Prepare v0.6.2 release

.github/ISSUE_TEMPLATE/database-feedback.yml

@@ -13,7 +13,7 @@ body:
     attributes:
       label: safe-migrate version
       description: Paste the output of `safe-migrate --version`.
-      placeholder: safe-migrate 0.6.1
+      placeholder: safe-migrate 0.6.2
     validations:
       required: true
 

CHANGELOG.md

@@ -5,6 +5,19 @@ commits and pull requests. Published binaries, checksums, and generated release
 notes are available on the
 [GitHub Releases page](https://github.com/dsecurity49/safe-migrate/releases).
 
+## v0.6.2 — 2026-08-27
+
+- Added reproducible, ignored performance scenarios for large synchronized
+  baselines, ordered chains, transaction and savepoint rollback, compound
+  statements, dependency graphs, reports, and the complete protected-cache
+  round trip, with a recorded local baseline and no timing-sensitive CI gate.
+- Added test-only cache and state invariant validation for modeled identities,
+  cache relationships, dependency edges, constraints, pending validation, and
+  transaction-frame consistency across conflicts and rollbacks.
+- Hardened `ALTER DATABASE ... OWNER TO` extraction so an incomplete typed AST
+  is rejected instead of reaching an unchecked accessor, while preserving the
+  exact fact produced for valid SQL.
+
 ## v0.6.1 — 2026-08-26
 
 - Upgraded the exactly pinned Squawk parser stack from 2.62.0 to 2.63.0 and

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "safe-migrate"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2024"
 rust-version = "1.94"
 description = "Sync PostgreSQL metadata, then lint migrations offline"

README.md

@@ -310,7 +310,7 @@ and GitHub cache contents are not signed. Store a 64-character hexadecimal key
 as `SAFE_MIGRATE_CACHE_KEY` and pass it to both workflows.
 
 ```yaml
-- uses: dsecurity49/safe-migrate@v0.6.1
+- uses: dsecurity49/safe-migrate@v0.6.2
   env:
     DATABASE_URL: ${{ secrets.SAFE_MIGRATE_DATABASE_URL }}
     SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
@@ -329,7 +329,7 @@ Replace `public` with the schemas that contain your migrations, or omit
 Add this after checkout in the pull-request workflow:
 
 ```yaml
-- uses: dsecurity49/safe-migrate@v0.6.1
+- uses: dsecurity49/safe-migrate@v0.6.2
   env:
     SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
   with:

docs/BENCHMARKS.md

@@ -0,0 +1,38 @@
+# Local benchmark baseline
+
+This document records reproducible, non-CI performance scenarios. The values
+are comparison points for later `0.6.x` work, not performance guarantees.
+Run them with:
+
+```sh
+cargo test --locked --test performance_scenarios -- --ignored --nocapture
+```
+
+The scenarios validate final state as well as timing, so an apparent speedup
+that breaks transaction cleanup is not a valid comparison.
+
+## Initial `v0.6.2` baseline
+
+Captured on 2026-08-26 from base commit `ac8b5ad`, with local uncommitted
+`v0.6.2` hardening changes, using Rust 1.98.0 on an aarch64 Android Linux
+environment. Timings are wall-clock milliseconds from a debug test build and
+will vary with device load.
+
+| Scenario | Statements | Elapsed |
+| --- | ---: | ---: |
+| ordered thousand-statement chain | 1,000 | 11,595 ms |
+| large synchronized-baseline hydration | 1,000 relations | 99 ms |
+| cache encode/compress/encrypt/decrypt/decompress/decode | 1,000 relations | 99 ms |
+| long transaction rollback | 503 | 4,952 ms |
+| repeated savepoint rollback | 752 | 1,586 ms |
+| failed multi-action statement rollback | 3 | 14 ms |
+| rename and cascade dependency graph | 304 | 3,323 ms |
+| location-rich reports with many findings | 250 | 2,440 ms |
+
+The scenarios cover ordered-chain analysis, baseline hydration, cache
+processing, transaction undo, compound-statement atomicity, savepoint cleanup,
+rename/cascade graph cleanup, and location-rich report generation. They
+intentionally avoid timing thresholds in CI. Allocation, peak-memory,
+checkpoint-capture, and isolated dependency-query measurements require a
+profiler or allocator instrumentation and are deliberately not inferred from
+these wall-clock samples.

docs/CONTRACT.md

@@ -1,6 +1,6 @@
 # CLI and Report Contract
 
-This document defines safe-migrate v0.6.1's CLI, report, cache, and GitHub
+This document defines safe-migrate v0.6.2's CLI, report, cache, and GitHub
 Action behavior.
 
 If you are learning safe-migrate, start with the [README](../README.md). This

docs/GITHUB_ACTIONS.md

@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.1
+      - uses: dsecurity49/safe-migrate@v0.6.2
         env:
           SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
         with:
@@ -83,7 +83,7 @@ explicitly.
 In a trusted branch job, pass the checked-out file directly:
 
 ```yaml
-      - uses: dsecurity49/safe-migrate@v0.6.1
+      - uses: dsecurity49/safe-migrate@v0.6.2
         with:
           path: migrations
           config: safe-migrate.toml
@@ -107,7 +107,7 @@ separately:
           sparse-checkout-cone-mode: false
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.1
+      - uses: dsecurity49/safe-migrate@v0.6.2
         with:
           path: migrations
           config: .safe-migrate-base/safe-migrate.toml
@@ -153,7 +153,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.1
+      - uses: dsecurity49/safe-migrate@v0.6.2
         env:
           DATABASE_URL: ${{ secrets.SAFE_MIGRATE_DATABASE_URL }}
           SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}

scripts/test-action-contract

@@ -9,7 +9,7 @@ baseline="$repo_root/scripts/action-baseline"
 manifest="$repo_root/action.yml"
 workflow="$repo_root/.github/workflows/ci.yml"
 
-test "$(/bin/sh "$resolver" v0.6.1 "$repo_root/Cargo.toml")" = v0.6.1
+test "$(/bin/sh "$resolver" v0.6.2 "$repo_root/Cargo.toml")" = v0.6.2
 test "$(/bin/sh "$resolver" 0123456789abcdef0123456789abcdef01234567 "$repo_root/Cargo.toml")" = source
 
 if /bin/sh "$resolver" main "$repo_root/Cargo.toml" >/dev/null 2>&1; then

src/ast/visitor.rs

@@ -3249,7 +3249,7 @@ impl AstVisitor {
             }
             AlterDatabaseAction::OwnerTo(ot) => {
                 crate::analysis::facts::AlterDatabaseAction::OwnerChange(Self::extract_role(
-                    &ot.role_ref().unwrap(),
+                    &ot.role_ref()?,
                 ))
             }
             AlterDatabaseAction::SetTablespace(st) => {

src/ast/visitor_tests.rs

@@ -998,6 +998,17 @@ mod tests {
             database.action,
             AlterDatabaseAction::Rename { to } if to == "NewDb"
         ));
+
+        let Some(StatementFact::AlterDatabase(database)) =
+            parse_and_extract_statement("ALTER DATABASE app OWNER TO AppOwner;")
+        else {
+            panic!("expected alter database owner fact");
+        };
+        assert!(matches!(
+            database.action,
+            AlterDatabaseAction::OwnerChange(crate::analysis::facts::RoleFact::Named { name, .. })
+                if name == "appowner"
+        ));
     }
 
     #[test]