# Migrations

**Generated SQL is never hand-edited.** Hand-editing poisons Drizzle's diff
baseline, and the baseline is what tells you the database still matches the
schema that the types are inferred from.

The split follows what Drizzle can actually diff:

| Owned by Drizzle | Owned by hand |
|---|---|
| Tables, columns, indexes | SQL functions |
| RLS policies, via `pgPolicy` beside the table | Data seeds |
| Enums | The release matrix and its versions |

```
yarn generate            # schema diff -> migrations/
yarn generate:custom     # empty file -> migrations/, for functions and data
yarn migrate
```

## Why policies sit beside their tables

A new table shipping with no policy is the failure mode that matters, and RLS
default-deny only helps if it was enabled on that table. Declaring the policy in
the same file as the table makes the omission visible at review time.

## Why the matrix is a data migration

The release matrix is **versioned, never updated** — a past release has to be
reconstructable when an award is protested. A rule change is an INSERT at a new
version. That is exactly what `--custom` is for.

## Ordering: why the functions are migration 0000, and why they are plpgsql

Drizzle emits an RLS policy in the **same migration as the table it guards**, so
the functions those policies call must already exist. But the functions read
`solicitation`, `participation` and `release_matrix` — which that same later
migration creates. A straightforward cycle.

`LANGUAGE sql` validates a function body at `CREATE` time and would fail. plpgsql
defers validation to first call, which breaks the cycle. For the same reason the
signatures use `text` rather than the `release_level` enum: the enum does not
exist yet either.

The cost is real and worth knowing: **a typo inside a function body is not caught
at migration time.** It surfaces the first time a policy runs — which, because
policy failures present as empty results, is the failure mode #11 already flagged
as hard to diagnose. Database-level tests over these functions are not optional.