = Expr::Binary {
                lhs: Box::new(lhs[0].clone()),
                op: BinOp::Eq,
                rhs: Box::new(rhs[0].clone()),
            };
            Expr::Binary {
                lhs: Box::new(head_strict),
                op: BinOp::Or,
                rhs: Box::new(Expr::Binary {
                    lhs: Box::new(head_eq),
                    op: BinOp::And,
                    rhs: Box::new(row_lex(&lhs[1..], &rhs[1..], strict, last)),
                }),
            }
        }
        let negated_in = if matches!(self.peek(), Token::Not)
            && matches!(self.tokens.get(self.pos + 1), Some(Token::In))
        {
            self.advance();
            true
        } else {
            false
        };
        if matches!(self.peek(), Token::In) {
            self.advance();
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected '(' after row IN, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // `(a, b) [NOT] IN (SELECT x, y)` — a multi-column subquery,
            // not a list of literal rows. Row-vs-list decomposes to
            // OR-of-AND above, but the subquery's rows are only known at
            // runtime, so keep it as a RowInSubquery node.
            if matches!(self.peek(), Token::Select) {
                let inner = self.parse_select_stmt()?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after row IN-subquery, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let Statement::Select(s) = inner else {
                    unreachable!("parse_select_stmt always returns Statement::Select")
                };
                return Ok(Expr::RowInSubquery {
                    row,
                    subquery: Box::new(s),
                    negated: negated_in,
                });
            }
            let mut alternatives: Vec<Expr> = Vec::new();
            loop {
                // Optional ROW keyword before the paren row.
                if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("row"))
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
                {
                    self.advance();
                }
                if !matches!(self.peek(), Token::LParen) {
                    return Err(self.err(alloc::format!(
                        "expected '(' to open a row inside IN, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                let mut rhs = alloc::vec![self.parse_expr(0)?];
                while matches!(self.peek(), Token::Comma) {
                    self.advance();
                    rhs.push(self.parse_expr(0)?);
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(alloc::format!(
                        "expected ')' after row inside IN, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                if rhs.len() != row.len() {
                    return Err(self.err(alloc::format!(
                        "row IN arity mismatch: left has {}, right has {}",
                        row.len(),
                        rhs.len()
                    )));
                }
                alternatives.push(row_eq(&row, &rhs));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' to close row IN list, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut it = alternatives.into_iter();
            let first = it.next().expect("IN list has at least one row");
            let combined = it.fold(first, |acc, e| Expr::Binary {
                lhs: Box::new(acc),
                op: BinOp::Or,
                rhs: Box::new(e),
            });
            return Ok(maybe_not(combined, negated_in));
        }
        // SQL-standard `(S1, E1) OVERLAPS (S2, E2)` — true when the
        // two periods share at least one time point. Each pair is
        // normalised with least/greatest (PG accepts the endpoints
        // in either order), then lowered to the standard
        // `start1 < end2 AND start2 < end1` form.
        if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("overlaps")) {
            if row.len() != 2 {
                return Err(self.err(alloc::format!(
                    "OVERLAPS needs (start, end) pairs; left side has {} elements",
                    row.len()
                )));
            }
            self.advance();
            if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("row"))
                && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
            {
                self.advance();
            }
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(alloc::format!(
                    "expected '(' after OVERLAPS, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let r0 = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::Comma) {
                return Err(self.err(alloc::format!(
                    "OVERLAPS needs (start, end) on the right, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let r1 = self.parse_expr(0)?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after OVERLAPS pair, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let pair_fn = |name: &str, a: &Expr, b: &Expr| Expr::FunctionCall {
                name: String::from(name),
                args: alloc::vec![a.clone(), b.clone()],
            };
            let lt = |lhs: Expr, rhs: Expr| Expr::Binary {
                lhs: Box::new(lhs),
                op: BinOp::Lt,
                rhs: Box::new(rhs),
            };
            return Ok(Expr::Binary {
                lhs: Box::new(lt(
                    pair_fn("least", &row[0], &row[1]),
                    pair_fn("greatest", &r0, &r1),
                )),
                op: BinOp::And,
                rhs: Box::new(lt(
                    pair_fn("least", &r0, &r1),
                    pair_fn("greatest", &row[0], &row[1]),
                )),
            });
        }
        // `(a, b, …) IS [NOT] NULL` — the SQL row null predicate. Per
        // PG, `IS NULL` is true only when EVERY field is NULL, and
        // `IS NOT NULL` is true only when every field is non-NULL — the
        // latter is NOT the negation of the former (a mixed row is
        // neither). Desugar to an AND chain of per-field `IS [NOT] NULL`,
        // which reproduces exactly that all-fields semantics.
        if matches!(self.peek(), Token::Is) {
            self.advance();
            let negated = if matches!(self.peek(), Token::Not) {
                self.advance();
                true
            } else {
                false
            };
            if !matches!(self.peek(), Token::Null) {
                return Err(self.err(alloc::format!(
                    "expected NULL after row IS [NOT], got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let mut it = row.iter().map(|e| Expr::IsNull {
                expr: Box::new(e.clone()),
                negated,
            });
            let first = it.next().expect("row has at least two elements");
            return Ok(it.fold(first, |acc, e| Expr::Binary {
                lhs: Box::new(acc),
                op: BinOp::And,
                rhs: Box::new(e),
            }));
        }
        let op = match self.peek() {
            Token::Eq => BinOp::Eq,
            Token::NotEq => BinOp::NotEq,
            Token::Lt => BinOp::Lt,
            Token::LtEq => BinOp::LtEq,
            Token::Gt => BinOp::Gt,
            Token::GtEq => BinOp::GtEq,
            // v7.38 (read01, composite) — a bare `(a, b, …)` not followed by a
            // comparison / [NOT] IN / IS [NOT] NULL / OVERLAPS is a row (record)
            // constructor value, identical to the `ROW(a, b, …)` keyword form:
            // `(1,'a')::text` → `(1,a)`, `SELECT (1,2,3)` → `(1,2,3)`. Postfix
            // (`::text`, `.field`) applies at the caller just as it does for the
            // ROW(...) node. All the comparison / predicate forms returned above.
            _ => {
                return Ok(Expr::FunctionCall {
                    name: String::from("row"),
                    args: row,
                });
            }
        };
        self.advance();
        // Optional ROW keyword before the paren row.
        if matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("row"))
            && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen))
        {
            self.advance();
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' to open the right-hand row, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // `(a, b) <op> (SELECT x, y)` — compare against a single-row
        // subquery. Kept as a node (the subquery's row is a runtime value);
        // the literal-RHS form below still decomposes at parse time.
        if matches!(self.peek(), Token::Select) {
            let inner = self.parse_select_stmt()?;
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after row comparison subquery, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            let Statement::Select(s) = inner else {
                unreachable!("parse_select_stmt always returns Statement::Select")
            };
            return Ok(Expr::RowCmpSubquery {
                row,
                op,
                subquery: Box::new(s),
            });
        }
        let mut rhs = alloc::vec![self.parse_expr(0)?];
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            rhs.push(self.parse_expr(0)?);
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' after right-hand row, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if rhs.len() != row.len() {
            // v7.39 (round 239) — PG's wording (42601).
            return Err(self.err("unequal number of entries in row expressions".to_string()));
        }
        Ok(match op {
            BinOp::Eq => row_eq(&row, &rhs),
            BinOp::NotEq => maybe_not(row_eq(&row, &rhs), true),
            BinOp::Lt => row_lex(&row, &rhs, BinOp::Lt, BinOp::Lt),
            BinOp::LtEq => row_lex(&row, &rhs, BinOp::Lt, BinOp::LtEq),
            BinOp::Gt => row_lex(&row, &rhs, BinOp::Gt, BinOp::Gt),
            BinOp::GtEq => row_lex(&row, &rhs, BinOp::Gt, BinOp::GtEq),
            _ => unreachable!("op restricted above"),
        })
    }

    /// `LIKE p ESCAPE 'c'` — rewrite the pattern so the custom
    /// escape character becomes the matcher's default backslash:
    /// `c%` (escaped wildcard) → `\%`, `cc` (literal escape char)
    /// → the char itself, and any pre-existing backslash escapes
    /// itself so it stays literal. Both operands must be string
    /// literals — a runtime pattern would need matcher support.
    fn rewrite_like_escape(pattern: Expr, esc: Expr) -> Result<Expr, String> {
        let (Expr::Literal(Literal::String(p)), Expr::Literal(Literal::String(e))) =
            (&pattern, &esc)
        else {
            return Err(
                "LIKE ... ESCAPE requires string-literal pattern and escape \
                 (runtime escape characters are not supported yet)"
                    .into(),
            );
        };
        // v7.38 (read01 P6.18) — PG accepts `ESCAPE ''` to mean "no escape
        // character" (every `%`/`_` is a wildcard, nothing is escaped). Only a
        // multi-character escape is an error.
        let esc_ch: Option<char> = {
            let mut ch_iter = e.chars();
            match (ch_iter.next(), ch_iter.next()) {
                (Some(c), None) => Some(c),
                (None, _) => None,
                (Some(_), Some(_)) => {
                    return Err(alloc::format!(
                        "ESCAPE must be a single character, got {e:?}"
                    ));
                }
            }
        };
        let mut out = String::with_capacity(p.len() + 4);
        let mut chars = p.chars();
        while let Some(c) = chars.next() {
            if Some(c) == esc_ch {
                match chars.next() {
                    // Escaped wildcard / escaped escape → keep the
                    // next char literal via backslash.
                    Some(next) => {
                        out.push('\\');
                        out.push(next);
                    }
                    None => {
                        return Err("LIKE pattern ends with the escape character".into());
                    }
                }
            } else if c == '\\' && esc_ch != Some('\\') {
                // A raw backslash is literal under a custom (or absent) escape
                // — escape it for the backslash-based matcher.
                out.push('\\');
                out.push('\\');
            } else {
                out.push(c);
            }
        }
        Ok(Expr::Literal(Literal::String(out)))
    }

    /// `x [NOT] LIKE ANY/ALL (ARRAY[p1, p2, …])` — quantified pattern
    /// match. Desugars to an OR (ANY) / AND (ALL) chain of per-element
    /// `x [NOT] LIKE pi`, which reproduces PG's three-valued semantics
    /// exactly (a NULL pattern makes an element NULL; `false OR NULL` =
    /// NULL, `true AND NULL` = NULL, …). ANY over an empty array is
    /// FALSE, ALL over empty is TRUE. Returns `None` when the token after
    /// LIKE is not `ANY(`/`ALL(`, so the caller falls back to a plain
    /// pattern. Only a literal `ARRAY[...]` is accepted today — a runtime
    /// array expression errors honestly rather than silently mismatching.
    fn try_like_any_all(
        &mut self,
        base: &Expr,
        negated: bool,
        case_insensitive: bool,
    ) -> Result<Option<Expr>, ParseError> {
        let is_any = match self.peek() {
            Token::All if matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) => false,
            Token::Ident(s)
                if s.eq_ignore_ascii_case("any")
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::LParen)) =>
            {
                true
            }
            _ => return Ok(None),
        };
        self.advance(); // ANY / ALL
        self.advance(); // '('
        let arr = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' after LIKE {} argument, got {:?}",
                if is_any { "ANY" } else { "ALL" },
                self.peek()
            )));
        }
        self.advance(); // ')'
        let Expr::Array(items) = arr else {
            return Err(self.err(
                "LIKE ANY/ALL currently requires a literal ARRAY[...] of patterns".to_string(),
            ));
        };
        let mut clauses = items.into_iter().map(|p| Expr::Like {
            expr: Box::new(base.clone()),
            pattern: Box::new(p),
            negated,
            case_insensitive,
        });
        let Some(first) = clauses.next() else {
            // ANY(empty) = FALSE, ALL(empty) = TRUE.
            return Ok(Some(Expr::Literal(Literal::Bool(!is_any))));
        };
        let op = if is_any { BinOp::Or } else { BinOp::And };
        let combined = clauses.fold(first, |acc, c| Expr::Binary {
            lhs: Box::new(acc),
            op,
            rhs: Box::new(c),
        });
        Ok(Some(combined))
    }

    /// `x BETWEEN low AND high`  →  `(x >= low) AND (x <= high)`, wrapped in
    /// `NOT` when `negated`. Bounds parse at precedence 5 so the trailing
    /// `AND` is not swallowed.
    fn parse_between_tail(&mut self, expr: Expr, negated: bool) -> Result<Expr, ParseError> {
        self.advance(); // BETWEEN
        // SYMMETRIC — the bounds may arrive in either order; both
        // orientations OR together. ASYMMETRIC is the default and
        // absorbs as noise.
        let symmetric = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("symmetric"))
        {
            self.advance();
            true
        } else {
            if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("asymmetric")) {
                self.advance();
            }
            false
        };
        let low = self.parse_expr(6)?;
        if !matches!(self.peek(), Token::And) {
            return Err(self.err(format!(
                "expected AND after BETWEEN low bound, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let high = self.parse_expr(6)?;
        let target = Box::new(expr);
        let range = |lo: Expr, hi: Expr| Expr::Binary {
            lhs: Box::new(Expr::Binary {
                lhs: target.clone(),
                op: BinOp::GtEq,
                rhs: Box::new(lo),
            }),
            op: BinOp::And,
            rhs: Box::new(Expr::Binary {
                lhs: target.clone(),
                op: BinOp::LtEq,
                rhs: Box::new(hi),
            }),
        };
        let combined = if symmetric {
            Expr::Binary {
                lhs: Box::new(range(low.clone(), high.clone())),
                op: BinOp::Or,
                rhs: Box::new(range(high, low)),
            }
        } else {
            range(low, high)
        };
        Ok(maybe_not(combined, negated))
    }

    /// `x IN (a, b, c)`  →  chained OR of equalities. Empty list collapses
    /// to FALSE (TRUE under NOT IN), matching standard SQL semantics.
    /// v4.11: parse `WITH name AS (SELECT ...) [, ...] SELECT ...`.
    /// Caller already consumed the leading `WITH` ident.
    /// v7.38 (read01) — recursive-CTE well-formedness. PG rejects ORDER BY
    /// / LIMIT / OFFSET anywhere in a recursive query, and a recursive
    /// self-reference that appears more than once in a single term.
    fn validate_recursive_cte(&self, cte: &crate::ast::Cte) -> Result<(), ParseError> {
        use crate::ast::{CteBody, SelectStatement};
        if !cte.recursive {
            return Ok(());
        }
        let CteBody::Select(body) = &cte.body else {
            return Ok(());
        };
        // A recursive CTE body is `base UNION [ALL] recursive [UNION …]`;
        // check the anchor and every peer term.
        let has_order = |s: &SelectStatement| !s.order_by.is_empty();
        let has_limit = |s: &SelectStatement| s.limit.is_some() || s.offset.is_some();
        if has_order(body) || body.unions.iter().any(|(_, u)| has_order(u)) {
            return Err(self.err(String::from(
                "ORDER BY in a recursive query is not implemented",
            )));
        }
        if has_limit(body) || body.unions.iter().any(|(_, u)| has_limit(u)) {
            return Err(self.err(String::from(
                "LIMIT in a recursive query is not implemented",
            )));
        }
        let self_refs = |s: &SelectStatement| -> usize {
            let Some(from) = &s.from else {
                return 0;
            };
            let mut n = usize::from(from.primary.name.eq_ignore_ascii_case(&cte.name));
            for j in &from.joins {
                if j.table.name.eq_ignore_ascii_case(&cte.name) {
                    n += 1;
                }
            }
            n
        };
        if body.unions.iter().any(|(_, u)| self_refs(u) > 1) {
            return Err(self.err(alloc::format!(
                "recursive reference to query \"{}\" must not appear more than once",
                cte.name
            )));
        }
        // v7.39 (round 145, parse_cte.c) — the remaining well-formedness rules
        // apply only when the body actually references itself (a non-self-
        // referencing CTE under WITH RECURSIVE may use any set-op shape).
        let anchor_refs = self_refs(body);
        let union_refs = body.unions.iter().any(|(_, u)| self_refs(u) > 0);
        if anchor_refs > 0 || union_refs {
            // Shape: the top level must be UNION [ALL] arms only. A self-ref
            // under INTERSECT / EXCEPT (or with no set-op at all) is PG's
            // "does not have the form" error — SPG used to compute a value.
            if body.unions.is_empty()
                || body.unions.iter().any(|(k, _)| {
                    !matches!(
                        k,
                        crate::ast::UnionKind::Distinct | crate::ast::UnionKind::All
                    )
                })
            {
                return Err(self.err(alloc::format!(
                    "recursive query \"{}\" does not have the form non-recursive-term \
                     UNION [ALL] recursive-term",
                    cte.name
                )));
            }
            if anchor_refs > 0 {
                return Err(self.err(alloc::format!(
                    "recursive reference to query \"{}\" must not appear within its non-recursive term",
                    cte.name
                )));
            }
        }
        let is_self = |t: &crate::ast::TableRef| t.name.eq_ignore_ascii_case(&cte.name);
        for (_, u) in &body.unions {
            if self_refs(u) == 0 {
                continue;
            }
            // The self-reference must not sit on the nullable side of an outer
            // join (LEFT: right side; RIGHT: everything before it; FULL: both).
            if let Some(from) = &u.from {
                for (i, j) in from.joins.iter().enumerate() {
                    let left_has_self = is_self(&from.primary)
                        || from.joins[..i].iter().any(|pj| is_self(&pj.table));
                    let violated = match j.kind {
                        crate::ast::JoinKind::Left => is_self(&j.table),
                        crate::ast::JoinKind::Right => left_has_self,
                        crate::ast::JoinKind::FullOuter => is_self(&j.table) || left_has_self,
                        _ => false,
                    };
                    if violated {
                        return Err(self.err(alloc::format!(
                            "recursive reference to query \"{}\" must not appear within an outer join",
                            cte.name
                        )));
                    }
                }
            }
            // No aggregates at the top level of the recursive term (SPG used
            // to run them and surface a misleading downstream error).
            let mut items_and_having: Vec<&Expr> = Vec::new();
            for it in &u.items {
                if let crate::ast::SelectItem::Expr { expr, .. } = it {
                    items_and_having.push(expr);
                }
            }
            if let Some(h) = &u.having {
                items_and_having.push(h);
            }
            for e in items_and_having {
                if expr_has_toplevel_aggregate(e) {
                    return Err(self.err(String::from(
                        "aggregate functions are not allowed in a recursive query's recursive term",
                    )));
                }
            }
        }
        // A self-reference inside a sublink expression (EXISTS / IN / scalar
        // subquery) anywhere in the body is rejected; a plain FROM derived
        // table is legal in PG and untouched here.
        let mut all_terms: Vec<&SelectStatement> = alloc::vec![body];
        all_terms.extend(body.unions.iter().map(|(_, u)| u));
        for term in all_terms {
            if select_has_self_ref_in_sublink(term, &cte.name) {
                return Err(self.err(alloc::format!(
                    "recursive reference to query \"{}\" must not appear within a subquery",
                    cte.name
                )));
            }
        }
        Ok(())
    }

    /// v7.38 (read01 U16) — desugar a CTE's SEARCH / CYCLE clause into
    /// extra body columns, mirroring PG's `rewriteSearchAndCycle`. Runs
    /// right after parse so the engine sees a plain recursive CTE with the
    /// tracking columns already projected. DEPTH FIRST and CYCLE are
    /// supported; BREADTH FIRST needs numeric-composite ordering SPG's
    /// text-rendered rows can't provide, and errors honestly.
    fn desugar_cte_search_cycle(&self, cte: &mut crate::ast::Cte) -> Result<(), ParseError> {
        use crate::ast::{BinOp, ColumnName, CteBody, Expr, Literal, SelectItem, UnOp};
        if cte.search.is_none() && cte.cycle.is_none() {
            return Ok(());
        }
        let cte_name = cte.name.clone();
        let col_names = cte.column_overrides.clone();
        if col_names.is_empty() {
            return Err(
                self.err("SEARCH / CYCLE requires an explicit WITH name(cols) column list".into())
            );
        }
        let search = cte.search.take();
        let cycle = cte.cycle.take();
        let mut extra_cols: Vec<String> = Vec::new();
        let col_ref = |name: &str| {
            Expr::Column(ColumnName {
                qualifier: Some(cte_name.clone()),
                name: name.to_string(),
            })
        };
        // Position of a SEARCH/CYCLE column within the CTE's column list.
        let pos_of = |name: &str| -> Result<usize, ParseError> {
            col_names
                .iter()
                .position(|c| c.eq_ignore_ascii_case(name))
                .ok_or_else(|| {
                    self.err(format!("SEARCH/CYCLE column {name:?} is not a CTE column"))
                })
        };
        let row_of = |items: &[SelectItem], positions: &[usize]| -> Result<Expr, ParseError> {
            let mut args = Vec::with_capacity(positions.len());
            for &p in positions {
                match items.get(p) {
                    Some(SelectItem::Expr { expr, .. }) => args.push(expr.clone()),
                    _ => {
                        return Err(self.err(
                            "SEARCH/CYCLE column maps to a non-expression select item".into(),
                        ));
                    }
                }
            }
            Ok(Expr::FunctionCall {
                name: "row".into(),
                args,
            })
        };
        let CteBody::Select(body) = &mut cte.body else {
            return Err(self.err("SEARCH / CYCLE requires a SELECT CTE body".into()));
        };
        if body.unions.is_empty() {
            return Err(self.err("SEARCH / CYCLE requires a recursive (UNION) CTE".into()));
        }
        let rec = body.unions.len() - 1; // recursive term = last UNION peer

        if let Some(srch) = search {
            // v7.38 (T31) — SEARCH's SET column is ORDER BY'd, and PG's key is a
            // `record[]` (DEPTH) or `(depth, keys…)` record (BREADTH). SPG has
            // no typed `record[]`, but element-wise array ORDER BY is correct
            // (`[1,2] < [1,10] < [2]`), so a SINGLE scalar BY column maps
            // exactly onto a typed array: DEPTH is the root→node path
            // `array_append(parent, key)`, BREADTH is `[depth, key]`. This
            // orders numerically (multi-digit keys included), matching PG.
            //
            // A multi-column BY would need a record[] to keep the per-node key
            // tuple orderable, which SPG can't express — error honestly there
            // rather than mis-order.
            if srch.by_columns.len() != 1 {
                return Err(self.err(
                    "SEARCH … BY with multiple columns needs typed record[] ordering \
                     SPG doesn't have yet; a single BY column is supported"
                        .into(),
                ));
            }
            let key_pos = pos_of(&srch.by_columns[0])?;
            let base_key = match body.items.get(key_pos) {
                Some(SelectItem::Expr { expr, .. }) => expr.clone(),
                _ => {
                    return Err(
                        self.err("SEARCH BY column maps to a non-expression select item".into())
                    );
                }
            };
            let rec_key = match body.unions[rec].1.items.get(key_pos) {
                Some(SelectItem::Expr { expr, .. }) => expr.clone(),
                _ => {
                    return Err(
                        self.err("SEARCH BY column maps to a non-expression select item".into())
                    );
                }
            };
            if srch.depth_first {
                // base: ARRAY[key]; rec: array_append(cte.set, key).
                body.items.push(SelectItem::Expr {
                    expr: Expr::Array(alloc::vec![base_key]),
                    alias: Some(srch.set_column.clone()),
                });
                body.unions[rec].1.items.push(SelectItem::Expr {
                    expr: Expr::FunctionCall {
                        name: "array_append".into(),
                        args: alloc::vec![col_ref(&srch.set_column), rec_key],
                    },
                    alias: Some(srch.set_column.clone()),
                });
            } else {
                // BREADTH: [depth, key]; depth starts at 0 and increments. The
                // leading depth element dominates the element-wise comparison,
                // so shallower rows sort first, then by key — PG's (depth, key).
                body.items.push(SelectItem::Expr {
                    expr: Expr::Array(alloc::vec![Expr::Literal(Literal::Integer(0)), base_key,]),
                    alias: Some(srch.set_column.clone()),
                });
                // rec depth = cte.set[1] + 1.
                let parent_depth = Expr::ArraySubscript {
                    target: Box::new(col_ref(&srch.set_column)),
                    index: Box::new(Expr::Literal(Literal::Integer(1))),
                };
                body.unions[rec].1.items.push(SelectItem::Expr {
                    expr: Expr::Array(alloc::vec![
                        Expr::Binary {
                            lhs: Box::new(parent_depth),
                            op: BinOp::Add,
                            rhs: Box::new(Expr::Literal(Literal::Integer(1))),
                        },
                        rec_key,
                    ]),
                    alias: Some(srch.set_column.clone()),
                });
            }
            extra_cols.push(srch.set_column);
        }

        if let Some(cyc) = cycle {
            let positions: Vec<usize> = cyc
                .columns
                .iter()
                .map(|c| pos_of(c))
                .collect::<Result<_, _>>()?;
            // v7.38 (read01, T9) — ROW(cols) is now a first-class composite, so
            // cast it to text for the cycle path: membership only needs equality,
            // and the record text form gives SPG a TextArray path (SPG has no
            // typed record[] array). Cycle detection is unaffected.
            let base_row = Expr::Cast {
                expr: Box::new(row_of(&body.items, &positions)?),
                target: CastTarget::Text,
            };
            let rec_row = Expr::Cast {
                expr: Box::new(row_of(&body.unions[rec].1.items, &positions)?),
                target: CastTarget::Text,
            };
            let mark = cyc.mark_value.clone().unwrap_or(Literal::Bool(true));
            let dflt = cyc.default_value.clone().unwrap_or(Literal::Bool(false));
            // base: <default> AS mark, ARRAY[ROW(cols)] AS path.
            body.items.push(SelectItem::Expr {
                expr: Expr::Literal(dflt.clone()),
                alias: Some(cyc.mark_column.clone()),
            });
            body.items.push(SelectItem::Expr {
                expr: Expr::Array(alloc::vec![base_row]),
                alias: Some(cyc.path_column.clone()),
            });
            // rec mark: ROW(cols) already in the path → cycle.
            let hit = Expr::AnyAll {
                expr: Box::new(rec_row.clone()),
                op: BinOp::Eq,
                array: Box::new(col_ref(&cyc.path_column)),
                is_any: true,
            };
            let mark_expr = if cyc.mark_value.is_some() || cyc.default_value.is_some() {
                Expr::Case {
                    operand: None,
                    branches: alloc::vec![(hit, Expr::Literal(mark))],
                    else_branch: Some(Box::new(Expr::Literal(dflt))),
                }
            } else {
                hit
            };
            body.unions[rec].1.items.push(SelectItem::Expr {
                expr: mark_expr,
                alias: Some(cyc.mark_column.clone()),
            });
            // rec path: array_append(cte.path, ROW(cols)).
            body.unions[rec].1.items.push(SelectItem::Expr {
                expr: Expr::FunctionCall {
                    name: "array_append".into(),
                    args: alloc::vec![col_ref(&cyc.path_column), rec_row],
                },
                alias: Some(cyc.path_column.clone()),
            });
            // rec WHERE: AND NOT cte.mark — stop expanding a cycled row.
            let stop = Expr::Unary {
                op: UnOp::Not,
                expr: Box::new(col_ref(&cyc.mark_column)),
            };
            let w = &mut body.unions[rec].1.where_;
            *w = Some(match w.take() {
                Some(prev) => Expr::Binary {
                    lhs: Box::new(prev),
                    op: BinOp::And,
                    rhs: Box::new(stop),
                },
                None => stop,
            });
            extra_cols.push(cyc.mark_column);
            extra_cols.push(cyc.path_column);
        }
        cte.column_overrides.extend(extra_cols);
        Ok(())
    }

    /// v7.38 (read01 U16) — `SEARCH { DEPTH | BREADTH } FIRST BY col [,
    /// col…] SET seqcol`. Returns None when the next token isn't SEARCH.
    fn parse_cte_search_clause(&mut self) -> Result<Option<crate::ast::SearchClause>, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("search")) {
            return Ok(None);
        }
        self.advance(); // SEARCH
        let depth_first = match self.peek() {
            Token::Ident(s) if s.eq_ignore_ascii_case("depth") => true,
            Token::Ident(s) if s.eq_ignore_ascii_case("breadth") => false,
            other => {
                return Err(self.err(format!(
                    "expected DEPTH or BREADTH after SEARCH, got {other:?}"
                )));
            }
        };
        self.advance();
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("first")) {
            return Err(self.err(format!(
                "expected FIRST after SEARCH mode, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if !self.peek_is_by() {
            return Err(self.err(format!(
                "expected BY after SEARCH … FIRST, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut by_columns = alloc::vec![self.expect_ident_like()?];
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            by_columns.push(self.expect_ident_like()?);
        }
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("set")) {
            return Err(self.err(format!(
                "expected SET in SEARCH clause, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let set_column = self.expect_ident_like()?;
        Ok(Some(crate::ast::SearchClause {
            depth_first,
            by_columns,
            set_column,
        }))
    }

    /// v7.38 (read01 U16) — `CYCLE col [, col…] SET markcol [TO v DEFAULT w]
    /// USING pathcol`. Returns None when the next token isn't CYCLE.
    fn parse_cte_cycle_clause(&mut self) -> Result<Option<crate::ast::CycleClause>, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("cycle")) {
            return Ok(None);
        }
        self.advance(); // CYCLE
        let mut columns = alloc::vec![self.expect_ident_like()?];
        while matches!(self.peek(), Token::Comma) {
            self.advance();
            columns.push(self.expect_ident_like()?);
        }
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("set")) {
            return Err(self.err(format!(
                "expected SET in CYCLE clause, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mark_column = self.expect_ident_like()?;
        let mut mark_value = None;
        let mut default_value = None;
        if matches!(self.peek(), Token::To) {
            self.advance();
            mark_value = Some(self.parse_cycle_literal()?);
            if !matches!(self.peek(), Token::Default) {
                return Err(self.err(format!(
                    "expected DEFAULT after CYCLE … TO, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            default_value = Some(self.parse_cycle_literal()?);
        }
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("using")) {
            return Err(self.err(format!(
                "expected USING in CYCLE clause, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let path_column = self.expect_ident_like()?;
        Ok(Some(crate::ast::CycleClause {
            columns,
            mark_column,
            mark_value,
            default_value,
            path_column,
        }))
    }

    /// The mark / default value in a CYCLE `TO v DEFAULT w` — a bare
    /// literal (string / bool / number) in PG.
    fn parse_cycle_literal(&mut self) -> Result<crate::ast::Literal, ParseError> {
        match self.parse_expr(0)? {
            Expr::Literal(l) => Ok(l),
            other => Err(self.err(format!(
                "CYCLE mark/default value must be a literal, got {other:?}"
            ))),
        }
    }

    fn parse_with_cte_then_select(&mut self) -> Result<Statement, ParseError> {
        // v4.22: WITH RECURSIVE — optional keyword right after WITH.
        // Comes through as an identifier; consume it if present and
        // mark every CTE in the clause as recursive (PG semantics —
        // the flag is per-WITH, not per-CTE).
        let mut recursive = false;
        if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek()
            && s.eq_ignore_ascii_case("recursive")
        {
            self.advance();
            recursive = true;
        }
        let mut ctes = Vec::new();
        loop {
            let name = self.expect_ident_like()?;
            // v4.22: optional column-name list — `WITH t(a,b,c) AS ...`.
            // PG uses these to rename the body's output columns; we
            // do the same below by overriding `columns[i].name`.
            let column_overrides: Vec<String> = if matches!(self.peek(), Token::LParen) {
                self.advance();
                let mut names = Vec::new();
                loop {
                    names.push(self.expect_ident_like()?);
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                        continue;
                    }
                    break;
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' to close CTE column list, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                names
            } else {
                Vec::new()
            };
            // AS is a reserved Token::As (used by SELECT-item / FROM
            // aliasing) — handle it specially rather than as a bare
            // ident.
            if !matches!(self.peek(), Token::As) {
                return Err(self.err(format!(
                    "expected AS after CTE name {name:?}, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.37.17 (17.6 siblings) — PG 12+ `AS [NOT]
            // MATERIALIZED` optimizer hints. SPG materialises every
            // CTE, so both spellings are accepted and absorbed.
            if matches!(self.peek(), Token::Not) {
                self.advance(); // NOT
                if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("materialized"))
                {
                    self.advance();
                } else {
                    return Err(self.err(format!(
                        "expected MATERIALIZED after AS NOT, got {:?}",
                        self.peek()
                    )));
                }
            } else if matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s)
                if s.eq_ignore_ascii_case("materialized"))
            {
                self.advance();
            }
            if !matches!(self.peek(), Token::LParen) {
                return Err(self.err(format!(
                    "expected '(' after AS in WITH clause, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.37.43-T4.4 — accept INSERT / UPDATE / DELETE (with
            // RETURNING) as the CTE body in addition to SELECT.
            // PG writable CTE semantics. UPDATE / DELETE come in as
            // bare Idents (lexer keeps SELECT / INSERT as reserved
            // tokens but treats the rest of DML as case-insensitive
            // idents).
            let is_update_kw = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update"));
            let is_delete_kw = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete"));
            let is_merge_kw = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("merge"));
            let body = match self.peek() {
                Token::Select => {
                    let inner = self.parse_select_stmt()?;
                    let Statement::Select(s) = inner else {
                        unreachable!("parse_select_stmt returns Select");
                    };
                    crate::ast::CteBody::Select(s)
                }
                // v7.39 (round 869) — `WITH x AS (TABLE t)`. PG spells
                // `SELECT * FROM t` this way and accepts it wherever a
                // SELECT goes, so the CTE body dispatch needs its own
                // arm: this match is keyed on the FIRST token, and
                // `Token::Table` fell through to a tail that then
                // rejected what it got. `parse_table_shorthand` has
                // returned a desugared SelectStatement since the
                // shorthand landed — only the routing was missing.
                // Round 868 found this by putting the shorthand in a
                // subquery; every earlier check used a top-level form.
                // v7.39 (round 869) — `WITH x AS (TABLE t)`. PG spells
                // `SELECT * FROM t` this way and accepts it wherever a
                // SELECT goes, so the CTE body dispatch needs its own
                // arm: this match is keyed on the FIRST token, and
                // `Token::Table` fell through to a tail that rejected
                // what it got. `parse_table_shorthand` has returned a
                // desugared SelectStatement since the shorthand landed —
                // only the routing was missing, here and in the derived
                // table's second-token gate. Round 868 found both by
                // putting the shorthand in a subquery; every earlier
                // check had used a top-level form.
                Token::Table
                    if matches!(
                        self.tokens.get(self.pos + 1),
                        Some(Token::Ident(_) | Token::QuotedIdent(_))
                    ) =>
                {
                    let mut head = self.parse_table_shorthand()?;
                    self.parse_setop_chain_into(&mut head)?;
                    self.parse_select_tail_into(&mut head)?;
                    crate::ast::CteBody::Select(head)
                }
                // v7.37.17 (17.6 siblings) — VALUES as a CTE body:
                // WITH t(a) AS (VALUES (1), (2)) … lowers through
                // the shared rows helper onto a Select body.
                Token::Values => {
                    self.advance(); // VALUES
                    let mut head = self.parse_values_rows_body()?;
                    // A VALUES seed can head a set-operation chain —
                    // WITH RECURSIVE t(n) AS (VALUES(1) UNION ALL
                    // SELECT n+1 FROM t …). Attach any trailing
                    // UNION / INTERSECT / EXCEPT peers so the
                    // recursive-CTE body parses like the SELECT seed.
                    self.parse_setop_chain_into(&mut head)?;
                    crate::ast::CteBody::Select(head)
                }
                Token::Insert => {
                    let inner = self.parse_one_statement()?;
                    let Statement::Insert(s) = inner else {
                        unreachable!("Token::Insert routes to Insert");
                    };
                    crate::ast::CteBody::Insert(alloc::boxed::Box::new(s))
                }
                _ if is_update_kw => {
                    let inner = self.parse_one_statement()?;
                    let Statement::Update(s) = inner else {
                        return Err(
                            self.err(format!("expected UPDATE inside WITH (…), got {inner:?}"))
                        );
                    };
                    crate::ast::CteBody::Update(alloc::boxed::Box::new(s))
                }
                _ if is_delete_kw => {
                    let inner = self.parse_one_statement()?;
                    let Statement::Delete(s) = inner else {
                        return Err(
                            self.err(format!("expected DELETE inside WITH (…), got {inner:?}"))
                        );
                    };
                    crate::ast::CteBody::Delete(alloc::boxed::Box::new(s))
                }
                // v7.39 (round 149) — PG 17 allows MERGE as a
                // data-modifying CTE body.
                _ if is_merge_kw => {
                    let inner = self.parse_one_statement()?;
                    let Statement::Merge(s) = inner else {
                        return Err(
                            self.err(format!("expected MERGE inside WITH (…), got {inner:?}"))
                        );
                    };
                    crate::ast::CteBody::Merge(alloc::boxed::Box::new(s))
                }
                // v7.39 (round 151) — a CTE body may itself be
                // WITH-headed (PG grammar: PreparableStmt carries its
                // own with_clause). The nested statement keeps its own
                // ctes; the modifying-CTE-at-top-level rule is enforced
                // at execution.
                Token::Ident(s) if s.eq_ignore_ascii_case("with") => {
                    self.advance(); // WITH
                    match self.parse_with_cte_then_select()? {
                        Statement::Select(s) => crate::ast::CteBody::Select(s),
                        Statement::Insert(s) => {
                            crate::ast::CteBody::Insert(alloc::boxed::Box::new(s))
                        }
                        Statement::Update(s) => {
                            crate::ast::CteBody::Update(alloc::boxed::Box::new(s))
                        }
                        Statement::Delete(s) => {
                            crate::ast::CteBody::Delete(alloc::boxed::Box::new(s))
                        }
                        Statement::Merge(s) => {
                            crate::ast::CteBody::Merge(alloc::boxed::Box::new(s))
                        }

                        other => {
                            return Err(self.err(format!(
                                "WITH body must be SELECT / INSERT / UPDATE / DELETE / MERGE, got {other:?}"
                            )));
                        }
                    }
                }
                other => {
                    return Err(self.err(format!(
                        "WITH body must be SELECT / INSERT / UPDATE / DELETE / MERGE, got {other:?}"
                    )));
                }
            };
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(format!(
                    "expected ')' after CTE body, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            // v7.38 (read01 U16) — optional SEARCH / CYCLE on a recursive
            // CTE, desugared into extra body columns by the engine.
            let search = self.parse_cte_search_clause()?;
            let cycle = self.parse_cte_cycle_clause()?;
            let mut cte = crate::ast::Cte {
                name,
                body,
                recursive,
                column_overrides,
                search,
                cycle,
            };
            self.validate_recursive_cte(&cte)?;
            self.desugar_cte_search_cycle(&mut cte)?;
            ctes.push(cte);
            if matches!(self.peek(), Token::Comma) {
                self.advance();
                continue;
            }
            break;
        }
        // v7.37.43-T4.4 — the outer body may be SELECT (classical),
        // or INSERT / UPDATE / DELETE (writable CTE outer). Attach
        // the parsed CTEs to whichever statement the body produces.
        let outer_is_update = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("update"));
        let outer_is_delete = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("delete"));
        let outer_is_merge = matches!(self.peek(), Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("merge"));
        match self.peek() {
            Token::Select => {
                let body_stmt = self.parse_select_stmt()?;
                let Statement::Select(mut body) = body_stmt else {
                    unreachable!()
                };
                body.ctes = ctes;
                Ok(Statement::Select(body))
            }
            Token::Insert => {
                let body_stmt = self.parse_one_statement()?;
                let Statement::Insert(mut body) = body_stmt else {
                    unreachable!()
                };
                body.ctes = ctes;
                Ok(Statement::Insert(body))
            }
            _ if outer_is_update => {
                let body_stmt = self.parse_one_statement()?;
                let Statement::Update(mut body) = body_stmt else {
                    return Err(self.err(format!("expected UPDATE after WITH clause")));
                };
                body.ctes = ctes;
                Ok(Statement::Update(body))
            }
            _ if outer_is_delete => {
                let body_stmt = self.parse_one_statement()?;
                let Statement::Delete(mut body) = body_stmt else {
                    return Err(self.err(format!("expected DELETE after WITH clause")));
                };
                body.ctes = ctes;
                Ok(Statement::Delete(body))
            }
            // v7.39 (round 149) — PG 15 allows a WITH clause on MERGE;
            // WITH RECURSIVE is rejected with PG's exact message
            // (parse analysis, transformWithClause).
            _ if outer_is_merge => {
                if recursive {
                    return Err(self.err(String::from(
                        "WITH RECURSIVE is not supported for MERGE statement",
                    )));
                }
                let body_stmt = self.parse_one_statement()?;
                let Statement::Merge(mut body) = body_stmt else {
                    return Err(self.err(format!("expected MERGE after WITH clause")));
                };
                body.ctes = ctes;
                Ok(Statement::Merge(body))
            }
            other => Err(self.err(format!(
                "expected SELECT / INSERT / UPDATE / DELETE / MERGE after WITH clause, got {other:?}"
            ))),
        }
    }

    /// v4.10: parse `EXISTS (SELECT ...)`. Caller (`parse_atom`)
    /// already consumed the leading `EXISTS` ident via
    /// `self.advance()`.
    /// v7.13.0 — parse the rest of a `CASE … END` expression after
    /// the leading `CASE` ident has been consumed (mailrs round-5
    /// G9). Supports both the searched form
    /// (`CASE WHEN cond THEN val …`) and the simple form
    /// (`CASE operand WHEN val THEN val …`).
    fn parse_case_atom(&mut self) -> Result<Expr, ParseError> {
        // Disambiguate searched vs simple form: if the next token
        // is `WHEN`, we're in the searched form. Otherwise the
        // intervening expression is the operand.
        let operand = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("when")) {
            None
        } else {
            Some(Box::new(self.parse_expr(0)?))
        };
        let mut branches: Vec<(Expr, Expr)> = Vec::new();
        loop {
            match self.peek() {
                Token::Ident(s) if s.eq_ignore_ascii_case("when") => {
                    self.advance();
                    let cond = self.parse_expr(0)?;
                    match self.peek() {
                        Token::Ident(t) if t.eq_ignore_ascii_case("then") => {
                            self.advance();
                        }
                        other => {
                            return Err(self.err(alloc::format!(
                                "expected THEN after CASE WHEN <expr>, got {other:?}"
                            )));
                        }
                    }
                    let value = self.parse_expr(0)?;
                    branches.push((cond, value));
                }
                _ => break,
            }
        }
        if branches.is_empty() {
            return Err(self.err("CASE requires at least one WHEN … THEN … branch".into()));
        }
        let else_branch = if matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("else"))
        {
            self.advance();
            Some(Box::new(self.parse_expr(0)?))
        } else {
            None
        };
        match self.peek() {
            Token::Ident(s) if s.eq_ignore_ascii_case("end") => {
                self.advance();
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected END to close CASE expression, got {other:?}"
                )));
            }
        }
        Ok(Expr::Case {
            operand,
            branches,
            else_branch,
        })
    }

    /// v7.39 (round 151) — nested `WITH … SELECT …` in a subquery /
    /// query-source position (EXISTS / IN / INSERT source / CTE body /
    /// view body). Caller consumed the WITH keyword. Only a SELECT
    /// outer is grammatical here; the data-modifying-CTE-at-top-level
    /// rule (PG 0A000) is enforced at execution, where the SQLSTATE
    /// maps correctly.
    fn parse_nested_with_select(&mut self) -> Result<crate::ast::SelectStatement, ParseError> {
        let inner = self.parse_with_cte_then_select()?;
        match inner {
            Statement::Select(s) => Ok(s),
            other => Err(self.err(format!(
                "expected SELECT after WITH in a subquery, got {other:?}"
            ))),
        }
    }

    /// True when the next token is the (unquoted) WITH keyword. WITH is
    /// reserved in PG, so a bare `with` can never be a column reference
    /// in these positions; a quoted `"with"` stays an identifier.
    fn peek_is_with_kw(&self) -> bool {
        matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("with"))
    }

    /// v7.39 (round 153) — the `ANY / ALL ( [WITH …] SELECT … )` body.
    /// `#[inline(never)]` keeps the large SelectStatement temporaries
    /// off parse_expr's recursive frame (the nesting-budget stack
    /// cliff — see the round-153 gate regression).
    #[inline(never)]
    fn parse_any_all_select_body(&mut self) -> Result<crate::ast::SelectStatement, ParseError> {
        if self.peek_is_with_kw() {
            self.advance();
            self.parse_nested_with_select()
        } else {
            match self.parse_select_stmt()? {
                Statement::Select(s) => Ok(s),
                other => Err(self.err(alloc::format!(
                    "expected SELECT inside ANY/ALL, got {other:?}"
                ))),
            }
        }
    }

    fn parse_exists_atom(&mut self, negated: bool) -> Result<Expr, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after EXISTS, got {:?}", self.peek())));
        }
        self.advance();
        // v7.39 (round 151) — `EXISTS (WITH … SELECT …)` is legal PG.
        let s = if self.peek_is_with_kw() {
            self.advance();
            self.parse_nested_with_select()?
        } else {
            let inner = self.parse_select_stmt()?;
            let Statement::Select(s) = inner else {
                unreachable!("parse_select_stmt returns Select")
            };
            s
        };
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' after EXISTS-subquery, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(Expr::Exists {
            subquery: Box::new(s),
            negated,
        })
    }

    fn parse_in_tail(&mut self, expr: Expr, negated: bool) -> Result<Expr, ParseError> {
        self.advance(); // IN
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after IN, got {:?}", self.peek())));
        }
        self.advance();
        // v4.10: `IN (SELECT ...)` — subquery branch. v7.39 (round 151)
        // also accepts a WITH-headed subquery (`IN (WITH … SELECT …)`).
        if matches!(self.peek(), Token::Select) || self.peek_is_with_kw() {
            let s = if self.peek_is_with_kw() {
                self.advance();
                self.parse_nested_with_select()?
            } else {
                let inner = self.parse_select_stmt()?;
                let Statement::Select(s) = inner else {
                    unreachable!("parse_select_stmt always returns Statement::Select")
                };
                s
            };
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(format!(
                    "expected ')' after IN-subquery, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            return Ok(Expr::InSubquery {
                expr: Box::new(expr),
                subquery: Box::new(s),
                negated,
            });
        }
        let mut elements = Vec::new();
        if !matches!(self.peek(), Token::RParen) {
            loop {
                elements.push(self.parse_expr(0)?);
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RParen => break,
                    other => {
                        return Err(
                            self.err(format!("expected ',' or ')' in IN list, got {other:?}"))
                        );
                    }
                }
            }
        }
        self.advance(); // ')'
        // v7.30.2 (mailrs round-25) — flat InList node instead of a
        // left-deep OR-Eq chain: chain depth scaled with the element
        // count and overflowed the stack (eval + drop are recursive).
        if elements.is_empty() {
            return Ok(maybe_not(Expr::Literal(Literal::Bool(false)), negated));
        }
        Ok(Expr::InList {
            expr: Box::new(expr),
            list: elements,
            negated,
        })
    }

    /// Parse a pgvector array literal `[ x1, x2, ... ]`. The opening `[` is
    /// already consumed by the caller. Elements must be numeric literals
    /// (with optional unary `-`); any compound expression is rejected at
    /// parse time so the runtime never needs to evaluate inside a vector.
    /// `EXTRACT(<field> FROM <source>)`. The dispatching `parse_atom`
    /// has already consumed the `EXTRACT` token before calling us —
    /// we pick up at the opening `(`.
    /// v7.17.0 Phase 2.2 — MySQL `MATCH(col [, col ...]) AGAINST
    /// (expr [IN BOOLEAN MODE | IN NATURAL LANGUAGE MODE
    /// [WITH QUERY EXPANSION]])`. Rewritten in-place to a
    /// per-column OR-fold of
    /// `to_tsvector('simple', col) @@ plainto_tsquery('simple',
    /// term)` so the existing FTS evaluator handles semantics.
    ///
    /// The mode modifier is accepted-and-ignored at v7.17 — all
    /// modes map to the same `plainto_tsquery` rewrite. Boolean-
    /// mode operators (`+foo -bar`) would need their own parser
    /// (Phase 2.2c); customers who hit them today already get a
    /// correct lexeme-match against the bare term, only without
    /// the +/- precedence the customer asked for.
    fn parse_match_against_atom(&mut self) -> Result<Expr, ParseError> {
        // Already at `MATCH`-consumed position; the dispatcher
        // confirmed the next token is `(`.
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after MATCH, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let mut cols: Vec<Expr> = Vec::new();
        loop {
            cols.push(self.parse_expr(0)?);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RParen => break,
                other => {
                    return Err(self.err(alloc::format!(
                        "expected ',' or ')' in MATCH column list, got {other:?}"
                    )));
                }
            }
        }
        self.advance(); // ')'
        // Expect AGAINST.
        match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s) if s.eq_ignore_ascii_case("against") => {
                self.advance();
            }
            other => {
                return Err(self.err(alloc::format!(
                    "expected AGAINST after MATCH column list, got {other:?}"
                )));
            }
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(alloc::format!(
                "expected '(' after AGAINST, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // Read AGAINST's argument as a single primary token —
        // string literal, placeholder, or column-ref ident. We
        // can't call `parse_expr` / `parse_unary` here because
        // the postfix chain inside `parse_atom` would greedily
        // fold a trailing `IN BOOLEAN MODE` as `expr IN (...)`
        // and fail at "expected '(' after IN". Customers always
        // write a literal or bound parameter in AGAINST, so this
        // restriction is non-blocking; the error path explains
        // the limit if a more complex expression shows up.
        let term = match self.advance() {
            Token::String(s) => Expr::Literal(crate::ast::Literal::String(s)),
            Token::Placeholder(n) => Expr::Placeholder(n),
            Token::Ident(s) | Token::QuotedIdent(s) => Expr::Column(crate::ast::ColumnName {
                qualifier: None,
                name: s,
            }),
            other => {
                return Err(self.err(alloc::format!(
                    "MATCH ... AGAINST(<term>) expects a string literal, \
                     bound parameter, or column ref, got {other:?}"
                )));
            }
        };
        // Optional mode tail — accept-and-ignore at v7.17:
        //   IN NATURAL LANGUAGE MODE [WITH QUERY EXPANSION]
        //   IN BOOLEAN MODE
        //   WITH QUERY EXPANSION
        loop {
            match self.peek() {
                // IN lexes as a reserved Token::In, not an ident,
                // so it gets its own arm.
                Token::In => {
                    self.advance();
                }
                Token::Ident(s) | Token::QuotedIdent(s)
                    if s.eq_ignore_ascii_case("natural")
                        || s.eq_ignore_ascii_case("language")
                        || s.eq_ignore_ascii_case("boolean")
                        || s.eq_ignore_ascii_case("mode")
                        || s.eq_ignore_ascii_case("with")
                        || s.eq_ignore_ascii_case("query")
                        || s.eq_ignore_ascii_case("expansion") =>
                {
                    self.advance();
                }
                _ => break,
            }
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(alloc::format!(
                "expected ')' to close AGAINST, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        // Build per-column `to_tsvector('simple', col) @@
        // plainto_tsquery('simple', term)` and OR-fold.
        let simple_lit = || Expr::Literal(crate::ast::Literal::String(String::from("simple")));
        let plainto = Expr::FunctionCall {
            name: String::from("plainto_tsquery"),
            args: alloc::vec![simple_lit(), term.clone()],
        };
        let mut folded: Option<Expr> = None;
        for col in cols {
            let to_tsv = Expr::FunctionCall {
                name: String::from("to_tsvector"),
                args: alloc::vec![simple_lit(), col],
            };
            let leaf = Expr::Binary {
                lhs: Box::new(to_tsv),
                op: crate::ast::BinOp::TsMatch,
                rhs: Box::new(plainto.clone()),
            };
            folded = Some(match folded {
                None => leaf,
                Some(prev) => Expr::Binary {
                    lhs: Box::new(prev),
                    op: crate::ast::BinOp::Or,
                    rhs: Box::new(leaf),
                },
            });
        }
        match folded {
            Some(e) => Ok(e),
            None => Err(self.err(String::from(
                "MATCH(...) AGAINST(...) requires at least one column",
            ))),
        }
    }

    fn parse_extract_atom(&mut self) -> Result<Expr, ParseError> {
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after EXTRACT, got {:?}", self.peek())));
        }
        self.advance();
        let field_name = self.expect_ident_like()?;
        let field = match field_name.to_ascii_lowercase().as_str() {
            // PG accepts the plural spellings (years/months/…/millenniums) as
            // aliases for the singular fields — its datetime unit table has both.
            // (quarter has no plural; dow/doy/isoyear/epoch/julian likewise.)
            "year" | "years" => ExtractField::Year,
            "month" | "months" => ExtractField::Month,
            "day" | "days" => ExtractField::Day,
            "hour" | "hours" => ExtractField::Hour,
            "minute" | "minutes" => ExtractField::Minute,
            "second" | "seconds" => ExtractField::Second,
            "microsecond" | "microseconds" => ExtractField::Microsecond,
            "epoch" => ExtractField::Epoch,
            "dow" => ExtractField::Dow,
            "isodow" => ExtractField::Isodow,
            "doy" => ExtractField::Doy,
            "week" | "weeks" => ExtractField::Week,
            "isoyear" => ExtractField::Isoyear,
            "quarter" => ExtractField::Quarter,
            "decade" | "decades" => ExtractField::Decade,
            "century" | "centuries" => ExtractField::Century,
            "millennium" | "millenniums" | "millennia" => ExtractField::Millennium,
            "julian" => ExtractField::Julian,
            "millisecond" | "milliseconds" => ExtractField::Millisecond,
            "timezone" => ExtractField::Timezone,
            "timezone_hour" => ExtractField::TimezoneHour,
            "timezone_minute" => ExtractField::TimezoneMinute,
            // v7.39 (round 253) — PG resolves EXTRACT fields at runtime and
            // reports an unknown one with the source type (22023); carry the
            // raw name so eval can word it.
            other => ExtractField::Other(alloc::string::String::from(other)),
        };
        if !matches!(self.peek(), Token::From) {
            return Err(self.err(format!(
                "expected FROM after EXTRACT field, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        let source = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' to close EXTRACT, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        Ok(Expr::Extract {
            field,
            source: Box::new(source),
        })
    }

    /// `INTERVAL '<n> <unit> [<n> <unit> ...]'` — the `INTERVAL` keyword
    /// is already consumed; we expect a single string literal next and
    /// resolve it into `Literal::Interval` at parse time so the engine
    /// never has to re-tokenise inside the string.
    /// The unquoted count of a MySQL `INTERVAL <n> <UNIT>`, when the
    /// tokens ahead really are one. A quoted count (`INTERVAL '2' DAY`)
    /// is the SQL-standard form and is left to the path below.
    fn peek_unquoted_interval_count(&self) -> Option<(alloc::string::String, usize)> {
        // A negative count lexes as `-` then the number (`INTERVAL -1 DAY`).
        let (offset, sign) = match self.peek() {
            Token::Minus => (1, "-"),
            _ => (0, ""),
        };
        let Some(Token::Integer(n)) = self.tokens.get(self.pos + offset) else {
            return None;
        };
        self.tokens
            .get(self.pos + offset + 1)
            .filter(|t| mysql_interval_unit(t).is_some())?;
        Some((alloc::format!("{sign}{n}"), offset + 1))
    }

    /// v7.39 (round 422) — is the parenthesised group starting at the CURRENT
    /// `(` a single quantity followed by a time unit (`INTERVAL (1+1) DAY`),
    /// rather than the argument list of MySQL's `INTERVAL(N, N1, …)` function?
    ///
    /// Scans `self.tokens` by index and consumes NOTHING. Round 409 decided
    /// this by parsing the group and then restoring `self.pos` — which could
    /// never have worked, because `advance()` DESTROYS the token it returns
    /// (`mem::replace(.., Eof)`); the restore yielded a stream of Eof. It was
    /// inert only because both branches errored back then.
    fn interval_paren_is_quantity(&self) -> bool {
        let mut depth = 0usize;
        let mut saw_top_level_comma = false;
        let mut i = self.pos;
        while let Some(tok) = self.tokens.get(i) {
            match tok {
                Token::LParen => depth += 1,
                Token::RParen => {
                    depth = depth.saturating_sub(1);
                    if depth == 0 {
                        return !saw_top_level_comma
                            && mysql_interval_unit(self.tokens.get(i + 1).unwrap_or(&Token::Eof))
                                .is_some();
                    }
                }
                // A comma directly inside the outermost parens means the
                // argument list of the INTERVAL() function.
                Token::Comma if depth == 1 => saw_top_level_comma = true,
                Token::Eof => return false,
                _ => {}
            }
            i += 1;
        }
        false
    }

    fn parse_interval_atom(&mut self) -> Result<Expr, ParseError> {
        // v7.39 (round 409) — MySQL's `INTERVAL(N, N1, N2, …)` function
        // (the index of the last Ni ≤ N), distinct from the interval literal.
        // `INTERVAL (` is ambiguous with `INTERVAL (expr) UNIT`, so the shape
        // is decided by a non-destructive lookahead (round 422) before either
        // branch consumes anything. MySQL only.
        if self.mysql_dialect
            && matches!(self.peek(), Token::LParen)
            && !self.interval_paren_is_quantity()
        {
            self.advance(); // (
            let mut args = Vec::new();
            if !matches!(self.peek(), Token::RParen) {
                loop {
                    args.push(self.parse_expr(0)?);
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                        continue;
                    }
                    break;
                }
            }
            if !matches!(self.peek(), Token::RParen) {
                return Err(self.err(alloc::format!(
                    "expected ')' after INTERVAL() arguments, got {:?}",
                    self.peek()
                )));
            }
            self.advance(); // )
            return Ok(Expr::FunctionCall {
                name: alloc::string::String::from("interval"),
                args,
            });
        }
        // v7.39 (round 350, M7) — MySQL's `INTERVAL <n> <UNIT>`, with the
        // number UNQUOTED: `DATE_ADD(d, INTERVAL 1 MONTH)`,
        // `d + INTERVAL 90 MINUTE`, `INTERVAL -1 DAY`. It is how MySQL
        // writes every date arithmetic there is, and it did not parse at
        // all. PG rejects the unquoted form outright (`syntax error at or
        // near "1"`, measured), so it is taken only in the MySQL dialect —
        // PG's own `INTERVAL '1' DAY` is untouched below.
        if self.mysql_dialect
            && let Some((text, consume)) = self.peek_unquoted_interval_count()
        {
            for _ in 0..consume {
                self.advance(); // the optional `-` and the number
            }
            let Some(unit) = mysql_interval_unit(self.peek()) else {
                return Err(self.err(alloc::format!(
                    "expected an interval unit after INTERVAL {text}, got {:?}",
                    self.peek()
                )));
            };
            self.advance(); // the unit
            let (months, days, micros) = scale_mysql_interval(&text, unit)
                .ok_or_else(|| self.err(alloc::format!("cannot read INTERVAL {text} {unit}")))?;
            return Ok(Expr::Literal(Literal::Interval {
                months,
                days,
                micros,
                // The canonical rendering, so Display round-trips into a
                // form both dialects read back.
                text: alloc::format!("{text} {unit}"),
            }));
        }
        // v7.39 (round 422) — MySQL's interval QUANTITY may be any expression,
        // not just a literal: `DATE_ADD(d, INTERVAL n DAY)`,
        // `d + INTERVAL n*2 DAY`, `INTERVAL (1+1) DAY`, `INTERVAL ABS(-5) DAY`.
        // Those cannot fold into a compile-time `Literal::Interval`, so they
        // lower onto the existing `make_interval(y, mo, w, d, h, mi, s)`
        // builtin, which builds the value at run time (and yields NULL for a
        // NULL quantity, as MariaDB does). The literal path above still folds
        // the constant case — it is cheaper and round-trips through Display.
        //
        // Guarded off a String operand so PG's own `INTERVAL '1 day'` (and
        // MySQL's quoted spelling) keep the qualifier path below.
        if self.mysql_dialect && !matches!(self.peek(), Token::String(_)) {
            let qty = self.parse_expr(0)?;
            let Some(unit) = mysql_interval_unit(self.peek()) else {
                return Err(self.err(alloc::format!(
                    "expected an interval unit after INTERVAL <expr>, got {:?}",
                    self.peek()
                )));
            };
            self.advance(); // the unit
            return Ok(make_interval_call(qty, unit));
        }
        let tok = self.advance();
        let Token::String(text) = tok else {
            return Err(self.err(format!(
                "expected string literal after INTERVAL, got {tok:?}"
            )));
        };
        // v7.39 (read01 round 102) — SQL-standard trailing field qualifier
        // `<FIELD> [TO <FIELD>]` (`INTERVAL '2' YEAR`, `INTERVAL '1-6' YEAR TO
        // MONTH`, `INTERVAL '1 2:03:04' DAY TO SECOND`). It sets which field a
        // bare number means and the leading/trailing precision.
        let field1 = interval_field_of(self.peek());
        let qualifier = if let Some(f1) = field1 {
            self.advance();
            let f2 = if matches!(self.peek(), Token::To) {
                self.advance();
                let Some(f) = interval_field_of(self.peek()) else {
                    return Err(self.err(format!(
                        "expected an interval field after TO, got {:?}",
                        self.peek()
                    )));
                };
                self.advance();
                Some(f)
            } else {
                None
            };
            Some((f1, f2))
        } else {
            None
        };
        let (months, days, micros) = match qualifier {
            Some(q) => interpret_qualified_interval(&text, q),
            None => parse_interval_text(&text),
        }
        .ok_or_else(|| ParseError {
            message: format!(
                "cannot parse INTERVAL {text:?}; \
                     expected `<n> <unit> [<n> <unit> ...]` with units \
                     microsecond[s], millisecond[s], second[s], minute[s], \
                     hour[s], day[s], week[s], month[s], year[s]"
            ),
            token_pos: self.consumed_pos(),
        })?;
        Ok(Expr::Literal(Literal::Interval {
            months,
            days,
            micros,
            text,
        }))
    }

    /// v7.38 (read01, T10) — parse a bracketed sub-array `[e, e, …]` inside an
    /// `ARRAY[...]` constructor, recursing on further nested `[...]` so
    /// `ARRAY[[1,2],[3,4]]` (and deeper) becomes nested `Expr::Array` rather
    /// than a pgvector literal.
    fn parse_array_bracket_body(&mut self) -> Result<Expr, ParseError> {
        self.advance(); // consume `[`
        let mut items: Vec<Expr> = Vec::new();
        if !matches!(self.peek(), Token::RBracket) {
            loop {
                if matches!(self.peek(), Token::LBracket) {
                    items.push(self.parse_array_bracket_body()?);
                } else {
                    items.push(self.parse_expr(0)?);
                }
                match self.peek() {
                    Token::Comma => {
                        self.advance();
                    }
                    Token::RBracket => break,
                    other => {
                        return Err(self.err(alloc::format!(
                            "expected ',' or ']' in array literal, got {other:?}"
                        )));
                    }
                }
            }
        }
        self.advance(); // consume `]`
        Ok(Expr::Array(items))
    }

    fn parse_vector_literal_body(&mut self) -> Result<Expr, ParseError> {
        let mut elems = Vec::new();
        if matches!(self.peek(), Token::RBracket) {
            self.advance();
            return Ok(Expr::Literal(Literal::Vector(elems)));
        }
        loop {
            let e = self.parse_expr(0)?;
            let x = extract_numeric_literal(&e).ok_or_else(|| ParseError {
                message: format!("vector element must be a numeric literal, got {e:?}"),
                token_pos: self.pos,
            })?;
            elems.push(x);
            match self.peek() {
                Token::Comma => {
                    self.advance();
                }
                Token::RBracket => {
                    self.advance();
                    break;
                }
                other => {
                    return Err(self.err(format!("expected ',' or ']' in vector, got {other:?}")));
                }
            }
        }
        Ok(Expr::Literal(Literal::Vector(elems)))
    }

    /// Atom that started with an identifier: could be `t.col`, `col`, or
    /// `func(arg, ...)`. Detect each shape by looking at the next token.
    /// v4.12: parse `(PARTITION BY expr, ... ORDER BY expr [DESC]
    /// [, ...])`. Caller has already consumed `OVER`. Either clause
    /// is optional; an empty `()` is also legal (PG semantics).
    /// v6.4.2 — consume an optional `IGNORE NULLS` / `RESPECT NULLS`
    /// modifier between `name(args)` and `OVER (...)`. Default is
    /// `Respect`. Unrecognised idents leave the stream unchanged.
    fn parse_null_treatment_modifier(&mut self) -> NullTreatment {
        let Token::Ident(s) = self.peek().clone() else {
            return NullTreatment::Respect;
        };
        let is_ignore = s.eq_ignore_ascii_case("ignore");
        let is_respect = s.eq_ignore_ascii_case("respect");
        if !is_ignore && !is_respect {
            return NullTreatment::Respect;
        }
        // Lookahead for NULLS — only consume both tokens together.
        // pos+1 must hold a "nulls" ident.
        if self.pos + 1 < self.tokens.len()
            && let Token::Ident(s2) = &self.tokens[self.pos + 1]
            && s2.eq_ignore_ascii_case("nulls")
        {
            self.advance();
            self.advance();
            return if is_ignore {
                NullTreatment::Ignore
            } else {
                NullTreatment::Respect
            };
        }
        NullTreatment::Respect
    }

    /// v7.32 (mailrs round-29) — `agg(args) FILTER (WHERE cond)`.
    /// `FILTER` is an unreserved keyword, so it arrives as an `Ident`
    /// (same shape as the `OVER` tail). Consumes the whole clause and
    /// returns the predicate; returns `None` when no `FILTER` follows.
    fn parse_filter_clause(&mut self) -> Result<Option<Box<Expr>>, ParseError> {
        let (Token::Ident(s) | Token::QuotedIdent(s)) = self.peek() else {
            return Ok(None);
        };
        if !s.eq_ignore_ascii_case("filter") {
            return Ok(None);
        }
        self.advance(); // FILTER
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after FILTER, got {:?}", self.peek())));
        }
        self.advance(); // (
        if !matches!(self.peek(), Token::Where) {
            return Err(self.err(format!(
                "expected WHERE inside FILTER (...), got {:?}",
                self.peek()
            )));
        }
        self.advance(); // WHERE
        let cond = self.parse_expr(0)?;
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' to close FILTER (WHERE ...), got {:?}",
                self.peek()
            )));
        }
        self.advance(); // )
        Ok(Some(Box::new(cond)))
    }

    /// v7.39 (round 354, M12) — consume a `SEPARATOR '<s>'` tail and push
    /// the separator as the aggregate's second argument, which is the
    /// shape `string_agg` already takes. Returns whether one was there.
    fn consume_group_concat_separator(&mut self, args: &mut Vec<Expr>) -> Result<bool, ParseError> {
        if !matches!(self.peek(), Token::Ident(k) if k.eq_ignore_ascii_case("separator")) {
            return Ok(false);
        }
        self.advance();
        let Token::String(sep) = self.peek().clone() else {
            return Err(self.err(alloc::format!(
                "expected a string literal after SEPARATOR, got {:?}",
                self.peek()
            )));
        };
        self.advance();
        args.push(Expr::Literal(Literal::String(sep)));
        Ok(true)
    }

    /// v7.32 (round-29) — `WITHIN GROUP ( ORDER BY <sort_spec> )` tail
    /// for ordered-set aggregates. `WITHIN` is unreserved (arrives as an
    /// `Ident`); `GROUP` and `ORDER`/`BY` are keywords. Returns the sort
    /// keys, or an empty vec when no `WITHIN GROUP` follows.
    fn parse_within_group_clause(&mut self) -> Result<Vec<OrderBy>, ParseError> {
        let (Token::Ident(s) | Token::QuotedIdent(s)) = self.peek() else {
            return Ok(Vec::new());
        };
        if !s.eq_ignore_ascii_case("within") {
            return Ok(Vec::new());
        }
        self.advance(); // WITHIN
        if !matches!(self.peek(), Token::Group) {
            return Err(self.err(format!(
                "expected GROUP after WITHIN, got {:?}",
                self.peek()
            )));
        }
        self.advance(); // GROUP
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!(
                "expected '(' after WITHIN GROUP, got {:?}",
                self.peek()
            )));
        }
        self.advance(); // (
        if !matches!(self.peek(), Token::Order) {
            return Err(self.err(format!(
                "expected ORDER BY inside WITHIN GROUP (...), got {:?}",
                self.peek()
            )));
        }
        self.advance(); // ORDER
        if !self.peek_is_by() {
            return Err(self.err(format!("expected BY after ORDER, got {:?}", self.peek())));
        }
        self.advance(); // BY
        let mut keys: Vec<OrderBy> = Vec::new();
        loop {
            // v7.39 (round 691) — save/restore, the discipline this parser
            // already uses around `pending_sample_preds`, so a subquery inside
            // a key neither inherits nor leaks the channel.
            let saved_flag = core::mem::replace(&mut self.in_order_by_key, true);
            let saved_coll = self.order_key_collation.take();
            let parsed = self.parse_expr(0);
            self.in_order_by_key = saved_flag;
            let collation = core::mem::replace(&mut self.order_key_collation, saved_coll);
            let expr = parsed?;
            let desc = if matches!(self.peek(), Token::Desc) {
                self.advance();
                true
            } else if matches!(self.peek(), Token::Asc) {
                self.advance();
                false
            } else {
                false
            };
            let nulls_first = self.parse_optional_nulls_placement()?;
            keys.push(OrderBy {
                expr,
                desc,
                nulls_first,
                collation,
            });
            if matches!(self.peek(), Token::Comma) {
                self.advance();
            } else {
                break;
            }
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' to close WITHIN GROUP (ORDER BY ...), got {:?}",
                self.peek()
            )));
        }
        self.advance(); // )
        Ok(keys)
    }

    /// No frame clause is supported.
    #[allow(clippy::type_complexity)] // (partitions, ordered-keys-with-desc) is the natural shape
    fn parse_over_clause(
        &mut self,
    ) -> Result<
        (
            Vec<Expr>,
            Vec<(Expr, bool, Option<bool>)>,
            Option<WindowFrame>,
        ),
        ParseError,
    > {
        // `OVER w` — a named-window reference. The WINDOW clause
        // parses after the select list, so the name rides out as a
        // marker in partition_by; parse_bare_select substitutes the
        // definition once the clause is known.
        if let Token::Ident(w) | Token::QuotedIdent(w) = self.peek() {
            let name = w.clone();
            self.advance();
            return Ok((
                alloc::vec![Expr::Column(crate::ast::ColumnName {
                    qualifier: Some("__named_window__".to_string()),
                    name,
                })],
                Vec::new(),
                None,
            ));
        }
        if !matches!(self.peek(), Token::LParen) {
            return Err(self.err(format!("expected '(' after OVER, got {:?}", self.peek())));
        }
        self.advance();
        let mut partition_by = Vec::new();
        let mut order_by = Vec::new();
        // v7.39 (round 229) — `OVER (w1 …)`: a *copy* of an existing named
        // window, refined in place. PG's rules (probed against 18.4) differ
        // from the bare `OVER w1` form, so the reference rides out under its
        // own marker and `substitute_named_windows` applies them. The base
        // name is any leading identifier that isn't a window-spec keyword.
        let base_window = match self.peek() {
            Token::Ident(s) | Token::QuotedIdent(s)
                if !s.eq_ignore_ascii_case("partition")
                    && !s.eq_ignore_ascii_case("rows")
                    && !s.eq_ignore_ascii_case("range")
                    && !s.eq_ignore_ascii_case("groups") =>
            {
                let n = s.clone();
                self.advance();
                Some(n)
            }
            _ => None,
        };
        // PARTITION BY ?
        // v7.37.6-B promoted PARTITION to a reserved keyword
        // (Token::Partition); pre-7.37.6-B catalogs lexed it as
        // `Token::Ident("partition")`. Accept both so older sources
        // and the new lexer surface land on the same path.
        let is_partition_kw = match self.peek() {
            Token::Partition => true,
            Token::Ident(s) | Token::QuotedIdent(s) => s.eq_ignore_ascii_case("partition"),
            _ => false,
        };
        if is_partition_kw {
            self.advance();
            if !self.peek_is_by() {
                return Err(self.err(format!(
                    "expected BY after PARTITION, got {:?}",
                    self.peek()
                )));
            }
            self.advance();
            loop {
                partition_by.push(self.parse_expr(0)?);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
        }
        // ORDER BY ?
        if matches!(self.peek(), Token::Order) {
            self.advance();
            if !self.peek_is_by() {
                return Err(self.err(format!("expected BY after ORDER, got {:?}", self.peek())));
            }
            self.advance();
            loop {
                let e = self.parse_expr(0)?;
                let desc = if matches!(self.peek(), Token::Desc) {
                    self.advance();
                    true
                } else if matches!(self.peek(), Token::Asc) {
                    self.advance();
                    false
                } else {
                    false
                };
                // v7.24.1 — NULLS FIRST/LAST inside OVER (…).
                let nulls_first = self.parse_optional_nulls_placement()?;
                order_by.push((e, desc, nulls_first));
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                    continue;
                }
                break;
            }
        }
        // v4.20: optional explicit frame, `ROWS ...` / `RANGE ...`.
        // Both keywords come through the lexer as identifiers; match
        // case-insensitively.
        let mut frame: Option<WindowFrame> = None;
        if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek() {
            let kind = if s.eq_ignore_ascii_case("rows") {
                Some(FrameKind::Rows)
            } else if s.eq_ignore_ascii_case("range") {
                Some(FrameKind::Range)
            } else if s.eq_ignore_ascii_case("groups") {
                // v7.37.19 (19.11) — PG 11+ GROUPS frame mode.
                Some(FrameKind::Groups)
            } else {
                None
            };
            if let Some(kind) = kind {
                self.advance();
                frame = Some(self.parse_frame_tail(kind)?);
            }
        }
        if !matches!(self.peek(), Token::RParen) {
            return Err(self.err(format!(
                "expected ')' to close OVER clause, got {:?}",
                self.peek()
            )));
        }
        self.advance();
        if let Some(base) = base_window {
            // A copy may refine but never override the base's partitioning
            // (PG rejects it outright, before looking the name up).
            if !partition_by.is_empty() {
                return Err(self.err(alloc::format!(
                    "cannot override PARTITION BY clause of window \"{base}\""
                )));
            }
            partition_by = alloc::vec![Expr::Column(crate::ast::ColumnName {
                qualifier: Some("__named_window_ref__".to_string()),
                name: base,
            })];
        }
        Ok((partition_by, order_by, frame))
    }

    /// v4.20: parse the tail of an explicit frame, given the `ROWS`
    /// or `RANGE` keyword was just consumed. Accepts both
    /// `BETWEEN <bound> AND <bound>` and the single-bound shorthand
    /// (`ROWS UNBOUNDED PRECEDING`, `ROWS 5 PRECEDING`, etc.) which
    /// PG normalises to `BETWEEN <bound> AND CURRENT ROW`.
    fn parse_frame_tail(&mut self, kind: FrameKind) -> Result<WindowFrame, ParseError> {
        let (start, end) = if matches!(self.peek(), Token::Between) {
            self.advance();
            let start = self.parse_frame_bound()?;
            if !matches!(self.peek(), Token::And) {
                return Err(self.err(format!("expected AND in frame spec, got {:?}", self.peek())));
            }
            self.advance();
            let end = self.parse_frame_bound()?;
            (start, Some(end))
        } else {
            (self.parse_frame_bound()?, None)
        };
        let exclude = self.parse_frame_exclusion()?;
        Ok(WindowFrame {
            kind,
            start,
            end,
            exclude,
        })
    }

    /// Optional `EXCLUDE {CURRENT ROW | GROUP | TIES | NO OTHERS}`
    /// after a frame spec. NO OTHERS is the default no-op.
    fn parse_frame_exclusion(&mut self) -> Result<FrameExclusion, ParseError> {
        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("exclude")) {
            return Ok(FrameExclusion::NoOthers);
        }
        self.advance(); // EXCLUDE
        match self.peek() {
            Token::Ident(s) if s.eq_ignore_ascii_case("current") => {
                self.advance();
                if !matches!(self.peek(), Token::Ident(r) if r.eq_ignore_ascii_case("row")) {
                    return Err(self.err(format!(
                        "expected ROW after EXCLUDE CURRENT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                Ok(FrameExclusion::CurrentRow)
            }
            // v7.39 (read01 round 109) — GROUP is a reserved keyword token, so
            // `EXCLUDE GROUP` arrives as `Token::Group`, not `Ident("group")`.
            // Without this arm it fell to the catch-all, whose message
            // self-contradictingly listed GROUP as expected.
            Token::Ident(s) if s.eq_ignore_ascii_case("group") => {
                self.advance();
                Ok(FrameExclusion::Group)
            }
            Token::Group => {
                self.advance();
                Ok(FrameExclusion::Group)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("ties") => {
                self.advance();
                Ok(FrameExclusion::Ties)
            }
            Token::Ident(s) if s.eq_ignore_ascii_case("no") => {
                self.advance();
                if !matches!(self.peek(), Token::Ident(r) if r.eq_ignore_ascii_case("others")) {
                    return Err(self.err(format!(
                        "expected OTHERS after EXCLUDE NO, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                Ok(FrameExclusion::NoOthers)
            }
            other => Err(self.err(format!(
                "expected CURRENT ROW / GROUP / TIES / NO OTHERS after EXCLUDE, got {other:?}"
            ))),
        }
    }

    /// Parse one frame bound: `UNBOUNDED PRECEDING`, `<n> PRECEDING`,
    /// `<interval> PRECEDING`, `CURRENT ROW`, `<n>/<interval> FOLLOWING`,
    /// `UNBOUNDED FOLLOWING`.
    fn parse_frame_bound(&mut self) -> Result<FrameBound, ParseError> {
        // Interval-typed offset for a value-based RANGE frame over a
        // DATE / TIMESTAMP ORDER BY column (PG time-series windows),
        // spelled `INTERVAL '1 day' PRECEDING` or `'1 day'::interval
        // PRECEDING`.
        if let Some((months, days, micros)) = self.try_take_interval_offset()? {
            let dir = self.expect_ident_like()?;
            return if dir.eq_ignore_ascii_case("preceding") {
                Ok(FrameBound::IntervalPreceding {
                    months,
                    days,
                    micros,
                })
            } else if dir.eq_ignore_ascii_case("following") {
                Ok(FrameBound::IntervalFollowing {
                    months,
                    days,
                    micros,
                })
            } else {
                Err(self.err(format!(
                    "expected PRECEDING or FOLLOWING after interval offset, got {dir:?}"
                )))
            };
        }
        // Number-led: "<n> PRECEDING" / "<n> FOLLOWING".
        if let Token::Integer(n) = *self.peek() {
            self.advance();
            let n: u64 = u64::try_from(n).map_err(|_| {
                self.err(format!(
                    "invalid frame offset {n} — expected non-negative integer"
                ))
            })?;
            let dir = self.expect_ident_like()?;
            return if dir.eq_ignore_ascii_case("preceding") {
                Ok(FrameBound::OffsetPreceding(n))
            } else if dir.eq_ignore_ascii_case("following") {
                Ok(FrameBound::OffsetFollowing(n))
            } else {
                Err(self.err(format!(
                    "expected PRECEDING or FOLLOWING after offset, got {dir:?}"
                )))
            };
        }
        let first = self.expect_ident_like()?;
        if first.eq_ignore_ascii_case("unbounded") {
            let dir = self.expect_ident_like()?;
            return if dir.eq_ignore_ascii_case("preceding") {
                Ok(FrameBound::UnboundedPreceding)
            } else if dir.eq_ignore_ascii_case("following") {
                Ok(FrameBound::UnboundedFollowing)
            } else {
                Err(self.err(format!(
                    "expected PRECEDING or FOLLOWING after UNBOUNDED, got {dir:?}"
                )))
            };
        }
        if first.eq_ignore_ascii_case("current") {
            let row = self.expect_ident_like()?;
            if !row.eq_ignore_ascii_case("row") {
                return Err(self.err(format!("expected ROW after CURRENT, got {row:?}")));
            }
            return Ok(FrameBound::CurrentRow);
        }
        Err(self.err(format!(
            "expected frame bound (UNBOUNDED/CURRENT/<n>), got {first:?}"
        )))
    }

    /// Detect and consume a leading interval offset in a frame bound —
    /// `INTERVAL '1 day'` or `'1 day'::interval` — returning its folded
    /// `(months, days, micros)`. Leaves the cursor on the trailing
    /// PRECEDING / FOLLOWING keyword. Returns `None` (without advancing)
    /// when the next tokens are not an interval offset.
    fn try_take_interval_offset(&mut self) -> Result<Option<(i32, i32, i64)>, ParseError> {
        // Shape A — `INTERVAL '1 day'`.
        if matches!(self.peek(), Token::Interval) {
            self.advance(); // INTERVAL
            let atom = self.parse_interval_atom()?;
            if let Expr::Literal(Literal::Interval {
                months,
                days,
                micros,
                ..
            }) = atom
            {
                return Ok(Some((months, days, micros)));
            }
            return Err(self.err("expected an interval literal in frame offset".to_string()));
        }
        // Shape B — `'1 day'::interval`. Look ahead for the exact
        // string / `::` / interval-target triple before committing.
        if let Token::String(text) = self.peek() {
            let target_is_interval = match self.tokens.get(self.pos + 2) {
                Some(Token::Interval) => true,
                Some(Token::Ident(s)) => s.eq_ignore_ascii_case("interval"),
                _ => false,
            };
            let is_cast = matches!(self.tokens.get(self.pos + 1), Some(Token::DoubleColon))
                && target_is_interval;
            if is_cast {
                let text = text.clone();
                self.advance(); // string
                self.advance(); // ::
                self.advance(); // interval
                let parts = parse_interval_text(&text).ok_or_else(|| {
                    self.err(format!("cannot parse INTERVAL {text:?} in frame offset"))
                })?;
                return Ok(Some(parts));
            }
        }
        Ok(None)
    }

    fn finish_ident_atom(&mut self, first: String) -> Result<Expr, ParseError> {
        if matches!(self.peek(), Token::Dot) {
            self.advance();
            let name = self.expect_ident_like()?;
            // v7.14.0 — schema-qualified function call
            // `<schema>.<fn>(args)`. PG dumps emit
            // `pg_catalog.set_config(...)` in the preamble. SPG
            // is single-namespace: drop the schema prefix and
            // route the dispatch on the bare function name.
            if matches!(self.peek(), Token::LParen) {
                return self.finish_ident_atom(name);
            }
            return Ok(Expr::Column(ColumnName {
                qualifier: Some(first),
                name,
            }));
        }
        if matches!(self.peek(), Token::LParen) {
            self.advance();
            // `COUNT(*)` — special-cased here because `*` isn't a normal
            // expression token. Lower-case match on `first` since the lexer
            // folds identifiers.
            if first.eq_ignore_ascii_case("count") && matches!(self.peek(), Token::Star) {
                self.advance();
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' after COUNT(*), got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                // v7.32 (round-29) — `COUNT(*) FILTER (WHERE …)`.
                let filter = self.parse_filter_clause()?;
                // v4.12: COUNT(*) OVER (...) — same window tail.
                let null_treatment = self.parse_null_treatment_modifier();
                if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek()
                    && s.eq_ignore_ascii_case("over")
                {
                    self.advance();
                    let (partition_by, order_by, frame) = self.parse_over_clause()?;
                    return Ok(Expr::WindowFunction {
                        name: "count_star".into(),
                        args: Vec::new(),
                        partition_by,
                        order_by,
                        frame,
                        null_treatment,
                        filter,
                    });
                }
                if let Some(filter) = filter {
                    return Ok(Expr::AggregateOrdered {
                        call: Box::new(Expr::FunctionCall {
                            name: "count_star".into(),
                            args: Vec::new(),
                        }),
                        order_by: Vec::new(),
                        distinct: false,
                        filter: Some(filter),
                    });
                }
                return Ok(Expr::FunctionCall {
                    name: "count_star".into(),
                    args: Vec::new(),
                });
            }
            // Function call. PG-style: zero-or-more comma-separated args.
            let mut args = Vec::new();
            // v7.38 (read01, T14) — named-argument notation `argname => value`.
            // Names are collected in lock-step with `args` and resolved to
            // positional order after the loop (the AST stays positional).
            let mut arg_names: Vec<Option<String>> = Vec::new();
            let mut agg_order_by: Vec<OrderBy> = Vec::new();
            // v7.39 (round 354, M12) — whether a `SEPARATOR '<s>'` tail was
            // seen, so the value arguments before it can be folded.
            let mut saw_separator = false;
            // v7.25 (round-17) — `COUNT(DISTINCT x)` and friends.
            // v7.32 (round-29) — accept the dual `ALL` quantifier too
            // (the default; ORMs emit `COUNT(ALL x)` / `SUM(ALL x)`).
            let agg_distinct = if matches!(self.peek(), Token::Distinct) {
                self.advance();
                true
            } else if matches!(self.peek(), Token::All) {
                self.advance();
                false
            } else {
                false
            };
            // v7.37.17 (17.6 siblings) — MySQL TIMESTAMPADD /
            // TIMESTAMPDIFF take a bare unit keyword as the first
            // argument (MINUTE, DAY, ...), and GET_FORMAT takes a
            // bare type keyword (DATE / TIME / DATETIME); lower them
            // onto string literals so the evaluator sees plain text.
            if ((first.eq_ignore_ascii_case("timestampadd")
                || first.eq_ignore_ascii_case("timestampdiff"))
                && matches!(self.peek(), Token::Ident(u) if matches!(
                    u.to_ascii_lowercase().as_str(),
                    "microsecond" | "second" | "minute" | "hour" | "day"
                        | "week" | "month" | "quarter" | "year"
                )))
                || (first.eq_ignore_ascii_case("get_format")
                    && matches!(self.peek(), Token::Ident(u) if matches!(
                        u.to_ascii_lowercase().as_str(),
                        "date" | "time" | "datetime" | "timestamp"
                    )))
            {
                if let Token::Ident(u) = self.peek() {
                    args.push(Expr::Literal(Literal::String(u.to_ascii_lowercase())));
                }
                self.advance();
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                }
            }
            // `ROW(a, b, …)` keyword constructor. Followed by a
            // comparison operator or [NOT] IN it joins the paren
            // row-constructor machinery (fieldwise parse-time
            // expansion); bare, it stays a `row` call the evaluator
            // renders as PG record text.
            if first.eq_ignore_ascii_case("row") {
                let mut row_items = Vec::new();
                if !matches!(self.peek(), Token::RParen) {
                    loop {
                        row_items.push(self.parse_expr(0)?);
                        match self.peek() {
                            Token::Comma => {
                                self.advance();
                            }
                            Token::RParen => break,
                            other => {
                                return Err(self.err(format!(
                                    "expected ',' or ')' in ROW(...), got {other:?}"
                                )));
                            }
                        }
                    }
                }
                self.advance(); // ')'
                let comparison_follows = matches!(
                    self.peek(),
                    Token::Eq
                        | Token::NotEq
                        | Token::Lt
                        | Token::LtEq
                        | Token::Gt
                        | Token::GtEq
                        | Token::In
                ) || (matches!(self.peek(), Token::Not)
                    && matches!(self.tokens.get(self.pos + 1), Some(Token::In)))
                    || matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("overlaps"));
                if comparison_follows && !row_items.is_empty() {
                    return self.parse_row_comparison_tail(row_items);
                }
                return Ok(Expr::FunctionCall {
                    name: String::from("row"),
                    args: row_items,
                });
            }
            // v7.39 (read01 xml.c) — `XMLPARSE(DOCUMENT|CONTENT expr)`:
            // the parse-mode keyword introduces the source text. SPG
            // carries XML as text, so both modes lower to __xmlparse(expr)
            // which validates well-formedness and returns Value::Xml.
            if first.eq_ignore_ascii_case("xmlparse")
                && matches!(self.peek(), Token::Ident(kw)
                    if kw.eq_ignore_ascii_case("document")
                        || kw.eq_ignore_ascii_case("content"))
            {
                let mode = match self.advance() {
                    Token::Ident(kw) => kw.to_ascii_lowercase(),
                    _ => unreachable!("peeked an ident"),
                };
                let src = self.parse_expr(0)?;
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' to close XMLPARSE, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                return Ok(Expr::FunctionCall {
                    name: String::from("__xmlparse"),
                    args: alloc::vec![src, Expr::Literal(Literal::String(mode))],
                });
            }
            // SQL/XML `XMLELEMENT(NAME ident [, content …])` — the NAME
            // keyword introduces the element name (a bare or quoted
            // identifier), then optional content expressions. Lower to a
            // plain `xmlelement(name_text, content …)` call.
            if first.eq_ignore_ascii_case("xmlelement")
                && matches!(self.peek(), Token::Ident(kw) if kw.eq_ignore_ascii_case("name"))
            {
                self.advance(); // consume NAME
                let elem_name = match self.peek().clone() {
                    Token::Ident(n) | Token::QuotedIdent(n) => {
                        self.advance();
                        n
                    }
                    other => {
                        return Err(self.err(format!(
                            "expected element name after XMLELEMENT NAME, got {other:?}"
                        )));
                    }
                };
                let mut args = alloc::vec![Expr::Literal(Literal::String(elem_name))];
                while matches!(self.peek(), Token::Comma) {
                    self.advance();
                    args.push(self.parse_expr(0)?);
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' to close XMLELEMENT, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                return Ok(Expr::FunctionCall {
                    name: String::from("xmlelement"),
                    args,
                });
            }
            // SQL/XML `XMLFOREST(value [AS name], …)` — each `value AS name`
            // becomes a `<name>value</name>` element; a bare column infers its
            // own name. Lower to `xmlforest(name1, val1, name2, val2, …)`.
            if first.eq_ignore_ascii_case("xmlforest") && !matches!(self.peek(), Token::RParen) {
                let mut args: Vec<Expr> = Vec::new();
                loop {
                    let val = self.parse_expr(0)?;
                    let name = if matches!(self.peek(), Token::As) {
                        self.advance();
                        match self.peek().clone() {
                            Token::Ident(n) | Token::QuotedIdent(n) => {
                                self.advance();
                                n
                            }
                            other => {
                                return Err(self.err(format!(
                                    "expected name after AS in XMLFOREST, got {other:?}"
                                )));
                            }
                        }
                    } else if let Expr::Column(c) = &val {
                        c.name.clone()
                    } else {
                        return Err(
                            self.err("XMLFOREST element without a column name needs AS".into())
                        );
                    };
                    args.push(Expr::Literal(Literal::String(name)));
                    args.push(val);
                    if matches!(self.peek(), Token::Comma) {
                        self.advance();
                    } else {
                        break;
                    }
                }
                if !matches!(self.peek(), Token::RParen) {
                    return Err(self.err(format!(
                        "expected ')' to close XMLFOREST, got {:?}",
                        self.peek()
                    )));
                }
                self.advance();
                return Ok(Expr::FunctionCall {
                    name: String::from("xmlforest"),
                    args,
                });
            }
            // SQL-standard `POSITION(sub IN str)` — lowers onto
            // strpos(str, sub). IN is the argument separator here,
            // so the needle parses with the IN-tail suppressed.
            if first.eq_ignore_ascii_case("position") && !matches!(self.peek(), Token::RParen) {
                let saved = self.suppress_in_tail;
                self.suppress_in_tail = true;
                let needle = self.parse_expr(0);
                self.suppress_in_tail = saved;
                let needle = needle?;
                if matches!(self.peek(), Token::In) {
                    self.advance();
                    let haystack = self.parse_expr(0)?;
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(self.err(format!(
                            "expected ')' to close POSITION, got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    return Ok(Expr::FunctionCall {
                        name: String::from("strpos"),
                        args: alloc::vec![haystack, needle],
                    });
                }
                // position(sub, str) comma form (incl. bytea) —
                // hand the parsed first arg to the generic list.
                args.push(needle);
                if matches!(self.peek(), Token::Comma) {
                    self.advance();
                }
            }
            // SQL-standard `TRIM([BOTH|LEADING|TRAILING] [chars]
            // FROM str)` — lowers onto btrim / ltrim / rtrim. The
            // plain comma forms TRIM(str) / TRIM(str, chars) keep
            // riding the generic argument list below.
            if first.eq_ignore_ascii_case("trim") {
                let mode = match self.peek() {
                    Token::Ident(k) if k.eq_ignore_ascii_case("both") => {
                        self.advance();
                        Some("btrim")
                    }
                    Token::Ident(k) if k.eq_ignore_ascii_case("leading") => {
                        self.advance();
                        Some("ltrim")
                    }
                    Token::Ident(k) if k.eq_ignore_ascii_case("trailing") => {
                        self.advance();
                        Some("rtrim")
                    }
                    _ => None,
                };
                if mode.is_some() || matches!(self.peek(), Token::From) {
                    // TRIM([mode] FROM str) — no strip-chars.
                    let chars = if matches!(self.peek(), Token::From) {
                        None
                    } else {
                        Some(self.parse_expr(0)?)
                    };
                    if !matches!(self.peek(), Token::From) {
                        return Err(self.err(format!(
                            "expected FROM in TRIM([BOTH|LEADING|TRAILING] [chars] FROM str), got {:?}",
                            self.peek()
                        )));
                    }
                    self.advance();
                    let target = self.parse_expr(0)?;
                    if !matches!(self.peek(), Token::RParen) {
                        return Err(
                            self.err(format!("expected ')' to close TRIM, got {:?}", self.peek()))
                        );
                    }
                    self.advance();
                    let mut trim_args = alloc::vec![target];
                    if let Some(c) = chars {
                        trim_args.push(c);
                    }
                    return Ok(Expr::FunctionCall {
                        name: String::from(mode.unwrap_or("btrim")),
                        args: trim_args,
                    });
                }
            }
            if !matches!(self.peek(), Token::RParen) {
                loop {
                    // v7.38 (read01, T14) — `argname => value` names this arg.
                    // v7.39 (read01 round 77) — `argname := value` is the same
                    // thing, and it is the spelling PG's own docs lead with. It
                    // was simply never lexed here, so every `f(x := 1)` died in
                    // the parser regardless of what `f` was.
                    let this_name = match (&self.tokens[self.pos], self.tokens.get(self.pos + 1)) {
                        (
                            Token::Ident(n) | Token::QuotedIdent(n),
                            Some(Token::FatArrow | Token::ColonEq),
                        ) => {
                            let name = n.clone();
                            self.advance(); // name
                            self.advance(); // => / :=
                            Some(name)
                        }
                        _ => None,
                    };
                    // v7.39 (read01 round 100) — `VARIADIC <array>` spreads an
                    // array's elements into a variadic call's trailing args
                    // (`concat_ws(',', VARIADIC ARRAY[…])`). VARIADIC isn't
                    // reserved, so it arrives as a bare ident before the arg.
                    let is_variadic = this_name.is_none()
                        && matches!(&self.tokens[self.pos], Token::Ident(s) if s.eq_ignore_ascii_case("variadic"));
                    if is_variadic {
                        self.advance();
                    }
                    let arg = self.parse_expr(0)?;
                    args.push(match &this_name {
                        // The callee's parameter names decide the slot, and a
                        // user function's live in the catalog. Carry the name
                        // to eval rather than guessing here.
                        Some(n) => Expr::NamedArg {
                            name: n.clone(),
                            expr: Box::new(arg),
                        },
                        None if is_variadic => Expr::Variadic(Box::new(arg)),
                        None => arg,
                    });
                    arg_names.push(this_name);
                    // v7.25 (round-17) — standard `CAST(expr AS type)`.
                    // The `::` cast already worked; this lowers the
                    // function form onto the same Expr::Cast node.
                    if first.eq_ignore_ascii_case("cast")
                        && args.len() == 1
                        && matches!(self.peek(), Token::As)
                    {
                        self.advance();
                        let target = self.parse_cast_target()?;
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' to close CAST, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        return Ok(Expr::Cast {
                            expr: Box::new(args.pop().expect("one arg")),
                            target,
                        });
                    }
                    // v7.38 (read01 P6.-) — `normalize(text, FORM)` where FORM is
                    // a bare keyword NFC / NFD / NFKC / NFKD. PG parses these as
                    // keywords; SPG's lexer makes them plain idents (so they'd be
                    // read as column refs). Lower the keyword to the string form
                    // the evaluator already accepts.
                    if first.eq_ignore_ascii_case("normalize")
                        && args.len() == 1
                        && matches!(self.peek(), Token::Comma)
                    {
                        let form = match self.tokens.get(self.pos + 1) {
                            Some(Token::Ident(f) | Token::QuotedIdent(f)) => {
                                let up = f.to_ascii_uppercase();
                                matches!(up.as_str(), "NFC" | "NFD" | "NFKC" | "NFKD").then_some(up)
                            }
                            _ => None,
                        };
                        if let Some(up) = form {
                            self.advance(); // comma
                            self.advance(); // form keyword
                            args.push(Expr::Literal(Literal::String(up)));
                        }
                    }
                    // v7.37.7 C.1.8 — PG `substring(str FROM pos FOR len)` syntactic
                    // form. Desugars to the comma-list shape evaluator already
                    // handles. Triggered after the first arg when the function
                    // name is substring / substr and the next token is FROM
                    // (a reserved keyword in PG; SPG also reserves it).
                    // v7.39 (read01 regexp.c) — `substring(str SIMILAR pat
                    // ESCAPE esc)` (SQL:1999 three-part form) desugars to the
                    // internal __substring_similar(str, pat, esc) call.
                    if (first.eq_ignore_ascii_case("substring")
                        || first.eq_ignore_ascii_case("substr"))
                        && args.len() == 1
                        && matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("similar"))
                    {
                        self.advance(); // SIMILAR
                        let pattern = self.parse_expr(0)?;
                        if !matches!(self.peek(), Token::Ident(s) if s.eq_ignore_ascii_case("escape"))
                        {
                            return Err(self.err(format!(
                                "expected ESCAPE in substring(... SIMILAR ...), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance(); // ESCAPE
                        let esc = self.parse_expr(0)?;
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' to close substring(... SIMILAR ...), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        args.push(pattern);
                        args.push(esc);
                        return Ok(Expr::FunctionCall {
                            name: "__substring_similar".to_string(),
                            args,
                        });
                    }
                    if (first.eq_ignore_ascii_case("substring")
                        || first.eq_ignore_ascii_case("substr"))
                        && args.len() == 1
                        && matches!(self.peek(), Token::From | Token::For)
                    {
                        // `substring(str FROM pos [FOR len])`, or the FOR-only
                        // `substring(str FOR len)` which PG treats as FROM 1.
                        if matches!(self.peek(), Token::From) {
                            self.advance();
                            let start = self.parse_expr(0)?;
                            args.push(start);
                        } else {
                            args.push(Expr::Literal(Literal::Integer(1)));
                        }
                        if matches!(self.peek(), Token::For) {
                            self.advance();
                            let length = self.parse_expr(0)?;
                            args.push(length);
                        }
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' to close substring(... FROM ... [FOR ...]), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        return Ok(Expr::FunctionCall {
                            name: first.to_ascii_lowercase(),
                            args,
                        });
                    }
                    // PG `overlay(str PLACING repl FROM n [FOR len])`
                    // syntactic form. Desugars to the `overlay(str,
                    // repl, n[, len])` comma-list shape the evaluator
                    // already implements. `PLACING` is not a reserved
                    // token in SPG, so it arrives as a bare Ident.
                    if first.eq_ignore_ascii_case("overlay")
                        && args.len() == 1
                        && matches!(self.peek(), Token::Ident(kw) if kw == "placing")
                    {
                        self.advance(); // consume PLACING
                        args.push(self.parse_expr(0)?); // replacement
                        if !matches!(self.peek(), Token::From) {
                            return Err(self.err(format!(
                                "expected FROM in overlay(... PLACING ... FROM ...), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        args.push(self.parse_expr(0)?); // start position
                        if matches!(self.peek(), Token::For) {
                            self.advance();
                            args.push(self.parse_expr(0)?); // length
                        }
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' to close overlay(... PLACING ... FROM ... [FOR ...]), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        return Ok(Expr::FunctionCall {
                            name: String::from("overlay"),
                            args,
                        });
                    }
                    // `TRIM(chars FROM str)` — the keyword-less
                    // spelling lands here after the chars parse
                    // (the keyword forms return earlier).
                    if first.eq_ignore_ascii_case("trim")
                        && args.len() == 1
                        && matches!(self.peek(), Token::From)
                    {
                        self.advance();
                        let target = self.parse_expr(0)?;
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' to close TRIM(chars FROM str), got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        let chars = args.pop().expect("one arg");
                        return Ok(Expr::FunctionCall {
                            name: String::from("btrim"),
                            args: alloc::vec![target, chars],
                        });
                    }
                    // v7.24 (round-16 A) — aggregate-internal
                    // ordering: `array_agg(x ORDER BY y DESC NULLS
                    // LAST)`. Keys close the argument list.
                    if matches!(self.peek(), Token::Order) {
                        self.advance();
                        if !self.peek_is_by() {
                            return Err(self.err(format!(
                                "expected BY after ORDER in aggregate args, got {:?}",
                                self.peek()
                            )));
                        }
                        self.advance();
                        loop {
                            // v7.39 (round 691) — save/restore, the discipline this parser
                            // already uses around `pending_sample_preds`, so a subquery inside
                            // a key neither inherits nor leaks the channel.
                            let saved_flag = core::mem::replace(&mut self.in_order_by_key, true);
                            let saved_coll = self.order_key_collation.take();
                            let parsed = self.parse_expr(0);
                            self.in_order_by_key = saved_flag;
                            let collation =
                                core::mem::replace(&mut self.order_key_collation, saved_coll);
                            let expr = parsed?;
                            let desc = if matches!(self.peek(), Token::Desc) {
                                self.advance();
                                true
                            } else if matches!(self.peek(), Token::Asc) {
                                self.advance();
                                false
                            } else {
                                false
                            };
                            let nulls_first = self.parse_optional_nulls_placement()?;
                            agg_order_by.push(OrderBy {
                                expr,
                                desc,
                                nulls_first,
                                collation,
                            });
                            if matches!(self.peek(), Token::Comma) {
                                self.advance();
                            } else {
                                break;
                            }
                        }
                        // v7.39 (round 354, M12) — `SEPARATOR '<s>'` may
                        // follow the ORDER BY inside GROUP_CONCAT.
                        if self.consume_group_concat_separator(&mut args)? {
                            saw_separator = true;
                        }
                        if !matches!(self.peek(), Token::RParen) {
                            return Err(self.err(format!(
                                "expected ')' after aggregate ORDER BY, got {:?}",
                                self.peek()
                            )));
                        }
                        break;
                    }
                    // v7.39 (round 354, M12) — …or directly after the
                    // arguments (`GROUP_CONCAT(t SEPARATOR '|')`). MySQL's
                    // own spelling of what PG passes as string_agg's second
                    // argument; it was a parse error, so every MySQL query
                    // that names its own separator failed outright.
                    if self.consume_group_concat_separator(&mut args)? {
                        saw_separator = true;
                        break;
                    }
                    match self.peek() {
                        Token::Comma => {
                            self.advance();
                        }
                        Token::RParen => break,
                        other => {
                            return Err(self.err(format!(
                                "expected ',' or ')' in function args, got {other:?}"
                            )));
                        }
                    }
                }
            }
            // v7.39 (round 354, M12) — MySQL's GROUP_CONCAT concatenates
            // its value arguments PER ROW: `GROUP_CONCAT(n, ':', t)` is
            // `3:c,1:a,…` (measured on MariaDB 11), NOT a second argument
            // meaning a separator — that is what the explicit SEPARATOR
            // tail is for. Fold them into one `concat(...)` so the
            // aggregate keeps its single value argument.
            if self.mysql_dialect && first.eq_ignore_ascii_case("group_concat") {
                let values = args.len() - usize::from(saw_separator);
                if values > 1 {
                    let sep_arg = if saw_separator { args.pop() } else { None };
                    let folded = Expr::FunctionCall {
                        name: "concat".to_string(),
                        args: core::mem::take(&mut args),
                    };
                    args.push(folded);
                    if let Some(sep) = sep_arg {
                        args.push(sep);
                    }
                }
            }
            self.advance(); // consume ')'
            // v7.39 (read01 round 77) — named arguments are NOT reordered here
            // any more. The parser has no catalog, so it could only ever resolve
            // the handful of `make_*` builtins whose parameter names were baked
            // into a table right here — every user function got
            // "does not support named arguments", though the catalog has been
            // storing its parameter names all along. Reordering happens in eval,
            // in one place, for builtins and user functions alike.
            // v7.32 (round-29) — ordered-set aggregate tail
            // `name(direct_args) WITHIN GROUP (ORDER BY …)`
            // (percentile_cont / percentile_disc / mode). The sort spec
            // lands in the same `order_by` slot a decorated aggregate
            // uses; the executor dispatches on the function name. WITHIN
            // GROUP and an intra-argument ORDER BY are mutually
            // exclusive (PG rejects both).
            let within_group_order = self.parse_within_group_clause()?;
            if !within_group_order.is_empty() && !agg_order_by.is_empty() {
                return Err(self.err(
                    "an aggregate may not carry both an in-argument ORDER BY and WITHIN GROUP"
                        .into(),
                ));
            }
            let within_group_seen = !within_group_order.is_empty();
            let agg_order_by = if within_group_order.is_empty() {
                agg_order_by
            } else {
                within_group_order
            };
            // v7.32 (round-29) — `name(args) FILTER (WHERE …)`.
            let filter = self.parse_filter_clause()?;
            // v4.12: window-function tail — `name(args) OVER (...)`.
            // Promotes the just-parsed FunctionCall into a
            // WindowFunction node carrying partition + order.
            // v6.4.2: also accepts `name(args) IGNORE NULLS OVER (...)`
            // / `RESPECT NULLS OVER (...)` between the closing paren
            // and `OVER`.
            let null_treatment = self.parse_null_treatment_modifier();
            if let Token::Ident(s) | Token::QuotedIdent(s) = self.peek()
                && s.eq_ignore_ascii_case("over")
            {
                self.advance();
                // v7.39 (round 230) — PG implements neither modifier for a
                // windowed call and says so (0A000). Both used to be parsed
                // and then silently dropped here, so `count(DISTINCT v)
                // OVER (…)` quietly answered the non-distinct count.
                if agg_distinct {
                    return Err(
                        self.err("DISTINCT is not implemented for window functions".to_string())
                    );
                }
                if !agg_order_by.is_empty() {
                    // PG separates the two shapes that land here: a
                    // WITHIN GROUP call is an ordered-set aggregate and gets
                    // its own message naming the aggregate; a plain
                    // `agg(x ORDER BY y)` gets the generic one.
                    let msg = if within_group_seen {
                        alloc::format!("OVER is not supported for ordered-set aggregate {first}")
                    } else {
                        "aggregate ORDER BY is not implemented for window functions".to_string()
                    };
                    return Err(self.err(msg));
                }
                let (partition_by, order_by, frame) = self.parse_over_clause()?;
                return Ok(Expr::WindowFunction {
                    name: first,
                    args,
                    partition_by,
                    order_by,
                    frame,
                    null_treatment,
                    filter,
                });
            }
            if !agg_order_by.is_empty() || agg_distinct || filter.is_some() {
                return Ok(Expr::AggregateOrdered {
                    call: Box::new(Expr::FunctionCall { name: first, args }),
                    order_by: agg_order_by,
                    distinct: agg_distinct,
                    filter,
                });
            }
            // v7.39 (round 522) — PG declares `date_add` / `date_subtract`
            // over TIMESTAMPTZ and has no timestamp overload, so a
            // timestamp argument is coerced on the way in and the answer
            // is timestamptz — measured: `pg_typeof(date_add(TIMESTAMP
            // '2020-01-01', INTERVAL '1 hour'))` is `timestamp with time
            // zone`. SPG answered `timestamp without time zone`, dropping
            // the offset from every rendering.
            //
            // Writing the coercion PG performs makes the existing
            // argument-driven typing (the one `date_trunc` uses) reach the
            // right answer, rather than teaching the type layer a second
            // rule. MySQL's DATE_ADD is a different function that returns
            // DATE or DATETIME, so this is PG-dialect only.
            //
            // Out-of-line because this sits on the RECURSIVE descent
            // frame: an inline block with locals here costs every nesting
            // level, and the suite's deep-nesting sentinel overflowed the
            // 512 KiB parser stack the moment one was added (round 430's
            // lesson, in the same shape).
            if !self.mysql_dialect {
                lift_date_add_arg_to_timestamptz(&first, &mut args);
            }
            return Ok(Expr::FunctionCall { name: first, args });
        }
        // v7.9.20 — SQL-standard parenless keyword expressions
        // (PG treats these as functions called without parens).
        // Resolve to a synthetic FunctionCall so the engine's
        // eval path reuses the existing function-call routing.
        // mailrs G3.
        let lc = first.to_ascii_lowercase();
        if matches!(
            lc.as_str(),
            "current_date"
                | "current_time"
                | "current_timestamp"
                | "localtimestamp"
                | "localtime"
                // v7.37.17 (17.6 siblings) — session-identity SQL-
                // standard parenless keywords. current_user /
                // session_user / user were already caught by the
                // pgwire canned-response shortcut but bare-select
                // in the embedded engine went through Expr::Column
                // and errored. Adding them here so the parser
                // resolves to a synthetic FunctionCall that reuses
                // the existing eval/functions.rs dispatch.
                | "current_user"
                | "session_user"
                | "current_role"
                | "current_catalog"
                | "current_schema"
                | "current_database"
                // v7.39 (read01 round 51) — PG 16's system_user is parenless too.
                | "system_user"
        ) {
            return Ok(Expr::FunctionCall {
                name: lc,
                args: Vec::new(),
            });
        }
        Ok(Expr::Column(ColumnName {
            qualifier: None,
            name: first,
        }))
    }
}

/// v7.39 (round 522) — write the coercion PG's `date_add` /
/// `date_subtract` signature performs.
///
/// PG declares both over TIMESTAMPTZ and has no timestamp overload, so a
/// timestamp argument is cast on the way in and the answer is
/// timestamptz — measured: `pg_typeof(date_add(TIMESTAMP '2020-01-01',
/// INTERVAL '1 hour'))` is `timestamp with time zone`. SPG answered
/// `timestamp without time zone`, dropping the offset from every
/// rendering of the result.
///
/// Writing the cast the signature implies lets the existing
/// argument-driven typing (the one `date_trunc` uses) reach the right
/// answer instead of teaching the type layer a second rule. MySQL's
/// DATE_ADD is a different function returning DATE or DATETIME, so the
/// caller applies this in PG dialect only.
///
/// A free function, and not a block at the call site, because the caller
/// is on the recursive-descent frame chain.
#[inline(never)]
fn lift_date_add_arg_to_timestamptz(name: &str, args: &mut alloc::vec::Vec<Expr>) {
    if args.len() != 2
        || !(name.eq_ignore_ascii_case("date_add") || name.eq_ignore_ascii_case("date_subtract"))
    {
        return;
    }
    let base = args.remove(0);
    args.insert(
        0,
        Expr::Cast {
            expr: Box::new(base),
            target: CastTarget::Timestamptz,
        },
    );
}

/// v6.8.2 — walk an expression tree and return the first column
/// reference's bare name. Used by `parse_create_index_stmt_after_create`
/// to derive `CreateIndexStatement.column` from an expression
/// key (so downstream planner code resolving a primary column
/// position keeps working with expression indexes). Returns
/// `None` when the expression has no column ref at all — caller
/// surfaces that as a parse error.
fn extract_first_column(expr: &Expr) -> Option<String> {
    match expr {
        Expr::Column(cn) => Some(cn.name.clone()),
        Expr::FunctionCall { args, .. } => args.iter().find_map(extract_first_column),
        Expr::Binary { lhs, rhs, .. } => {
            extract_first_column(lhs).or_else(|| extract_first_column(rhs))
        }
        Expr::Unary { expr: e, .. } => extract_first_column(e),
        // v7.39 (read01 round 93) — a cast wraps its operand: a common
        // expression-index key is `lower(col::text)`, where the column
        // sits under the `::text` cast inside the function arg. Without
        // descending here the key was rejected as "references no column".
        Expr::Cast { expr: e, .. } => extract_first_column(e),
        _ => None,
    }
}

fn maybe_not(expr: Expr, negated: bool) -> Expr {
    if negated {
        Expr::Unary {
            op: UnOp::Not,
            expr: Box::new(expr),
        }
    } else {
        expr
    }
}

/// v7.39 (round 353, M9/M10) — three operator TOKENS mean different
/// things in the two dialects, and SPG read all three PG's way:
///
/// | token | PG (and SPG) | MySQL, measured |
/// |---|---|---|
/// | `\|\|` | string concatenation | **OR** — `1 \|\| 0` is 1, not '10' |
/// | `&&` | inet / array overlap | **AND** |
/// | `<=>` | pgvector cosine distance | **NULL-safe equal** |
///
/// `1 || 0` answering the string '10' on a MySQL session is a wrong
/// answer with no error, which is why they are routed here rather than
/// left to the shared table.
impl Parser {
    fn binop_here(&self, tok: &Token) -> Option<(BinOp, u8)> {
        if self.mysql_dialect {
            // v7.39 (round 353, M9) — `DIV` is MySQL's truncating integer
            // division (`5 DIV 2` is 2, `-7 DIV 2` is -3 — toward zero —
            // and `5 DIV 0` is NULL). It is a plain ident to the lexer.
            if let Token::Ident(w) = tok
                && w.eq_ignore_ascii_case("div")
            {
                return Some((BinOp::IntDiv, 8));
            }
            // v7.39 (round 394) — `MOD` is MySQL's modulo operator, a synonym
            // for `%` (`10 MOD 3` is 1, `5.5 MOD 2` is 1.5). A plain ident to
            // the lexer; the `MOD(x, y)` function form is unaffected (MOD
            // there sits in operand position, not infix).
            if let Token::Ident(w) = tok
                && w.eq_ignore_ascii_case("mod")
            {
                return Some((BinOp::Mod, 8));
            }
            // v7.39 (round 407) — `XOR` is MySQL's logical exclusive-or, a
            // plain ident to the lexer. Its precedence sits between OR (1)
            // and AND (3) — hence rung 2, the slot freed by moving AND up.
            if let Token::Ident(w) = tok
                && w.eq_ignore_ascii_case("xor")
            {
                return Some((BinOp::LogicalXor, 2));
            }
            match tok {
                Token::Concat => return Some((BinOp::Or, 1)),
                // MySQL's `&&` is logical AND, sharing AND's rung (3).
                Token::InetOverlap => return Some((BinOp::And, 3)),
                // MySQL's `<=>` is NULL-safe equal, at the comparison rung (5).
                Token::CosineDistance => return Some((BinOp::IsNotDistinctFrom, 5)),
                _ => {}
            }
        }
        binop_from(tok)
    }
}

// v7.39 (round 407) — precedence ladder. To open a rung for MySQL's `XOR`
// (which sits strictly between OR and AND), every level from AND upward was
// shifted +1: the ladder is now OR=1, XOR=2, AND=3, IS=4, comparison=5,
// distance=6, additive/concat/bitwise=7, multiplicative/JSON=8, prefix=9.
// XOR only exists in the MySQL dialect (binop_here); PG never sees it, and
// the *relative* order of every PG operator is unchanged by the shift.
fn binop_from(tok: &Token) -> Option<(BinOp, u8)> {
    let pair = match tok {
        Token::Or => (BinOp::Or, 1),
        Token::And => (BinOp::And, 3),
        Token::Eq => (BinOp::Eq, 5),
        Token::NotEq => (BinOp::NotEq, 5),
        Token::Lt => (BinOp::Lt, 5),
        Token::LtEq => (BinOp::LtEq, 5),
        Token::Gt => (BinOp::Gt, 5),
        Token::GtEq => (BinOp::GtEq, 5),
        // pgvector distance ops all sit on the same rung — tighter than
        // comparisons (5) so `col <-> v < threshold` parses correctly.
        Token::L2Distance => (BinOp::L2Distance, 6),
        // v7.39 (read01 geo_ops.c) — geometric predicates ride the
        // comparison rung.
        Token::GeomParallel => (BinOp::GeomParallel, 5),
        // v7.39 (read01 rangetypes.c) — range `&<` / `&>` on the
        // comparison rung.
        Token::OverLeft => (BinOp::OverLeft, 5),
        Token::OverRight => (BinOp::OverRight, 5),
        Token::GeomPerp => (BinOp::GeomPerp, 5),
        Token::GeomSameAs => (BinOp::GeomSameAs, 5),
        Token::ClosestPoint => (BinOp::ClosestPoint, 6),
        Token::GeomHoriz => (BinOp::GeomHoriz, 5),
        Token::InnerProduct => (BinOp::InnerProduct, 6),
        Token::CosineDistance => (BinOp::CosineDistance, 6),
        Token::Plus => (BinOp::Add, 7),
        Token::Minus => (BinOp::Sub, 7),
        // v7.39 (round 760, F31-B1) — the generic-operator rung. PG
        // binds every "other" operator (`||`, `|`, `&`, `#`, the
        // pgvector distances above) BETWEEN additive (7) and the
        // comparisons (5): `'a' || 1 + 1` is `'a' || 2` → `a2`,
        // `a & b + 1` is `a & (b + 1)`, and `flags & $1 = 0` stays
        // `(flags & $1) = 0`. They shared rung 7 with `+ -` since v1
        // ("matches PG conceptually" — the round-753 audit measured it
        // false; the old rung errored on `'a' || 1 + 1` with
        // `text + integer`). Same-level chains left-fold, as PG does.
        Token::Concat => (BinOp::Concat, 6),
        Token::Pipe => (BinOp::BitOr, 6),
        Token::Amp => (BinOp::BitAnd, 6),
        Token::Star => (BinOp::Mul, 8),
        Token::Slash => (BinOp::Div, 8),
        Token::Percent => (BinOp::Mod, 8),
        // v4.14: JSON path ops bind tighter than comparisons (5)
        // and additive (7) so `doc->'k' = 'v'` parses correctly.
        // Same rung as the multiplicative ops.
        Token::JsonGet => (BinOp::JsonGet, 8),
        Token::JsonGetText => (BinOp::JsonGetText, 8),
        Token::JsonGetPath => (BinOp::JsonGetPath, 8),
        Token::JsonGetPathText => (BinOp::JsonGetPathText, 8),
        Token::JsonContains => (BinOp::JsonContains, 8),
        Token::JsonPathExists => (BinOp::JsonPathExists, 8),
        Token::JsonContainedBy => (BinOp::JsonContainedBy, 8),
        Token::JsonKeyExists => (BinOp::JsonKeyExists, 8),
        Token::JsonKeysAny => (BinOp::JsonKeysAny, 8),
        Token::JsonKeysAll => (BinOp::JsonKeysAll, 8),
        Token::JsonDeletePath => (BinOp::JsonDeletePath, 8),
        // v7.12.2 — `@@` binds at the comparison rung (looser than
        // arithmetic, tighter than AND / OR). PG places `@@` at
        // the same precedence as `=` / `<`, so we follow.
        Token::TsMatch => (BinOp::TsMatch, 5),
        // v7.17.0 Phase 3.P0-47 — PG INET / CIDR containment + overlap.
        // PG places these at the comparison rung (same level as `=`),
        // so we follow.
        Token::InetContainedBy => (BinOp::InetContainedBy, 5),
        Token::InetContainedByEq => (BinOp::InetContainedByEq, 5),
        Token::InetContains => (BinOp::InetContains, 5),
        Token::InetContainsEq => (BinOp::InetContainsEq, 5),
        Token::InetOverlap => (BinOp::InetOverlap, 5),
        // v7.39 (round 508) — the geometric and pattern-order predicates
        // ride the comparison rung, as every other predicate does.
        Token::Intersects => (BinOp::Intersects, 5),
        Token::IsBelow => (BinOp::IsBelow, 5),
        Token::IsAbove => (BinOp::IsAbove, 5),
        Token::PatternLt => (BinOp::PatternLt, 5),
        Token::PatternLtEq => (BinOp::PatternLtEq, 5),
        Token::PatternGt => (BinOp::PatternGt, 5),
        Token::PatternGtEq => (BinOp::PatternGtEq, 5),
        // `@@@` is the old spelling of `@@` and means exactly it.
        Token::TsMatchOld => (BinOp::TsMatch, 5),
        _ => return None,
    };
    Some(pair)
}

#[allow(clippy::cast_possible_truncation, clippy::cast_precision_loss)]
// `as f32` here is intentional: vector elements widen / narrow into f32 on
// purpose. i64 → f32 loses precision past 2^24, f64 → f32 loses precision
// past ~15 decimal digits — both are acceptable for a fixed-precision
// pgvector column.
/// v7.17.0 Phase 1.3 — words that would otherwise be eaten as an
/// implicit table alias and break trailing clauses. WITH lands
/// here so `… FROM t WITH NO DATA` doesn't consume WITH as the
/// alias for `t`; same for ON / WHERE / HAVING / GROUP / ORDER /
/// LIMIT / OFFSET / UNION / EXCEPT / INTERSECT / RETURNING / SET
/// / VALUES / FOR / LATERAL — all of which would otherwise be
/// silently swallowed by `parse_optional_alias`.
fn is_alias_stopword(s: &str) -> bool {
    matches!(
        s.to_ascii_lowercase().as_str(),
        "with"
            | "on"
            | "where"
            | "having"
            | "group"
            | "order"
            | "limit"
            | "offset"
            | "union"
            | "except"
            | "intersect"
            | "returning"
            | "set"
            | "values"
            | "for"
            | "window"
            | "tablesample"
            | "lateral"
            | "left"
            | "right"
            | "inner"
            | "outer"
            | "full"
            | "cross"
            | "join"
            | "natural"
            | "using"
            | "fetch"
    )
}

fn extract_numeric_literal(e: &Expr) -> Option<f32> {
    match e {
        Expr::Literal(Literal::Integer(n)) => Some(*n as f32),
        Expr::Literal(Literal::Float(x)) => Some(*x as f32),
        // v7.38 (read01) — a dotted literal is now NUMERIC, so a vector element
        // like `2.5` arrives as Literal::Numeric; widen it into f32. (`no_std`,
        // so scale the divisor by hand instead of `f32::powi`.)
        Expr::Literal(Literal::Numeric { unscaled, scale }) => {
            let mut div = 1.0f32;
            for _ in 0..*scale {
                div *= 10.0;
            }
            Some(*unscaled as f32 / div)
        }
        Expr::Unary {
            op: UnOp::Neg,
            expr,
        } => extract_numeric_literal(expr).map(|x| -x),
        _ => None,
    }
}

/// Parse the text inside `INTERVAL '...'` into `(months, micros)`. Accepts
/// one or more `<n> <unit>` pairs separated by whitespace. `<n>` may be
/// negative. Returns `None` if any pair fails to parse or no pair is found.
///
/// Recognised units (case-insensitive, optional trailing `s`):
/// `microsecond`, `millisecond`, `second`, `minute`, `hour`, `day`, `week`,
/// `month`, `year`. `week` widens to 7 days; `year` widens to 12 months.
/// v7.37.5 β — returns `(months, days, micros)`. `days` is preserved
/// as its own dimension so `INTERVAL '1 day'` ≠ `INTERVAL '24 hours'`
/// (PG-canonical: DST and month-boundary semantics depend on this).
/// `week` rolls into `days` (× 7). Sub-day units flow into `micros`.
/// ISO 8601 duration input for INTERVAL: `P1Y2M3DT4H5M6S`. Before the `T`,
/// `M` is months; after it, `M` is minutes. Returns `(months, days, micros)`.
#[allow(clippy::cast_possible_truncation)]
fn parse_iso8601_interval(rest: &str) -> Option<(i32, i32, i64)> {
    let mut months: i64 = 0;
    let mut days: i64 = 0;
    let mut micros: i64 = 0;
    let mut in_time = false;
    let mut num = alloc::string::String::new();
    for ch in rest.chars() {
        if ch.is_ascii_digit() || ch == '.' || ch == '-' || ch == '+' {
            num.push(ch);
            continue;
        }
        if ch == 'T' || ch == 't' {
            if !num.is_empty() {
                return None;
            }
            in_time = true;
            continue;
        }
        let n: f64 = num.parse().ok()?;
        num.clear();
        match (ch, in_time) {
            ('Y' | 'y', false) => months += (n * 12.0) as i64,
            ('M', false) => months += n as i64,
            ('W' | 'w', false) => days += (n * 7.0) as i64,
            ('D' | 'd', false) => days += n as i64,
            ('H' | 'h', true) => micros += (n * 3_600_000_000.0) as i64,
            ('M', true) => micros += (n * 60_000_000.0) as i64,
            ('S' | 's', true) => micros += (n * 1_000_000.0) as i64,
            _ => return None,
        }
    }
    if !num.is_empty() {
        return None;
    }
    Some((
        i32::try_from(months).ok()?,
        i32::try_from(days).ok()?,
        micros,
    ))
}

/// PG year-month shorthand for INTERVAL: `1-2` = 1 year 2 mons (an optional
/// leading `-` negates the whole value). Rejects date-like strings.
fn parse_year_month_interval(s: &str) -> Option<(i32, i32, i64)> {
    let (neg, body) = match s.strip_prefix('-') {
        Some(b) => (true, b),
        None => (false, s),
    };
    let (y, m) = body.split_once('-')?;
    let years: i32 = y.parse().ok()?;
    let mons: i32 = m.parse().ok()?;
    if years < 0 || mons < 0 {
        return None;
    }
    let total = years.checked_mul(12)?.checked_add(mons)?;
    Some((if neg { -total } else { total }, 0, 0))
}

/// Parse a clock-time interval token `HH:MM[:SS[.ffffff]]` (optionally signed)
/// into microseconds. Used for the `3 days 14:30:45` / bare `14:30:45` forms.
fn parse_interval_clock(tok: &str) -> Option<i64> {
    let (neg, body) = match tok.strip_prefix('-') {
        Some(r) => (true, r),
        None => (false, tok.strip_prefix('+').unwrap_or(tok)),
    };
    let mut it = body.split(':');
    let h: i64 = it.next()?.parse().ok()?;
    let m: i64 = it.next()?.parse().ok()?;
    let s_tok = it.next().unwrap_or("0");
    if it.next().is_some() {
        return None;
    }
    let sec_us: i64 = if let Some((sec, frac)) = s_tok.split_once('.') {
        let sec: i64 = sec.parse().ok()?;
        let mut f = alloc::string::String::from(frac);
        while f.len() < 6 {
            f.push('0');
        }
        f.truncate(6);
        let fus: i64 = f.parse().ok()?;
        sec.checked_mul(1_000_000)?.checked_add(fus)?
    } else {
        s_tok.parse::<i64>().ok()?.checked_mul(1_000_000)?
    };
    let total = h
        .checked_mul(3_600_000_000)?
        .checked_add(m.checked_mul(60_000_000)?)?
        .checked_add(sec_us)?;
    Some(if neg { -total } else { total })
}

/// v7.39 (read01 round 77) — one canonical name per interval unit, covering
/// every spelling PG accepts (measured against live PG18.4, not guessed):
/// `min` / `mins` / `m` are minutes, `mon` / `mons` are months, `y` is years.
/// Before this, the unit table matched long names only, with an ad-hoc
/// `strip_suffix('s')` in front of it — so `'15 min'` (and `hrs`, `secs`,
/// `yrs`, every abbreviation anyone actually types) was "cannot parse as
/// INTERVAL", and it had also grown arms for the debris that stripping leaves
/// behind (`centurie`, `millenniu`). Two parallel unit matches (integer and
/// fractional) both read from this one table now.
fn canonical_interval_unit(raw: &str) -> Option<&'static str> {
    let u = raw.to_ascii_lowercase();
    Some(match u.as_str() {
        "microsecond" | "microseconds" | "us" | "usec" | "usecs" | "usecond" | "useconds" => {
            "microsecond"
        }
        "millisecond" | "milliseconds" | "ms" | "msec" | "msecs" | "msecond" | "mseconds" => {
            "millisecond"
        }
        "second" | "seconds" | "sec" | "secs" | "s" => "second",
        "minute" | "minutes" | "min" | "mins" | "m" => "minute",
        "hour" | "hours" | "hr" | "hrs" | "h" => "hour",
        "day" | "days" | "d" => "day",
        "week" | "weeks" | "w" => "week",
        "month" | "months" | "mon" | "mons" => "month",
        "year" | "years" | "yr" | "yrs" | "y" => "year",
        "decade" | "decades" | "dec" | "decs" => "decade",
        "century" | "centuries" | "cent" | "c" => "century",
        "millennium" | "millenniums" | "millennia" | "mil" | "mils" => "millennium",
        _ => return None,
    })
}

/// v7.39 (read01 round 102) — the six SQL-standard interval fields that can
/// qualify an `INTERVAL '…' <FIELD> [TO <FIELD>]` literal.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum IntervalField {
    Year,
    Month,
    Day,
    Hour,
    Minute,
    Second,
}

/// Recognise an interval field keyword (bare ident, case-insensitive). Plural
/// spellings aren't standard for the qualifier position, so only the singular
/// forms are accepted.
/// v7.39 (round 350, M7) — MySQL's interval units, measured against
/// MariaDB 11. QUARTER is three months and WEEK seven days; MICROSECOND
/// is the finest. (The compound spellings — `DAY_HOUR` and friends, which
/// take a `'1 2'` style literal — are not read here; they stay a parse
/// error rather than being silently misread.)
/// v7.39 (round 430) — lower a `@name` / `@@name` reference to its call.
///
/// ONE `@` is a MySQL USER variable: its own per-session namespace, nothing
/// to do with a `@@` engine setting, and an unset one reads NULL rather
/// than raising. (The parser used to strip every `@`, so `@x` and `@@x`
/// were the same node and `SELECT @x` answered "Unknown system variable".)
/// For `@@`, the `session.` / `global.` scope is KEPT: a global read must
/// not see a session override — measured, after `SET autocommit=0`,
/// `@@global.autocommit` is still 1.
///
/// Out-of-line and NOT a method: `parse_atom` is the giant recursive frame
/// the parser's nesting budget is tuned against, and building these
/// `String` + `Vec` locals inside it overflowed the guard's stack (the same
/// wall `parse_left_right_atom` and friends were factored out for).
#[inline(never)]
fn variable_ref_atom(raw: &str) -> Expr {
    let user_var = !raw.starts_with("@@");
    let bare = raw.trim_start_matches('@').to_ascii_lowercase();
    Expr::FunctionCall {
        name: String::from(if user_var {
            "__spg_user_var"
        } else {
            "__spg_session_var"
        }),
        args: alloc::vec![Expr::Literal(Literal::String(bare))],
    }
}

fn mysql_interval_unit(tok: &Token) -> Option<&'static str> {
    let Token::Ident(s) = tok else { return None };
    Some(match () {
        () if s.eq_ignore_ascii_case("microsecond") => "microsecond",
        () if s.eq_ignore_ascii_case("second") => "second",
        () if s.eq_ignore_ascii_case("minute") => "minute",
        () if s.eq_ignore_ascii_case("hour") => "hour",
        () if s.eq_ignore_ascii_case("day") => "day",
        () if s.eq_ignore_ascii_case("week") => "week",
        () if s.eq_ignore_ascii_case("month") => "month",
        () if s.eq_ignore_ascii_case("quarter") => "quarter",
        () if s.eq_ignore_ascii_case("year") => "year",
        () => return None,
    })
}

/// v7.39 (round 422) — lower `INTERVAL <expr> <unit>` onto the existing
/// `make_interval(years, months, weeks, days, hours, mins, secs)` builtin,
/// which constructs the value at run time. Only the slot the unit names
/// carries the quantity; QUARTER and MICROSECOND scale it into the nearest
/// slot the builtin has (months and fractional seconds respectively).
fn make_interval_call(qty: Expr, unit: &str) -> Expr {
    let zero = || Expr::Literal(Literal::Integer(0));
    let scaled = |op: crate::ast::BinOp, by: Expr| Expr::Binary {
        lhs: alloc::boxed::Box::new(qty.clone()),
        op,
        rhs: alloc::boxed::Box::new(by),
    };
    // (years, months, weeks, days, hours, mins, secs)
    let mut args = alloc::vec![zero(), zero(), zero(), zero(), zero(), zero(), zero()];
    match unit {
        "year" => args[0] = qty,
        "quarter" => {
            args[1] = scaled(crate::ast::BinOp::Mul, Expr::Literal(Literal::Integer(3)));
        }
        "month" => args[1] = qty,
        "week" => args[2] = qty,
        "day" => args[3] = qty,
        "hour" => args[4] = qty,
        "minute" => args[5] = qty,
        "second" => args[6] = qty,
        // The builtin's seconds slot takes a fraction, so microseconds ride
        // it scaled down; the divisor is a NUMERIC literal so the division
        // stays exact rather than going through a float.
        "microsecond" => {
            args[6] = scaled(
                crate::ast::BinOp::Div,
                Expr::Literal(Literal::Numeric {
                    unscaled: 1_000_000,
                    scale: 0,
                }),
            );
        }
        _ => args[3] = qty,
    }
    Expr::FunctionCall {
        name: alloc::string::String::from("make_interval"),
        args,
    }
}

/// `(count, unit)` → `(months, days, micros)`.
fn scale_mysql_interval(count: &str, unit: &str) -> Option<(i32, i32, i64)> {
    let n: i64 = count.trim().parse().ok()?;
    Some(match unit {
        "microsecond" => (0, 0, n),
        "second" => (0, 0, n.checked_mul(1_000_000)?),
        "minute" => (0, 0, n.checked_mul(60_000_000)?),
        "hour" => (0, 0, n.checked_mul(3_600_000_000)?),
        "day" => (0, i32::try_from(n).ok()?, 0),
        "week" => (0, i32::try_from(n.checked_mul(7)?).ok()?, 0),
        "month" => (i32::try_from(n).ok()?, 0, 0),
        "quarter" => (i32::try_from(n.checked_mul(3)?).ok()?, 0, 0),
        "year" => (i32::try_from(n.checked_mul(12)?).ok()?, 0, 0),
        _ => return None,
    })
}

fn interval_field_of(tok: &Token) -> Option<IntervalField> {
    let Token::Ident(s) = tok else { return None };
    Some(match () {
        () if s.eq_ignore_ascii_case("year") => IntervalField::Year,
        () if s.eq_ignore_ascii_case("month") => IntervalField::Month,
        () if s.eq_ignore_ascii_case("day") => IntervalField::Day,
        () if s.eq_ignore_ascii_case("hour") => IntervalField::Hour,
        () if s.eq_ignore_ascii_case("minute") => IntervalField::Minute,
        () if s.eq_ignore_ascii_case("second") => IntervalField::Second,
        () => return None,
    })
}

/// v7.39 (read01 round 102) — interpret an interval literal under a field
/// qualifier. Returns `(months, days, micros)`.
///
/// * A single field applied to a bare number sets which unit the number means,
///   truncated to that field's precision (`INTERVAL '1.5' HOUR` → `01:00:00`);
///   SECOND keeps its fraction (`'90.5' SECOND` → `00:01:30.5`).
/// * `YEAR TO MONTH` reads the `Y-M` form (`'1-6'` → 1 year 6 months).
/// * Every other range, and any literal a single field can't read as a plain
///   number (`'2 days' DAY`), falls back to the unqualified parse — SPG's
///   interval-text parser already reads the `D H:MM:SS` / `H:MM` forms exactly
///   like PG, and the qualifier there only bounds precision.
fn interpret_qualified_interval(
    text: &str,
    (f1, f2): (IntervalField, Option<IntervalField>),
) -> Option<(i32, i32, i64)> {
    if let Some(f2) = f2 {
        if f1 == IntervalField::Year && f2 == IntervalField::Month {
            if let Some(m) = parse_year_month_literal(text) {
                return Some((m, 0, 0));
            }
        }
        return parse_interval_text(text);
    }
    // Single field: reinterpret a bare number; otherwise the default parse.
    let trimmed = text.trim();
    if let Ok(val) = trimmed.parse::<f64>() {
        // no_std: f64 has no trunc/round; cast toward zero + round-half-away.
        #[allow(clippy::cast_possible_truncation)]
        let whole = val as i64;
        #[allow(clippy::cast_possible_truncation)]
        let secs_micros = {
            let m = val * 1_000_000.0;
            if m >= 0.0 {
                (m + 0.5) as i64
            } else {
                (m - 0.5) as i64
            }
        };
        return Some(match f1 {
            IntervalField::Year => (i32::try_from(whole).ok()?.checked_mul(12)?, 0, 0),
            IntervalField::Month => (i32::try_from(whole).ok()?, 0, 0),
            IntervalField::Day => (0, i32::try_from(whole).ok()?, 0),
            IntervalField::Hour => (0, 0, whole.checked_mul(3_600_000_000)?),
            IntervalField::Minute => (0, 0, whole.checked_mul(60_000_000)?),
            IntervalField::Second => (0, 0, secs_micros),
        });
    }
    parse_interval_text(text)
}

/// Parse the `Y-M` (optionally signed) year-to-month literal into total months.
fn parse_year_month_literal(text: &str) -> Option<i32> {
    let t = text.trim();
    let (neg, body) = match t.strip_prefix('-') {
        Some(r) => (true, r),
        None => (false, t.strip_prefix('+').unwrap_or(t)),
    };
    let mut it = body.split('-');
    let years: i32 = it.next()?.trim().parse().ok()?;
    let months: i32 = match it.next() {
        Some(m) => m.trim().parse().ok()?,
        None => 0,
    };
    if it.next().is_some() {
        return None;
    }
    let total = years.checked_mul(12)?.checked_add(months)?;
    Some(if neg { -total } else { total })
}

pub fn parse_interval_text(s: &str) -> Option<(i32, i32, i64)> {
    // v7.39 (read01 timestamp.c) — PG's postgres_verbose forms: a leading
    // `@` is decorative; a trailing `ago` negates the whole interval.
    let mut trimmed = s.trim();
    trimmed = trimmed.strip_prefix('@').map_or(trimmed, str::trim);
    let mut negate = false;
    if let Some(rest) = trimmed
        .strip_suffix("ago")
        .filter(|r| r.ends_with(char::is_whitespace) || r.is_empty())
    {
        negate = true;
        trimmed = rest.trim();
    }
    let finish = |v: Option<(i32, i32, i64)>| -> Option<(i32, i32, i64)> {
        let (mo, d, us) = v?;
        if negate {
            Some((mo.checked_neg()?, d.checked_neg()?, us.checked_neg()?))
        } else {
            Some((mo, d, us))
        }
    };
    let s = trimmed;
    // ISO 8601 duration (`P1Y2M3DT4H`) and PG's year-month shorthand (`1-2`)
    // are single tokens, not the `<n> <unit>` pair form handled below.
    if let Some(rest) = trimmed.strip_prefix(['P', 'p']) {
        return finish(parse_iso8601_interval(rest));
    }
    if !trimmed.contains(char::is_whitespace) && trimmed.contains('-') {
        if let Some(iv) = parse_year_month_interval(trimmed) {
            return finish(Some(iv));
        }
    }
    // v7.39 (GUC knife 3, differential) — PG accepts a bare number as
    // SECONDS: `INTERVAL '0'` = 00:00:00, `INTERVAL '5'` = 00:00:05,
    // fractions kept to the microsecond (`'1.5'` = 00:00:01.5).
    if !trimmed.is_empty() && !trimmed.contains(char::is_whitespace) {
        if let Ok(n) = trimmed.parse::<i64>() {
            return finish(Some((0, 0, n.checked_mul(1_000_000)?)));
        }
        if let Ok(f) = trimmed.parse::<f64>() {
            if f.is_finite() {
                #[allow(clippy::cast_possible_truncation)]
                return finish(Some((0, 0, (f * 1_000_000.0) as i64)));
            }
        }
    }
    // v7.39 (round 243) — PG accepts the number and unit run together
    // (`'15h 2m 12s'`); split each token at the digit→letter boundary so
    // the `<n> <unit>` pair loop below sees them as two.
    let raw_parts: Vec<&str> = s.split_whitespace().collect();
    let mut parts: Vec<&str> = Vec::with_capacity(raw_parts.len());
    for p in raw_parts {
        let boundary = p
            .char_indices()
            .find(|(i, c)| {
                *i > 0
                    && c.is_ascii_alphabetic()
                    && p[..*i]
                        .chars()
                        .all(|d| d.is_ascii_digit() || matches!(d, '.' | '-' | '+'))
                    && p[..*i].chars().any(|d| d.is_ascii_digit())
            })
            .map(|(i, _)| i);
        match boundary {
            Some(i) => {
                parts.push(&p[..i]);
                parts.push(&p[i..]);
            }
            None => parts.push(p),
        }
    }
    // A bare clock-time token `HH:MM[:SS[.ffffff]]` carries the time-of-day
    // part (PG: `3 days 14:30:45`, or `14:30:45` alone). Extract it; whatever
    // remains is the `<n> <unit>` pair form handled below.
    let mut clock_us: i64 = 0;
    let mut had_clock = false;
    if let Some(pos) = parts.iter().position(|p| p.contains(':')) {
        clock_us = parse_interval_clock(parts[pos])?;
        parts.remove(pos);
        had_clock = true;
    }
    // v7.39 (read01 timestamp.c) — a lone bare number alongside a clock
    // time is DAYS (PG: '3 4:05:06' = 3 days 04:05:06).
    let mut lone_days: i32 = 0;
    if had_clock && parts.len() == 1 {
        if let Ok(n) = parts[0].parse::<i64>() {
            lone_days = i32::try_from(n).ok()?;
            parts.clear();
        }
    }
    if !parts.len().is_multiple_of(2) || (parts.is_empty() && !had_clock && lone_days == 0) {
        return None;
    }
    let mut months: i32 = 0;
    let mut days: i32 = lone_days;
    let mut micros: i64 = clock_us;
    let mut i = 0;
    while i < parts.len() {
        let unit_stripped = canonical_interval_unit(parts[i + 1])?;
        if let Ok(n) = parts[i].parse::<i64>() {
            match unit_stripped {
                "microsecond" => micros = micros.checked_add(n)?,
                "millisecond" => micros = micros.checked_add(n.checked_mul(1_000)?)?,
                "second" => micros = micros.checked_add(n.checked_mul(1_000_000)?)?,
                "minute" => micros = micros.checked_add(n.checked_mul(60_000_000)?)?,
                "hour" => micros = micros.checked_add(n.checked_mul(3_600_000_000)?)?,
                "day" => {
                    let n32 = i32::try_from(n).ok()?;
                    days = days.checked_add(n32)?;
                }
                "week" => {
                    let n32 = i32::try_from(n).ok()?;
                    days = days.checked_add(n32.checked_mul(7)?)?;
                }
                "month" => {
                    let n32 = i32::try_from(n).ok()?;
                    months = months.checked_add(n32)?;
                }
                "year" => {
                    let n32 = i32::try_from(n).ok()?;
                    months = months.checked_add(n32.checked_mul(12)?)?;
                }
                // v7.39 (read01 timestamp.c) — the larger calendar units.
                "decade" => {
                    let n32 = i32::try_from(n).ok()?;
                    months = months.checked_add(n32.checked_mul(120)?)?;
                }
                "century" => {
                    let n32 = i32::try_from(n).ok()?;
                    months = months.checked_add(n32.checked_mul(1200)?)?;
                }
                "millennium" => {
                    let n32 = i32::try_from(n).ok()?;
                    months = months.checked_add(n32.checked_mul(12000)?)?;
                }
                _ => return None,
            }
        } else if let Ok(f) = parts[i].parse::<f64>() {
            // Fractional units cascade down to the next-finer field the way
            // PG does: `1.5 days` -> `1 day 12:00:00`, `1.5 months` ->
            // `1 mon 15 days` (30-day month), `1.5 years` -> `1 year 6 mons`.
            // no_std: f64 has no trunc/fract/round methods, so do them with
            // casts (toward-zero) + explicit round-half-away-from-zero.
            #[allow(clippy::cast_possible_truncation)]
            fn round_i64(x: f64) -> i64 {
                if x >= 0.0 {
                    (x + 0.5) as i64
                } else {
                    (x - 0.5) as i64
                }
            }
            #[allow(clippy::cast_possible_truncation, clippy::cast_precision_loss)]
            fn add_days_frac(days: &mut i32, micros: &mut i64, d: f64) -> Option<()> {
                const DAY_US: f64 = 86_400_000_000.0;
                let whole = d as i64; // truncates toward zero
                let frac = d - whole as f64;
                *days = days.checked_add(i32::try_from(whole).ok()?)?;
                *micros = micros.checked_add(round_i64(frac * DAY_US))?;
                Some(())
            }
            #[allow(clippy::cast_possible_truncation, clippy::cast_precision_loss)]
            match unit_stripped {
                "microsecond" => micros = micros.checked_add(round_i64(f))?,
                "millisecond" => micros = micros.checked_add(round_i64(f * 1_000.0))?,
                "second" => micros = micros.checked_add(round_i64(f * 1_000_000.0))?,
                "minute" => micros = micros.checked_add(round_i64(f * 60_000_000.0))?,
                "hour" => micros = micros.checked_add(round_i64(f * 3_600_000_000.0))?,
                "day" => add_days_frac(&mut days, &mut micros, f)?,
                "week" => add_days_frac(&mut days, &mut micros, f * 7.0)?,
                "month" => {
                    let whole = f as i64;
                    months = months.checked_add(i32::try_from(whole).ok()?)?;
                    add_days_frac(&mut days, &mut micros, (f - whole as f64) * 30.0)?;
                }
                "year" => {
                    let m = f * 12.0;
                    let whole = m as i64;
                    months = months.checked_add(i32::try_from(whole).ok()?)?;
                    add_days_frac(&mut days, &mut micros, (m - whole as f64) * 30.0)?;
                }
                _ => return None,
            }
        } else {
            return None;
        }
        i += 2;
    }
    finish(Some((months, days, micros)))
}

/// v7.37 — map a scalar type keyword to its [`CastTarget`] for the PG
/// `TYPE 'literal'` typed-literal syntax (`time '10:30'` == `'10:30'::time`).
/// `interval` is intentionally absent (handled by its own parser arm).
/// Returns `None` for names that aren't sensible as a bare typed literal, so
/// the caller falls back to treating the ident as a column reference.
fn typed_literal_cast_target(ident: &str) -> Option<CastTarget> {
    Some(match ident {
        "date" => CastTarget::Date,
        "timestamp" | "datetime" => CastTarget::Timestamp,
        "timestamptz" => CastTarget::Timestamptz,
        "bool" | "boolean" => CastTarget::Bool,
        "int" | "integer" | "int4" => CastTarget::Int,
        "bigint" | "int8" => CastTarget::BigInt,
        "float8" | "double precision" => CastTarget::Float,
        "uuid" => CastTarget::Uuid,
        "bytea" => CastTarget::Bytea,
        "json" => CastTarget::Json,
        "jsonb" => CastTarget::Jsonb,
        // Types without a dedicated CastTarget variant flow through the
        // generic Named path (engine resolves via column_type_to_data_type).
        "time" | "timetz" | "smallint" | "int2" | "numeric" | "decimal"
        | "real" | "float4" | "inet" | "cidr" | "macaddr" | "macaddr8"
        | "money" | "bit" | "varbit"
        // Geometric types accept the `TYPE 'literal'` prefix spelling too.
        | "point" | "line" | "lseg" | "box" | "path" | "polygon" | "circle"
        // Range / multirange types likewise.
        | "int4range" | "int8range" | "numrange" | "daterange" | "tsrange"
        | "tstzrange" | "int4multirange" | "int8multirange" | "nummultirange"
        | "datemultirange" | "tsmultirange" | "tstzmultirange"
        // v7.39 (read01 round 18) — oid / name / jsonpath literal prefixes.
        | "oid" | "name" | "jsonpath" | "pg_lsn" | "varchar" | "text" | "xid" | "xid8" => {
            CastTarget::Named(alloc::string::String::from(ident))
        }
        _ => return None,
    })
}

/// v7.12.4 — map a bare type-name identifier (the form that
/// appears in a function arg list or RETURNS clause) to a
/// [`ColumnTypeName`]. Returns `None` for unknown / extension
/// types so the caller can preserve them as
/// [`FunctionArgType::Raw`] / [`FunctionReturn::Other`].
///
/// Subset of the full column-type grammar — we deliberately
/// don't parse parameterised forms (`VARCHAR(n)`, `NUMERIC(p,s)`)
/// here because function-arg types in v7.12.4 are mostly the
/// bare form (`text`, `int`, `bytea`, …).
/// v7.39 (round 315, V19) — does this whole phrase name a type, rather
/// than being `name TYPE`?
///
/// The multi-word spellings SQL allows for a bare argument type, each
/// verified accepted by PG 18.4 as `CREATE FUNCTION f(<phrase>)`.
///
/// NOTE this list also exists in `spg-storage`, which computes the
/// signature key from the rendered argument text and has to reach the
/// same verdict. The two crates are siblings — neither depends on the
/// other — and each already carries its own table of type spellings
/// (`map_type_ident_to_column_type_name` here, `normalize_type_name`
/// there), so this follows the structure rather than inventing new
/// duplication. Recorded as V49.
pub fn is_multiword_type_phrase(phrase: &str) -> bool {
    let t = phrase.trim().to_ascii_lowercase();
    let base = t.split_once('(').map_or(t.as_str(), |(h, _)| h).trim();
    matches!(
        base,
        "double precision"
            | "character varying"
            | "bit varying"
            | "timestamp with time zone"
            | "timestamp without time zone"
            | "time with time zone"
            | "time without time zone"
            | "national character"
            | "national character varying"
    )
}

fn map_type_ident_to_column_type_name(ident: &str) -> Option<ColumnTypeName> {
    Some(match ident.to_ascii_lowercase().as_str() {
        "smallint" | "tinyint" => ColumnTypeName::SmallInt,
        "int" | "integer" | "mediumint" => ColumnTypeName::Int,
        "bigint" => ColumnTypeName::BigInt,
        "float" | "double" => ColumnTypeName::Float,
        // v7.39 (round 269) — real is 32-bit.
        "real" | "float4" => ColumnTypeName::Real,
        "text" => ColumnTypeName::Text,
        "bool" | "boolean" => ColumnTypeName::Bool,
        "date" => ColumnTypeName::Date,
        "timestamp" | "datetime" => ColumnTypeName::Timestamp,
        "timestamptz" => ColumnTypeName::Timestamptz,
        "json" => ColumnTypeName::Json,
        "jsonb" => ColumnTypeName::Jsonb,
        "bytea" | "bytes" => ColumnTypeName::Bytes,
        "tsvector" => ColumnTypeName::TsVector,
        "tsquery" => ColumnTypeName::TsQuery,
        "uuid" => ColumnTypeName::Uuid,
        "interval" => ColumnTypeName::Interval,
        "time" => ColumnTypeName::Time,
        "year" => ColumnTypeName::Year,
        "timetz" => ColumnTypeName::TimeTz,
        "money" => ColumnTypeName::Money,
        _ => return None,
    })
}

/// v7.12.4 — parse a PL/pgSQL function body (the bytes between
/// `$$ ... $$`). Returns the parsed `BEGIN ... END;` block.
///
/// v7.12.4 grammar (strict subset — IF / LOOP / DECLARE / RAISE
/// / embedded SQL land in v7.12.5+):
///
/// ```text
///   body          := [ws] block [ws]
///   block         := BEGIN stmt ( ; stmt )* [ ; ] END [ ; ]
///   stmt          := assign | return
///   assign        := assign_target := expr
///   assign_target := ( NEW | OLD ) . ident | ident
///   return        := RETURN ( NEW | OLD | NULL | expr )
/// ```
///
/// `expr` is parsed by recursing into the regular `Parser` — so a
/// PL/pgSQL `NEW.search_vector := to_tsvector('english',
/// NEW.subject || ' ' || NEW.sender)` body shape works without
/// the body parser knowing what `to_tsvector` is.
///
/// Errors here cause the caller to fall back to
/// `FunctionBody::Raw` — keeping the CREATE FUNCTION DDL itself
/// successful, but the executor will refuse to invoke the
/// function with an "unparseable body" error.
/// v7.12.4 — public alias for [`parse_plpgsql_body`] re-exported
/// from the crate root as `spg_sql::parse_function_body`.
pub fn parse_function_body(body: &str) -> Result<PlPgSqlBlock, ParseError> {
    parse_plpgsql_body(body)
}

fn parse_plpgsql_body(body: &str) -> Result<PlPgSqlBlock, ParseError> {
    // Use the regular lexer on the body text. The trailing
    // `END;` may or may not have a semicolon; the lexer treats
    // both forms identically.
    let tokens = lexer::tokenize(body).map_err(|e| ParseError {
        message: alloc::format!("plpgsql body lex error: {e}"),
        token_pos: 0,
    })?;
    let mut parser = Parser::new(tokens);
    parser.parse_plpgsql_block()
}

/// v7.39 (GUC) — the textual body of a SET value, for list joining.
fn set_value_text(v: &crate::ast::SetValue) -> alloc::string::String {
    match v {
        crate::ast::SetValue::String(s)
        | crate::ast::SetValue::Ident(s)
        | crate::ast::SetValue::Number(s) => s.clone(),
        crate::ast::SetValue::Default => "DEFAULT".into(),
    }
}

/// v7.39 (round 145, parse_cte.c / parse_agg.c) — true when an expression
/// contains an aggregate call at ITS OWN query level (recursion stops at
/// sublink boundaries — a sublink's aggregates belong to the sublink).
/// Backs the "aggregate functions are not allowed in a recursive query's
/// recursive term" well-formedness check.
fn expr_has_toplevel_aggregate(e: &Expr) -> bool {
    const AGG_NAMES: &[&str] = &[
        "count",
        "sum",
        "min",
        "max",
        "avg",
        "string_agg",
        "array_agg",
        "bool_and",
        "bool_or",
        "every",
        "any_value",
        "json_agg",
        "jsonb_agg",
        "json_object_agg",
        "jsonb_object_agg",
        "bit_and",
        "bit_or",
        "bit_xor",
        "var_pop",
        "var_samp",
        "variance",
        "stddev",
        "stddev_pop",
        "stddev_samp",
        "range_agg",
        "range_intersect_agg",
        "percentile_cont",
        "percentile_disc",
        "mode",
        "corr",
        "covar_pop",
        "covar_samp",
    ];
    match e {
        Expr::AggregateOrdered { .. } => true,
        Expr::FunctionCall { name, args } => {
            AGG_NAMES.contains(&name.to_ascii_lowercase().as_str())
                || args.iter().any(expr_has_toplevel_aggregate)
        }
        Expr::NamedArg { expr, .. }
        | Expr::Variadic(expr)
        | Expr::Unary { expr, .. }
        | Expr::Cast { expr, .. }
        | Expr::IsNull { expr, .. }
        | Expr::FieldAccess { base: expr, .. }
        | Expr::Extract { source: expr, .. } => expr_has_toplevel_aggregate(expr),
        Expr::Binary { lhs, rhs, .. } => {
            expr_has_toplevel_aggregate(lhs) || expr_has_toplevel_aggregate(rhs)
        }
        Expr::Like { expr, pattern, .. } => {
            expr_has_toplevel_aggregate(expr) || expr_has_toplevel_aggregate(pattern)
        }
        Expr::Array(items) => items.iter().any(expr_has_toplevel_aggregate),
        Expr::InList { expr, list, .. } => {
            expr_has_toplevel_aggregate(expr) || list.iter().any(expr_has_toplevel_aggregate)
        }
        Expr::ArraySubscript { target, index } => {
            expr_has_toplevel_aggregate(target) || expr_has_toplevel_aggregate(index)
        }
        Expr::ArraySlice { target, lo, hi } => {
            expr_has_toplevel_aggregate(target)
                || lo.as_deref().is_some_and(expr_has_toplevel_aggregate)
                || hi.as_deref().is_some_and(expr_has_toplevel_aggregate)
        }
        Expr::AnyAll { expr, array, .. } => {
            expr_has_toplevel_aggregate(expr) || expr_has_toplevel_aggregate(array)
        }
        Expr::Case {
            operand,
            branches,
            else_branch,
        } => {
            operand.as_deref().is_some_and(expr_has_toplevel_aggregate)
                || branches
                    .iter()
                    .any(|(w, t)| expr_has_toplevel_aggregate(w) || expr_has_toplevel_aggregate(t))
                || else_branch
                    .as_deref()
                    .is_some_and(expr_has_toplevel_aggregate)
        }
        // The outer-level operands of a sublink can aggregate; the sublink's
        // own body cannot leak its aggregates up here.
        Expr::InSubquery { expr, .. } => expr_has_toplevel_aggregate(expr),
        Expr::RowInSubquery { row, .. } | Expr::RowCmpSubquery { row, .. } => {
            row.iter().any(expr_has_toplevel_aggregate)
        }
        _ => false,
    }
}

/// v7.39 (round 145, parse_cte.c) — true when any sublink expression
/// (EXISTS / IN / scalar subquery) inside this SELECT term references the
/// named table anywhere in its subtree. A plain FROM derived table is NOT a
/// sublink and is legal in a recursive term, so it is not walked here.
fn select_has_self_ref_in_sublink(s: &crate::ast::SelectStatement, name: &str) -> bool {
    let mut exprs: Vec<&Expr> = Vec::new();
    for it in &s.items {
        if let crate::ast::SelectItem::Expr { expr, .. } = it {
            exprs.push(expr);
        }
    }
    if let Some(w) = &s.where_ {
        exprs.push(w);
    }
    if let Some(h) = &s.having {
        exprs.push(h);
    }
    if let Some(g) = &s.group_by {
        exprs.extend(g.iter());
    }
    if let Some(from) = &s.from {
        for j in &from.joins {
            if let Some(on) = &j.on {
                exprs.push(on);
            }
        }
    }
    exprs.into_iter().any(|e| expr_sublink_mentions(e, name))
}

/// Does this expression contain a sublink whose subquery mentions `name`?
fn expr_sublink_mentions(e: &Expr, name: &str) -> bool {
    match e {
        Expr::ScalarSubquery(sub) => select_mentions_table(sub, name),
        Expr::Exists { subquery, .. } => select_mentions_table(subquery, name),
        Expr::InSubquery { expr, subquery, .. } => {
            expr_sublink_mentions(expr, name) || select_mentions_table(subquery, name)
        }
        Expr::RowInSubquery { row, subquery, .. } => {
            row.iter().any(|x| expr_sublink_mentions(x, name))
                || select_mentions_table(subquery, name)
        }
        Expr::RowCmpSubquery { row, subquery, .. } => {
            row.iter().any(|x| expr_sublink_mentions(x, name))
                || select_mentions_table(subquery, name)
        }
        Expr::NamedArg { expr, .. }
        | Expr::Variadic(expr)
        | Expr::Unary { expr, .. }
        | Expr::Cast { expr, .. }
        | Expr::IsNull { expr, .. }
        | Expr::FieldAccess { base: expr, .. }
        | Expr::Extract { source: expr, .. } => expr_sublink_mentions(expr, name),
        Expr::Binary { lhs, rhs, .. } => {
            expr_sublink_mentions(lhs, name) || expr_sublink_mentions(rhs, name)
        }
        Expr::Like { expr, pattern, .. } => {
            expr_sublink_mentions(expr, name) || expr_sublink_mentions(pattern, name)
        }
        Expr::FunctionCall { args, .. } | Expr::Array(args) => {
            args.iter().any(|x| expr_sublink_mentions(x, name))
        }
        Expr::InList { expr, list, .. } => {
            expr_sublink_mentions(expr, name) || list.iter().any(|x| expr_sublink_mentions(x, name))
        }
        Expr::ArraySubscript { target, index } => {
            expr_sublink_mentions(target, name) || expr_sublink_mentions(index, name)
        }
        Expr::ArraySlice { target, lo, hi } => {
            expr_sublink_mentions(target, name)
                || lo
                    .as_deref()
                    .is_some_and(|x| expr_sublink_mentions(x, name))
                || hi
                    .as_deref()
                    .is_some_and(|x| expr_sublink_mentions(x, name))
        }
        Expr::AnyAll { expr, array, .. } => {
            expr_sublink_mentions(expr, name) || expr_sublink_mentions(array, name)
        }
        Expr::Case {
            operand,
            branches,
            else_branch,
        } => {
            operand
                .as_deref()
                .is_some_and(|x| expr_sublink_mentions(x, name))
                || branches
                    .iter()
                    .any(|(w, t)| expr_sublink_mentions(w, name) || expr_sublink_mentions(t, name))
                || else_branch
                    .as_deref()
                    .is_some_and(|x| expr_sublink_mentions(x, name))
        }
        _ => false,
    }
}

/// Does this SELECT (in full — FROM tables, derived tables, its own
/// sublinks, and union arms) mention the named table?
fn select_mentions_table(s: &crate::ast::SelectStatement, name: &str) -> bool {
    if let Some(from) = &s.from {
        if from.primary.name.eq_ignore_ascii_case(name) {
            return true;
        }
        if let Some(sub) = &from.primary.lateral_subquery
            && select_mentions_table(sub, name)
        {
            return true;
        }
        for j in &from.joins {
            if j.table.name.eq_ignore_ascii_case(name) {
                return true;
            }
            if let Some(sub) = &j.table.lateral_subquery
                && select_mentions_table(sub, name)
            {
                return true;
            }
        }
    }
    if select_has_self_ref_in_sublink(s, name) {
        return true;
    }
    s.unions.iter().any(|(_, u)| select_mentions_table(u, name))
}

/// v7.39 (round 284) — fold a constant `LIMIT` / `OFFSET` expression to a
/// row count, the way PG evaluates one before applying it.
///
/// `None` = not a constant (a column, a subquery, a function call).
/// `Some(Err(msg))` = PG rejects it, and the message is PG's; `{L}` in the
/// message stands in for LIMIT / OFFSET, which the caller substitutes.
/// All wordings were read off live PG 18.4.
fn fold_limit_constant(e: &crate::ast::Expr) -> Option<Result<i128, alloc::string::String>> {
    use crate::ast::{BinOp, Expr, Literal, UnOp};
    match e {
        Expr::Literal(Literal::Integer(n)) => Some(Ok(i128::from(*n))),
        Expr::Literal(Literal::Numeric { unscaled, scale }) => {
            Some(Ok(round_scaled_half_away(*unscaled, *scale)))
        }
        // PG coerces a string by its CONTENT, and fails on the value.
        Expr::Literal(Literal::String(t)) => Some(t.trim().parse::<i64>().map_or_else(
            |_| {
                Err(alloc::format!(
                    "invalid input syntax for type bigint: \"{t}\""
                ))
            },
            |n| Ok(i128::from(n)),
        )),
        Expr::Literal(Literal::Bool(_)) => Some(Err(
            "argument of {L} must be type bigint, not type boolean".into(),
        )),
        Expr::Unary {
            op: UnOp::Neg,
            expr,
        } => match fold_limit_constant(expr)? {
            Ok(v) => Some(Ok(-v)),
            e @ Err(_) => Some(e),
        },
        Expr::Binary { lhs, op, rhs } => {
            let a = match fold_limit_constant(lhs)? {
                Ok(v) => v,
                e @ Err(_) => return Some(e),
            };
            let b = match fold_limit_constant(rhs)? {
                Ok(v) => v,
                e @ Err(_) => return Some(e),
            };
            let out = match op {
                BinOp::Add => a.checked_add(b),
                BinOp::Sub => a.checked_sub(b),
                BinOp::Mul => a.checked_mul(b),
                BinOp::Div if b != 0 => a.checked_div(b),
                BinOp::Div => return Some(Err("division by zero".into())),
                BinOp::Mod if b != 0 => a.checked_rem(b),
                BinOp::Mod => return Some(Err("division by zero".into())),
                _ => return None,
            };
            // PG evaluates the arithmetic in the operand's own type, so an
            // int-by-int product that leaves int range fails there — before
            // the row count is ever looked at.
            match out {
                Some(v) if v > i128::from(i32::MAX) || v < i128::from(i32::MIN) => {
                    Some(Err("integer out of range".into()))
                }
                Some(v) => Some(Ok(v)),
                None => Some(Err("integer out of range".into())),
            }
        }
        _ => None,
    }
}

/// Round `unscaled / 10^scale` half away from zero — PG's numeric→bigint
/// cast, which is what makes `LIMIT 2.5` keep three rows.
fn round_scaled_half_away(unscaled: i128, scale: u16) -> i128 {
    if scale == 0 {
        return unscaled;
    }
    let Some(div) = 10i128.checked_pow(u32::from(scale)) else {
        return 0;
    };
    let neg = unscaled < 0;
    let mag = unscaled.unsigned_abs() as i128;
    let rounded = (mag + div / 2) / div;
    if neg { -rounded } else { rounded }
}

#[cfg(test)]
mod tests {
    use super::*;
    use alloc::string::ToString;

    fn parse(s: &str) -> Statement {
        parse_statement(s).expect("parse ok")
    }

    // v7.37.43-T4 sentori cutover acceptance — `release`, `index`,
    // `tables`, `partition`, etc. are unreserved keywords per PG's
    // `pg_get_keywords()` and MUST be usable as column / table /
    // alias names. Pre-T4 every drop-in user whose schema had one
    // of these as a column name (sentori events.release, mailrs
    // messages.index in some forks) blew the parser up at CREATE
    // TABLE time with "expected identifier, got Release". The
    // generalisation lives in `unreserved_keyword_text` + the
    // `expect_ident_like` and `parse_atom` arms that consult it.
    #[test]
    fn release_usable_as_column_name_in_create_table() {
        let stmt =
            parse("CREATE TABLE events (id INT PRIMARY KEY, release TEXT NOT NULL, payload TEXT)");
        if let Statement::CreateTable(t) = stmt {
            let names: alloc::vec::Vec<&str> = t.columns.iter().map(|c| c.name.as_str()).collect();
            assert_eq!(names, alloc::vec!["id", "release", "payload"]);
        } else {
            panic!("expected CreateTable");
        }
    }

    #[test]
    fn release_usable_as_column_ref_in_select_projection() {
        // The sentori `0003_partition_events.sql` INSERT-SELECT
        // walk references `release` in both column lists; the
        // projection-side use exercises `parse_atom`'s relaxed
        // identifier set.
        parse("SELECT id, release, payload FROM events WHERE id = 1");
    }

    #[test]
    fn release_usable_as_column_ref_in_insert_column_list() {
        // INSERT INTO t (id, release, payload) VALUES (…)
        parse("INSERT INTO events (id, release, payload) VALUES (1, '1.0.0', 'data')");
    }

    #[test]
    fn alter_column_drop_not_null_uses_keyword_drop_token() {
        // Sentori `0013_audit_tombstone.sql` issues
        // `ALTER TABLE … ALTER COLUMN x DROP NOT NULL`. The lexer
        // emits Token::Drop (not Ident("drop")); the parser must
        // accept both in the ALTER COLUMN sub-dispatch.
        parse("ALTER TABLE audit_logs ALTER COLUMN org_id DROP NOT NULL");
    }

    #[test]
    fn create_index_accepts_parenthesised_expression_key() {
        // sentori `0040_events_bundle_idx.sql` shape — JSONB
        // expression index. Pre-T4 the parser bailed at the
        // inner `(` with "expected column ident or expression,
        // got LParen". The Token::LParen arm in CREATE INDEX
        // routes through the expression parser instead.
        parse(
            "CREATE INDEX IF NOT EXISTS events_bundle_id_idx \
             ON events ((payload->'bundle'->>'id'))",
        );
    }

    // v7.30.2 (mailrs round-25 ask 2) — nesting / chain budgets must
    // surface as parse errors, never stack overflows (embed hosts
    // abort on overflow).
    /// The nesting budget is a COUNT; what it has to fit inside is a
    /// number of BYTES, and only one of those two is stable across
    /// compiler versions. Round 847 measured 30,336 bytes per level
    /// after a toolchain move, which puts 64 levels at 1.94 MB and
    /// overflows a 2 MiB thread — `nesting_budget_errors_cleanly`
    /// aborted instead of erroring, which is precisely the outcome it
    /// exists to rule out.
    ///
    /// So the budget is metered rather than assumed. The ceiling leaves
    /// the depth SPG advertises fitting in a default 2 MiB thread with
    /// room to spare, in the debug build, where frames are widest.
    #[test]
    fn nesting_frame_cost_stays_under_ceiling() {
        // Room for MAX_NEST_DEPTH levels inside 1.2 MB, so a 2 MiB
        // thread keeps a margin for whatever called the parser.
        const CEILING: usize = 1_200_000 / MAX_NEST_DEPTH;

        frame_meter::reset();
        let depth = frame_meter::SAMPLE_HI + 8;
        let sql = format!("SELECT {}1{}", "(".repeat(depth), ")".repeat(depth));
        parse(&sql);

        let per_level = frame_meter::bytes_per_level();
        {
            extern crate std;
            std::eprintln!("nesting frame: {per_level} bytes/level, ceiling {CEILING}");
        }
        assert!(
            per_level <= CEILING,
            "{per_level} bytes per nesting level exceeds {CEILING}; \
             {MAX_NEST_DEPTH} levels would want {} bytes. Out-line arms \
             in parse_expr_inner / parse_unary rather than lowering the \
             depth or widening the stack.",
            per_level * MAX_NEST_DEPTH
        );
    }

    #[test]
    fn nesting_budget_errors_cleanly() {
        let depth = MAX_NEST_DEPTH + 50;
        let sql = format!("SELECT {}1{}", "(".repeat(depth), ")".repeat(depth));
        let err = parse_statement(&sql).expect_err("must reject");
        assert!(err.message.contains("nests deeper"), "{err:?}");
        // Within budget still parses.
        let sql = format!("SELECT {}1{}", "(".repeat(48), ")".repeat(48));
        parse(&sql);
    }

    #[test]
    fn binary_chain_budget_errors_cleanly() {
        let sql = format!("SELECT 1{}", " + 1".repeat(MAX_BINARY_CHAIN + 50));
        let err = parse_statement(&sql).expect_err("must reject");
        assert!(err.message.contains("chained binary"), "{err:?}");
        // Within budget still parses (chain depth ≤ budget is safe
        // for recursive eval/drop on 2 MiB stacks).
        let sql = format!("SELECT 1{}", " + 1".repeat(200));
        parse(&sql);
    }

    #[test]
    fn in_list_unaffected_by_chain_budget() {
        // Flat InList: 20k elements parse fine and stay flat.
        let items: alloc::vec::Vec<String> = (0..20_000).map(|k| k.to_string()).collect();
        let sql = format!("SELECT 1 WHERE 5 IN ({})", items.join(","));
        let Statement::Select(s) = parse(&sql) else {
            panic!("expected select")
        };
        let Some(Expr::InList { list, negated, .. }) = s.where_ else {
            panic!("expected flat InList, got {:?}", s.where_)
        };
        assert_eq!(list.len(), 20_000);
        assert!(!negated);
    }

    fn lit_int(n: i64) -> Expr {
        Expr::Literal(Literal::Integer(n))
    }

    fn col(name: &str) -> Expr {
        Expr::Column(ColumnName {
            qualifier: None,
            name: name.into(),
        })
    }

    #[test]
    fn select_single_integer() {
        let s = parse("SELECT 1");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        assert_eq!(s.items.len(), 1);
        assert!(s.from.is_none());
        assert!(s.where_.is_none());
    }

    #[test]
    fn select_multiple_literal_kinds() {
        let s = parse("SELECT 1, 'hi', NULL, TRUE, 1.5");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        assert_eq!(s.items.len(), 5);
    }

    #[test]
    fn select_wildcard_from_table() {
        let s = parse("SELECT * FROM users");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        assert!(matches!(s.items[..], [SelectItem::Wildcard]));
        assert_eq!(s.from.as_ref().unwrap().primary.name, "users");
    }

    #[test]
    fn select_with_table_alias() {
        let s = parse("SELECT * FROM users AS u");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let t = &s.from.as_ref().unwrap().primary;
        assert_eq!(t.name, "users");
        assert_eq!(t.alias.as_deref(), Some("u"));
    }

    #[test]
    fn select_with_where_eq() {
        let s = parse("SELECT a FROM t WHERE a = 1");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let w = s.where_.unwrap();
        assert_eq!(
            w,
            Expr::Binary {
                lhs: Box::new(col("a")),
                op: BinOp::Eq,
                rhs: Box::new(lit_int(1)),
            }
        );
    }

    #[test]
    fn arithmetic_precedence() {
        let s = parse("SELECT 1 + 2 * 3");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!("wildcard?")
        };
        assert_eq!(
            expr,
            &Expr::Binary {
                lhs: Box::new(lit_int(1)),
                op: BinOp::Add,
                rhs: Box::new(Expr::Binary {
                    lhs: Box::new(lit_int(2)),
                    op: BinOp::Mul,
                    rhs: Box::new(lit_int(3)),
                }),
            }
        );
    }

    #[test]
    fn parentheses_override_precedence() {
        let s = parse("SELECT (1 + 2) * 3");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert_eq!(
            expr,
            &Expr::Binary {
                lhs: Box::new(Expr::Binary {
                    lhs: Box::new(lit_int(1)),
                    op: BinOp::Add,
                    rhs: Box::new(lit_int(2)),
                }),
                op: BinOp::Mul,
                rhs: Box::new(lit_int(3)),
            }
        );
    }

    #[test]
    fn not_binds_below_comparison() {
        // `NOT a = 1` should parse as `NOT (a = 1)`.
        let s = parse("SELECT NOT a = 1 FROM t");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert_eq!(
            expr,
            &Expr::Unary {
                op: UnOp::Not,
                expr: Box::new(Expr::Binary {
                    lhs: Box::new(col("a")),
                    op: BinOp::Eq,
                    rhs: Box::new(lit_int(1)),
                }),
            }
        );
    }

    #[test]
    fn unary_minus_binds_above_multiplication() {
        // `-a * 2` should be `(-a) * 2`.
        let s = parse("SELECT -a * 2 FROM t");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert_eq!(
            expr,
            &Expr::Binary {
                lhs: Box::new(Expr::Unary {
                    op: UnOp::Neg,
                    expr: Box::new(col("a")),
                }),
                op: BinOp::Mul,
                rhs: Box::new(lit_int(2)),
            }
        );
    }

    #[test]
    fn qualified_column() {
        let s = parse("SELECT t.col FROM t");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert_eq!(
            expr,
            &Expr::Column(ColumnName {
                qualifier: Some("t".into()),
                name: "col".into()
            })
        );
    }

    #[test]
    fn select_item_alias_with_as() {
        let s = parse("SELECT a AS y FROM t");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { alias, .. } = &s.items[0] else {
            panic!()
        };
        assert_eq!(alias.as_deref(), Some("y"));
    }

    #[test]
    fn trailing_semicolon_accepted() {
        let s = parse("SELECT 1;");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        assert_eq!(s.items.len(), 1);
    }

    #[test]
    fn boolean_chain_with_and_or_not() {
        // (NOT a) OR (b AND (NOT c))
        let s = parse("SELECT NOT a OR b AND NOT c FROM t");
        let Statement::Select(s) = s else {
            panic!("expected SELECT")
        };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        let expected = Expr::Binary {
            lhs: Box::new(Expr::Unary {
                op: UnOp::Not,
                expr: Box::new(col("a")),
            }),
            op: BinOp::Or,
            rhs: Box::new(Expr::Binary {
                lhs: Box::new(col("b")),
                op: BinOp::And,
                rhs: Box::new(Expr::Unary {
                    op: UnOp::Not,
                    expr: Box::new(col("c")),
                }),
            }),
        };
        assert_eq!(expr, &expected);
    }

    #[test]
    fn empty_input_errors() {
        // v7.14.0 — pg_dump preambles emit several comment-only
        // / blank-line statements that collapse to Statement::
        // Empty rather than a parse error. The old "SELECT in
        // message" assertion is stale; verify the new contract:
        // empty / whitespace / comment-only input parses to
        // Statement::Empty.
        assert!(matches!(parse_statement("").unwrap(), Statement::Empty));
        assert!(matches!(
            parse_statement("  \n\t ").unwrap(),
            Statement::Empty
        ));
        // Sanity: malformed-but-non-empty still errors.
        assert!(parse_statement("SELECT FROM WHERE").is_err());
    }

    #[test]
    fn unmatched_paren_errors() {
        assert!(parse_statement("SELECT (1 + 2").is_err());
    }

    #[test]
    fn display_round_trip_simple_select() {
        let original = parse("SELECT a + 1 FROM t WHERE a > 0");
        let text = original.to_string();
        let again = parse_statement(&text).expect("re-parse");
        assert_eq!(original, again);
    }

    // --- CREATE TABLE & INSERT (v0.3) ---------------------------------------

    #[test]
    fn create_table_single_column() {
        let s = parse("CREATE TABLE foo (a INT)");
        let Statement::CreateTable(c) = s else {
            panic!("expected CreateTable")
        };
        assert_eq!(c.name, "foo");
        assert_eq!(c.columns.len(), 1);
        assert_eq!(c.columns[0].name, "a");
        assert_eq!(c.columns[0].ty, ColumnTypeName::Int);
        assert!(c.columns[0].nullable);
    }

    #[test]
    fn create_table_multi_column_with_not_null_mix() {
        let s = parse("CREATE TABLE u (id INT NOT NULL, name TEXT, score FLOAT NOT NULL, ok BOOL)");
        let Statement::CreateTable(c) = s else {
            panic!()
        };
        assert_eq!(c.columns.len(), 4);
        assert_eq!(c.columns[0].ty, ColumnTypeName::Int);
        assert!(!c.columns[0].nullable);
        assert_eq!(c.columns[1].ty, ColumnTypeName::Text);
        assert!(c.columns[1].nullable);
        assert_eq!(c.columns[2].ty, ColumnTypeName::Float);
        assert!(!c.columns[2].nullable);
        assert_eq!(c.columns[3].ty, ColumnTypeName::Bool);
    }

    #[test]
    fn create_table_bigint_supported() {
        let s = parse("CREATE TABLE accounts (id BIGINT NOT NULL)");
        let Statement::CreateTable(c) = s else {
            panic!()
        };
        assert_eq!(c.columns[0].ty, ColumnTypeName::BigInt);
    }

    #[test]
    fn create_table_vector_default_is_f32() {
        let s = parse("CREATE TABLE t (v VECTOR(128))");
        let Statement::CreateTable(c) = s else {
            panic!()
        };
        assert_eq!(
            c.columns[0].ty,
            ColumnTypeName::Vector {
                dim: 128,
                encoding: VecEncoding::F32,
            },
        );
    }

    #[test]
    fn create_table_vector_using_sq8() {
        // v6.0.1: `USING SQ8` selects scalar-quantised encoding.
        // Case-insensitive on both `USING` and the encoding name.
        for sql in [
            "CREATE TABLE t (v VECTOR(128) USING SQ8)",
            "CREATE TABLE t (v VECTOR(128) using sq8)",
        ] {
            let s = parse(sql);
            let Statement::CreateTable(c) = s else {
                panic!()
            };
            assert_eq!(
                c.columns[0].ty,
                ColumnTypeName::Vector {
                    dim: 128,
                    encoding: VecEncoding::Sq8,
                },
                "{sql}",
            );
        }
    }

    #[test]
    fn create_table_vector_using_unknown_errors() {
        // v7.16.1 — the inline `USING <encoding>` shape on
        // CREATE TABLE column defs was withdrawn before
        // v7.14.0 in favour of `CREATE INDEX … USING hnsw
        // (col vector_<metric>_ops)`; the parser now rejects
        // USING at column-list position with a clearer
        // "expected ',' or ')'" message. Test asserts the
        // current rejection, not the old "unknown vector
        // encoding" string.
        let err = parse_statement("CREATE TABLE t (v VECTOR(8) USING PQ8)").unwrap_err();
        assert!(
            err.message.contains("USING")
                || err.message.contains("using")
                || err.message.contains("')'")
                || err.message.contains("','"),
            "expected USING/column-list rejection, got: {}",
            err.message
        );
    }

    #[test]
    fn vector_using_sq8_display_roundtrips() {
        // The Display impl must produce text that re-parses to the
        // same AST. Guard for the v6.0.1 `USING SQ8` suffix.
        let s = parse("CREATE TABLE t (v VECTOR(64) USING SQ8)");
        let Statement::CreateTable(c) = s else {
            panic!()
        };
        assert_eq!(c.columns[0].ty.to_string(), "VECTOR(64) USING SQ8");
    }

    #[test]
    fn parser_recognises_placeholders() {
        use crate::ast::{Expr, SelectItem, Statement};
        // $N in expression position parses as Expr::Placeholder(N).
        let s = parse("SELECT $1, $2 + 1 FROM t WHERE x = $3");
        let Statement::Select(sel) = s else { panic!() };
        assert!(matches!(
            sel.items[0],
            SelectItem::Expr {
                expr: Expr::Placeholder(1),
                alias: None
            }
        ));
        // $2 + 1
        let SelectItem::Expr {
            expr: Expr::Binary { lhs, rhs, .. },
            ..
        } = &sel.items[1]
        else {
            panic!()
        };
        assert!(matches!(**lhs, Expr::Placeholder(2)));
        assert!(matches!(**rhs, Expr::Literal(Literal::Integer(1))));
        // WHERE x = $3
        let Some(Expr::Binary { rhs, .. }) = sel.where_.as_ref() else {
            panic!()
        };
        assert!(matches!(**rhs, Expr::Placeholder(3)));
    }

    #[test]
    fn parser_rejects_dollar_zero() {
        // $0 is not valid in PG; the lexer rejects it.
        assert!(parse_statement("SELECT $0").is_err());
    }

    #[test]
    fn placeholder_display_roundtrips() {
        // The Display impl must produce text that re-lexes to the
        // same Placeholder token.
        let s = parse("SELECT $42 FROM t");
        let printed = s.to_string();
        assert!(printed.contains("$42"));
        let again = parse(&printed);
        assert_eq!(s, again);
    }

    #[test]
    fn alter_index_rebuild_bare() {
        use crate::ast::{AlterIndexTarget, Statement};
        let s = parse("ALTER INDEX my_idx REBUILD");
        let Statement::AlterIndex(a) = s else {
            panic!("expected AlterIndex, got {s:?}")
        };
        assert_eq!(a.name, "my_idx");
        assert_eq!(a.target, AlterIndexTarget::Rebuild { encoding: None });
    }

    #[test]
    fn alter_index_rebuild_with_encoding() {
        use crate::ast::{AlterIndexTarget, Statement};
        for (sql, want) in [
            (
                "ALTER INDEX my_idx REBUILD WITH (encoding = F32)",
                VecEncoding::F32,
            ),
            (
                "ALTER INDEX my_idx REBUILD WITH (encoding = sq8)",
                VecEncoding::Sq8,
            ),
            (
                "ALTER INDEX my_idx REBUILD WITH (encoding = HALF)",
                VecEncoding::F16,
            ),
        ] {
            let s = parse(sql);
            let Statement::AlterIndex(a) = s else {
                panic!("{sql}: expected AlterIndex")
            };
            assert_eq!(a.name, "my_idx");
            assert_eq!(
                a.target,
                AlterIndexTarget::Rebuild {
                    encoding: Some(want)
                },
                "{sql}"
            );
        }
    }

    #[test]
    fn alter_index_rebuild_unknown_encoding_errors() {
        let err = parse_statement("ALTER INDEX my_idx REBUILD WITH (encoding = PQ8)").unwrap_err();
        assert!(
            err.message.contains("unknown vector encoding"),
            "got: {}",
            err.message
        );
    }

    #[test]
    fn alter_index_rebuild_display_roundtrips() {
        for (input, want) in [
            ("ALTER INDEX my_idx REBUILD", "ALTER INDEX my_idx REBUILD"),
            (
                "ALTER INDEX my_idx REBUILD WITH (encoding = SQ8)",
                "ALTER INDEX my_idx REBUILD WITH (encoding = SQ8)",
            ),
            (
                "ALTER INDEX my_idx REBUILD WITH (encoding = HALF)",
                "ALTER INDEX my_idx REBUILD WITH (encoding = HALF)",
            ),
        ] {
            let s = parse(input);
            assert_eq!(s.to_string(), want);
        }
    }

    #[test]
    fn create_table_unknown_type_defers_to_engine() {
        // v4.9 picked XML as a parse-time "unsupported column
        // type" probe. v7.17.0 Phase 1.4 changed the contract:
        // an unknown type ident parses as Text + `user_type_ref`
        // so CREATE TABLE can resolve user-defined enum / domain
        // types — rejection of truly-unknown types moved to the
        // engine's catalog lookup. v7.37.5 ζ-A then promoted XML
        // to a first-class built-in, so this probe switched to a
        // synthetic name nothing in the lexer will ever recognise.
        let stmt = parse_statement("CREATE TABLE x (a my_user_type)").unwrap();
        let Statement::CreateTable(t) = stmt else {
            panic!("expected CreateTable");
        };
        assert_eq!(t.columns[0].user_type_ref.as_deref(), Some("my_user_type"));
    }

    #[test]
    fn create_table_missing_table_keyword_errors() {
        assert!(parse_statement("CREATE x (a INT)").is_err());
    }

    // v7.37.6-B(sentori Epic 2 P0)— `PARTITION BY RANGE` parent +
    // `PARTITION OF parent <bounds>` child parse + Display round-trip.

    #[test]
    fn parse_create_table_partition_by_range() {
        use crate::ast::{PartitionBySpec, PartitionKindAst};
        let stmt = parse_statement(
            "CREATE TABLE events_partitioned (id BIGINT NOT NULL, ts TIMESTAMPTZ NOT NULL, \
             payload JSONB) PARTITION BY RANGE (ts)",
        )
        .unwrap();
        let Statement::CreateTable(t) = stmt else {
            panic!("expected CreateTable");
        };
        assert!(t.partition_of.is_none(), "parent has no partition_of");
        assert_eq!(t.columns.len(), 3);
        let by = t.partition_by.as_ref().expect("expected PARTITION BY");
        assert_eq!(
            by,
            &PartitionBySpec {
                kind: PartitionKindAst::Range,
                key_columns: alloc::vec!["ts".to_string()],
            }
        );
        // Display round-trip preserves the suffix. `quote_ident`
        // only adds double quotes when the ident needs escaping, so
        // a plain `ts` survives bare here.
        assert!(
            t.to_string().contains("PARTITION BY RANGE (ts)"),
            "Display lost PARTITION BY suffix: {t}"
        );
    }

    #[test]
    fn parse_create_table_partition_of_range() {
        use crate::ast::{PartitionOfBoundsAst, PartitionOfSpec};
        let stmt = parse_statement(
            "CREATE TABLE events_2026_06 PARTITION OF events_partitioned \
             FOR VALUES FROM ('2026-06-01 00:00:00+00') TO ('2026-07-01 00:00:00+00')",
        )
        .unwrap();
        let Statement::CreateTable(t) = stmt else {
            panic!("expected CreateTable");
        };
        assert!(t.columns.is_empty(), "child inherits columns from parent");
        assert!(t.partition_by.is_none());
        let of = t.partition_of.as_ref().expect("expected PARTITION OF");
        assert_eq!(of.parent_name, "events_partitioned");
        let PartitionOfSpec { bounds, .. } = of.clone();
        match bounds {
            PartitionOfBoundsAst::Range { lower, upper } => {
                assert!(lower.to_string().contains("2026-06-01"));
                assert!(upper.to_string().contains("2026-07-01"));
            }
            other => panic!("expected Range, got {other:?}"),
        }
        // Display round-trip emits the FOR VALUES tail. `quote_ident`
        // skips quotes when not required, so the parent name appears
        // bare here.
        let s = t.to_string();
        assert!(
            s.contains("PARTITION OF events_partitioned"),
            "Display lost PARTITION OF: {s}"
        );
        assert!(s.contains("FOR VALUES FROM"), "Display lost FROM: {s}");
        assert!(s.contains(") TO ("), "Display lost TO: {s}");
    }

    #[test]
    fn parse_create_table_partition_of_default() {
        use crate::ast::PartitionOfBoundsAst;
        let stmt =
            parse_statement("CREATE TABLE events_default PARTITION OF events_partitioned DEFAULT")
                .unwrap();
        let Statement::CreateTable(t) = stmt else {
            panic!("expected CreateTable");
        };
        let of = t.partition_of.as_ref().expect("expected PARTITION OF");
        assert_eq!(of.parent_name, "events_partitioned");
        assert!(matches!(of.bounds, PartitionOfBoundsAst::Default));
        assert!(
            t.to_string()
                .contains("PARTITION OF events_partitioned DEFAULT"),
            "Display lost DEFAULT: {t}"
        );
    }

    #[test]
    fn parse_create_table_partition_by_list() {
        // v7.37.16 (16.1) — `PARTITION BY LIST (key)` parent + a
        // child with `FOR VALUES IN (lit, lit, …)`.
        use crate::ast::{PartitionBySpec, PartitionKindAst, PartitionOfBoundsAst};
        let parent =
            parse_statement("CREATE TABLE events_listed (region TEXT) PARTITION BY LIST (region)")
                .unwrap();
        let Statement::CreateTable(t) = parent else {
            panic!("expected CreateTable");
        };
        let Some(PartitionBySpec {
            kind,
            ref key_columns,
        }) = t.partition_by
        else {
            panic!("expected PARTITION BY");
        };
        assert_eq!(kind, PartitionKindAst::List);
        assert_eq!(*key_columns, vec!["region".to_string()]);
        assert!(t.to_string().contains("PARTITION BY LIST (region)"));

        let child = parse_statement(
            "CREATE TABLE events_apac PARTITION OF events_listed \
             FOR VALUES IN ('jp', 'kr', 'tw')",
        )
        .unwrap();
        let Statement::CreateTable(c) = child else {
            panic!("expected CreateTable");
        };
        let of = c.partition_of.as_ref().expect("expected PARTITION OF");
        let PartitionOfBoundsAst::List { values } = &of.bounds else {
            panic!("expected List bounds, got {:?}", of.bounds);
        };
        assert_eq!(values.len(), 3);
        let disp = c.to_string();
        assert!(disp.contains("FOR VALUES IN ("), "Display lost IN: {disp}");
    }

    #[test]
    fn parse_create_table_partition_by_hash() {
        // v7.37.16 (16.2) — `PARTITION BY HASH (key)` parent + a
        // child with `FOR VALUES WITH (MODULUS m, REMAINDER r)`.
        use crate::ast::{PartitionBySpec, PartitionKindAst, PartitionOfBoundsAst};
        let parent =
            parse_statement("CREATE TABLE orders_h (id BIGINT) PARTITION BY HASH (id)").unwrap();
        let Statement::CreateTable(t) = parent else {
            panic!("expected CreateTable");
        };
        let Some(PartitionBySpec {
            kind,
            ref key_columns,
        }) = t.partition_by
        else {
            panic!("expected PARTITION BY");
        };
        assert_eq!(kind, PartitionKindAst::Hash);
        assert_eq!(*key_columns, vec!["id".to_string()]);
        assert!(t.to_string().contains("PARTITION BY HASH (id)"));

        let child = parse_statement(
            "CREATE TABLE orders_h_0 PARTITION OF orders_h \
             FOR VALUES WITH (MODULUS 4, REMAINDER 0)",
        )
        .unwrap();
        let Statement::CreateTable(c) = child else {
            panic!("expected CreateTable");
        };
        let of = c.partition_of.as_ref().expect("expected PARTITION OF");
        let PartitionOfBoundsAst::Hash { modulus, remainder } = of.bounds else {
            panic!("expected Hash bounds");
        };
        assert_eq!(modulus, 4);
        assert_eq!(remainder, 0);
        let disp = c.to_string();
        assert!(
            disp.contains("FOR VALUES WITH (MODULUS 4, REMAINDER 0)"),
            "Display lost HASH bounds: {disp}"
        );

        // Validation: REMAINDER ≥ MODULUS is rejected at parse time.
        let bad = parse_statement(
            "CREATE TABLE orders_h_bad PARTITION OF orders_h \
             FOR VALUES WITH (MODULUS 4, REMAINDER 4)",
        );
        let msg = format!("{}", bad.unwrap_err());
        assert!(
            msg.contains("REMAINDER") && msg.contains("MODULUS"),
            "expected REMAINDER/MODULUS validation error: {msg}"
        );
    }

    #[test]
    fn parse_create_table_partition_of_rejects_columns() {
        // v7.37.6-B contract: PARTITION OF children inherit columns
        // from the parent; an explicit list MUST surface as a parse
        // error rather than getting silently ignored.
        let err = parse_statement(
            "CREATE TABLE events_2026_06 PARTITION OF events_partitioned (id BIGINT) \
             FOR VALUES FROM ('a') TO ('b')",
        );
        assert!(err.is_err(), "expected parse error for explicit columns");
        let msg = format!("{}", err.unwrap_err());
        assert!(
            msg.contains("PARTITION OF") && msg.contains("column"),
            "error should mention PARTITION OF + columns: {msg}"
        );
    }

    #[test]
    fn insert_single_value() {
        let s = parse("INSERT INTO foo VALUES (42)");
        let Statement::Insert(i) = s else {
            panic!("expected Insert")
        };
        assert_eq!(i.table, "foo");
        assert_eq!(i.rows.len(), 1);
        assert_eq!(i.rows[0].len(), 1);
        assert!(matches!(i.rows[0][0], Expr::Literal(Literal::Integer(42))));
    }

    #[test]
    fn insert_multi_value_with_mixed_literals() {
        let s = parse("INSERT INTO foo VALUES (1, 'hi', 3.14, TRUE, NULL)");
        let Statement::Insert(i) = s else { panic!() };
        assert_eq!(i.rows.len(), 1);
        assert_eq!(i.rows[0].len(), 5);
    }

    #[test]
    fn insert_missing_into_errors() {
        assert!(parse_statement("INSERT foo VALUES (1)").is_err());
    }

    #[test]
    fn create_table_round_trip() {
        let original =
            parse("CREATE TABLE foo (id BIGINT NOT NULL, label TEXT, score FLOAT NOT NULL)");
        let text = original.to_string();
        let again = parse_statement(&text).expect("re-parse");
        assert_eq!(original, again);
    }

    #[test]
    fn insert_round_trip_with_negation_and_string() {
        let original = parse("INSERT INTO t VALUES (-1, 'it''s', NULL)");
        let text = original.to_string();
        let again = parse_statement(&text).expect("re-parse");
        assert_eq!(original, again);
    }

    #[test]
    fn unknown_keyword_at_statement_start_errors() {
        // v4.4: UPDATE is real SQL now. Use a fabricated keyword so
        // the top-level dispatch still has no branch to take.
        let err = parse_statement("FROBNICATE foo SET x = 1").unwrap_err();
        assert_eq!(err.message, "syntax error at or near \"FROBNICATE\"");
    }

    // --- v0.8 CREATE INDEX --------------------------------------------------

    #[test]
    fn create_index_basic() {
        let s = parse("CREATE INDEX idx_id ON users (id)");
        let Statement::CreateIndex(c) = s else {
            panic!("expected CreateIndex")
        };
        assert_eq!(c.name, "idx_id");
        assert_eq!(c.table, "users");
        assert_eq!(c.column, "id");
    }

    #[test]
    fn create_index_missing_on_errors() {
        assert!(parse_statement("CREATE INDEX foo users (id)").is_err());
    }

    #[test]
    fn create_index_missing_paren_errors() {
        assert!(parse_statement("CREATE INDEX foo ON users id").is_err());
    }

    #[test]
    fn create_index_round_trip() {
        let original = parse("CREATE INDEX by_name ON users (name)");
        let again = parse_statement(&original.to_string()).unwrap();
        assert_eq!(original, again);
    }

    // --- v7.9.29 CREATE UNIQUE INDEX [WHERE pred] (mailrs K1) -------------

    #[test]
    fn create_unique_index_basic() {
        let s = parse("CREATE UNIQUE INDEX uq_x ON t (a)");
        let Statement::CreateIndex(c) = s else {
            panic!("expected CreateIndex");
        };
        assert!(c.is_unique);
        assert_eq!(c.column, "a");
        assert!(c.partial_predicate.is_none());
    }

    #[test]
    fn create_unique_index_partial() {
        // mailrs's email_templates "one default per user" shape.
        let s = parse(
            "CREATE UNIQUE INDEX idx_email_templates_user_default \
             ON email_templates (user_address) WHERE is_default = true",
        );
        let Statement::CreateIndex(c) = s else {
            panic!("expected CreateIndex");
        };
        assert!(c.is_unique);
        assert_eq!(c.table, "email_templates");
        assert_eq!(c.column, "user_address");
        assert!(c.partial_predicate.is_some());
    }

    #[test]
    fn create_unique_index_composite_with_predicate() {
        // mailrs's calendar_events instance: composite columns.
        let s = parse(
            "CREATE UNIQUE INDEX uq_calendar_events_instance \
             ON calendar_events (calendar_id, uid, recurrence_id) \
             WHERE recurrence_id IS NOT NULL",
        );
        let Statement::CreateIndex(c) = s else {
            panic!("expected CreateIndex");
        };
        assert!(c.is_unique);
        assert_eq!(c.column, "calendar_id");
        assert_eq!(
            c.extra_columns,
            vec!["uid".to_string(), "recurrence_id".to_string()]
        );
        assert!(c.partial_predicate.is_some());
    }

    #[test]
    fn create_unique_index_using_btree_ok() {
        let s = parse("CREATE UNIQUE INDEX uq_x ON t USING btree (a)");
        assert!(matches!(s, Statement::CreateIndex(ref c) if c.is_unique));
    }

    #[test]
    fn create_unique_index_using_hnsw_rejected() {
        let err =
            parse_statement("CREATE UNIQUE INDEX uq_v ON t USING hnsw (embedding)").unwrap_err();
        assert!(err.message.contains("UNIQUE"), "{}", err.message);
    }

    #[test]
    fn create_unique_index_round_trip() {
        let original = parse(
            "CREATE UNIQUE INDEX uq_calendar_events_master \
             ON calendar_events (calendar_id, uid) WHERE recurrence_id IS NULL",
        );
        let again = parse_statement(&original.to_string()).unwrap();
        assert_eq!(original, again);
    }

    #[test]
    fn create_unique_without_index_errors() {
        let err = parse_statement("CREATE UNIQUE TABLE t (a INT)").unwrap_err();
        // v7.39 (round 340, V56) — PG 18.4, verbatim.
        assert_eq!(err.message, "syntax error at or near \"TABLE\"");
    }

    // --- v7.10.4 BYTES / BYTEA column type (Epic 1) ----------------------

    #[test]
    fn create_table_bytea_column() {
        let s = parse("CREATE TABLE t (id INT NOT NULL, payload BYTEA NOT NULL)");
        let Statement::CreateTable(c) = s else {
            panic!("expected CreateTable");
        };
        assert_eq!(c.columns.len(), 2);
        assert_eq!(c.columns[1].ty, ColumnTypeName::Bytes);
        assert!(!c.columns[1].nullable);
    }

    #[test]
    fn create_table_bytes_alias_column() {
        let s = parse("CREATE TABLE t (blob BYTES)");
        let Statement::CreateTable(c) = s else {
            panic!("expected CreateTable");
        };
        assert_eq!(c.columns[0].ty, ColumnTypeName::Bytes);
    }

    #[test]
    fn bytea_round_trip_display() {
        let original = parse("CREATE TABLE t (a BYTEA NOT NULL)");
        let again = parse_statement(&original.to_string()).unwrap();
        assert_eq!(original, again);
    }

    // --- v0.9 transactions -------------------------------------------------

    #[test]
    fn begin_commit_rollback_parse_as_unit_variants() {
        assert_eq!(parse("BEGIN"), Statement::Begin(None));
        assert_eq!(parse("COMMIT"), Statement::Commit);
        // r1066 — PG synonyms pgbench's tpcb script relies on.
        assert_eq!(parse("END"), Statement::Commit);
        assert_eq!(parse("END TRANSACTION"), Statement::Commit);
        assert_eq!(parse("COMMIT WORK"), Statement::Commit);
        assert_eq!(parse("ROLLBACK"), Statement::Rollback);
        // Trailing semicolons accepted too.
        assert_eq!(parse("BEGIN;"), Statement::Begin(None));
        // v7.39 (read01 round 118, B3) — an explicit ISOLATION LEVEL rides the
        // statement (with or without the WORK/TRANSACTION noise word).
        assert_eq!(
            parse("BEGIN ISOLATION LEVEL REPEATABLE READ"),
            Statement::Begin(Some(IsolationLevel::RepeatableRead))
        );
        assert_eq!(
            parse("START TRANSACTION ISOLATION LEVEL SERIALIZABLE"),
            Statement::Begin(Some(IsolationLevel::Serializable))
        );
        // A non-isolation mode keeps the session default (None).
        assert_eq!(parse("BEGIN READ ONLY"), Statement::Begin(None));
    }

    // --- v1.2: pgvector distance ops + ::vector cast --------------------

    #[test]
    fn inner_product_binop_parses() {
        let s = parse("SELECT v <#> [1.0, 2.0] FROM t");
        let Statement::Select(s) = s else { panic!() };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert!(matches!(
            expr,
            Expr::Binary {
                op: BinOp::InnerProduct,
                ..
            }
        ));
    }

    #[test]
    fn cosine_distance_binop_parses() {
        let s = parse("SELECT v <=> [1.0, 2.0] FROM t");
        let Statement::Select(s) = s else { panic!() };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert!(matches!(
            expr,
            Expr::Binary {
                op: BinOp::CosineDistance,
                ..
            }
        ));
    }

    #[test]
    fn vector_cast_postfix_wraps_string_literal() {
        let s = parse("SELECT '[1,2,3]'::vector FROM t");
        let Statement::Select(s) = s else { panic!() };
        let SelectItem::Expr { expr, .. } = &s.items[0] else {
            panic!()
        };
        assert!(matches!(
            expr,
            Expr::Cast {
                target: CastTarget::Vector,
                ..
            }
        ));
    }

    #[test]
    fn unsupported_cast_target_errors() {
        // v7.37.5 ship triage promoted the parser to accept every
        // ident as a `CastTarget::Named(canonical)`; the engine
        // surfaces the "unsupported cast target" error at eval
        // time when `type_name_to_data_type` can't resolve it.
        // Parser-side error now requires a NON-ident after `::`
        // (e.g. a punctuation token).
        let err = parse_statement("SELECT 1::, FROM t").unwrap_err();
        assert_eq!(err.message, "syntax error at or near \",\"");
    }

    #[test]
    fn tx_statements_round_trip() {
        for q in ["BEGIN", "COMMIT", "ROLLBACK"] {
            let original = parse(q);
            let again = parse_statement(&original.to_string()).unwrap();
            assert_eq!(original, again);
        }
    }

    #[test]
    fn interval_text_parsing_units() {
        // v7.37.5 β — three-field shape `(months, days, micros)` so
        // `'1 day'` and `'24 hours'` no longer collide (PG parity).
        // Single unit.
        assert_eq!(parse_interval_text("1 day"), Some((0, 1, 0)));
        assert_eq!(
            parse_interval_text("24 hours"),
            Some((0, 0, 86_400_000_000))
        );
        assert_eq!(parse_interval_text("1 second"), Some((0, 0, 1_000_000)));
        assert_eq!(parse_interval_text("1 month"), Some((1, 0, 0)));
        assert_eq!(parse_interval_text("2 years"), Some((24, 0, 0)));
        assert_eq!(parse_interval_text("1 week"), Some((0, 7, 0)));
        // Compound spans accumulate per-dimension.
        assert_eq!(parse_interval_text("1 year 6 months"), Some((18, 0, 0)));
        assert_eq!(
            parse_interval_text("1 day 2 hours"),
            Some((0, 1, 7_200_000_000))
        );
        // Negative numbers carry through per-dimension.
        assert_eq!(parse_interval_text("-1 day"), Some((0, -1, 0)));
        // Bad shapes return None.
        assert_eq!(parse_interval_text(""), None);
        assert_eq!(parse_interval_text("garbage"), None);
        assert_eq!(parse_interval_text("1 fortnight"), None);
        // v7.39 (GUC knife 3) — PG reads a bare number as SECONDS
        // (`INTERVAL '1'` = 00:00:01), verified against the oracle.
        assert_eq!(parse_interval_text("1"), Some((0, 0, 1_000_000)));
        assert_eq!(parse_interval_text("0"), Some((0, 0, 0)));
        assert_eq!(parse_interval_text("1.5"), Some((0, 0, 1_500_000)));
    }

    #[test]
    fn interval_literal_roundtrips_via_display() {
        let parsed = parse("SELECT INTERVAL '1 day 2 hours'");
        let s = parsed.to_string();
        // Display preserves the original text verbatim.
        assert!(s.contains("INTERVAL '1 day 2 hours'"), "got: {s}");
        // And re-parsing yields a structurally equal statement.
        let again = parse_statement(&s).unwrap();
        assert_eq!(parsed, again);
    }

    // ── v6.1.2: CREATE / DROP PUBLICATION ────────────────────

    #[test]
    fn parser_recognises_create_publication_bare() {
        let s = parse("CREATE PUBLICATION pub_a");
        let Statement::CreatePublication(p) = s else {
            panic!("expected CreatePublication, got {s:?}")
        };
        assert_eq!(p.name, "pub_a");
        assert_eq!(p.scope, PublicationScope::AllTables);
    }

    #[test]
    fn parser_recognises_create_publication_for_all_tables() {
        let s = parse("CREATE PUBLICATION pub_a FOR ALL TABLES");
        let Statement::CreatePublication(p) = s else {
            panic!("expected CreatePublication, got {s:?}")
        };
        assert_eq!(p.name, "pub_a");
        assert_eq!(p.scope, PublicationScope::AllTables);
    }

    #[test]
    fn parser_recognises_drop_publication() {
        let s = parse("DROP PUBLICATION pub_a");
        let Statement::DropPublication { name, .. } = s else {
            panic!("expected DropPublication, got {s:?}")
        };
        assert_eq!(name, "pub_a");
    }

    #[test]
    fn parser_recognises_for_table_list() {
        let s = parse("CREATE PUBLICATION pub_a FOR TABLE t1, t2, t3");
        let Statement::CreatePublication(p) = s else {
            panic!("expected CreatePublication, got {s:?}")
        };
        assert_eq!(p.name, "pub_a");
        let PublicationScope::ForTables(ts) = p.scope else {
            panic!("expected ForTables scope")
        };
        assert_eq!(ts, alloc::vec!["t1", "t2", "t3"]);
    }

    #[test]
    fn parser_rejects_bare_for_tables_and_takes_in_schema() {
        // v7.39 (round 754, F31-B5) — PG18-measured: the bare plural
        // is rejected (`invalid publication object list`; the old
        // test pinned an unverifiable "PG 19 accepts both" claim);
        // TABLES pairs with IN SCHEMA.
        let err = parse_statement("CREATE PUBLICATION pub_a FOR TABLES t1, t2")
            .expect_err("bare FOR TABLES must reject");
        assert!(
            alloc::format!("{err}").contains("invalid publication object list"),
            "got: {err}"
        );
        let s = parse("CREATE PUBLICATION pub_a FOR TABLES IN SCHEMA public");
        let Statement::CreatePublication(p) = s else {
            panic!("expected CreatePublication, got {s:?}")
        };
        let PublicationScope::TablesInSchema(schema) = p.scope else {
            panic!("expected TablesInSchema")
        };
        assert_eq!(schema, "public");
    }

    #[test]
    fn parser_recognises_for_all_tables_except_list() {
        let s = parse("CREATE PUBLICATION p FOR ALL TABLES EXCEPT t1, t2");
        let Statement::CreatePublication(p) = s else {
            panic!()
        };
        let PublicationScope::AllTablesExcept(ts) = p.scope else {
            panic!("expected AllTablesExcept")
        };
        assert_eq!(ts, alloc::vec!["t1", "t2"]);
    }

    #[test]
    fn parser_rejects_for_table_with_empty_list() {
        // `FOR TABLE` with nothing after is a parse error.
        let err = parse_statement("CREATE PUBLICATION p FOR TABLE")
            .expect_err("must error on empty list");
        // No specific message asserted — the call falls through to
        // expect_ident_like which yields "expected identifier, got …".
        assert!(!err.message.is_empty());
    }

    #[test]
    fn parser_recognises_show_publications() {
        // v6.1.3 — SHOW PUBLICATIONS lands here. PUBLICATIONS is a
        // bare ident in this position, NOT a reserved keyword.
        let s = parse("SHOW PUBLICATIONS");
        assert!(matches!(s, Statement::ShowPublications));
    }

    // ── v6.1.4: CREATE / DROP SUBSCRIPTION + SHOW SUBSCRIPTIONS ─

    #[test]
    fn parser_recognises_create_subscription_single_publication() {
        let s = parse(
            "CREATE SUBSCRIPTION sub_a CONNECTION 'host=127.0.0.1 port=20002' PUBLICATION pub_a",
        );
        let Statement::CreateSubscription(c) = s else {
            panic!("expected CreateSubscription, got {s:?}")
        };
        assert_eq!(c.name, "sub_a");
        assert_eq!(c.conn_str, "host=127.0.0.1 port=20002");
        assert_eq!(c.publications, alloc::vec!["pub_a"]);
    }

    #[test]
    fn parser_recognises_create_subscription_multi_publication() {
        let s = parse("CREATE SUBSCRIPTION sub_a CONNECTION 'host=h' PUBLICATION p1, p2, p3");
        let Statement::CreateSubscription(c) = s else {
            panic!()
        };
        assert_eq!(c.publications, alloc::vec!["p1", "p2", "p3"]);
    }

    #[test]
    fn parser_rejects_create_subscription_missing_connection() {
        let err = parse_statement("CREATE SUBSCRIPTION s PUBLICATION p")
            .expect_err("must error on missing CONNECTION");
        assert_eq!(err.message, "syntax error at or near \"PUBLICATION\"");
    }

    #[test]
    fn parser_rejects_create_subscription_missing_publication() {
        let err = parse_statement("CREATE SUBSCRIPTION s CONNECTION 'host=x'")
            .expect_err("must error on missing PUBLICATION");
        assert_eq!(err.message, "syntax error at end of input");
    }

    #[test]
    fn parser_recognises_drop_subscription() {
        let s = parse("DROP SUBSCRIPTION sub_a");
        let Statement::DropSubscription { name, .. } = s else {
            panic!("expected DropSubscription, got {s:?}")
        };
        assert_eq!(name, "sub_a");
    }

    #[test]
    fn parser_recognises_show_subscriptions() {
        let s = parse("SHOW SUBSCRIPTIONS");
        assert!(matches!(s, Statement::ShowSubscriptions));
    }

    #[test]
    fn parser_recognises_wait_for_wal_position_no_timeout() {
        let s = parse("WAIT FOR WAL POSITION 12345");
        let Statement::WaitForWalPosition { pos, timeout_ms } = s else {
            panic!("expected WaitForWalPosition, got {s:?}")
        };
        assert_eq!(pos, 12345);
        assert!(timeout_ms.is_none());
    }

    #[test]
    fn parser_recognises_wait_for_wal_position_with_timeout() {
        let s = parse("WAIT FOR WAL POSITION 67890 WITH TIMEOUT 5000");
        let Statement::WaitForWalPosition { pos, timeout_ms } = s else {
            panic!()
        };
        assert_eq!(pos, 67890);
        assert_eq!(timeout_ms, Some(5000));
    }

    #[test]
    fn parser_rejects_wait_with_negative_position() {
        // The lexer treats `-` as a token; `expect_u64_literal`
        // only sees the Integer that follows, so the negative
        // arrives as a unary-minus expression at higher levels.
        // Bare `WAIT FOR WAL POSITION -1` thus surfaces as a
        // parse error one way or another.
        let err = parse_statement("WAIT FOR WAL POSITION -1").unwrap_err();
        assert!(!err.message.is_empty());
    }

    #[test]
    fn parser_recognises_bare_analyze() {
        let s = parse("ANALYZE");
        assert!(matches!(s, Statement::Analyze(None)));
    }

    #[test]
    fn parser_recognises_analyze_with_table() {
        let s = parse("ANALYZE users");
        let Statement::Analyze(Some(name)) = s else {
            panic!("expected Analyze, got {s:?}")
        };
        assert_eq!(name, "users");
    }

    #[test]
    fn parser_recognises_analyze_with_quoted_table() {
        let s = parse("ANALYZE \"Mixed Case\"");
        let Statement::Analyze(Some(name)) = s else {
            panic!()
        };
        assert_eq!(name, "Mixed Case");
    }

    #[test]
    fn parser_rejects_analyze_with_garbage_token() {
        let err = parse_statement("ANALYZE 42").expect_err("must error");
        assert!(!err.message.is_empty());
    }

    #[test]
    fn analyze_display_roundtrips() {
        for sql in ["ANALYZE", "ANALYZE users"] {
            let s = parse(sql);
            let printed = s.to_string();
            let again = parse_statement(&printed)
                .unwrap_or_else(|e| panic!("re-parse failed for {printed:?}: {e}"));
            assert_eq!(s, again);
        }
    }

    #[test]
    fn wait_for_display_roundtrips() {
        for sql in [
            "WAIT FOR WAL POSITION 12345",
            "WAIT FOR WAL POSITION 67890 WITH TIMEOUT 5000",
        ] {
            let s = parse(sql);
            let printed = s.to_string();
            let again = parse_statement(&printed)
                .unwrap_or_else(|e| panic!("re-parse failed for {printed:?}: {e}"));
            assert_eq!(s, again, "round-trip mismatch for {sql:?}");
        }
    }

    #[test]
    fn subscription_ddl_display_roundtrips() {
        for sql in [
            "CREATE SUBSCRIPTION sub_a CONNECTION 'host=h port=20002' PUBLICATION pub_a",
            "CREATE SUBSCRIPTION sub_b CONNECTION 'host=h' PUBLICATION p1, p2",
            "DROP SUBSCRIPTION sub_a",
            "SHOW SUBSCRIPTIONS",
        ] {
            let s = parse(sql);
            let printed = s.to_string();
            let again = parse_statement(&printed)
                .unwrap_or_else(|e| panic!("re-parse failed for {printed:?}: {e}"));
            assert_eq!(s, again, "round-trip mismatch for {sql:?}");
        }
    }

    #[test]
    fn parser_drop_dispatches_user_vs_publication() {
        // Pre-v6.1.2 DROP USER took the bare-ident path; v6.1.2
        // tokenises DROP. Both targets must still parse.
        let s = parse("DROP USER 'alice'");
        let Statement::DropUser { name, .. } = s else {
            panic!("expected DropUser, got {s:?}")
        };
        assert_eq!(name, "alice");
        // And DROP PUBLICATION lands the new variant.
        let s = parse("DROP PUBLICATION p1");
        assert!(matches!(s, Statement::DropPublication { .. }));
    }

    #[test]
    fn publication_ddl_display_roundtrips() {
        // Every CREATE PUBLICATION variant must Display → parse →
        // same AST. v6.1.3 covers all three scope shapes.
        for sql in [
            "CREATE PUBLICATION pub_a",
            "CREATE PUBLICATION pub_a FOR ALL TABLES",
            "CREATE PUBLICATION pub_a FOR TABLE t1, t2",
            "CREATE PUBLICATION pub_a FOR ALL TABLES EXCEPT t1",
            "DROP PUBLICATION pub_a",
            "SHOW PUBLICATIONS",
        ] {
            let s = parse(sql);
            let printed = s.to_string();
            let again = parse_statement(&printed)
                .unwrap_or_else(|e| panic!("re-parse failed for {printed:?}: {e}"));
            assert_eq!(s, again, "round-trip mismatch for {sql:?}");
        }
    }

    // --- v7.12.4: CREATE FUNCTION + CREATE TRIGGER + PL/pgSQL ---

    #[test]
    fn create_function_returns_trigger_plpgsql_minimal() {
        let sql = "CREATE FUNCTION noop() RETURNS TRIGGER LANGUAGE plpgsql AS $$ BEGIN RETURN NEW; END; $$";
        let s = parse(sql);
        let Statement::CreateFunction(f) = s else {
            panic!("expected CreateFunction");
        };
        assert_eq!(f.name, "noop");
        assert!(!f.or_replace);
        assert!(f.args.is_empty());
        assert!(matches!(f.returns, FunctionReturn::Trigger));
        assert_eq!(f.language, "plpgsql");
        let FunctionBody::PlPgSql(block) = f.body else {
            panic!("expected PlPgSql body");
        };
        assert_eq!(block.statements.len(), 1);
        assert!(matches!(
            block.statements[0],
            PlPgSqlStmt::Return(ReturnTarget::New)
        ));
    }

    #[test]
    fn create_function_or_replace_with_assignment() {
        // mailrs-shape trigger function: NEW.col := to_tsvector(...);
        // RETURN NEW.
        let sql = "CREATE OR REPLACE FUNCTION update_sv() RETURNS TRIGGER LANGUAGE plpgsql AS $$
BEGIN
  NEW.search_vector := to_tsvector('english', NEW.subject);
  RETURN NEW;
END;
$$";
        let s = parse(sql);
        let Statement::CreateFunction(f) = s else {
            panic!("expected CreateFunction");
        };
        assert!(f.or_replace);
        let FunctionBody::PlPgSql(block) = &f.body else {
            panic!("expected PlPgSql body");
        };
        assert_eq!(block.statements.len(), 2);
        // First statement: NEW.search_vector := to_tsvector(...)
        let PlPgSqlStmt::Assign { target, .. } = &block.statements[0] else {
            panic!("expected Assign as first stmt");
        };
        match target {
            AssignTarget::NewColumn(c) => assert_eq!(c, "search_vector"),
            other => panic!("expected NEW.col, got {other:?}"),
        }
        // Second statement: RETURN NEW
        assert!(matches!(
            block.statements[1],
            PlPgSqlStmt::Return(ReturnTarget::New)
        ));
    }

    #[test]
    fn create_trigger_after_insert_or_update() {
        let sql = "CREATE TRIGGER tg AFTER INSERT OR UPDATE ON messages FOR EACH ROW EXECUTE FUNCTION update_sv()";
        let s = parse(sql);
        let Statement::CreateTrigger(t) = s else {
            panic!("expected CreateTrigger");
        };
        assert_eq!(t.name, "tg");
        assert_eq!(t.table, "messages");
        assert_eq!(t.timing, TriggerTiming::After);
        assert_eq!(t.events, vec![TriggerEvent::Insert, TriggerEvent::Update]);
        assert_eq!(t.for_each, TriggerForEach::Row);
        assert_eq!(t.function, "update_sv");
    }

    #[test]
    fn create_trigger_before_delete_execute_procedure_alias() {
        // PG also accepts the legacy `EXECUTE PROCEDURE` spelling.
        let sql =
            "CREATE TRIGGER guard BEFORE DELETE ON t FOR EACH ROW EXECUTE PROCEDURE block_delete()";
        let s = parse(sql);
        let Statement::CreateTrigger(t) = s else {
            panic!("expected CreateTrigger");
        };
        assert_eq!(t.timing, TriggerTiming::Before);
        assert_eq!(t.events, vec![TriggerEvent::Delete]);
    }

    #[test]
    fn drop_trigger_if_exists_round_trips() {
        // No parser support for DROP TRIGGER yet — added in v7.12.5
        // alongside the broader DROP …{IF EXISTS} cleanup. The
        // AST + Display impls are in place so we round-trip via
        // construction:
        let s = Statement::DropTrigger {
            name: "tg".into(),
            table: "messages".into(),
            if_exists: true,
        };
        assert_eq!(s.to_string(), "DROP TRIGGER IF EXISTS tg ON messages");
    }

    #[test]
    fn trigger_ddl_display_roundtrips_through_parser() {
        // CREATE TRIGGER + its referenced CREATE FUNCTION must
        // Display → parse → same AST (modulo PL/pgSQL body
        // formatting which is parser-canonicalised).
        for sql in [
            "CREATE TRIGGER tg AFTER INSERT ON t FOR EACH ROW EXECUTE FUNCTION f()",
            "CREATE TRIGGER tg2 BEFORE UPDATE OR DELETE ON t FOR EACH ROW EXECUTE FUNCTION g()",
        ] {
            let s = parse(sql);
            let printed = s.to_string();
            let again = parse_statement(&printed)
                .unwrap_or_else(|e| panic!("re-parse failed for {printed:?}: {e}"));
            assert_eq!(s, again, "round-trip mismatch for {sql:?}");
        }
    }
}