From ae74bcf3ecec0c35dedd6aa8a1e9ee32138ce944 Mon Sep 17 00:00:00 2001
From: huyplb <huyplb@live.com>
Date: Sun, 8 Nov 2026 14:47:05 -0600
Subject: [PATCH 1/4] feat(utilities): Rename Column changes a type in place,
 on every SQL engine

A type change is now one in-place ALTER by default; the add / copy /
switch-over plan becomes an opt-in Large table mode on the eight engines
that have it. A size warning from the catalog estimate points at it from
about a million rows or 1 GB. A type change alone lists routines as
one-line warnings; the line-by-line references are for a rename.

- PostgreSQL family: ALTER ... TYPE, with USING only across kinds
  (CockroachDB refused to rewrite an indexed column for an explicit USING).
- MySQL family: MODIFY restating NOT NULL, default, collation and the
  comment read from the catalog.
- SQL Server: one transaction that scripts the column's indexes from
  sys.indexes at run time (filters, INCLUDE, DESC kept, INCLUDE-only and
  filter-only indexes found) and puts them back; large-table mode moves
  filtered indexes at the switch-over, since sp_rename refuses a column a
  filter names.
- New: Oracle, Db2 (+ REORG), SQLite (rename only), DuckDB (refused while
  the table has an index), Redshift (VARCHAR lengthening), ClickHouse
  (Nullable kept, sorting key refused). A dialect can refuse a change with
  its reason before any SQL is shown.

Run live on PostgreSQL, MySQL, MariaDB, TiDB, SQL Server, CockroachDB,
Oracle, Db2, SQLite, DuckDB and ClickHouse. Feature map refreshed (163
routes, counts re-measured).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/e2e/src/generated/test-ids.ts            |   5 +-
 .../components/ColumnChangePanel.test.tsx     | 106 +++-
 .../components/ColumnChangePanel.tsx          | 115 ++++-
 .../src/frontend/shared/lib/column-change.ts  |   3 +-
 docs/FEATURE_MAP.md                           |   6 +-
 docs/feature-map.html                         |  26 +-
 docs/feature-map/app.js                       |   2 +-
 docs/feature-map/data.js                      |  12 +-
 docs/feature-map/template.html                |  10 +-
 docs/plans/2026-11-01-safe-column-change.md   | 112 +++++
 docs/testing/TEST_IDS.md                      |   5 +-
 docs/user-guide.md                            |  43 +-
 packages/sql/src/index.ts                     |   3 +-
 .../utilities/column-change.registry.ts       |  19 +
 .../modules/utilities/column-change.test.ts   | 455 ++++++++++++++++--
 .../src/modules/utilities/column-change.ts    | 152 +++---
 .../modules/utilities/column-change.types.ts  |  59 ++-
 .../modules/utilities/column-type-shape.ts    |  68 +++
 packages/sql/src/providers/DIALECTS.md        |   5 +
 .../clickHouse/clickhouse.column-change.ts    |  74 +++
 .../cockroachDb/cockroachdb.column-change.ts  |  10 +-
 .../src/providers/db2/db2.column-change.ts    |  53 ++
 .../providers/duckDb/duckdb.column-change.ts  |  57 +++
 .../providers/mysql/mysql.column-change.ts    |  36 +-
 .../providers/oracle/oracle.column-change.ts  |  48 ++
 .../postgres/postgres.column-change.ts        |  42 +-
 .../redshift/redshift.column-change.ts        |  65 +++
 .../providers/sqlLite/sqlite.column-change.ts |  39 ++
 .../sqlServer/sqlserver.column-change.ts      | 206 ++++++--
 packages/ui-shared/src/index.ts               |   3 +-
 30 files changed, 1611 insertions(+), 228 deletions(-)
 create mode 100644 packages/sql/src/modules/utilities/column-type-shape.ts
 create mode 100644 packages/sql/src/providers/clickHouse/clickhouse.column-change.ts
 create mode 100644 packages/sql/src/providers/db2/db2.column-change.ts
 create mode 100644 packages/sql/src/providers/duckDb/duckdb.column-change.ts
 create mode 100644 packages/sql/src/providers/oracle/oracle.column-change.ts
 create mode 100644 packages/sql/src/providers/redshift/redshift.column-change.ts
 create mode 100644 packages/sql/src/providers/sqlLite/sqlite.column-change.ts

diff --git a/apps/e2e/src/generated/test-ids.ts b/apps/e2e/src/generated/test-ids.ts
index 0ff3bad1d..75e8a6525 100644
--- a/apps/e2e/src/generated/test-ids.ts
+++ b/apps/e2e/src/generated/test-ids.ts
@@ -2997,6 +2997,8 @@ export const TestIds = {
       columnChangeHint: 'column-change-hint',
       /** section · What it touches */
       columnChangeImpact: 'column-change-impact',
+      /** input */
+      columnChangeLargeTable: 'column-change-large-table',
       /** p */
       columnChangeLoadError: 'column-change-load-error',
       /** input */
@@ -3029,7 +3031,7 @@ export const TestIds = {
       columnChangeStep: (value: string | number) => `column-change-step-${value}`,
       /** button */
       columnChangeStepCopy: (value: string | number) => `column-change-step-${value}-copy`,
-      /** section · ( steps) */
+      /** section · ( ) */
       columnChangeSteps: 'column-change-steps',
       /** select */
       columnChangeTable: 'column-change-table',
@@ -4184,6 +4186,7 @@ export type TestId =
   | 'column-change-copy-all'
   | 'column-change-hint'
   | 'column-change-impact'
+  | 'column-change-large-table'
   | 'column-change-load-error'
   | 'column-change-new-name'
   | 'column-change-new-type'
diff --git a/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.test.tsx b/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.test.tsx
index d36b74e38..48d3c899b 100644
--- a/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.test.tsx
+++ b/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.test.tsx
@@ -8,8 +8,19 @@ vi.mock('@/shared/api/sqlApi', () => ({
   executeSql: (...args: unknown[]) => executeSql(...args),
 }));
 
+const fetchTableInsight = vi.hoisted(() => vi.fn());
+vi.mock('@/shared/api/schemaApi', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  fetchTableInsight: (...args: unknown[]) => fetchTableInsight(...args),
+}));
+
 vi.mock('@/features/compare', () => {
-  const state = { connections: [{ id: 'pg', name: 'Shop', dialect: 'postgres', schema: 'shop', hasPassword: true }] };
+  const state = {
+    connections: [
+      { id: 'pg', name: 'Shop', dialect: 'postgres', schema: 'shop', hasPassword: true },
+      { id: 'ora', name: 'Ledger', dialect: 'oracle', schema: 'shop', hasPassword: true },
+    ],
+  };
   const useSyncStore = (sel: (s: typeof state) => unknown) => sel(state);
   useSyncStore.getState = () => state;
   return { useSyncStore };
@@ -45,8 +56,13 @@ const pick = (testId: string, value: string) => fireEvent.change(screen.getByTes
 describe('ColumnChangePanel', () => {
   beforeEach(() => {
     executeSql.mockReset();
+    fetchTableInsight.mockReset();
+    fetchTableInsight.mockResolvedValue({ estimatedRows: 120, sizeBytes: 16384 });
     useSqlEditorStore.setState({
-      schemaCache: { pg: { status: 'ready', tables: [orders, statusFn] } },
+      schemaCache: {
+        pg: { status: 'ready', tables: [orders, statusFn] },
+        ora: { status: 'ready', tables: [orders] },
+      },
       ensureSchema: async () => undefined,
       ensureConnectionSelected: () => undefined,
     } as never);
@@ -59,6 +75,7 @@ describe('ColumnChangePanel', () => {
     pick('column-change-column', 'status');
     expect(screen.getByTestId('column-change-hint')).toBeTruthy();
     pick('column-change-new-type', 'varchar(40)');
+    fireEvent.click(screen.getByTestId('column-change-large-table'));
 
     expect(screen.getByTestId('column-change-impact').textContent).toContain('orders_status_idx');
     expect(screen.getByTestId('column-change-impact').textContent).toContain('orders_status_label');
@@ -110,6 +127,7 @@ describe('ColumnChangePanel', () => {
     pick('column-change-table', 'orders');
     pick('column-change-column', 'status');
     pick('column-change-new-type', 'varchar(40)');
+    fireEvent.click(screen.getByTestId('column-change-large-table'));
     fireEvent.click(screen.getByTestId('column-change-run-add'));
     await waitFor(() => expect(executeSql).toHaveBeenCalled());
     expect(executeSql.mock.calls[0]![0]).toMatchObject({ connectionId: 'pg' });
@@ -133,6 +151,7 @@ describe('ColumnChangePanel', () => {
     pick('column-change-table', 'orders');
     pick('column-change-column', 'status');
     pick('column-change-new-type', 'varchar(40)');
+    fireEvent.click(screen.getByTestId('column-change-large-table'));
     expect(screen.getByTestId('column-change-step-3').textContent).toContain('DO $fox_copy$');
     fireEvent.click(screen.getByTestId('column-change-run-copy'));
     await waitFor(() => expect(screen.getByTestId('column-change-progress').textContent).toMatch(/10/));
@@ -194,6 +213,7 @@ describe('ColumnChangePanel', () => {
     pick('column-change-table', 'orders');
     pick('column-change-column', 'status');
     pick('column-change-new-type', 'varchar(40)');
+    fireEvent.click(screen.getByTestId('column-change-large-table'));
     fireEvent.click(screen.getByTestId('column-change-run-all'));
     await waitFor(() => expect(screen.getByTestId('column-change-run-status').textContent).toMatch(/All parts finished/));
     const batches = executeSql.mock.calls.map((c) => (c[1] as string[]).join('\n'));
@@ -207,4 +227,86 @@ describe('ColumnChangePanel', () => {
     expect(addAt).toBeGreaterThanOrEqual(0);
     expect(dropAt).toBeGreaterThan(addAt);
   });
+
+  describe('a type change in place (the default)', () => {
+    const typeIn = (type: string) => {
+      render(<ColumnChangePanel lockedConnectionId="pg" />);
+      pick('column-change-table', 'orders');
+      pick('column-change-column', 'status');
+      pick('column-change-new-type', type);
+    };
+
+    it('is one ALTER, with no copy part and no batch size until large-table mode is on', () => {
+      typeIn('varchar(40)');
+      expect(screen.getByTestId('column-change-steps').textContent).toContain('Change in place (1 step)');
+      expect(screen.getByTestId('column-change-step-1').textContent).toContain(
+        'ALTER TABLE "shop"."orders" ALTER COLUMN "status" TYPE varchar(40);'
+      );
+      expect(screen.queryByTestId('column-change-part-copy')).toBeNull();
+      expect(screen.queryByTestId('column-change-batch')).toBeNull();
+      expect((screen.getByTestId('column-change-large-table') as HTMLInputElement).checked).toBe(false);
+
+      fireEvent.click(screen.getByTestId('column-change-large-table'));
+      expect(screen.getByTestId('column-change-part-copy')).toBeTruthy();
+      expect(screen.getByTestId('column-change-batch')).toBeTruthy();
+    });
+
+    it('offers large-table mode only for a type change', () => {
+      render(<ColumnChangePanel lockedConnectionId="pg" />);
+      pick('column-change-table', 'orders');
+      pick('column-change-column', 'status');
+      pick('column-change-new-name', 'state');
+      expect(screen.queryByTestId('column-change-large-table')).toBeNull();
+    });
+
+    it('shows no line-by-line references for a type change, only the one-line warnings', () => {
+      typeIn('varchar(40)');
+      expect(screen.queryByTestId('column-change-references')).toBeNull();
+      expect(screen.getByTestId('column-change-warnings').textContent).toContain(
+        'Functions that may use the column: orders_status_label'
+      );
+    });
+
+    it('warns on a large table, from the catalog estimate, and not in large-table mode', async () => {
+      fetchTableInsight.mockResolvedValue({ estimatedRows: 4_000_000, sizeBytes: 2 * 1024 ** 3 });
+      typeIn('varchar(40)');
+      await waitFor(() =>
+        expect(screen.getByTestId('column-change-warnings').textContent).toMatch(
+          /orders is large \(about 4\.0 million rows, 2\.0 GB\)/
+        )
+      );
+      expect(fetchTableInsight.mock.calls[0]).toEqual([{ connectionId: 'pg', password: undefined }, { table: 'orders', schema: 'shop' }]);
+      fireEvent.click(screen.getByTestId('column-change-large-table'));
+      expect(screen.getByTestId('column-change-warnings').textContent).not.toMatch(/is large/);
+    });
+
+    it('says nothing about size when the estimate cannot be read', async () => {
+      fetchTableInsight.mockRejectedValue(new Error('no stats'));
+      typeIn('varchar(40)');
+      await waitFor(() => expect(fetchTableInsight).toHaveBeenCalled());
+      expect(screen.getByTestId('column-change-warnings').textContent).not.toMatch(/is large/);
+    });
+
+    it('runs the ALTER against this connection and says the column changed', async () => {
+      useSqlEditorStore.setState({ safeMode: false } as never);
+      executeSql.mockResolvedValue({ results: [{ ok: true, columns: [], rows: [], rowCount: 0, truncated: false, durationMs: 1 }] });
+      typeIn('varchar(40)');
+      fireEvent.click(screen.getByTestId('column-change-run-all'));
+      await waitFor(() => expect(screen.getByTestId('column-change-run-status').textContent).toBe('Column changed.'));
+      expect(executeSql).toHaveBeenCalledTimes(1);
+      expect((executeSql.mock.calls[0]![1] as string[])[0]).toContain('ALTER COLUMN "status" TYPE varchar(40)');
+    });
+  });
+
+  it('changes the type in place on an engine without large-table mode, and does not offer it', () => {
+    render(<ColumnChangePanel lockedConnectionId="ora" />);
+    pick('column-change-table', 'orders');
+    pick('column-change-column', 'status');
+    pick('column-change-new-type', 'VARCHAR2(40)');
+    expect(screen.getByTestId('column-change-step-1').textContent).toContain(
+      'ALTER TABLE "SHOP"."orders" MODIFY ("status" VARCHAR2(40));'
+    );
+    expect(screen.queryByTestId('column-change-large-table')).toBeNull();
+    expect(screen.queryByTestId('column-change-batch')).toBeNull();
+  });
 });
diff --git a/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.tsx b/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.tsx
index 623351cdc..e1eed2687 100644
--- a/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.tsx
+++ b/apps/web/src/frontend/features/utilities/components/ColumnChangePanel.tsx
@@ -3,11 +3,12 @@
  * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
  * SPDX-License-Identifier: Apache-2.0
  *
- * Utilities → Rename Column: rename a column or change its type the safe way.
- * A type change is three parts — add a nullable column, copy rows in a loop
- * (with progress), then constraints / triggers / description — each with
- * preview SQL to copy, run, or execute all. Lossy type conversions warn
- * and must be acknowledged before Run or Execute all.
+ * Utilities → Rename Column: rename a column or change its type.
+ * A type change is one in-place ALTER by default. Large-table mode turns it
+ * into three parts — add a nullable column, copy rows in a loop (with
+ * progress), then constraints / triggers / description — so a big table stays
+ * writable. Each part has preview SQL to copy, run, or execute all. Lossy type
+ * conversions warn and must be acknowledged before Run or Execute all.
  */
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import { Check, Copy, Loader2, Play, SquareTerminal } from 'lucide-react';
@@ -15,10 +16,13 @@ import { useSyncStore } from '@/features/compare';
 import { useSqlEditorStore } from '@/features/sql-editor/state';
 import { useUiStore } from '@/platform/uiStore';
 import { executeSql, type SqlStatementResult } from '@/shared/api/sqlApi';
+import { fetchTableInsight } from '@/shared/api/schemaApi';
 import {
   COLUMN_CHANGE_PHASES,
   DEFAULT_COLUMN_CHANGE_BATCH,
+  columnChangeLargeTable,
   planColumnChange,
+  type ColumnChangeMode,
   type ColumnChangePhase,
   type ColumnChangePlan,
   type ColumnChangeProgressSql,
@@ -39,13 +43,17 @@ type RunTarget = ColumnChangePhase | 'all';
 
 const PHASE_ORDER: ColumnChangePhase[] = ['add', 'copy', 'finish'];
 
-function statusFor(phase: ColumnChangePhase): string {
+function statusFor(phase: ColumnChangePhase, mode: ColumnChangeMode): string {
+  if (mode === 'rename') return 'Rename finished.';
+  if (mode === 'direct') return 'Column changed.';
   if (phase === 'add') return 'New column is in place.';
   if (phase === 'copy') return 'Copy finished. Check the mismatch count is 0 before the last part.';
   return 'Constraints, triggers and description are applied.';
 }
 
-function progressFor(phase: ColumnChangePhase): string {
+function progressFor(phase: ColumnChangePhase, mode: ColumnChangeMode): string {
+  if (mode === 'rename') return 'Renaming…';
+  if (mode === 'direct') return 'Changing the column…';
   if (phase === 'add') return 'Adding the new column…';
   if (phase === 'copy') return 'Copying data…';
   return 'Applying constraints, triggers and description…';
@@ -133,6 +141,9 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
   const [newName, setNewName] = useState('');
   const [newType, setNewType] = useState('');
   const [batchSize, setBatchSize] = useState(DEFAULT_COLUMN_CHANGE_BATCH);
+  const [largeTable, setLargeTable] = useState(false);
+  /** The catalog's row estimate and size for the picked table, for the size warning. */
+  const [tableSize, setTableSize] = useState<{ rows: number | null; bytes: number | null } | null>(null);
   const [passwordDraft, setPasswordDraft] = useState('');
   const [loading, setLoading] = useState(false);
   const [loadError, setLoadError] = useState<string | null>(null);
@@ -184,10 +195,31 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
     // Reload when the credential changes, or once its password is given.
   }, [lockedConnectionId, needsPassword, load]);
 
+  // The table's size, for the warning that points at large-table mode. A
+  // catalog estimate, so no COUNT(*) on a big table; unknown when it fails.
+  const password = sessionPasswords[lockedConnectionId];
+  useEffect(() => {
+    setTableSize(null);
+    if (!lockedConnectionId || !tableName || needsPassword) return;
+    let cancelled = false;
+    fetchTableInsight(
+      { connectionId: lockedConnectionId, password: password || undefined },
+      { table: tableName, schema: conn?.schema?.trim() || undefined }
+    )
+      .then((res) => {
+        if (!cancelled) setTableSize({ rows: res.estimatedRows, bytes: res.sizeBytes });
+      })
+      .catch(() => undefined);
+    return () => {
+      cancelled = true;
+    };
+  }, [lockedConnectionId, tableName, needsPassword, password, conn?.schema]);
+
   // A new table or column starts a new change.
   useEffect(() => {
     setNewName('');
     setNewType('');
+    setLargeTable(false);
     setRunError(null);
     setRunStatus(null);
     setConfirmTarget(null);
@@ -209,18 +241,27 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
       tables: all,
       column: column.name,
       change: { newName: newName.trim() || undefined, newType: newType.trim() || undefined },
+      largeTable: largeTable && columnChangeLargeTable(conn.dialect),
       batchSize,
+      estimatedRows: tableSize?.rows,
+      sizeBytes: tableSize?.bytes,
     });
-  }, [conn, table, column, newName, newType, batchSize, all]);
+  }, [conn, table, column, newName, newType, largeTable, batchSize, tableSize, all]);
 
   const script = plan?.ok ? columnChangeScript(plan.steps) : '';
-  const typeChange = Boolean(plan?.ok && plan.progress);
+  const mode: ColumnChangeMode | undefined = plan?.ok ? plan.mode : undefined;
+  // Offered as soon as a type is typed in that is not the column's own.
+  const typeRequested = Boolean(column && newType.trim() && newType.trim().toLowerCase() !== column.type.toLowerCase());
+  const largeTableOffered = typeRequested && Boolean(conn && columnChangeLargeTable(conn.dialect));
   const conversionWarning = plan?.ok ? plan.impact.lossy : undefined;
   const runDisabled =
     Boolean(runningTarget) || needsPassword || Boolean(conversionWarning && !ackLossy);
-  const parts = typeChange
-    ? COLUMN_CHANGE_PHASES
-    : [{ id: 'add' as const, title: 'Rename', blurb: 'Instant catalog rename. Indexes follow; application SQL that names the column does not.' }];
+  const parts =
+    mode === 'copy'
+      ? COLUMN_CHANGE_PHASES
+      : mode === 'direct'
+        ? [{ id: 'add' as const, title: 'Change in place', blurb: 'One ALTER on the column. Fine for small and medium tables.' }]
+        : [{ id: 'add' as const, title: 'Rename', blurb: 'Instant catalog rename. Indexes follow; application SQL that names the column does not.' }];
 
   const runStatements = useCallback(
     async (sql: string): Promise<SqlStatementResult[]> => {
@@ -273,7 +314,7 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
       setConfirmTarget(null);
       try {
         await executePhase(phase, live, true);
-        setRunStatus(statusFor(phase));
+        setRunStatus(statusFor(phase, live.mode));
       } catch (e: unknown) {
         setRunError(e instanceof Error ? e.message : String(e));
       } finally {
@@ -285,7 +326,7 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
 
   const runAll = useCallback(
     async (live: Extract<ColumnChangePlan, { ok: true }>) => {
-      const phases = live.progress ? PHASE_ORDER : (['add'] as ColumnChangePhase[]);
+      const phases = live.mode === 'copy' ? PHASE_ORDER : (['add'] as ColumnChangePhase[]);
       setRunningTarget('all');
       setRunError(null);
       setRunStatus(null);
@@ -293,10 +334,10 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
       try {
         for (let i = 0; i < phases.length; i++) {
           const phase = phases[i]!;
-          setRunStatus(progressFor(phase));
+          setRunStatus(progressFor(phase, live.mode));
           await executePhase(phase, live, i === phases.length - 1);
         }
-        setRunStatus(live.progress ? 'All parts finished.' : 'Rename finished.');
+        setRunStatus(live.mode === 'copy' ? 'All parts finished.' : statusFor('add', live.mode));
       } catch (e: unknown) {
         setRunError(e instanceof Error ? e.message : String(e));
       } finally {
@@ -423,18 +464,40 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
             ))}
           </datalist>
         </label>
-        <label className="block">
-          <span className={sectionLabelCls}>Rows per batch</span>
+        {largeTableOffered && largeTable && (
+          <label className="block">
+            <span className={sectionLabelCls}>Rows per batch</span>
+            <input
+              data-testid="column-change-batch"
+              type="number"
+              min={1}
+              value={batchSize}
+              onChange={(e) => setBatchSize(Math.max(1, Number(e.target.value) || DEFAULT_COLUMN_CHANGE_BATCH))}
+              className={inputCls}
+            />
+          </label>
+        )}
+      </div>
+
+      {largeTableOffered && (
+        <label className="flex items-start gap-2 text-[12px] text-slate-300">
           <input
-            data-testid="column-change-batch"
-            type="number"
-            min={1}
-            value={batchSize}
-            onChange={(e) => setBatchSize(Math.max(1, Number(e.target.value) || DEFAULT_COLUMN_CHANGE_BATCH))}
-            className={inputCls}
+            type="checkbox"
+            data-testid="column-change-large-table"
+            checked={largeTable}
+            onChange={(e) => setLargeTable(e.target.checked)}
+            className="mt-0.5 h-3.5 w-3.5"
           />
+          <span>
+            <span className="font-bold text-slate-200">Large table mode</span>
+            <span className="text-slate-500">
+              {' '}
+              — add a new column, copy the data in batches, then switch over, so the table stays writable. Off: one
+              ALTER in place, simpler and fine for small and medium tables.
+            </span>
+          </span>
         </label>
-      </div>
+      )}
 
       {loadError && (
         <p className="text-[12px] text-rose-300" data-testid="column-change-load-error">
@@ -541,7 +604,7 @@ export const ColumnChangePanel: React.FC<Props> = ({ lockedConnectionId = '' })
           <section className="space-y-3" data-testid="column-change-steps">
             <div className="flex flex-wrap items-center gap-2">
               <h2 className={`${sectionLabelCls} flex-1`}>
-                {typeChange ? 'Three parts' : 'Rename'} ({plan.steps.length} steps)
+                {mode === 'copy' ? 'Three parts' : mode === 'direct' ? 'Change in place' : 'Rename'} ({plan.steps.length} {plan.steps.length === 1 ? 'step' : 'steps'})
               </h2>
               <CopyButton text={script} testId="column-change-copy-all" label="Copy all" />
               {confirmTarget === 'all' ? (
diff --git a/apps/web/src/frontend/shared/lib/column-change.ts b/apps/web/src/frontend/shared/lib/column-change.ts
index 49bc720c0..8fea87f07 100644
--- a/apps/web/src/frontend/shared/lib/column-change.ts
+++ b/apps/web/src/frontend/shared/lib/column-change.ts
@@ -1,7 +1,8 @@
-export { DEFAULT_COLUMN_CHANGE_BATCH, COLUMN_CHANGE_PHASES, planColumnChange } from '@foxschema/ui-shared';
+export { DEFAULT_COLUMN_CHANGE_BATCH, COLUMN_CHANGE_PHASES, planColumnChange, columnChangeLargeTable } from '@foxschema/ui-shared';
 export type {
   ColumnChange,
   ColumnChangeImpact,
+  ColumnChangeMode,
   ColumnChangePlan,
   ColumnChangeStep,
   ColumnChangePhase,
diff --git a/docs/FEATURE_MAP.md b/docs/FEATURE_MAP.md
index dd2e59f44..07983587d 100644
--- a/docs/FEATURE_MAP.md
+++ b/docs/FEATURE_MAP.md
@@ -38,7 +38,7 @@ flowchart LR
   end
   subgraph server["Fox server — packages/server (Fastify)"]
     PLAT["platform<br/>identity · RBAC · workspaces<br/>connections · guards"]
-    FEAT["18 feature modules<br/>159 routes"]
+    FEAT["18 feature modules<br/>163 routes"]
   end
   WFS["Workflow server :8081<br/>apps/workflow-server<br/>+ packages/workflow-engine"]
   META[("Metadata store<br/>SQLite · 28 tables")]
@@ -179,7 +179,7 @@ in its folders and its e2e specs (`apps/e2e/src/tests`).
 |---|---|---|---|---|---|---|---|
 | `utilities.indexes` | Index management — fragmentation (custom probe is one read-only SELECT), batch, rebuild / reorg / optimize SQL (Db2: every index on the table), drop | Utils (rail) | `/api/schema/index-fragmentation`, `-batch` | server `access` (`index-fragmentation.service`); sql `utilities` | `utility.access`, `utility.index.drop` | — | sql 7; e2e `sql-editor-utilities`, `-utilities-dialects` |
 | `utilities.clone` | Clone table | Utils | (editor execute) | web `CloneTableModal` | `utility.access`, `editor.ddl` | — | (utilities e2e) |
-| `utilities.columns` | Rename column — rename or change a type the safe way: what it touches (indexes, constraints, triggers, functions, procedures, views), then three parts (add nullable column, copy loop with progress, constraints / triggers / description) as preview SQL to copy, run, or execute all; lossy conversions (narrowing, text→number, text→boolean) warn and must be acknowledged | Utils | `/api/sql/execute` (optional Run / Execute all) | sql `utilities/column-change` + `providers/*/*.column-change.ts`; web `ColumnChangePanel` | `utility.access`, `editor.dml` | — | sql 87 (+ live PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB); web 9 |
+| `utilities.columns` | Rename column — rename, or change a type: what it touches (indexes, constraints, triggers, functions, procedures, views), then one in-place ALTER by default (with a size warning from 1M rows or 1 GB), or in large-table mode three parts (add nullable column, copy loop with progress, constraints / triggers / description), as preview SQL to copy, run, or execute all; lossy conversions (narrowing, text→number, text→boolean) warn and must be acknowledged | Utils | `/api/sql/execute` (optional Run / Execute all) | sql `utilities/column-change` + `providers/*/*.column-change.ts`; web `ColumnChangePanel` | `utility.access`, `editor.dml` | — | sql 147 (+ live PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB, Oracle, Db2, SQLite, DuckDB, ClickHouse); web 25 |
 | `utilities.insights` | Server insights, table insight, query files | Utils | `/api/schema/dba-utility`, `/api/schema/table-insight` | server `access` (`dba-utilities.service`) | `utility.access` | — | (utilities e2e) |
 | `utilities.trace` | SQL Tracer — Live (engine sessions, ~1 s) and Fox activity (statements run from Fox on a saved connection); redacted, 15 min / 10,000 statements | Utils | `/api/sql-trace/start`, `/:id/events`, `/:id/stop` | server `sql-trace` (+ `platform/sql-activity`); sql `utilities/sql-trace` | `utility.trace` | — | server 27; web 7; e2e `utilities-sql-tracer` |
 | `utilities.backup` | Backup & Restore — per-engine command builders, server-side SQL backup after confirmation, recorded backups, saved defaults | Utils | `/api/backup-settings` (2) | server `backup`; sql `providers/*/*.backup.ts` | `utility.access` | `backup_settings` | server 2; e2e `backup-restore-ui`, `backup-commands-dialects` |
@@ -579,7 +579,7 @@ Known gaps and open work (2026-11-02, after #575 – #589) — each belongs on t
 | `platform.workspaces` | Workspace ceiling caps by rank; a custom role mapping is not intersected with the account's permissions | improvement |
 | `platform.connections` | A requirepass-only Redis saved without its password is not prompted (the **No password** login method is shipped) | improvement |
 | `platform.system` | Home → Services is status only; start/stop the Workflow engine (`admin.services`) is later | feature |
-| `utilities.columns` | SQLite (table rebuild), Oracle, Db2, Redshift, ClickHouse not in v1; primary-key / inbound-FK / identity columns refused; running the steps from the app is v2 | feature |
+| `utilities.columns` | SQLite type change needs a table rebuild; DuckDB tables with an index are refused (no index columns in the model); Redshift only lengthens a VARCHAR; primary-key / inbound-FK / identity columns refused; large-table mode only on the 8 engines that have it | feature |
 
 ## Planning work
 
diff --git a/docs/feature-map.html b/docs/feature-map.html
index 04dfd8c62..03e2f52f4 100644
--- a/docs/feature-map.html
+++ b/docs/feature-map.html
@@ -238,17 +238,17 @@
   <div class="wrap">
     <div class="titlerow">
       <h1>Fox <span>Feature Map</span></h1>
-      <div class="stamp">Measured on <code>main</code> · <code>b12bcd5607</code> · 2026-10-31 · mirrors <code>docs/FEATURE_MAP.md</code></div>
+      <div class="stamp">Measured on <code>main</code> · <code>f39dca3ee1</code> · 2026-11-08, with Rename Column from <code>feat/column-change-direct-alter</code> · mirrors <code>docs/FEATURE_MAP.md</code></div>
     </div>
     <ul class="stats" aria-label="Inventory">
       <li><b>35</b> features</li>
-      <li><b>158</b> HTTP routes</li>
+      <li><b>163</b> HTTP routes</li>
       <li><b>18</b> server modules</li>
       <li><b>14</b> web features</li>
       <li><b>16</b> engines</li>
       <li><b>28</b> metadata tables</li>
-      <li><b>57</b> e2e specs</li>
-      <li><b>~550</b> unit-test files</li>
+      <li><b>58</b> e2e specs</li>
+      <li><b>~560</b> unit-test files</li>
     </ul>
     <nav class="tabs" role="tablist" aria-label="Views">
       <button role="tab" id="tab-plan" data-tab="plan" aria-selected="true">Plan</button>
@@ -307,7 +307,7 @@ <h2>System</h2>
   end
   subgraph server["Fox server — packages/server (Fastify)"]
     PLAT["platform&lt;br/&gt;identity · RBAC · workspaces&lt;br/&gt;connections · guards"]
-    FEAT["18 feature modules&lt;br/&gt;159 routes"]
+    FEAT["18 feature modules&lt;br/&gt;163 routes"]
   end
   WFS["Workflow server :8081&lt;br/&gt;apps/workflow-server&lt;br/&gt;+ packages/workflow-engine"]
   META[("Metadata store&lt;br/&gt;SQLite · 28 tables")]
@@ -653,7 +653,7 @@ <h2>Coverage</h2>
       </div>
       <div class="section">
         <h3>End-to-end suites</h3>
-        <p class="lede">57 Playwright specs in 35 groups, run with <code>npm run test:e2e:all</code>. Dialect suites need their Docker container and a fresh seed.</p>
+        <p class="lede">58 Playwright specs in 35 groups, run with <code>npm run test:e2e:all</code>. Dialect suites need their Docker container and a fresh seed.</p>
         <div class="areas" id="e2e-groups"></div>
       </div>
     </section>
@@ -666,7 +666,7 @@ <h3>End-to-end suites</h3>
 
 <script>
 // Reference data: the inventory of what Fox Schema ships, measured from the
-// codebase on main 66575674 (2026-11-02). Mirrors docs/FEATURE_MAP.md.
+// codebase on main f39dca3ee1 (2026-11-08). Mirrors docs/FEATURE_MAP.md.
 // Work items are not here: they live in the page's shared store.
 const AREAS = [
   { id: 'platform', name: 'Platform' },
@@ -782,9 +782,9 @@ <h3>End-to-end suites</h3>
     ui: 'Utils', api: 'through /api/sql/execute', code: 'web CloneTableModal', perms: 'utility.access, editor.ddl',
     tables: '—', tests: 'utilities e2e' },
   { id: 'utilities.columns', area: 'utilities', name: 'Rename column',
-    subs: ['Rename in place', 'Add nullable column', 'Copy loop with progress', 'Constraints, triggers, functions, procedures', 'What it touches', 'Lossy conversions', 'Copy SQL, Run, or Execute all'],
+    subs: ['Rename in place', 'Change type in place', 'Large table mode', 'Table size warning', 'All 14 SQL engines', 'Add nullable column', 'Copy loop with progress', 'Constraints, triggers, functions, procedures', 'What it touches', 'Lossy conversions', 'Copy SQL, Run, or Execute all'],
     ui: 'Utils', api: 'through /api/sql/execute', code: 'sql utilities/column-change, providers/*/*.column-change · web ColumnChangePanel', perms: 'utility.access, editor.dml',
-    tables: '—', tests: 'sql 87 · web 9 · live: PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB' },
+    tables: '—', tests: 'sql 147 · web 25 · live: PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB, Oracle, Db2, SQLite, DuckDB, ClickHouse' },
   { id: 'utilities.insights', area: 'utilities', name: 'Server insights',
     subs: ['Server insights', 'Table insight', 'Query files'],
     ui: 'Utils', api: '/api/schema/dba-utility, /api/schema/table-insight',
@@ -867,7 +867,7 @@ <h3>End-to-end suites</h3>
   ],
 };
 
-// Routes per feature, from the 159 pinned in http-contract.test.ts.
+// Routes per feature: 163 pinned in http-contract.test.ts; this split was last counted at 159 (2026-11-02).
 const ROUTES = [
   ['platform.auth', 22], ['platform.workspaces', 21], ['platform.admin', 20], ['schema.git', 15],
   ['schema.snapshots', 11], ['editor.files', 11], ['platform.secrets', 9], ['platform.connections', 8],
@@ -877,8 +877,8 @@ <h3>End-to-end suites</h3>
 
 // Unit-test files per package.
 const TESTS = [
-  ['apps/web', 180], ['packages/server', 107], ['packages/workflow-engine', 87], ['packages/sql', 87],
-  ['apps/cli', 25], ['packages/db', 26], ['apps/workflow-server', 19], ['packages/shared', 13],
+  ['apps/web', 189], ['packages/server', 111], ['packages/workflow-engine', 87], ['packages/sql', 89],
+  ['apps/cli', 25], ['packages/db', 28], ['apps/workflow-server', 19], ['packages/shared', 14],
   ['packages/workflow-contract', 1], ['packages/ui-shared', 1],
 ];
 
@@ -1548,7 +1548,7 @@ <h3>End-to-end suites</h3>
     );
   }
   function renderCoverage() {
-    barChart('chart-routes', 'HTTP routes by feature', '153 routes pinned by http-contract.test.ts', ROUTES, 'Feature');
+    barChart('chart-routes', 'HTTP routes by feature', '163 routes pinned by http-contract.test.ts; the split per feature was counted at 159', ROUTES, 'Feature');
     barChart('chart-tests', 'Unit-test files by package', 'Files named *.test.ts(x), excluding e2e', TESTS, 'Package');
     const g = $('#e2e-groups');
     for (const name of E2E_GROUPS) g.append(h('span', { class: 'tag' }, name));
diff --git a/docs/feature-map/app.js b/docs/feature-map/app.js
index 30c80a84e..4370df736 100644
--- a/docs/feature-map/app.js
+++ b/docs/feature-map/app.js
@@ -605,7 +605,7 @@
     );
   }
   function renderCoverage() {
-    barChart('chart-routes', 'HTTP routes by feature', '153 routes pinned by http-contract.test.ts', ROUTES, 'Feature');
+    barChart('chart-routes', 'HTTP routes by feature', '163 routes pinned by http-contract.test.ts; the split per feature was counted at 159', ROUTES, 'Feature');
     barChart('chart-tests', 'Unit-test files by package', 'Files named *.test.ts(x), excluding e2e', TESTS, 'Package');
     const g = $('#e2e-groups');
     for (const name of E2E_GROUPS) g.append(h('span', { class: 'tag' }, name));
diff --git a/docs/feature-map/data.js b/docs/feature-map/data.js
index 710af5623..1646456fe 100644
--- a/docs/feature-map/data.js
+++ b/docs/feature-map/data.js
@@ -1,5 +1,5 @@
 // Reference data: the inventory of what Fox Schema ships, measured from the
-// codebase on main 66575674 (2026-11-02). Mirrors docs/FEATURE_MAP.md.
+// codebase on main f39dca3ee1 (2026-11-08). Mirrors docs/FEATURE_MAP.md.
 // Work items are not here: they live in the page's shared store.
 const AREAS = [
   { id: 'platform', name: 'Platform' },
@@ -115,9 +115,9 @@ const FEATURES = [
     ui: 'Utils', api: 'through /api/sql/execute', code: 'web CloneTableModal', perms: 'utility.access, editor.ddl',
     tables: '—', tests: 'utilities e2e' },
   { id: 'utilities.columns', area: 'utilities', name: 'Rename column',
-    subs: ['Rename in place', 'Add nullable column', 'Copy loop with progress', 'Constraints, triggers, functions, procedures', 'What it touches', 'Lossy conversions', 'Copy SQL, Run, or Execute all'],
+    subs: ['Rename in place', 'Change type in place', 'Large table mode', 'Table size warning', 'All 14 SQL engines', 'Add nullable column', 'Copy loop with progress', 'Constraints, triggers, functions, procedures', 'What it touches', 'Lossy conversions', 'Copy SQL, Run, or Execute all'],
     ui: 'Utils', api: 'through /api/sql/execute', code: 'sql utilities/column-change, providers/*/*.column-change · web ColumnChangePanel', perms: 'utility.access, editor.dml',
-    tables: '—', tests: 'sql 87 · web 9 · live: PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB' },
+    tables: '—', tests: 'sql 147 · web 25 · live: PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, TiDB, YugabyteDB, Oracle, Db2, SQLite, DuckDB, ClickHouse' },
   { id: 'utilities.insights', area: 'utilities', name: 'Server insights',
     subs: ['Server insights', 'Table insight', 'Query files'],
     ui: 'Utils', api: '/api/schema/dba-utility, /api/schema/table-insight',
@@ -200,7 +200,7 @@ const ENGINES = {
   ],
 };
 
-// Routes per feature, from the 159 pinned in http-contract.test.ts.
+// Routes per feature: 163 pinned in http-contract.test.ts; this split was last counted at 159 (2026-11-02).
 const ROUTES = [
   ['platform.auth', 22], ['platform.workspaces', 21], ['platform.admin', 20], ['schema.git', 15],
   ['schema.snapshots', 11], ['editor.files', 11], ['platform.secrets', 9], ['platform.connections', 8],
@@ -210,8 +210,8 @@ const ROUTES = [
 
 // Unit-test files per package.
 const TESTS = [
-  ['apps/web', 180], ['packages/server', 107], ['packages/workflow-engine', 87], ['packages/sql', 87],
-  ['apps/cli', 25], ['packages/db', 26], ['apps/workflow-server', 19], ['packages/shared', 13],
+  ['apps/web', 189], ['packages/server', 111], ['packages/workflow-engine', 87], ['packages/sql', 89],
+  ['apps/cli', 25], ['packages/db', 28], ['apps/workflow-server', 19], ['packages/shared', 14],
   ['packages/workflow-contract', 1], ['packages/ui-shared', 1],
 ];
 
diff --git a/docs/feature-map/template.html b/docs/feature-map/template.html
index 07772029c..aee2928df 100644
--- a/docs/feature-map/template.html
+++ b/docs/feature-map/template.html
@@ -227,17 +227,17 @@
   <div class="wrap">
     <div class="titlerow">
       <h1>Fox <span>Feature Map</span></h1>
-      <div class="stamp">Measured on <code>main</code> · <code>b12bcd5607</code> · 2026-10-31 · mirrors <code>docs/FEATURE_MAP.md</code></div>
+      <div class="stamp">Measured on <code>main</code> · <code>f39dca3ee1</code> · 2026-11-08, with Rename Column from <code>feat/column-change-direct-alter</code> · mirrors <code>docs/FEATURE_MAP.md</code></div>
     </div>
     <ul class="stats" aria-label="Inventory">
       <li><b>35</b> features</li>
-      <li><b>158</b> HTTP routes</li>
+      <li><b>163</b> HTTP routes</li>
       <li><b>18</b> server modules</li>
       <li><b>14</b> web features</li>
       <li><b>16</b> engines</li>
       <li><b>28</b> metadata tables</li>
-      <li><b>57</b> e2e specs</li>
-      <li><b>~550</b> unit-test files</li>
+      <li><b>58</b> e2e specs</li>
+      <li><b>~560</b> unit-test files</li>
     </ul>
     <nav class="tabs" role="tablist" aria-label="Views">
       <button role="tab" id="tab-plan" data-tab="plan" aria-selected="true">Plan</button>
@@ -355,7 +355,7 @@ <h2>Coverage</h2>
       </div>
       <div class="section">
         <h3>End-to-end suites</h3>
-        <p class="lede">57 Playwright specs in 35 groups, run with <code>npm run test:e2e:all</code>. Dialect suites need their Docker container and a fresh seed.</p>
+        <p class="lede">58 Playwright specs in 35 groups, run with <code>npm run test:e2e:all</code>. Dialect suites need their Docker container and a fresh seed.</p>
         <div class="areas" id="e2e-groups"></div>
       </div>
     </section>
diff --git a/docs/plans/2026-11-01-safe-column-change.md b/docs/plans/2026-11-01-safe-column-change.md
index 3cb6c958f..3117c75a5 100644
--- a/docs/plans/2026-11-01-safe-column-change.md
+++ b/docs/plans/2026-11-01-safe-column-change.md
@@ -143,3 +143,115 @@ Live runs (seeded `demo_a.orders`, 11 rows, batches of 3), every step through
 | SQL Server | `status` nvarchar(20) → nvarchar(40), renamed `state` (NOT NULL, DEFAULT constraint, index) | All 7 steps, as above |
 
 The Utilities → Change Column screen shipped in #589.
+
+## Direct by default, copy as large-table mode (2026-11-08)
+
+The add-copy-switch plan is right for a big, busy table and too much for most.
+A type change is now **one in-place ALTER by default**; the copy plan above is
+**large-table mode**, a checkbox shown once a new type is typed in. Its batch
+size field only appears with it. A rename alone is unchanged.
+
+- **Direct steps per engine** (`alterTypeSteps` on each `ColumnChangeDialect`):
+  - PostgreSQL / YugabyteDB: `ALTER COLUMN … TYPE … USING col::type`. NOT NULL,
+    the default, the comment and indexes stay with the column. PostgreSQL
+    refuses while a view uses the column (`viewsBlockTypeChange`), so the plain
+    "views may use" warning becomes "drop it first and recreate after".
+  - CockroachDB: the same, after `SET enable_experimental_alter_column_type_general = true`.
+  - MySQL / MariaDB / TiDB: `MODIFY COLUMN`, which drops whatever it does not
+    restate, so it restates NOT NULL, the default and a character collation,
+    and keeps the comment by reading it from `information_schema` in a
+    prepared statement (the same trick the copy path uses for the new column).
+  - SQL Server / Azure SQL: `ALTER COLUMN` refuses while an index, a foreign
+    key or a default sits on the column, so the step is one batch in one
+    transaction: drop them, alter, put them back. The indexes are **scripted
+    from the catalog as it runs**: Fox's index model has no filter, included
+    columns or sort order, and recreating from it turned a filtered unique
+    index into an unfiltered one in the live run. The catalog script also finds
+    an index that only INCLUDEs the column, which the model misses and which
+    blocks the ALTER too. Fill factor, compression and partitioning are not
+    carried over.
+- **Kept:** the data-loss check (the lossy warning and its acknowledgement)
+  and the foreign-key-types check. **New:** a size warning from the catalog's
+  row estimate and size (`fetchTableInsight`): from 1 million rows or 1 GB,
+  the plan warns that the ALTER can rewrite the table and block writes, and
+  points at large-table mode. Unknown size, no warning.
+- **Only large-table mode** needs a primary key and free `__new` / `__old`
+  names. An identity column is still refused in both modes.
+- **A type change alone lists no line-by-line references.** Views, triggers,
+  functions and procedures that may use the column keep their one-line
+  warnings; the detailed lines (`impact.dependents`) are for a rename, where
+  stored SQL must say the new name.
+
+Live runs (2026-11-08), every step through Fox's own reader and splitter:
+
+| Engine | Change | Result |
+|---|---|---|
+| PostgreSQL 16 | `status` varchar(20) → varchar(40), `qty` int → bigint, `pid` int → bigint (foreign key) | One ALTER each; NOT NULL, default and comment kept. A view on the column made the ALTER fail, as the warning says |
+| MySQL 8 | `status` varchar(20) utf8mb4_bin → varchar(40), `qty` int → bigint | NOT NULL, default, collation and both comments kept |
+| SQL Server 2022 | `status` (default, DESC index with INCLUDE), `qty` (filtered unique index, included elsewhere), `note`, `extra` (only INCLUDEd) | All four changed; every index back with its sort order, includes and filter. `note` varchar → int with a value `'hi'` failed and rolled back whole, indexes intact |
+
+**Large-table mode on SQL Server, fixed the same day.** It too recreated
+indexes from the model (losing filters), and its switch-over could never pass a
+filtered index: **SQL Server will not `sp_rename` a column a filter names**
+("one or more objects access this column"), whether the column is indexed or
+only in the `WHERE`. Now the constraints step copies only unfiltered indexes,
+scripted from the catalog, as `<name>__new` on the new column. The switch-over
+batch moves the filtered ones: it drops them, renames both columns, and
+rebuilds them on the new column with the filter rewritten, all in one
+transaction. The drop step is one batch too: it drops the old column's
+indexes from the catalog, drops the column, and gives the `__new` ones their
+names back. An index counts when the column is a key, an INCLUDE or in its
+filter (`CHARINDEX(QUOTENAME(col), filter_definition)`), in both modes. Live,
+SQL Server 2022, with a DESC index with INCLUDE, a filtered unique index, a
+filter-only index (`ON (id) WHERE qty > 0`) and an INCLUDE-only column: all
+four changes ran in both modes, and every index came back under its own name,
+filter and options intact. A plain rename alone still hits the `sp_rename`
+rule; that belongs with the rename rewrite work.
+
+## Every SQL engine (2026-11-08)
+
+Rename Column now covers all 14 SQL dialects. The six added do the change in
+place only; large-table mode stays with the eight that have it, and the screen
+hides it elsewhere (`columnChangeLargeTable`). A dialect can refuse a change it
+cannot make, with its reason, before any SQL is shown (`refuse` on
+`ColumnChangeDialect`).
+
+| Engine | Rename | Type change |
+|---|---|---|
+| Oracle | `RENAME COLUMN` | `MODIFY (col type)`, no NULL clause (restating NOT NULL is ORA-01442). Lengths and precision only on a table with data (ORA-01439 across kinds, ORA-01441 below the longest value) |
+| Db2 | `RENAME COLUMN` | `SET DATA TYPE`, then `CALL SYSPROC.ADMIN_CMD('REORG TABLE …')`. Without it the next write fails with SQL0668N reason 7 (checked live) |
+| SQLite | `RENAME COLUMN`; SQLite rewrites the index, view and trigger that name it (checked live) | Refused: it needs a table rebuild, not covered yet |
+| DuckDB | `RENAME COLUMN` | `ALTER COLUMN … TYPE … USING CAST(…)`. Both refused while the table has **any** index: DuckDB will not alter it ("entries that depend on it"), and Fox's DuckDB index model has no columns to rebuild one from. A primary key does not count |
+| Redshift | `RENAME COLUMN` | Only lengthening a VARCHAR (`ALTER COLUMN … TYPE varchar(n)`); anything else refused with the reason |
+| ClickHouse | `RENAME COLUMN` | `MODIFY COLUMN`; a nullable column stays `Nullable(…)`, inside `LowCardinality(…)` when that is asked for. A sorting-key column is refused for both, with ClickHouse's reason ahead of the general primary-key one |
+
+Also from the live runs: the PostgreSQL family now writes `USING col::type`
+only when the kind of type changes (text to number). An explicit `USING` made
+CockroachDB rewrite an indexed column it would otherwise only relabel, and it
+refuses to rewrite one that is part of an index. The type-kind reading moved
+to `column-type-shape.ts`, and it now reads ClickHouse's `Int16`–`Int256`,
+`Float32/64` and its `Nullable(…)` / `LowCardinality(…)` wrappers for the
+data-loss check.
+
+Live runs, direct mode, through Fox's own reader, planner, splitter and drivers:
+
+| Engine | Result |
+|---|---|
+| SQLite (file) | Rename ran; the index, view and trigger were rewritten to the new name and kept working; a type change was refused |
+| DuckDB (file) | Two type changes and a rename ran, NOT NULL and defaults kept. With an index on the table, all three refused with the reason |
+| ClickHouse 24.8 | `Int32` → `Int64`, `LowCardinality(Nullable(String))`, a rename: defaults and comments kept. The sorting-key column refused |
+| Oracle 23 Free | Two `MODIFY`s and a rename, NOT NULL, default and comment kept; the index valid, the view marked invalid until next use |
+| Db2 | Three `SET DATA TYPE` + `REORG` and a rename; writes and the view work after. A `SET DATA TYPE` without the REORG left the table reorg-pending |
+| CockroachDB | Lengthened an indexed varchar in place (after the `USING` fix) and a rename |
+| MariaDB 11, TiDB 8.5 | `MODIFY` kept the collation, NOT NULL, default and comments; a rename |
+
+**Not run live:** Redshift (the local container is plain PostgreSQL, which
+proves nothing about Redshift) and YugabyteDB (its container never answered a
+query: the stale-masters problem in RUNNING_E2E.md, fixed by recreating its
+volume).
+
+Oracle, again after the volume was recreated (the old one carried timezone
+file v45, which the current image does not ship, so every `DROP` failed with
+ORA-01804): the same run passed and cleaned up after itself, and on a scratch
+table shortening below the longest value failed with ORA-01441 and a NUMBER to
+VARCHAR2 change with data with ORA-01439, as the step's note says.
diff --git a/docs/testing/TEST_IDS.md b/docs/testing/TEST_IDS.md
index 7da2ca245..c7e0adf11 100644
--- a/docs/testing/TEST_IDS.md
+++ b/docs/testing/TEST_IDS.md
@@ -8,7 +8,7 @@ or `TestIds` for the same tree with autocomplete. `{name}` marks a part filled i
 time; "in FilterPicker" marks an ID a shared component draws from the prop written here.
 How to write a test with them: [WRITING_E2E.md](WRITING_E2E.md).
 
-Every control has a test ID: **1034** buttons, text boxes, selects and textareas.
+Every control has a test ID: **1035** buttons, text boxes, selects and textareas.
 
 ## access
 
@@ -1602,6 +1602,7 @@ Every control has a test ID: **1034** buttons, text boxes, selects and textareas
   - `column-change-copy-all` · button in CopyButton
   - `column-change-hint` · p
   - `column-change-impact` · section · What it touches
+  - `column-change-large-table` · input
   - `column-change-load-error` · p
   - `column-change-new-name` · input
   - `column-change-new-type` · input
@@ -1618,7 +1619,7 @@ Every control has a test ID: **1034** buttons, text boxes, selects and textareas
   - `column-change-run-status` · p
   - `column-change-step-{value}` · article
   - `column-change-step-{value}-copy` · button in CopyButton
-  - `column-change-steps` · section · ( steps)
+  - `column-change-steps` · section · ( )
   - `column-change-table` · select
   - `column-change-unlock` · button · Unlock
   - `column-change-warnings` · ul
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 3aaded2b7..87f0abdcf 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -652,20 +652,29 @@ saved credential at the top, then a tool:
   statement and is not one transaction — if it stops after rename, recover by
   renaming the archive back. Inbound FKs from other tables still point at the
   archive until you update them.
-- **Rename Column** — rename a column, change its type, or both, the safe way.
+- **Rename Column** — rename a column, change its type, or both.
   Pick a table and column, then a new name and/or type (types you already use
   on this connection are suggested). Fox shows **what it touches** from the
   schema it already loaded (indexes, unique constraints, outbound foreign keys,
   triggers, functions, procedures, and views whose definition *may* mention the
   column — a text match). A **rename alone**
-  is one instant `RENAME COLUMN` (or `sp_rename`). A **type change** is three
-  parts, each with preview SQL you can **Copy** or **Run** here (Safe mode
+  is one instant `RENAME COLUMN` (or `sp_rename`), and lists the lines of each
+  view, trigger, function and procedure that name the column, with the new name.
+  A **type change** is **one ALTER in place** by default — `ALTER COLUMN … TYPE`,
+  MySQL's `MODIFY COLUMN` restating NOT NULL, default, collation and comment, or
+  on SQL Server one transaction that takes the column's indexes, keys and default
+  off and puts them back. Fine for small and medium tables. From about a million
+  rows or 1 GB (the catalog's estimate) Fox warns that it can block writes while
+  it rewrites the table. Tick **Large table mode** to do it in three
+  parts instead, each with preview SQL you can **Copy** or **Run** here (Safe mode
   confirms): **add** a nullable column with no default, **copy** rows in a
   loop of batches with progress (`copied / total`) — Copy SQL is the loop,
   Run still patches one batch at a time — then **constraints, triggers and
   description** (indexes, keys, catalog comment, table triggers rewritten to
   the new name, switch-over, drop the old column). **Execute all** runs the
-  three parts in order against this connection (Safe mode confirms once).
+  steps in order against this connection (Safe mode confirms once). PostgreSQL
+  refuses an in-place type change while a view uses the column: drop the view
+  first and recreate it after.
   **Copy all** and **Open in editor** still send the whole script to a new tab
   against this connection only.
 
@@ -677,12 +686,26 @@ saved credential at the top, then a tool:
   **warning**: acknowledge it before Run or Execute all. The copy still stops
   on the first value that does not convert.
 
-  **Engines:** PostgreSQL, YugabyteDB, CockroachDB, MySQL, MariaDB, TiDB, SQL
-  Server, Azure SQL. The rest — including SQLite (needs a table rebuild),
-  Redshift, Oracle, Db2 — say “not yet” rather than SQL that would fail there.
-  Also refused for now: a primary-key column, a column other tables’ foreign
-  keys point at, an identity column, and a type change on a table with no
-  primary key (the copy batches through it).
+  **Engines:** every SQL engine Fox supports. Large-table mode is offered on
+  PostgreSQL, YugabyteDB, CockroachDB, MySQL, MariaDB, TiDB, SQL Server and
+  Azure SQL; the others change the column in place, within what each engine can do:
+  - **Oracle** — `MODIFY`; it changes a length or precision on a table with
+    data, but another kind of type needs the column empty.
+  - **Db2** — `SET DATA TYPE`, then a `REORG` of the table, which Db2 needs
+    before it takes writes again.
+  - **SQLite** — rename only (SQLite also updates the indexes, views and
+    triggers that name the column). A type change needs a table rebuild, not
+    covered yet.
+  - **DuckDB** — rename and type change, but not while the table has an index:
+    DuckDB will not alter it. Fox names the indexes to drop first.
+  - **Redshift** — rename, and making a VARCHAR longer; no other type change.
+  - **ClickHouse** — rename and `MODIFY COLUMN` (a nullable column stays
+    `Nullable`); not a column in the table's sorting key.
+
+  Fox refuses a change an engine cannot make, with the reason, rather than
+  showing SQL that would fail there. Also refused for now: a primary-key
+  column, a column other tables’ foreign keys point at, an identity column, and
+  in large-table mode a table with no primary key (the copy batches through it).
 - **Backup & Restore** — Fox Schema writes the backup and restore commands
   for this connection. The amber banner says *where* they run, because that is
   what the folder means:
diff --git a/packages/sql/src/index.ts b/packages/sql/src/index.ts
index b1086df0a..765fc1056 100644
--- a/packages/sql/src/index.ts
+++ b/packages/sql/src/index.ts
@@ -171,11 +171,12 @@ export {
   DEFAULT_COLUMN_CHANGE_BATCH,
   COLUMN_CHANGE_PHASES,
 } from './modules/utilities/column-change.js';
-export { resolveColumnChange } from './modules/utilities/column-change.registry.js';
+export { resolveColumnChange, columnChangeLargeTable } from './modules/utilities/column-change.registry.js';
 export type {
   ColumnChange,
   ColumnChangeInput,
   ColumnChangeImpact,
+  ColumnChangeMode,
   ColumnChangePlan,
   ColumnChangeStep,
   ColumnChangePhase,
diff --git a/packages/sql/src/modules/utilities/column-change.registry.ts b/packages/sql/src/modules/utilities/column-change.registry.ts
index 794853312..df05c5bc4 100644
--- a/packages/sql/src/modules/utilities/column-change.registry.ts
+++ b/packages/sql/src/modules/utilities/column-change.registry.ts
@@ -15,6 +15,12 @@ import { mariaDbColumnChange } from '../../providers/mariaDb/mariadb.column-chan
 import { tiDbColumnChange } from '../../providers/tiDb/tidb.column-change.js';
 import { sqlServerColumnChange } from '../../providers/sqlServer/sqlserver.column-change.js';
 import { azureSqlColumnChange } from '../../providers/azureSql/azuresql.column-change.js';
+import { oracleColumnChange } from '../../providers/oracle/oracle.column-change.js';
+import { db2ColumnChange } from '../../providers/db2/db2.column-change.js';
+import { sqliteColumnChange } from '../../providers/sqlLite/sqlite.column-change.js';
+import { duckDbColumnChange } from '../../providers/duckDb/duckdb.column-change.js';
+import { redshiftColumnChange } from '../../providers/redshift/redshift.column-change.js';
+import { clickHouseColumnChange } from '../../providers/clickHouse/clickhouse.column-change.js';
 
 export const COLUMN_CHANGE_MAP: Record<string, ColumnChangeDialect> = {
   postgres: postgresColumnChange,
@@ -25,8 +31,21 @@ export const COLUMN_CHANGE_MAP: Record<string, ColumnChangeDialect> = {
   tidb: tiDbColumnChange,
   sqlserver: sqlServerColumnChange,
   azuresql: azureSqlColumnChange,
+  // In place only: no large-table mode on these.
+  oracle: oracleColumnChange,
+  db2: db2ColumnChange,
+  sqlite: sqliteColumnChange,
+  duckdb: duckDbColumnChange,
+  redshift: redshiftColumnChange,
+  clickhouse: clickHouseColumnChange,
 };
 
 export function resolveColumnChange(dialect: string): ColumnChangeDialect | undefined {
   return COLUMN_CHANGE_MAP[(dialect || '').toLowerCase()];
 }
+
+/** Whether this engine offers large-table mode (new column, batched copy, switch-over). */
+export function columnChangeLargeTable(dialect: string): boolean {
+  const d = resolveColumnChange(dialect);
+  return Boolean(d?.rebuildSteps && d.progressSql);
+}
diff --git a/packages/sql/src/modules/utilities/column-change.test.ts b/packages/sql/src/modules/utilities/column-change.test.ts
index 9c4bd7d3f..a03482474 100644
--- a/packages/sql/src/modules/utilities/column-change.test.ts
+++ b/packages/sql/src/modules/utilities/column-change.test.ts
@@ -6,8 +6,8 @@
 import { describe, expect, it } from 'vitest';
 import type { ColumnInfo, TableSchema } from '../../interfaces/schema.interface.js';
 import { splitSqlStatements } from '../sql-text/sql-splitter.js';
-import { columnReferenceLines, lossyConversion, planColumnChange } from './column-change.js';
-import { COLUMN_CHANGE_MAP } from './column-change.registry.js';
+import { columnReferenceLines, largeTableNote, lossyConversion, planColumnChange } from './column-change.js';
+import { COLUMN_CHANGE_MAP, columnChangeLargeTable } from './column-change.registry.js';
 import type { ColumnChangeInput, ColumnChangePlan } from './column-change.types.js';
 
 const col = (name: string, type: string, extra: Partial<ColumnInfo> = {}): ColumnInfo => ({
@@ -71,6 +71,8 @@ const ALL = [customers, products, orders, orderItems, openOrders, statusFn, stat
 
 const plan = (over: Partial<ColumnChangeInput> & Pick<ColumnChangeInput, 'column' | 'change'>): ColumnChangePlan =>
   planColumnChange({ dialect: 'postgres', schema: 'shop', table: orders, tables: ALL, batchSize: 500, ...over });
+/** The same, in large-table mode: new column, batched copy, switch-over. */
+const large = (over: Parameters<typeof plan>[0]): ColumnChangePlan => plan({ largeTable: true, ...over });
 
 const ok = (p: ColumnChangePlan) => {
   if (!p.ok) throw new Error(p.error);
@@ -80,7 +82,7 @@ const sqlOf = (p: ColumnChangePlan, title: RegExp) => ok(p).steps.find((s) => ti
 
 describe('planColumnChange: what it refuses', () => {
   it.each([
-    ['an engine without the plan yet', { dialect: 'oracle', column: 'status', change: { newType: 'text' } }, /not available for Oracle yet/],
+    ['an engine without the plan yet', { dialect: 'mongodb', column: 'status', change: { newType: 'text' } }, /not available for MongoDB yet/],
     ['a column the table does not have', { column: 'nope', change: { newName: 'x' } }, /has no column nope/],
     ['no change', { column: 'status', change: { newName: 'status', newType: 'VARCHAR(20)' } }, /Nothing to change/],
     ['a name already taken', { column: 'status', change: { newName: 'total' } }, /already has a column total/],
@@ -96,9 +98,11 @@ describe('planColumnChange: what it refuses', () => {
     expect(!p.ok && p.error).toMatch(/foreign keys point at this column \(order_items\)/);
   });
 
-  it('refuses a type change on a table without a primary key, but allows a rename there', () => {
-    const typed = planColumnChange({ dialect: 'postgres', table: orderItems, tables: ALL, column: 'sku', change: { newType: 'text' } });
-    expect(!typed.ok && typed.error).toMatch(/needs a primary key/);
+  it('needs a primary key only to copy in batches: a direct change and a rename go ahead without one', () => {
+    const copied = planColumnChange({ dialect: 'postgres', table: orderItems, tables: ALL, column: 'sku', change: { newType: 'text' }, largeTable: true });
+    expect(!copied.ok && copied.error).toMatch(/needs a primary key/);
+    const direct = planColumnChange({ dialect: 'postgres', table: orderItems, tables: ALL, column: 'sku', change: { newType: 'text' } });
+    expect(direct.ok).toBe(true);
     const renamed = planColumnChange({ dialect: 'postgres', table: orderItems, tables: ALL, column: 'sku', change: { newName: 'item_sku' } });
     expect(renamed.ok).toBe(true);
   });
@@ -144,7 +148,7 @@ describe('planColumnChange: a rename alone', () => {
 });
 
 describe('planColumnChange: a type change on PostgreSQL', () => {
-  const p = plan({ column: 'status', change: { newName: 'state', newType: 'varchar(40)' } });
+  const p = large({ column: 'status', change: { newName: 'state', newType: 'varchar(40)' } });
 
   it('lays out add, sync, copy, check, constraints, switch-over, drop and triggers, in that order', () => {
     expect(ok(p).steps.map((s) => s.title)).toEqual([
@@ -223,7 +227,7 @@ describe('planColumnChange: a type change on PostgreSQL', () => {
   });
 
   it('recreates an outbound foreign key on the new column', () => {
-    const fk = plan({ column: 'customer_id', change: { newType: 'bigint' } });
+    const fk = large({ column: 'customer_id', change: { newType: 'bigint' } });
     expect(sqlOf(fk, /constraints/)).toContain(
       'ALTER TABLE "shop"."orders" ADD CONSTRAINT "orders_customer_fk__new" FOREIGN KEY ("customer_id__new") REFERENCES "customers" ("id");'
     );
@@ -231,14 +235,14 @@ describe('planColumnChange: a type change on PostgreSQL', () => {
   });
 
   it('keeps the default when only the name changes through a rebuild, and NOT NULL either way', () => {
-    const same = plan({ column: 'status', change: { newType: 'text' } });
+    const same = large({ column: 'status', change: { newType: 'text' } });
     expect(sqlOf(same, /constraints/)).not.toContain('SET DEFAULT');
   });
 });
 
 describe('planColumnChange: engines without triggers', () => {
   it.each(['cockroachdb', 'tidb'])('%s has no sync step, and says to run the copy again before the switch', (dialect) => {
-    const p = ok(plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } }));
+    const p = ok(large({ dialect, column: 'status', change: { newType: 'varchar(40)' } }));
     expect(p.steps.some((s) => /Keep the new column in step/.test(s.title))).toBe(false);
     expect(p.warnings.join('\n')).toMatch(/no triggers/);
     expect(p.steps.find((s) => /^Copy/.test(s.title))?.note).toMatch(/run it once more just before the switch-over/);
@@ -248,7 +252,7 @@ describe('planColumnChange: engines without triggers', () => {
   });
 
   it('TiDB switches with two RENAME statements: one ALTER cannot rename both columns', () => {
-    const sql = sqlOf(plan({ dialect: 'tidb', column: 'status', change: { newType: 'varchar(40)' } }), /^Switch/);
+    const sql = sqlOf(large({ dialect: 'tidb', column: 'status', change: { newType: 'varchar(40)' } }), /^Switch/);
     expect(sql).toBe(
       [
         'ALTER TABLE `shop`.`orders` RENAME COLUMN `status` TO `status__old`;',
@@ -260,7 +264,7 @@ describe('planColumnChange: engines without triggers', () => {
 });
 
 describe('planColumnChange: MySQL', () => {
-  const p = plan({ dialect: 'mysql', column: 'status', change: { newType: 'varchar(40)' } });
+  const p = large({ dialect: 'mysql', column: 'status', change: { newType: 'varchar(40)' } });
 
   it('copies with a procedure loop around UPDATE … LIMIT, and renames both columns in one ALTER', () => {
     const sql = sqlOf(p, /^Copy/);
@@ -289,13 +293,13 @@ describe('planColumnChange: MySQL', () => {
       ...orders,
       columns: orders.columns.map((c) => (c.name === 'customer_id' ? { ...c, type: 'smallint' } : c)),
     };
-    const fk = plan({ dialect: 'mysql', table: narrow, tables: [customers, narrow], column: 'customer_id', change: { newType: 'integer' } });
+    const fk = large({ dialect: 'mysql', table: narrow, tables: [customers, narrow], column: 'customer_id', change: { newType: 'integer' } });
     expect(sqlOf(fk, /^Drop the old/).split('\n')[0]).toBe('ALTER TABLE `shop`.`orders` DROP FOREIGN KEY `orders_customer_fk`;');
   });
 });
 
 describe('planColumnChange: SQL Server', () => {
-  const p = plan({ dialect: 'sqlserver', column: 'status', change: { newType: 'nvarchar(40)' } });
+  const p = large({ dialect: 'sqlserver', column: 'status', change: { newType: 'nvarchar(40)' } });
 
   it('copies with a WHILE loop around UPDATE TOP, and renames through sp_rename in one batch and one transaction', () => {
     expect(ok(p).progress?.patchSql).toBe(
@@ -305,21 +309,17 @@ describe('planColumnChange: SQL Server', () => {
     expect(copy).toContain('WHILE @fox_n > 0');
     expect(copy).toContain('SET @fox_n = @@ROWCOUNT');
     expect(splitSqlStatements(copy)).toHaveLength(1);
-    expect(sqlOf(p, /^Switch/)).toBe(
-      [
-        'SET XACT_ABORT ON',
-        'BEGIN TRANSACTION',
-        '  DROP TRIGGER IF EXISTS [shop].[fox_sync_orders_status]',
-        "  EXEC sp_rename N'shop.orders.status', N'status__old', N'COLUMN'",
-        "  EXEC sp_rename N'shop.orders.status__new', N'status', N'COLUMN'",
-        'COMMIT TRANSACTION;',
-      ].join('\n')
-    );
+    const lines = sqlOf(p, /^Switch/).split('\n');
+    expect(lines.slice(0, 3)).toEqual(['SET XACT_ABORT ON', 'BEGIN TRANSACTION', '  DROP TRIGGER IF EXISTS [shop].[fox_sync_orders_status]']);
+    expect(lines).toContain("  EXEC sp_rename N'shop.orders.status', N'status__old', N'COLUMN'");
+    expect(lines).toContain("  EXEC sp_rename N'shop.orders.status__new', N'status', N'COLUMN'");
+    expect(lines.at(-1)).toBe('COMMIT TRANSACTION;');
+    expect(splitSqlStatements(sqlOf(p, /^Switch/))).toHaveLength(1);
   });
 
   it('drops the default constraint by looking up its name before dropping the column', () => {
     const sql = sqlOf(p, /^Drop the old/);
-    expect(sql).toMatch(/sys\.default_constraints[\s\S]*SET @sql = N'ALTER TABLE \[shop\]\.\[orders\] DROP CONSTRAINT ' \+ QUOTENAME\(@df\) EXEC sp_executesql @sql END;/);
+    expect(sql).toMatch(/sys\.default_constraints[\s\S]*SET @sql = N'ALTER TABLE \[shop\]\.\[orders\] DROP CONSTRAINT ' \+ QUOTENAME\(@df\) EXEC sp_executesql @sql END\n/);
     expect(sql).not.toMatch(/EXEC\(/);
     expect(sql.indexOf('sys.default_constraints')).toBeLessThan(sql.indexOf('DROP COLUMN [status__old]'));
   });
@@ -358,13 +358,31 @@ describe('planColumnChange: the steps split into the statements meant', () => {
     ['sqlserver', /^Switch/, 1],
     ['mysql', /Keep the new column/, 2],
   ])('%s %s is %i statement(s)', (dialect, title, count) => {
-    const p = plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } });
+    const p = large({ dialect, column: 'status', change: { newType: 'varchar(40)' } });
     expect(splitSqlStatements(sqlOf(p, title))).toHaveLength(count);
   });
 
-  it('SQL Server drop step is one statement per line, the default lookup included', () => {
-    const sql = sqlOf(plan({ dialect: 'sqlserver', column: 'status', change: { newType: 'varchar(40)' } }), /^Drop the old/);
-    expect(splitSqlStatements(sql)).toHaveLength(sql.split('\n').length);
+  it('SQL Server drop step is one batch in one transaction, so its index list lives through it', () => {
+    const sql = sqlOf(large({ dialect: 'sqlserver', column: 'status', change: { newType: 'varchar(40)' } }), /^Drop the old/);
+    expect(splitSqlStatements(sql)).toHaveLength(1);
+    expect(sql.startsWith('SET XACT_ABORT ON\nBEGIN TRANSACTION\n')).toBe(true);
+    expect(sql.endsWith('COMMIT TRANSACTION;')).toBe(true);
+  });
+
+  it('SQL Server large-table mode scripts its indexes from the catalog, on the new column and back', () => {
+    // Recreating from Fox's model lost a filtered index's filter (found live).
+    const p = large({ dialect: 'sqlserver', column: 'status', change: { newType: 'varchar(40)' } });
+    const constraints = sqlOf(p, /^Give the new column/);
+    expect(constraints).toContain("REPLACE(QUOTENAME(c.name), QUOTENAME(N'status'), QUOTENAME(N'status__new'))");
+    expect(constraints).toContain("REPLACE(i.filter_definition, QUOTENAME(N'status'), QUOTENAME(N'status__new'))");
+    expect(constraints).toContain("QUOTENAME(i.name + N'__new')");
+    expect(constraints).toMatch(/WHILE[^\n]*create_sql/);
+    expect(constraints).not.toContain('CREATE INDEX [orders_status_created__new]');
+    const drop = sqlOf(p, /^Drop the old/);
+    expect(drop).toContain("c.name = N'status__old')");
+    const at = (needle: string | RegExp) => (typeof needle === 'string' ? drop.indexOf(needle) : drop.search(needle));
+    expect(at(/WHILE[^\n]*drop_sql/)).toBeLessThan(at('DROP COLUMN [status__old]'));
+    expect(at('DROP COLUMN [status__old]')).toBeLessThan(at(/WHILE[^\n]*rename_sql/));
   });
 });
 
@@ -419,15 +437,16 @@ describe('planColumnChange: unique constraints and filtered indexes', () => {
 describe('planColumnChange: every registered dialect', () => {
   const dialects = Object.keys(COLUMN_CHANGE_MAP);
 
-  it.each(dialects)('%s generates a rename script', (dialect) => {
+  // DuckDB refuses a table with an index, as `orders` has; it has tests of its own.
+  it.each(dialects.filter((d) => d !== 'duckdb'))('%s generates a rename script', (dialect) => {
     const p = ok(plan({ dialect, column: 'status', change: { newName: 'state' } }));
     expect(p.steps).toHaveLength(1);
     expect(p.steps[0]!.sql.trim().length).toBeGreaterThan(10);
     expect(splitSqlStatements(p.steps[0]!.sql).length).toBeGreaterThan(0);
   });
 
-  it.each(dialects)('%s generates a type-change script with add, copy and finish SQL', (dialect) => {
-    const p = ok(plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } }));
+  it.each(dialects.filter(columnChangeLargeTable))('%s generates a type-change script with add, copy and finish SQL', (dialect) => {
+    const p = ok(large({ dialect, column: 'status', change: { newType: 'varchar(40)' } }));
     expect(p.steps.filter((s) => s.phase === 'add').length).toBeGreaterThan(0);
     expect(p.steps.filter((s) => s.phase === 'copy').length).toBeGreaterThan(0);
     expect(p.steps.filter((s) => s.phase === 'finish').length).toBeGreaterThan(0);
@@ -438,14 +457,19 @@ describe('planColumnChange: every registered dialect', () => {
     expect(p.progress?.patchSql).toMatch(/UPDATE/i);
   });
 
-  it.each(['oracle', 'sqlite', 'redshift', 'db2', 'clickhouse', 'duckdb'] as const)(
-    '%s is refused as not yet',
-    (dialect) => {
-      const p = plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } });
-      expect(p.ok).toBe(false);
-      expect(!p.ok && p.error).toMatch(/not available/i);
-    }
-  );
+  it.each(['mongodb', 'redis'] as const)('%s is refused as not yet', (dialect) => {
+    const p = plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } });
+    expect(p.ok).toBe(false);
+    expect(!p.ok && p.error).toMatch(/not available/i);
+  });
+
+  it('offers large-table mode on the engines that have it, and refuses it elsewhere', () => {
+    expect(dialects.filter(columnChangeLargeTable).sort()).toEqual(
+      ['azuresql', 'cockroachdb', 'mariadb', 'mysql', 'postgres', 'sqlserver', 'tidb', 'yugabytedb']
+    );
+    const p = plan({ dialect: 'oracle', column: 'status', change: { newType: 'varchar2(40)' }, largeTable: true });
+    expect(!p.ok && p.error).toMatch(/Large-table mode is not available for Oracle/);
+  });
 });
 
 describe('columnReferenceLines', () => {
@@ -580,9 +604,352 @@ describe('impact.dependents', () => {
     expect(impact.dependents).toEqual([]);
   });
 
-  it('still lists dependents for a type change, with no renamed line', () => {
-    const { impact } = ok(plan({ column: 'status', change: { newType: 'varchar(40)' } }));
-    expect(impact.dependents.length).toBeGreaterThan(0);
-    for (const d of impact.dependents) for (const r of d.references) expect(r.renamed).toBeUndefined();
+  it('lists no lines for a type change alone: the one-line warnings name the objects', () => {
+    for (const largeTable of [false, true]) {
+      const p = ok(plan({ column: 'status', change: { newType: 'varchar(40)' }, largeTable }));
+      expect(p.impact.dependents).toEqual([]);
+      expect(p.impact.functions).toEqual(['orders_status_label']);
+      expect(p.impact.procedures).toEqual(['bump_order_status']);
+      expect(p.warnings.join('\n')).toMatch(/Functions that may use the column: orders_status_label/);
+      expect(p.warnings.join('\n')).toMatch(/Procedures that may use the column: bump_order_status/);
+    }
+  });
+
+  it('lists the lines when a type change renames too', () => {
+    const { impact } = ok(plan({ column: 'status', change: { newName: 'state', newType: 'varchar(40)' } }));
+    expect(impact.dependents.map((d) => d.name)).toContain('orders_status_label');
+    expect(impact.dependents.every((d) => d.references.every((r) => r.renamed !== undefined))).toBe(true);
+  });
+});
+
+describe('planColumnChange: a direct type change (the default)', () => {
+  it('is one in-place step by default, with no copy and no progress', () => {
+    const p = ok(plan({ column: 'status', change: { newType: 'varchar(40)' } }));
+    expect(p.mode).toBe('direct');
+    expect(p.progress).toBeUndefined();
+    expect(p.steps.map((s) => s.phase)).toEqual(['add']);
+    expect(p.steps[0]!.sql).toBe(
+      'ALTER TABLE "shop"."orders" ALTER COLUMN "status" TYPE varchar(40);'
+    );
+    expect(p.steps[0]!.note).toMatch(/default \('new'\) is converted too/);
+  });
+
+  it('spells out USING only when the kind of type changes', () => {
+    // An explicit USING made CockroachDB rewrite an indexed column it would
+    // otherwise only relabel, and refuse (found live).
+    expect(ok(plan({ column: 'total', change: { newType: 'numeric(14,2)' } })).steps[0]!.sql).toBe(
+      'ALTER TABLE "shop"."orders" ALTER COLUMN "total" TYPE numeric(14,2);'
+    );
+    expect(ok(plan({ column: 'customer_id', change: { newType: 'bigint' } })).steps[0]!.sql).toBe(
+      'ALTER TABLE "shop"."orders" ALTER COLUMN "customer_id" TYPE bigint;'
+    );
+    expect(ok(plan({ column: 'status', change: { newType: 'integer' } })).steps[0]!.sql).toBe(
+      'ALTER TABLE "shop"."orders" ALTER COLUMN "status" TYPE integer USING "status"::integer;'
+    );
+    expect(ok(plan({ dialect: 'cockroachdb', column: 'status', change: { newType: 'varchar(40)' } })).steps[0]!.sql).not.toContain('USING');
+  });
+
+  it('names the mode of each kind of change', () => {
+    expect(ok(plan({ column: 'status', change: { newName: 'state' } })).mode).toBe('rename');
+    expect(ok(plan({ column: 'status', change: { newType: 'text' }, largeTable: true })).mode).toBe('copy');
+  });
+
+  it('changes the type, then renames, when both change', () => {
+    const p = ok(plan({ column: 'status', change: { newName: 'state', newType: 'varchar(40)' } }));
+    expect(p.steps.map((s) => s.title)).toEqual(['Change status to varchar(40)', 'Rename status to state']);
+  });
+
+  it('turns on CockroachDB’s general type change first', () => {
+    const sql = ok(plan({ dialect: 'cockroachdb', column: 'status', change: { newType: 'text' } })).steps[0]!.sql;
+    expect(sql.split('\n')[0]).toBe('SET enable_experimental_alter_column_type_general = true;');
+    expect(splitSqlStatements(sql)).toHaveLength(2);
+  });
+
+  it('says PostgreSQL refuses while a view uses the column, in place of the plain view warning', () => {
+    const pg = ok(plan({ column: 'status', change: { newType: 'varchar(40)' } })).warnings.join('\n');
+    expect(pg).toMatch(/PostgreSQL refuses to change the type of a column a view uses\. If v_open_orders uses it, drop it first/);
+    expect(pg).not.toMatch(/Views that may use the column/);
+    // MySQL resolves a view when it is read, so the plain warning stays.
+    const my = ok(plan({ dialect: 'mysql', column: 'status', change: { newType: 'varchar(40)' } })).warnings.join('\n');
+    expect(my).toMatch(/Views that may use the column: v_open_orders/);
+    // Large-table mode keeps its own warnings.
+    expect(ok(large({ column: 'status', change: { newType: 'varchar(40)' } })).warnings.join('\n')).toMatch(/Views that may use/);
+  });
+
+  it('refuses an identity column, and needs no primary key', () => {
+    const ident = table('t', { columns: [col('n', 'integer', { identity: true })] });
+    const p = planColumnChange({ dialect: 'postgres', table: ident, tables: [ident], column: 'n', change: { newType: 'bigint' } });
+    expect(!p.ok && p.error).toMatch(/identity column is not covered yet/);
+  });
+
+  it('still refuses a foreign key whose other side would not match', () => {
+    const p = plan({ dialect: 'mysql', column: 'customer_id', change: { newType: 'bigint' } });
+    expect(!p.ok && p.error).toMatch(/both sides of a foreign key/);
+  });
+});
+
+describe('planColumnChange: the size warning', () => {
+  const sized = (estimatedRows?: number | null, sizeBytes?: number | null, largeTable = false) =>
+    ok(plan({ column: 'status', change: { newType: 'varchar(40)' }, estimatedRows, sizeBytes, largeTable })).warnings.join('\n');
+
+  it('warns on a table of a million rows or a gigabyte, and points at large-table mode', () => {
+    expect(sized(2_500_000, 300 * 1024 ** 2)).toMatch(/orders is large \(about 2\.5 million rows, 0\.3 GB\)\..*large-table mode/);
+    expect(sized(null, 3 * 1024 ** 3)).toMatch(/orders is large \(3\.0 GB\)/);
+  });
+
+  it('says nothing on a small table, an unknown size, or in large-table mode', () => {
+    expect(sized(999_999, 10 * 1024 ** 2)).not.toMatch(/is large/);
+    expect(sized(undefined, undefined)).not.toMatch(/is large/);
+    expect(sized(5_000_000, null, true)).not.toMatch(/is large/);
+  });
+
+  it('largeTableNote reads billions and terabytes', () => {
+    expect(largeTableNote('t', 3_200_000_000, 2 * 1024 ** 4)).toMatch(/about 3\.2 billion rows, 2\.0 TB/);
+    expect(largeTableNote('t', 10, 10)).toBeUndefined();
+  });
+});
+
+describe('planColumnChange: a direct type change on MySQL', () => {
+  const sqlFor = (over: Partial<ColumnChangeInput> = {}) =>
+    ok(plan({ dialect: 'mysql', column: 'status', change: { newType: 'varchar(40)' }, ...over })).steps[0]!.sql;
+
+  it('restates NOT NULL and the default, and keeps the comment read from the catalog', () => {
+    const sql = sqlFor();
+    expect(sql).toContain(
+      "SET @fox_col_sql = CONCAT('ALTER TABLE `shop`.`orders` MODIFY COLUMN `status` varchar(40) NOT NULL DEFAULT ''new'' COMMENT ', QUOTE(IFNULL(@fox_col_comment, '')));"
+    );
+    expect(sql).toContain("COLUMN_NAME = 'status'");
+    expect(splitSqlStatements(sql)).toHaveLength(5);
+  });
+
+  it('restates a collation only on a character type', () => {
+    const collated = table('orders', {
+      columns: [col('id', 'int', { primaryKey: true }), col('code', 'varchar(10)', { collation: 'utf8mb4_bin' })],
+      primaryKey: { columns: ['id'] },
+    });
+    const sqlOf2 = (newType: string) =>
+      ok(planColumnChange({ dialect: 'mysql', table: collated, tables: [collated], column: 'code', change: { newType } })).steps[0]!.sql;
+    expect(sqlOf2('varchar(20)')).toContain('varchar(20) NULL COLLATE utf8mb4_bin COMMENT');
+    expect(sqlOf2('int')).toContain('MODIFY COLUMN `code` int NULL COMMENT');
+  });
+
+  it('still keeps the comment on the new column in large-table mode', () => {
+    const sql = ok(large({ dialect: 'mysql', column: 'status', change: { newType: 'varchar(40)' } })).steps.map((s) => s.sql).join('\n');
+    expect(sql).toContain("CONCAT('ALTER TABLE `shop`.`orders` MODIFY COLUMN `status__new` varchar(40) NULL COMMENT ', QUOTE(");
+  });
+});
+
+describe('planColumnChange: a direct type change on SQL Server', () => {
+  const stepSql = (over: Partial<ColumnChangeInput> & Pick<ColumnChangeInput, 'column' | 'change'>) =>
+    ok(plan({ dialect: 'sqlserver', ...over })).steps[0]!.sql;
+  const lines = (sql: string) => sql.split('\n').map((l) => l.trim());
+
+  it('is one batch in one transaction, so a failure undoes the drops too', () => {
+    const sql = stepSql({ column: 'total', change: { newType: 'decimal(14,2)' } });
+    expect(lines(sql)[0]).toBe('SET XACT_ABORT ON');
+    expect(lines(sql)[1]).toBe('BEGIN TRANSACTION');
+    expect(lines(sql).at(-1)).toBe('COMMIT TRANSACTION;');
+    expect(lines(sql)).toContain('ALTER TABLE [shop].[orders] ALTER COLUMN [total] decimal(14,2) NULL');
+    // One statement, so drivers send it as one batch and the transaction holds.
+    expect(splitSqlStatements(sql)).toHaveLength(1);
+  });
+
+  it('scripts the indexes from the catalog as it runs, filters, includes and sort order with them', () => {
+    // Fox's index model has no filter or included columns: recreating from it
+    // turned a filtered unique index into an unfiltered one (found live).
+    const sql = stepSql({ column: 'total', change: { newType: 'decimal(14,2)' } });
+    expect(sql).toContain('DECLARE @fox_ix TABLE');
+    expect(sql).toContain("ISNULL(N' WHERE ' + i.filter_definition, N'')");
+    expect(sql).toContain("ISNULL(N' INCLUDE (' + inc.cols + N')', N'')");
+    expect(sql).toContain("CASE WHEN ic.is_descending_key = 1 THEN N' DESC'");
+    // Any index naming the column, key or included: an INCLUDE-only one blocks the ALTER too.
+    expect(sql).toMatch(/AND \(EXISTS \(SELECT 1 FROM sys\.index_columns AS ic[\s\S]*c\.name = N'total'\)/);
+  });
+
+  it('drops the indexes, then the default, changes the column, and puts them back in reverse', () => {
+    const all = lines(stepSql({ column: 'status', change: { newType: 'nvarchar(40)' } }));
+    const at = (re: RegExp) => all.findIndex((l) => re.test(l));
+    const dropIx = at(/^SET @fox_n = 1 WHILE .* drop_sql/);
+    const dropDefault = at(/^DECLARE @df sysname.*c\.name = N'status'/);
+    const alter = at(/^ALTER TABLE \[shop\]\.\[orders\] ALTER COLUMN \[status\] nvarchar\(40\) NOT NULL$/);
+    const addDefault = at(/^ALTER TABLE \[shop\]\.\[orders\] ADD DEFAULT 'new' FOR \[status\]$/);
+    const createIx = at(/^SET @fox_n = 1 WHILE .* create_sql/);
+    expect([dropIx, dropDefault, alter, addDefault, createIx].every((i) => i > 0)).toBe(true);
+    expect(dropIx < dropDefault && dropDefault < alter && alter < addDefault && addDefault < createIx).toBe(true);
+  });
+
+  it('drops a foreign key first and adds it back last', () => {
+    const t = table('orders', {
+      columns: [col('id', 'int', { primaryKey: true }), col('cid', 'int')],
+      primaryKey: { columns: ['id'] },
+      foreignKeys: [{ name: 'fk_cid', columns: ['cid'], referencedTable: 'customers', referencedColumns: ['id'] }],
+    });
+    const parent = table('customers', { columns: [col('id', 'bigint', { primaryKey: true })] });
+    const all = lines(
+      ok(
+        planColumnChange({ dialect: 'sqlserver', schema: 'dbo', table: t, tables: [t, parent], column: 'cid', change: { newType: 'bigint' } })
+      ).steps[0]!.sql
+    );
+    expect(all[2]).toBe('ALTER TABLE [dbo].[orders] DROP CONSTRAINT [fk_cid]');
+    expect(all.at(-2)).toBe(
+      'ALTER TABLE [dbo].[orders] ADD CONSTRAINT [fk_cid] FOREIGN KEY ([cid]) REFERENCES [dbo].[customers] ([id])'
+    );
+  });
+
+  it('restates a collation on a character type', () => {
+    const t = table('orders', {
+      columns: [col('id', 'int', { primaryKey: true }), col('code', 'varchar(10)', { collation: 'Latin1_General_BIN2' })],
+      primaryKey: { columns: ['id'] },
+    });
+    const sql = ok(planColumnChange({ dialect: 'sqlserver', table: t, tables: [t], column: 'code', change: { newType: 'varchar(20)' } })).steps[0]!.sql;
+    expect(sql).toContain('ALTER COLUMN [code] varchar(20) COLLATE Latin1_General_BIN2 NULL');
+  });
+});
+
+describe('planColumnChange: every registered dialect, direct', () => {
+  // SQLite has no in-place type change; its refusal has a test of its own.
+  it.each(Object.keys(COLUMN_CHANGE_MAP).filter((d) => d !== 'sqlite' && d !== 'duckdb'))('%s changes a type in place, in SQL that splits', (dialect) => {
+    const p = ok(plan({ dialect, column: 'status', change: { newType: 'varchar(40)' } }));
+    expect(p.mode).toBe('direct');
+    expect(p.steps.every((s) => s.phase === 'add')).toBe(true);
+    for (const step of p.steps) expect(splitSqlStatements(step.sql).length, `${dialect} ${step.title}`).toBeGreaterThan(0);
+  });
+});
+
+describe('planColumnChange: SQL Server filtered indexes in large-table mode', () => {
+  // SQL Server will not rename a column a filter names (found live): the
+  // switch-over failed with "one or more objects access this column".
+  const p = large({ dialect: 'sqlserver', column: 'status', change: { newName: 'state', newType: 'varchar(40)' } });
+
+  it('copies only unfiltered indexes ahead of the switch-over', () => {
+    expect(sqlOf(p, /^Give the new column/)).toContain('AND i.has_filter = 0');
+  });
+
+  it('moves the filtered ones inside the switch-over: dropped before the renames, rebuilt on the new name after', () => {
+    const sql = sqlOf(p, /^Switch/);
+    expect(sql).toContain('AND i.has_filter = 1');
+    expect(sql).toContain("REPLACE(i.filter_definition, QUOTENAME(N'status'), QUOTENAME(N'state'))");
+    const dropAt = sql.search(/WHILE[^\n]*drop_sql/);
+    const renameAt = sql.indexOf("EXEC sp_rename N'shop.orders.status', N'status__old', N'COLUMN'");
+    const createAt = sql.search(/WHILE[^\n]*create_sql/);
+    expect(dropAt).toBeGreaterThan(0);
+    expect(dropAt < renameAt && renameAt < createAt).toBe(true);
+    expect(splitSqlStatements(sql)).toHaveLength(1);
+  });
+
+  it('counts an index whose filter names the column even when it does not index it', () => {
+    expect(sqlOf(p, /^Switch/)).toContain("OR (i.has_filter = 1 AND CHARINDEX(QUOTENAME(N'status'), i.filter_definition) > 0)");
+    const direct = ok(plan({ dialect: 'sqlserver', column: 'total', change: { newType: 'decimal(14,2)' } })).steps[0]!.sql;
+    expect(direct).toContain("CHARINDEX(QUOTENAME(N'total'), i.filter_definition) > 0");
+  });
+});
+
+describe('planColumnChange: engines that change in place only', () => {
+  const step = (dialect: string, change: { newName?: string; newType?: string }, column = 'status', schema = 'shop') =>
+    ok(plan({ dialect, schema, column, change })).steps;
+
+  it('Oracle renames, and MODIFYs the type without restating NOT NULL', () => {
+    expect(step('oracle', { newName: 'state' }).map((s) => s.sql)).toEqual([
+      'ALTER TABLE "SHOP"."orders" RENAME COLUMN "status" TO "state";',
+    ]);
+    const typed = step('oracle', { newType: 'VARCHAR2(40)' });
+    expect(typed.map((s) => s.sql)).toEqual(['ALTER TABLE "SHOP"."orders" MODIFY ("status" VARCHAR2(40));']);
+    expect(typed[0]!.note).toMatch(/ORA-01439/);
+  });
+
+  it('Db2 sets the data type, then reorganises the table through ADMIN_CMD', () => {
+    expect(step('db2', { newType: 'VARCHAR(40)' }).map((s) => s.sql)).toEqual([
+      'ALTER TABLE "SHOP"."orders" ALTER COLUMN "status" SET DATA TYPE VARCHAR(40);',
+      `CALL SYSPROC.ADMIN_CMD('REORG TABLE "SHOP"."orders"');`,
+    ]);
+    expect(step('db2', { newName: 'state' })[0]!.sql).toBe('ALTER TABLE "SHOP"."orders" RENAME COLUMN "status" TO "state";');
+  });
+
+  it('SQLite renames, and refuses a type change with the reason', () => {
+    expect(step('sqlite', { newName: 'state' })[0]!.sql).toBe('ALTER TABLE "orders" RENAME COLUMN "status" TO "state";');
+    const p = plan({ dialect: 'sqlite', column: 'status', change: { newType: 'TEXT' } });
+    expect(!p.ok && p.error).toMatch(/SQLite cannot change a column’s type in place/);
+    // Renaming and retyping at once is refused whole, not half done.
+    expect(plan({ dialect: 'sqlite', column: 'status', change: { newName: 'state', newType: 'TEXT' } }).ok).toBe(false);
+  });
+
+  describe('DuckDB', () => {
+    const plain = table('orders', {
+      columns: [col('id', 'INTEGER', { primaryKey: true }), col('status', 'VARCHAR'), col('note', 'VARCHAR')],
+      primaryKey: { columns: ['id'] },
+    });
+    const duck = (t: TableSchema, change: { newName?: string; newType?: string }) =>
+      planColumnChange({ dialect: 'duckdb', schema: 'main', table: t, tables: [t], column: 'status', change });
+
+    it('changes the type in place with a USING cast, and renames', () => {
+      expect(ok(duck(plain, { newType: 'VARCHAR(40)' })).steps[0]!.sql).toBe(
+        'ALTER TABLE "main"."orders" ALTER COLUMN "status" TYPE VARCHAR(40) USING CAST("status" AS VARCHAR(40));'
+      );
+      expect(ok(duck(plain, { newName: 'state' })).steps[0]!.sql).toBe('ALTER TABLE "main"."orders" RENAME COLUMN "status" TO "state";');
+    });
+
+    it('refuses any change while the table has an index, on any column, naming it', () => {
+      // DuckDB: "Cannot alter entry … because there are entries that depend on it" (found live).
+      const indexed = { ...plain, indices: [{ name: 'orders_note_idx', columns: [], unique: false }] };
+      for (const change of [{ newName: 'state' }, { newType: 'VARCHAR(40)' }]) {
+        const p = duck(indexed, change);
+        expect(!p.ok && p.error).toMatch(/DuckDB will not change a column of orders while the table has an index \(orders_note_idx\)/);
+      }
+    });
+  });
+
+  it('Redshift lengthens a VARCHAR and refuses every other type change', () => {
+    expect(step('redshift', { newType: 'varchar(40)' })[0]!.sql).toBe(
+      'ALTER TABLE "shop"."orders" ALTER COLUMN "status" TYPE varchar(40);'
+    );
+    expect(step('redshift', { newType: 'varchar(max)' })).toHaveLength(1);
+    for (const newType of ['varchar(10)', 'integer', 'char(40)']) {
+      const p = plan({ dialect: 'redshift', column: 'status', change: { newType } });
+      expect(!p.ok && p.error, newType).toMatch(/only to make a VARCHAR longer/);
+    }
+    expect(step('redshift', { newName: 'state' })[0]!.sql).toBe('ALTER TABLE "shop"."orders" RENAME COLUMN "status" TO "state";');
+  });
+
+  describe('ClickHouse', () => {
+    const events = table('events', {
+      columns: [
+        col('id', 'UInt64', { nullable: false }),
+        col('ts', 'DateTime', { nullable: false }),
+        col('note', 'String', { nullable: true }),
+        col('qty', 'Int32', { nullable: false }),
+      ],
+      orderBy: ['ts', 'cityHash64(id)'],
+    });
+    const ch = (column: string, change: { newName?: string; newType?: string }) =>
+      planColumnChange({ dialect: 'clickhouse', schema: 'analytics', table: events, tables: [events], column, change });
+
+    it('modifies the type, keeping a nullable column Nullable', () => {
+      const p = ok(ch('note', { newType: 'LowCardinality(String)' }));
+      // Nullable goes inside LowCardinality, or every NULL fails to convert.
+      expect(p.steps[0]!.sql).toBe('ALTER TABLE `analytics`.`events` MODIFY COLUMN `note` LowCardinality(Nullable(String));');
+      expect(ok(ch('note', { newType: 'FixedString(8)' })).steps[0]!.sql).toBe(
+        'ALTER TABLE `analytics`.`events` MODIFY COLUMN `note` Nullable(FixedString(8));'
+      );
+      expect(ok(ch('qty', { newType: 'Int64' })).steps[0]!.sql).toBe('ALTER TABLE `analytics`.`events` MODIFY COLUMN `qty` Int64;');
+      expect(ok(ch('qty', { newName: 'quantity' })).steps[0]!.sql).toBe(
+        'ALTER TABLE `analytics`.`events` RENAME COLUMN `qty` TO `quantity`;'
+      );
+    });
+
+    it('refuses a column in the sorting key, by name or inside an expression, with its own reason', () => {
+      for (const p of [ch('ts', { newName: 'at' }), ch('id', { newType: 'UInt32' })]) {
+        expect(!p.ok && p.error).toMatch(/sorting key \(ORDER BY \/ PRIMARY KEY\), and ClickHouse will not rename it/);
+      }
+      // Even when Fox also marks it as the primary key: the engine's reason wins.
+      const keyed = { ...events, primaryKey: { columns: ['ts'] } };
+      const p = planColumnChange({ dialect: 'clickhouse', table: keyed, tables: [keyed], column: 'ts', change: { newName: 'at' } });
+      expect(!p.ok && p.error).toMatch(/ClickHouse will not rename it/);
+    });
+
+    it('reads ClickHouse types for the data-loss check', () => {
+      expect(ok(ch('qty', { newType: 'Int16' })).impact.lossy).toMatch(/Narrowing Int32 to Int16/);
+      expect(lossyConversion('Nullable(String)', 'Nullable(Int64)')).toMatch(/text \(Nullable\(String\)\) to a number/);
+      expect(lossyConversion('Int32', 'Int64')).toBeUndefined();
+    });
   });
 });
diff --git a/packages/sql/src/modules/utilities/column-change.ts b/packages/sql/src/modules/utilities/column-change.ts
index b1148007a..b3d9940a4 100644
--- a/packages/sql/src/modules/utilities/column-change.ts
+++ b/packages/sql/src/modules/utilities/column-change.ts
@@ -17,6 +17,7 @@ import type { ColumnInfo, TableSchema } from '../../interfaces/schema.interface.
 import { PROVIDER_SETTINGS } from '../../providers/provider-settings.js';
 import { quoteIdentifierIfNeeded } from '../sql-text/sql-template.js';
 import { resolveColumnChange } from './column-change.registry.js';
+import { normType, shapeOf } from './column-type-shape.js';
 import type {
   ColumnChangeContext,
   ColumnChangeImpact,
@@ -50,7 +51,6 @@ export const COLUMN_CHANGE_PHASES: Array<{
 const same = (a: string, b: string) => a.toLowerCase() === b.toLowerCase();
 const engineName = (dialect: string) => PROVIDER_SETTINGS[dialect.toLowerCase()]?.label ?? dialect;
 const has = (cols: readonly string[], name: string) => cols.some((c) => same(c, name));
-const normType = (type: string) => type.trim().replace(/\s+/g, ' ').toLowerCase();
 const escapeWord = (word: string) => word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
 const wordIn = (text: string, word: string) =>
@@ -151,13 +151,6 @@ export function planColumnChange(input: ColumnChangeInput): ColumnChangePlan {
   if (renamed && input.table.columns.some((c) => c !== column && same(c.name, targetName))) {
     return { ok: false, error: `${input.table.name} already has a column ${targetName}.`, impact };
   }
-  if (impact.inPrimaryKey) {
-    return { ok: false, error: 'Changing a primary key column is not covered yet.', impact };
-  }
-  if (impact.inboundForeignKeys.length > 0) {
-    const from = [...new Set(impact.inboundForeignKeys.map((f) => f.table))].join(', ');
-    return { ok: false, error: `Other tables' foreign keys point at this column (${from}). Changing a referenced column is not covered yet.`, impact };
-  }
 
   const warnings: string[] = [];
   if (impact.views.length > 0) {
@@ -188,19 +181,45 @@ export function planColumnChange(input: ColumnChangeInput): ColumnChangePlan {
     indexes: impact.indexes,
     outboundForeignKeys: impact.outboundForeignKeys,
     triggers: impact.triggers,
+    sortingKey: input.table.orderBy ?? [],
+    tableIndexes: input.table.indices ?? [],
     batchSize: Math.max(1, Math.floor(input.batchSize ?? DEFAULT_COLUMN_CHANGE_BATCH)),
     typeChanged,
   };
 
-  if (!typeChanged) return { ok: true, impact, steps: dialect.renameSteps(ctx), warnings };
+  // The engine's own reason first: "ClickHouse will not rename a sorting-key
+  // column" says more than the general primary-key refusal below.
+  const refused = dialect.refuse?.(ctx, { renamed, typeChanged });
+  if (refused) return { ok: false, error: refused, impact };
+  if (impact.inPrimaryKey) {
+    return { ok: false, error: 'Changing a primary key column is not covered yet.', impact };
+  }
+  if (impact.inboundForeignKeys.length > 0) {
+    const from = [...new Set(impact.inboundForeignKeys.map((f) => f.table))].join(', ');
+    return { ok: false, error: `Other tables' foreign keys point at this column (${from}). Changing a referenced column is not covered yet.`, impact };
+  }
+
+  if (!typeChanged) return { ok: true, mode: 'rename', impact, steps: dialect.renameSteps(ctx), warnings };
 
-  if (column.identity) return { ok: false, error: 'An identity column cannot be copied this way.', impact };
-  if (primaryKey.length === 0) {
-    return { ok: false, error: 'The table needs a primary key: the copy works through it in batches.', impact };
+  const copy = Boolean(input.largeTable);
+  if (copy && !(dialect.rebuildSteps && dialect.progressSql)) {
+    return { ok: false, error: `Large-table mode is not available for ${engineName(input.dialect)}: the change runs in place.`, impact };
+  }
+  if (column.identity) {
+    return {
+      ok: false,
+      error: copy ? 'An identity column cannot be copied this way.' : 'Changing the type of an identity column is not covered yet.',
+      impact,
+    };
   }
-  for (const name of [ctx.newColumn, ctx.oldColumn]) {
-    if (input.table.columns.some((c) => same(c.name, name))) {
-      return { ok: false, error: `${input.table.name} already has a column ${name}, which this plan needs for a while.`, impact };
+  if (copy) {
+    if (primaryKey.length === 0) {
+      return { ok: false, error: 'The table needs a primary key: the copy works through it in batches.', impact };
+    }
+    for (const name of [ctx.newColumn, ctx.oldColumn]) {
+      if (input.table.columns.some((c) => same(c.name, name))) {
+        return { ok: false, error: `${input.table.name} already has a column ${name}, which this plan needs for a while.`, impact };
+      }
     }
   }
   if (dialect.foreignKeyTypesMustMatch) {
@@ -219,10 +238,51 @@ export function planColumnChange(input: ColumnChangeInput): ColumnChangePlan {
       }
     }
   }
-  if (!dialect.triggers) {
-    warnings.push('This engine has no triggers here: writes during the copy are caught by running the copy once more before the switch-over.');
+  if (copy && dialect.rebuildSteps && dialect.progressSql) {
+    if (!dialect.triggers) {
+      warnings.push('This engine has no triggers here: writes during the copy are caught by running the copy once more before the switch-over.');
+    }
+    return { ok: true, mode: 'copy', impact, steps: dialect.rebuildSteps(ctx), warnings, progress: dialect.progressSql(ctx) };
   }
-  return { ok: true, impact, steps: dialect.rebuildSteps(ctx), warnings, progress: dialect.progressSql(ctx) };
+
+  if (dialect.viewsBlockTypeChange && impact.views.length > 0) {
+    const at = warnings.findIndex((w) => w.startsWith('Views that may use the column'));
+    warnings.splice(
+      at,
+      1,
+      `${engineName(input.dialect)} refuses to change the type of a column a view uses. ` +
+        `If ${impact.views.join(', ')} ${impact.views.length === 1 ? 'uses' : 'use'} it, drop ${impact.views.length === 1 ? 'it' : 'them'} first and recreate after.`
+    );
+  }
+  const size = largeTableNote(input.table.name, input.estimatedRows, input.sizeBytes);
+  if (size) warnings.push(size);
+  const steps = [...dialect.alterTypeSteps(ctx), ...(renamed ? dialect.renameSteps(ctx) : [])];
+  return { ok: true, mode: 'direct', impact, steps, warnings };
+}
+
+/** From here an in-place type change is worth thinking twice about. */
+export const LARGE_TABLE_ROWS = 1_000_000;
+export const LARGE_TABLE_BYTES = 1024 ** 3;
+
+const roughly = (n: number) =>
+  n >= 1e9 ? `${(n / 1e9).toFixed(1)} billion` : n >= 1e6 ? `${(n / 1e6).toFixed(1)} million` : n.toLocaleString('en-US');
+const roughBytes = (n: number) => (n >= 1024 ** 4 ? `${(n / 1024 ** 4).toFixed(1)} TB` : `${(n / 1024 ** 3).toFixed(1)} GB`);
+
+/** Why an in-place ALTER may hurt on this table, or undefined when it is small or its size is unknown. */
+export function largeTableNote(table: string, rows?: number | null, bytes?: number | null): string | undefined {
+  const manyRows = typeof rows === 'number' && rows >= LARGE_TABLE_ROWS;
+  const manyBytes = typeof bytes === 'number' && bytes >= LARGE_TABLE_BYTES;
+  if (!manyRows && !manyBytes) return undefined;
+  const sized = [
+    typeof rows === 'number' ? `about ${roughly(rows)} rows` : '',
+    typeof bytes === 'number' ? roughBytes(bytes) : '',
+  ]
+    .filter(Boolean)
+    .join(', ');
+  return (
+    `${table} is large (${sized}). An in-place type change can rewrite the whole table and block writes until it ` +
+    'finishes. Turn on large-table mode to copy in batches while the table stays writable.'
+  );
 }
 
 function findImpact(input: ColumnChangeInput, column: ColumnInfo, newType: string | undefined): ColumnChangeImpact {
@@ -269,6 +329,9 @@ function findImpact(input: ColumnChangeInput, column: ColumnInfo, newType: strin
   const functions = matchedFunctions.map((t) => t.name);
   const procedures = matchedProcedures.map((t) => t.name);
   const newName = input.change.newName?.trim();
+  // The lines are for a rename, where stored SQL must say the new name. A type
+  // change alone gets the one-line "may use" warnings and no more.
+  const renaming = Boolean(newName && newName !== name);
   const dependent = (
     objectType: ColumnDependent['objectType'],
     objName: string,
@@ -278,12 +341,14 @@ function findImpact(input: ColumnChangeInput, column: ColumnInfo, newType: strin
     if (references.length === 0) return [];
     return [{ name: objName, objectType, definition: definition ?? '', references }];
   };
-  const dependents: ColumnDependent[] = [
-    ...matchedViews.flatMap((t) => dependent('VIEW', t.name, t.definition)),
-    ...matchedFunctions.flatMap((t) => dependent('FUNCTION', t.name, t.definition)),
-    ...matchedProcedures.flatMap((t) => dependent('PROCEDURE', t.name, t.definition)),
-    ...triggers.flatMap((t) => dependent('TRIGGER', t.name, t.definition)),
-  ];
+  const dependents: ColumnDependent[] = renaming
+    ? [
+        ...matchedViews.flatMap((t) => dependent('VIEW', t.name, t.definition)),
+        ...matchedFunctions.flatMap((t) => dependent('FUNCTION', t.name, t.definition)),
+        ...matchedProcedures.flatMap((t) => dependent('PROCEDURE', t.name, t.definition)),
+        ...triggers.flatMap((t) => dependent('TRIGGER', t.name, t.definition)),
+      ]
+    : [];
 
   return {
     inPrimaryKey,
@@ -299,45 +364,6 @@ function findImpact(input: ColumnChangeInput, column: ColumnInfo, newType: strin
   };
 }
 
-interface TypeShape {
-  kind: 'text' | 'int' | 'decimal' | 'float' | 'date' | 'datetime' | 'datetimetz' | 'bool' | 'other';
-  /** Text length, integer width rank, or decimal precision. */
-  size?: number;
-  scale?: number;
-}
-
-const TEXT_TYPES = new Set([
-  'char', 'nchar', 'varchar', 'nvarchar', 'character', 'character varying', 'text', 'ntext',
-  'string', 'clob', 'varchar2', 'nvarchar2', 'tinytext', 'mediumtext', 'longtext',
-]);
-
-const INT_RANK: Record<string, number> = {
-  tinyint: 1, smallint: 2, int2: 2, mediumint: 3, int: 4, integer: 4, int4: 4, serial: 4, bigint: 5, int8: 5, bigserial: 5,
-};
-
-const FLOAT_RANK: Record<string, number> = {
-  real: 1, float4: 1,
-  float: 2, double: 2, 'double precision': 2, float8: 2,
-};
-
-function shapeOf(type: string): TypeShape {
-  const t = normType(type);
-  const base = t.replace(/\(.*$/, '').trim();
-  const args = (t.match(/\(([^)]*)\)/)?.[1] ?? '').split(',').map((a) => a.trim());
-  const num = (v: string | undefined) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
-  if (TEXT_TYPES.has(base)) {
-    return { kind: 'text', size: args[0] === 'max' ? undefined : num(args[0]) };
-  }
-  if (base in INT_RANK) return { kind: 'int', size: INT_RANK[base] };
-  if (/^(decimal|numeric|number|money)$/.test(base)) return { kind: 'decimal', size: num(args[0]), scale: num(args[1]) ?? 0 };
-  if (base in FLOAT_RANK) return { kind: 'float', size: FLOAT_RANK[base] };
-  if (base === 'date') return { kind: 'date' };
-  if (/^(timestamptz|datetimeoffset)$/.test(base) || /with time zone/.test(t)) return { kind: 'datetimetz' };
-  if (/^(timestamp|datetime|datetime2|smalldatetime)/.test(base)) return { kind: 'datetime' };
-  if (/^(bool|boolean|bit)$/.test(base)) return { kind: 'bool' };
-  return { kind: 'other' };
-}
-
 /** Why moving values from `from` to `to` can lose data or fail, or undefined when it should not. */
 export function lossyConversion(from: string, to: string): string | undefined {
   const a = shapeOf(from);
diff --git a/packages/sql/src/modules/utilities/column-change.types.ts b/packages/sql/src/modules/utilities/column-change.types.ts
index 37ce27074..e883948e1 100644
--- a/packages/sql/src/modules/utilities/column-change.types.ts
+++ b/packages/sql/src/modules/utilities/column-change.types.ts
@@ -23,10 +23,26 @@ export interface ColumnChangeInput {
   tables: TableSchema[];
   column: string;
   change: ColumnChange;
-  /** Rows per copy batch. Default 10,000. */
+  /**
+   * Large-table mode: change the type through a new column, a batched copy and
+   * a switch-over, so the table stays writable. Off by default: one in-place
+   * ALTER is simpler, and fine for small and medium tables.
+   */
+  largeTable?: boolean;
+  /** Rows per copy batch, in large-table mode. Default 10,000. */
   batchSize?: number;
+  /** The catalog's row estimate, for the size warning. Unknown when left out. */
+  estimatedRows?: number | null;
+  /** Table plus indexes in bytes, as the catalog reports it, for the size warning. */
+  sizeBytes?: number | null;
 }
 
+/**
+ * How the change is made: a rename alone in place, a type change by one
+ * in-place ALTER, or a type change through a new column and a copy.
+ */
+export type ColumnChangeMode = 'rename' | 'direct' | 'copy';
+
 export interface InboundForeignKey {
   table: string;
   foreignKey: ForeignKeyInfo;
@@ -80,7 +96,8 @@ export interface ColumnChangeImpact {
    * The same views, functions, procedures and triggers, with the lines that
    * name the column. The name lists above stay as they are — the warnings and
    * the summary read them — and this carries what a reader needs to act.
-   * Empty for an object whose definition the catalog did not give us.
+   * Empty for an object whose definition the catalog did not give us, and
+   * empty unless the column is renamed: a type change alone needs no lines.
    */
   dependents: ColumnDependent[];
   /** Why the type change can lose data or fail on some values, when it can. */
@@ -110,10 +127,11 @@ export interface ColumnChangeStep {
 export type ColumnChangePlan =
   | {
       ok: true;
+      mode: ColumnChangeMode;
       impact: ColumnChangeImpact;
       steps: ColumnChangeStep[];
       warnings: string[];
-      /** Present for a type change: COUNT(*) and rows still to copy. */
+      /** Present in large-table mode: COUNT(*) and rows still to copy. */
       progress?: ColumnChangeProgressSql;
     }
   | { ok: false; error: string; impact?: ColumnChangeImpact };
@@ -134,6 +152,13 @@ export interface ColumnChangeContext {
   outboundForeignKeys: ForeignKeyInfo[];
   /** Table triggers whose definition mentions the column. */
   triggers: TriggerInfo[];
+  /**
+   * The table's sorting key (ClickHouse ORDER BY), as names or the engine's own
+   * expressions. Empty elsewhere. An engine may refuse to touch a column in it.
+   */
+  sortingKey: string[];
+  /** Every index on the table, not only those on the column (DuckDB will not alter a table that has one). */
+  tableIndexes: IndexInfo[];
   batchSize: number;
   typeChanged: boolean;
 }
@@ -141,10 +166,25 @@ export interface ColumnChangeContext {
 export interface ColumnChangeDialect {
   /** Steps for a rename alone: the engine renames in place, instantly. */
   renameSteps(ctx: ColumnChangeContext): ColumnChangeStep[];
-  /** Steps for a type change (with or without a rename): new column, copy, switch over. */
-  rebuildSteps(ctx: ColumnChangeContext): ColumnChangeStep[];
-  /** COUNT(*) and rows still waiting to copy, for the copy-part progress. */
-  progressSql(ctx: ColumnChangeContext): ColumnChangeProgressSql;
+  /**
+   * Steps for a type change in place: one ALTER, plus whatever the engine needs
+   * around it (SQL Server drops and recreates the indexes, keys and default on
+   * the column). A rename with it is added after, from `renameSteps`.
+   */
+  alterTypeSteps(ctx: ColumnChangeContext): ColumnChangeStep[];
+  /**
+   * Steps for a type change in large-table mode: new column, copy, switch over.
+   * Absent where the engine has no such mode here; the screen then hides it.
+   */
+  rebuildSteps?(ctx: ColumnChangeContext): ColumnChangeStep[];
+  /** COUNT(*) and rows still waiting to copy, for the copy-part progress. With `rebuildSteps`. */
+  progressSql?(ctx: ColumnChangeContext): ColumnChangeProgressSql;
+  /**
+   * Why the engine cannot make this change, or undefined when it can: SQLite
+   * has no in-place type change, Redshift only lengthens a VARCHAR, ClickHouse
+   * will not touch a sorting-key column. Asked once the change is known.
+   */
+  refuse?(ctx: ColumnChangeContext, change: { renamed: boolean; typeChanged: boolean }): string | undefined;
   /** Whether the engine can keep the new column in step with a trigger during the copy. */
   triggers: boolean;
   /**
@@ -152,4 +192,9 @@ export interface ColumnChangeDialect {
    * Server). PostgreSQL only needs comparable types, so int8 may reference int4.
    */
   foreignKeyTypesMustMatch: boolean;
+  /**
+   * Whether the engine refuses an in-place type change on a column a view uses
+   * (PostgreSQL and its family), so the view must be dropped and recreated.
+   */
+  viewsBlockTypeChange: boolean;
 }
diff --git a/packages/sql/src/modules/utilities/column-type-shape.ts b/packages/sql/src/modules/utilities/column-type-shape.ts
new file mode 100644
index 000000000..3a4654978
--- /dev/null
+++ b/packages/sql/src/modules/utilities/column-type-shape.ts
@@ -0,0 +1,68 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * What kind of type a column type is (text, integer, decimal, …) and its size,
+ * read across dialects' spellings. Shared by the column-change planner (the
+ * data-loss check) and the dialects that phrase a type change by kind. Kept
+ * apart from the planner so a dialect can import it without a cycle.
+ */
+
+/** A type as written, lower-cased with single spaces, for comparing. */
+export const normType = (type: string) => type.trim().replace(/\s+/g, ' ').toLowerCase();
+
+export interface TypeShape {
+  kind: 'text' | 'int' | 'decimal' | 'float' | 'date' | 'datetime' | 'datetimetz' | 'bool' | 'other';
+  /** Text length, integer width rank, or decimal precision. */
+  size?: number;
+  scale?: number;
+}
+
+const TEXT_TYPES = new Set([
+  'char', 'nchar', 'varchar', 'nvarchar', 'character', 'character varying', 'text', 'ntext',
+  'string', 'clob', 'varchar2', 'nvarchar2', 'tinytext', 'mediumtext', 'longtext',
+]);
+
+const INT_RANK: Record<string, number> = {
+  tinyint: 1, smallint: 2, int2: 2, mediumint: 3, int: 4, integer: 4, int4: 4, serial: 4, bigint: 5, int8: 5, bigserial: 5,
+  // ClickHouse. Its Int8 is one byte, but `int8` above is PostgreSQL's bigint, which wins.
+  int16: 2, int32: 4, int64: 5, int128: 6, int256: 7,
+};
+
+const FLOAT_RANK: Record<string, number> = {
+  real: 1, float4: 1,
+  float: 2, double: 2, 'double precision': 2, float8: 2,
+  float32: 1, float64: 2,
+};
+
+export function shapeOf(type: string): TypeShape {
+  // ClickHouse wraps a type for nullability and dictionary encoding; the value is the inner type.
+  const wrapper = /^(?:nullable|lowcardinality)\s*\((.*)\)$/;
+  let t = normType(type);
+  while (wrapper.test(t)) t = t.replace(wrapper, '$1').trim();
+  const base = t.replace(/\(.*$/, '').trim();
+  const args = (t.match(/\(([^)]*)\)/)?.[1] ?? '').split(',').map((a) => a.trim());
+  const num = (v: string | undefined) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
+  if (TEXT_TYPES.has(base)) {
+    return { kind: 'text', size: args[0] === 'max' ? undefined : num(args[0]) };
+  }
+  if (base in INT_RANK) return { kind: 'int', size: INT_RANK[base] };
+  if (/^(decimal|numeric|number|money)$/.test(base)) return { kind: 'decimal', size: num(args[0]), scale: num(args[1]) ?? 0 };
+  if (base in FLOAT_RANK) return { kind: 'float', size: FLOAT_RANK[base] };
+  if (base === 'date') return { kind: 'date' };
+  if (/^(timestamptz|datetimeoffset)$/.test(base) || /with time zone/.test(t)) return { kind: 'datetimetz' };
+  if (/^(timestamp|datetime|datetime2|smalldatetime)/.test(base)) return { kind: 'datetime' };
+  if (/^(bool|boolean|bit)$/.test(base)) return { kind: 'bool' };
+  return { kind: 'other' };
+}
+
+/**
+ * Whether two types are the same kind (text and text, integer and integer, …),
+ * so a dialect can convert between them without spelling out the cast. Unknown
+ * kinds never match.
+ */
+export function sameTypeKind(a: string, b: string): boolean {
+  const x = shapeOf(a).kind;
+  return x !== 'other' && x === shapeOf(b).kind;
+}
diff --git a/packages/sql/src/providers/DIALECTS.md b/packages/sql/src/providers/DIALECTS.md
index bfe7ddb9c..060ddb64b 100644
--- a/packages/sql/src/providers/DIALECTS.md
+++ b/packages/sql/src/providers/DIALECTS.md
@@ -98,6 +98,7 @@ Each dialect lives in `providers/<name>/<name>.sql-dialect.ts`.
 - Provider: `timestamp without/with time zone`, `character varying`, `bytea` mapping.
 
 ### SQL Server / Azure SQL (`sqlserver.sql-dialect.ts`; azure re-exports it)
+- **`sp_rename` and `ALTER COLUMN` are refused for a column a filtered index names** in its `WHERE` ("one or more objects access this column"), indexed or not. Fox's SQL Server index model has no filters; Rename Column scripts such indexes from `sys.indexes` when it runs.
 - `modifyColumnStatements` = `ALTER COLUMN`, must re-state nullability + `IDENTITY(1,1)`.
 - `dropIndexStatement` ⇒ `DROP INDEX name ON table`.
 - `dropTriggerStatement` ⇒ `DROP TRIGGER IF EXISTS schema.name`.
@@ -139,6 +140,7 @@ Each dialect lives in `providers/<name>/<name>.sql-dialect.ts`.
 - `dropForeignKeyStatement` ⇒ `ALTER TABLE t DROP FOREIGN KEY name` (no `IF EXISTS`).
 
 ### SQLite (`sqlite.sql-dialect.ts`)
+- `RENAME COLUMN` (3.25+) rewrites the indexes, views and triggers that name the column itself (Rename Column relies on this, checked live).
 - No `ALTER COLUMN` for type/nullability, no `ALTER` default, no `DROP PRIMARY KEY`
   ⇒ those hooks emit `-- review:` comments (table must be recreated), never invalid SQL.
 - `dropIndexStatement` / `dropTriggerStatement` ⇒ `IF EXISTS`, bare name (global namespace).
@@ -150,6 +152,7 @@ Each dialect lives in `providers/<name>/<name>.sql-dialect.ts`.
 - `IDENTITY(seed,step)` on the column. `dropIndex/Trigger` Postgres-style with `IF EXISTS`.
 
 ### ClickHouse (`clickhouse.sql-dialect.ts`)
+- A sorting-key column cannot be renamed or retyped. `MODIFY COLUMN` keeps the default and comment; a nullable column must stay `Nullable(T)` — `LowCardinality(Nullable(T))` for dictionary encoding — or its NULLs fail to convert.
 - `nullableTypeWrapper` ⇒ `Nullable(T)`; generator skips `NULL`/`NOT NULL` keywords.
 - **No table-level `PRIMARY KEY` constraint.** ClickHouse only allows `CHECK` /
   `ASSUME` inside the column list; `CONSTRAINT PRIMARY_KEY PRIMARY KEY (id)` is
@@ -177,6 +180,7 @@ Each dialect lives in `providers/<name>/<name>.sql-dialect.ts`.
   Transaction checkbox off and disabled.
 
 ### Wire-compatible variants — CockroachDB / YugabyteDB / TiDB
+- **CockroachDB `ALTER COLUMN … TYPE`:** an explicit `USING` forces a column rewrite, and a rewrite is refused for a column in an index ("not supported for columns that are part of an index"). Without `USING`, lengthening a string is a metadata change. General conversions need `SET enable_experimental_alter_column_type_general = true`.
 - **CockroachDB** (`cockroachDb/`) and **YugabyteDB** (`yugabyteDb/`) are PostgreSQL
   wire/catalog compatible: their `.sql-dialect.ts` **re-exports `postgresSqlDialect`**,
   their provider **subclasses `PostgresProvider`** (only `provider` id differs), and
@@ -189,6 +193,7 @@ Each dialect lives in `providers/<name>/<name>.sql-dialect.ts`.
   or a standalone `.sql-dialect.ts` only when a real divergence surfaces.
 
 ### DuckDB (`duckDb/duckdb.sql-dialect.ts`, full provider)
+- **Any index on a table blocks every `ALTER` on it** — a rename of an unrelated column included ("Cannot alter entry … entries that depend on it"). A primary key does not. `duckdb_indexes()` is read without its columns, so an index cannot be rebuilt from the model; Rename Column refuses and names the indexes.
 - Embedded (file path connection, like SQLite) but schema-aware with Postgres-
   flavored SQL. Introspects via `information_schema` + `duckdb_constraints()` /
   `duckdb_indexes()` / `duckdb_views()` / `duckdb_sequences()` / `duckdb_types()`.
diff --git a/packages/sql/src/providers/clickHouse/clickhouse.column-change.ts b/packages/sql/src/providers/clickHouse/clickhouse.column-change.ts
new file mode 100644
index 000000000..8bce4ac53
--- /dev/null
+++ b/packages/sql/src/providers/clickHouse/clickhouse.column-change.ts
@@ -0,0 +1,74 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on ClickHouse: both changes in place. ClickHouse will not
+ * rename or retype a column in the sorting key, so that is refused up front.
+ */
+import type { ColumnChangeContext, ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'clickhouse');
+const table = (ctx: ColumnChangeContext) => (ctx.schema ? `${q(ctx.schema)}.${q(ctx.table)}` : q(ctx.table));
+const escapeWord = (word: string) => word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/** Whether the sorting key names the column: a plain name, or inside an expression such as `cityHash64(id)`. */
+function inSortingKey(ctx: ColumnChangeContext): boolean {
+  const name = ctx.column.name;
+  const word = new RegExp(`(^|[^A-Za-z0-9_])\`?${escapeWord(name)}\`?([^A-Za-z0-9_]|$)`);
+  return (
+    ctx.primaryKey.some((k) => k === name) ||
+    ctx.sortingKey.some((expr) => expr === name || word.test(expr))
+  );
+}
+
+/**
+ * The new type as ClickHouse must be told it. A nullable column is
+ * `Nullable(T)`; Fox shows it as T with nullable set, so a type typed in
+ * without the wrapper gets it back, or every NULL would fail to convert.
+ */
+export function clickHouseTargetType(ctx: ColumnChangeContext): string {
+  const t = ctx.targetType.trim();
+  if (!ctx.column.nullable || /nullable\s*\(/i.test(t)) return t;
+  // Nullable goes inside LowCardinality: LowCardinality(Nullable(String)).
+  const low = t.match(/^lowcardinality\s*\((.*)\)$/i);
+  return low ? `LowCardinality(Nullable(${low[1]!.trim()}))` : `Nullable(${t})`;
+}
+
+export const clickHouseColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  refuse: (ctx) =>
+    inSortingKey(ctx)
+      ? `${ctx.column.name} is in ${ctx.table}’s sorting key (ORDER BY / PRIMARY KEY), and ClickHouse will not ` +
+        'rename it or change its type. Recreate the table with the new column instead.'
+      : undefined,
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${table(ctx)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note:
+        'A metadata change. Materialized views and queries that name the column do not follow it. ClickHouse has ' +
+        'no transactions, so this applies on its own.',
+    },
+  ],
+
+  alterTypeSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Change ${ctx.column.name} to ${clickHouseTargetType(ctx)}`,
+      rerunSafe: true,
+      sql: `ALTER TABLE ${table(ctx)} MODIFY COLUMN ${q(ctx.column.name)} ${clickHouseTargetType(ctx)};`,
+      note:
+        'Rewrites the column in every data part as a mutation; the default and comment stay. A value that does ' +
+        'not convert stops the mutation, which then has to be killed (KILL MUTATION) before the table takes ' +
+        'another change. ClickHouse has no transactions.',
+    },
+  ],
+};
diff --git a/packages/sql/src/providers/cockroachDb/cockroachdb.column-change.ts b/packages/sql/src/providers/cockroachDb/cockroachdb.column-change.ts
index 74e402b36..c6b4ce14d 100644
--- a/packages/sql/src/providers/cockroachDb/cockroachdb.column-change.ts
+++ b/packages/sql/src/providers/cockroachDb/cockroachdb.column-change.ts
@@ -9,4 +9,12 @@
  */
 import { postgresFamilyColumnChange } from '../postgres/postgres.column-change.js';
 
-export const cockroachDbColumnChange = postgresFamilyColumnChange({ triggers: false });
+export const cockroachDbColumnChange = postgresFamilyColumnChange({
+  triggers: false,
+  // Widening a string or an int is allowed as is; any other conversion needs this.
+  alterTypeSetting: 'SET enable_experimental_alter_column_type_general = true;',
+  alterTypeNote:
+    'Lengthening a string or widening an int is a metadata change. Any other change rewrites the column in the ' +
+    'background, which CockroachDB refuses for a column that is part of an index (drop the index first) and inside ' +
+    'an explicit transaction. A value that does not convert stops it.',
+});
diff --git a/packages/sql/src/providers/db2/db2.column-change.ts b/packages/sql/src/providers/db2/db2.column-change.ts
new file mode 100644
index 000000000..bab2673ac
--- /dev/null
+++ b/packages/sql/src/providers/db2/db2.column-change.ts
@@ -0,0 +1,53 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on Db2: both changes in place. The schema is folded to upper
+ * case and the table quoted exactly as the catalog gave it (DIALECTS.md, Db2).
+ */
+import type { ColumnChangeContext, ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'db2');
+const table = (ctx: ColumnChangeContext) => (ctx.schema ? `${q(ctx.schema.toUpperCase())}.${q(ctx.table)}` : q(ctx.table));
+
+export const db2ColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${table(ctx)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note:
+        'Instant: only the catalog changes, and indexes and keys follow. Views, triggers and routines that name ' +
+        'the column are marked invalid and fail until they are changed.',
+    },
+  ],
+
+  alterTypeSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+      rerunSafe: true,
+      sql: `ALTER TABLE ${table(ctx)} ALTER COLUMN ${q(ctx.column.name)} SET DATA TYPE ${ctx.targetType};`,
+      note:
+        'NOT NULL and the default stay: SET DATA TYPE changes only the type. A value that does not fit stops it. ' +
+        'Some changes leave the table reorg-pending, so the next step reorganises it.',
+    },
+    {
+      phase: 'add',
+      title: `Reorganise ${ctx.table}`,
+      rerunSafe: true,
+      // ADMIN_CMD: plain REORG TABLE is a CLP command, not SQL.
+      sql: `CALL SYSPROC.ADMIN_CMD('REORG TABLE ${table(ctx).replace(/'/g, "''")}');`,
+      note:
+        'Reads still work on a reorg-pending table, but every write fails with SQL0668N reason 7 until it is ' +
+        'reorganised. REORG rewrites the table and blocks writes while it runs; harmless when nothing was pending.',
+    },
+  ],
+};
diff --git a/packages/sql/src/providers/duckDb/duckdb.column-change.ts b/packages/sql/src/providers/duckDb/duckdb.column-change.ts
new file mode 100644
index 000000000..abfa3d6bc
--- /dev/null
+++ b/packages/sql/src/providers/duckDb/duckdb.column-change.ts
@@ -0,0 +1,57 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on DuckDB: both changes in place.
+ */
+import type { ColumnChangeContext, ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'duckdb');
+const table = (ctx: ColumnChangeContext) => (ctx.schema ? `${q(ctx.schema)}.${q(ctx.table)}` : q(ctx.table));
+
+export const duckDbColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  // DuckDB refuses every ALTER on a table that has an index, a rename of an
+  // unrelated column included ("Cannot alter entry … entries that depend on
+  // it"). Fox does not know an index's columns here, so it cannot put one back:
+  // the user drops and recreates them. A primary key does not count.
+  refuse: (ctx) => {
+    const names = ctx.tableIndexes.map((i) => i.name);
+    if (names.length === 0) return undefined;
+    return (
+      `DuckDB will not change a column of ${ctx.table} while the table has ${names.length === 1 ? 'an index' : 'indexes'} ` +
+      `(${names.join(', ')}). Drop ${names.length === 1 ? 'it' : 'them'}, make the change, then create ` +
+      `${names.length === 1 ? 'it' : 'them'} again.`
+    );
+  },
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${table(ctx)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note: 'Instant. Views keep their SQL text, so one that names the column fails until it is recreated.',
+    },
+  ],
+
+  alterTypeSteps: (ctx) => {
+    const col = q(ctx.column.name);
+    return [
+      {
+        phase: 'add',
+        title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+        rerunSafe: true,
+        sql: `ALTER TABLE ${table(ctx)} ALTER COLUMN ${col} TYPE ${ctx.targetType} USING CAST(${col} AS ${ctx.targetType});`,
+        note:
+          'Rewrites the column; NOT NULL and the default stay. A value that does not convert stops it and ' +
+          'changes nothing.',
+      },
+    ];
+  },
+};
diff --git a/packages/sql/src/providers/mysql/mysql.column-change.ts b/packages/sql/src/providers/mysql/mysql.column-change.ts
index 7c2c80e8a..ccb9e79b6 100644
--- a/packages/sql/src/providers/mysql/mysql.column-change.ts
+++ b/packages/sql/src/providers/mysql/mysql.column-change.ts
@@ -61,6 +61,20 @@ export function mysqlFamilyColumnChange(options: { triggers: boolean; atomicSwit
   return {
     triggers: options.triggers,
     foreignKeyTypesMustMatch: true,
+    viewsBlockTypeChange: false,
+
+    alterTypeSteps: (ctx) => [
+      {
+        phase: 'add',
+        title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+        rerunSafe: true,
+        sql: mysqlModifyKeepingComment(ctx, ctx.column.name, mysqlRestated(ctx)),
+        note:
+          'MODIFY restates the whole column, so its NOT NULL, default, collation and comment are carried over. ' +
+          'Most type changes copy the table and block writes while they run; lengthening a varchar is often instant. ' +
+          'Run with strict SQL mode (the default) so a value that does not fit stops it instead of being cut or stored as 0.',
+      },
+    ],
 
     renameSteps: (ctx) => [
       {
@@ -211,20 +225,38 @@ export function mysqlFamilyColumnChange(options: { triggers: boolean; atomicSwit
 const mysqlLit = (value: string) => value.replace(/'/g, "''");
 const mysqlWord = (name: string) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
-function mysqlCopyComment(ctx: ColumnChangeContext): string {
+/**
+ * `MODIFY COLUMN <target> <definition> COMMENT <the column's comment>`, with the
+ * comment read from the catalog when it runs. A MODIFY drops what it does not
+ * restate, and the comment is not in the schema Fox holds.
+ */
+function mysqlModifyKeepingComment(ctx: ColumnChangeContext, target: string, definition: string): string {
   const schema = ctx.schema || '';
   const schemaPred = schema
     ? `TABLE_SCHEMA = '${mysqlLit(schema)}'`
     : 'TABLE_SCHEMA = DATABASE()';
+  const head = mysqlLit(`ALTER TABLE ${table(ctx)} MODIFY COLUMN ${q(target)} ${definition} COMMENT `);
   return [
     `SET @fox_col_comment = (SELECT COLUMN_COMMENT FROM information_schema.COLUMNS WHERE ${schemaPred} AND TABLE_NAME = '${mysqlLit(ctx.table)}' AND COLUMN_NAME = '${mysqlLit(ctx.column.name)}');`,
-    `SET @fox_col_sql = CONCAT('ALTER TABLE ${table(ctx)} MODIFY COLUMN ${q(ctx.newColumn)} ${ctx.targetType.replace(/'/g, "''")} NULL COMMENT ', QUOTE(IFNULL(@fox_col_comment, '')));`,
+    `SET @fox_col_sql = CONCAT('${head}', QUOTE(IFNULL(@fox_col_comment, '')));`,
     'PREPARE fox_col_stmt FROM @fox_col_sql;',
     'EXECUTE fox_col_stmt;',
     'DEALLOCATE PREPARE fox_col_stmt;',
   ].join('\n');
 }
 
+function mysqlCopyComment(ctx: ColumnChangeContext): string {
+  return mysqlModifyKeepingComment(ctx, ctx.newColumn, `${ctx.targetType} NULL`);
+}
+
+/** The column as MODIFY must restate it under the new type: nullability, default and collation. */
+function mysqlRestated(ctx: ColumnChangeContext): string {
+  const parts = [ctx.targetType, ctx.column.nullable ? 'NULL' : 'NOT NULL'];
+  if (ctx.column.defaultValue) parts.push(`DEFAULT ${ctx.column.defaultValue}`);
+  if (ctx.column.collation && /char|text/i.test(ctx.targetType)) parts.push(`COLLATE ${ctx.column.collation}`);
+  return parts.join(' ');
+}
+
 function mysqlRebuildTriggers(ctx: ColumnChangeContext): ColumnChangeStep | undefined {
   if (ctx.triggers.length === 0) return undefined;
   const sql = ctx.triggers
diff --git a/packages/sql/src/providers/oracle/oracle.column-change.ts b/packages/sql/src/providers/oracle/oracle.column-change.ts
new file mode 100644
index 000000000..de2541ac2
--- /dev/null
+++ b/packages/sql/src/providers/oracle/oracle.column-change.ts
@@ -0,0 +1,48 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on Oracle: both changes in place. Names are quoted as the
+ * catalog stores them; the schema is folded to upper case, the way Oracle
+ * keeps an unquoted user name.
+ */
+import type { ColumnChangeContext, ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'oracle');
+const table = (ctx: ColumnChangeContext) => (ctx.schema ? `${q(ctx.schema.toUpperCase())}.${q(ctx.table)}` : q(ctx.table));
+
+export const oracleColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${table(ctx)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note:
+        'Instant, and committed at once (Oracle DDL). Indexes and constraints follow; views, triggers and PL/SQL ' +
+        'that name the column become invalid and fail until they are changed.',
+    },
+  ],
+
+  alterTypeSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+      rerunSafe: true,
+      // No NULL / NOT NULL: MODIFY keeps what it does not restate, and restating
+      // NOT NULL on a NOT NULL column is ORA-01442.
+      sql: `ALTER TABLE ${table(ctx)} MODIFY (${q(ctx.column.name)} ${ctx.targetType});`,
+      note:
+        'NOT NULL, the default and the comment stay. Oracle changes a length or precision in place and refuses to ' +
+        'go below the longest value (ORA-01441); a change to another kind of type, such as text to number or to a ' +
+        'LOB, needs the column empty (ORA-01439). Views on the table are marked invalid and recompile when next ' +
+        'used. Committed at once.',
+    },
+  ],
+};
diff --git a/packages/sql/src/providers/postgres/postgres.column-change.ts b/packages/sql/src/providers/postgres/postgres.column-change.ts
index dc278641a..9a98f75ed 100644
--- a/packages/sql/src/providers/postgres/postgres.column-change.ts
+++ b/packages/sql/src/providers/postgres/postgres.column-change.ts
@@ -12,6 +12,7 @@ import type {
   ColumnChangeDialect,
   ColumnChangeStep,
 } from '../../modules/utilities/column-change.types.js';
+import { sameTypeKind } from '../../modules/utilities/column-type-shape.js';
 
 const lit = (value: string) => value.replace(/'/g, "''");
 const identWord = (name: string) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -101,10 +102,49 @@ function postgresCopyLoop(ctx: ColumnChangeContext, procedural: boolean): string
   ].join('\n');
 }
 
-export function postgresFamilyColumnChange(options: { triggers: boolean }): ColumnChangeDialect {
+export function postgresFamilyColumnChange(options: {
+  triggers: boolean;
+  /**
+   * A session setting the engine wants before a general type change
+   * (CockroachDB keeps most conversions behind an experimental flag).
+   */
+  alterTypeSetting?: string;
+  /** What the engine does to the table during the ALTER, for the step's note. */
+  alterTypeNote?: string;
+}): ColumnChangeDialect {
   return {
     triggers: options.triggers,
     foreignKeyTypesMustMatch: false,
+    viewsBlockTypeChange: true,
+
+    alterTypeSteps: (ctx) => {
+      const col = q(ctx.column.name);
+      // USING only across kinds (text to number), where the engine needs the cast
+      // spelled out. Within a kind it is left off: an explicit USING makes
+      // CockroachDB rewrite the column, which it refuses for an indexed one,
+      // where lengthening a varchar is otherwise a metadata change (found live).
+      const using = sameTypeKind(ctx.column.type, ctx.targetType) ? '' : ` USING ${col}::${ctx.targetType}`;
+      const alter = `ALTER TABLE ${table(ctx)} ALTER COLUMN ${col} TYPE ${ctx.targetType}${using};`;
+      return [
+        {
+          phase: 'add',
+          title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+          rerunSafe: false,
+          sql: options.alterTypeSetting ? `${options.alterTypeSetting}\n${alter}` : alter,
+          note: [
+            options.alterTypeNote ??
+              'One statement, all or nothing: a value that does not convert stops it and changes nothing. ' +
+                'Most changes rewrite the table and block reads and writes while they run; widening a varchar does not.',
+            'Indexes and constraints on the column are rebuilt with it.',
+            ctx.column.defaultValue
+              ? `The default (${ctx.column.defaultValue}) is converted too; if it cannot be, drop it first.`
+              : '',
+          ]
+            .filter(Boolean)
+            .join(' '),
+        },
+      ];
+    },
 
     renameSteps: (ctx) => [
       {
diff --git a/packages/sql/src/providers/redshift/redshift.column-change.ts b/packages/sql/src/providers/redshift/redshift.column-change.ts
new file mode 100644
index 000000000..ef4e667c6
--- /dev/null
+++ b/packages/sql/src/providers/redshift/redshift.column-change.ts
@@ -0,0 +1,65 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on Redshift: a rename in place, and a type change only where
+ * Redshift has one — making a VARCHAR longer. Anything else is refused with
+ * the reason, never SQL that fails there.
+ */
+import type { ColumnChangeContext, ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'redshift');
+const table = (ctx: ColumnChangeContext) => (ctx.schema ? `${q(ctx.schema)}.${q(ctx.table)}` : q(ctx.table));
+
+/** Redshift's VARCHAR(MAX). */
+const VARCHAR_MAX = 65535;
+
+/** The length of a VARCHAR type, or undefined for any other type. */
+export function redshiftVarcharLength(type: string): number | undefined {
+  const m = type.trim().match(/^(?:character\s+varying|varchar|nvarchar|text)\s*(?:\(\s*(\d+|max)\s*\))?$/i);
+  if (!m) return undefined;
+  // A bare VARCHAR, and TEXT, are VARCHAR(256) on Redshift.
+  if (!m[1]) return 256;
+  return /^max$/i.test(m[1]) ? VARCHAR_MAX : Number(m[1]);
+}
+
+export const redshiftColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  refuse: (ctx, { typeChanged }) => {
+    if (!typeChanged) return undefined;
+    const from = redshiftVarcharLength(ctx.column.type);
+    const to = redshiftVarcharLength(ctx.targetType);
+    if (from !== undefined && to !== undefined && to > from) return undefined;
+    return (
+      `Redshift changes a column’s type in place only to make a VARCHAR longer, and ${ctx.column.type} → ` +
+      `${ctx.targetType} is not that. Add a new column and copy into it, or recreate the table.`
+    );
+  },
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${table(ctx)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note: 'Instant. A late-binding view or stored SQL that names the column fails until it is changed.',
+    },
+  ],
+
+  alterTypeSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+      rerunSafe: true,
+      sql: `ALTER TABLE ${table(ctx)} ALTER COLUMN ${q(ctx.column.name)} TYPE ${ctx.targetType};`,
+      note:
+        'Lengthens the VARCHAR in place. Redshift runs it outside a transaction block, and refuses it on a column ' +
+        'encoded BYTEDICT, RUNLENGTH, TEXT255 or TEXT32K.',
+    },
+  ],
+};
diff --git a/packages/sql/src/providers/sqlLite/sqlite.column-change.ts b/packages/sql/src/providers/sqlLite/sqlite.column-change.ts
new file mode 100644
index 000000000..793f666e2
--- /dev/null
+++ b/packages/sql/src/providers/sqlLite/sqlite.column-change.ts
@@ -0,0 +1,39 @@
+/**
+ * Fox Schema (@foxschema/sql)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Rename Column on SQLite: a rename only. SQLite has no ALTER COLUMN; a type
+ * change needs the table rebuilt, which is refused here with that reason.
+ */
+import type { ColumnChangeDialect } from '../../modules/utilities/column-change.types.js';
+import { quoteSqlIdentifier } from '../../modules/sql-text/sql-template.js';
+
+const q = (name: string) => quoteSqlIdentifier(name, 'sqlite');
+
+export const sqliteColumnChange: ColumnChangeDialect = {
+  triggers: false,
+  foreignKeyTypesMustMatch: false,
+  viewsBlockTypeChange: false,
+
+  refuse: (_ctx, { typeChanged }) =>
+    typeChanged
+      ? 'SQLite cannot change a column’s type in place: it needs the table rebuilt (a new table, a copy, a swap), ' +
+        'which is not covered here yet. A rename on its own works.'
+      : undefined,
+
+  renameSteps: (ctx) => [
+    {
+      phase: 'add',
+      title: `Rename ${ctx.column.name} to ${ctx.targetName}`,
+      rerunSafe: false,
+      sql: `ALTER TABLE ${q(ctx.table)} RENAME COLUMN ${q(ctx.column.name)} TO ${q(ctx.targetName)};`,
+      note:
+        'Needs SQLite 3.25 or later. SQLite also rewrites the indexes, triggers and views that name the column, ' +
+        'so they keep working; application SQL does not change.',
+    },
+  ],
+
+  // Never reached: `refuse` stops a type change first.
+  alterTypeSteps: () => [],
+};
diff --git a/packages/sql/src/providers/sqlServer/sqlserver.column-change.ts b/packages/sql/src/providers/sqlServer/sqlserver.column-change.ts
index dbbac1b6b..3dbb61a86 100644
--- a/packages/sql/src/providers/sqlServer/sqlserver.column-change.ts
+++ b/packages/sql/src/providers/sqlServer/sqlserver.column-change.ts
@@ -50,9 +50,140 @@ function sqlServerCopyLoop(ctx: ColumnChangeContext): string {
   ].join('\n');
 }
 
+/** The DEFAULT constraint's generated name, found by the column, dropped by name. No `;`: it runs inside one batch. */
+function dropDefaultFor(ctx: ColumnChangeContext, column: string): string {
+  const t = table(ctx);
+  return (
+    `DECLARE @df sysname, @sql nvarchar(max) SELECT @df = dc.name FROM sys.default_constraints AS dc ` +
+    `JOIN sys.columns AS c ON c.object_id = dc.parent_object_id AND c.column_id = dc.parent_column_id ` +
+    `WHERE dc.parent_object_id = OBJECT_ID(${lit(schemaOf(ctx), ctx.table)}) AND c.name = ${lit(column)} ` +
+    `IF @df IS NOT NULL BEGIN SET @sql = N'ALTER TABLE ${t.replace(/'/g, "''")} DROP CONSTRAINT ' + QUOTENAME(@df) ` +
+    `EXEC sp_executesql @sql END`
+  );
+}
+
+/** `N'…'` around a string the catalog gives at run time, quotes doubled, as T-SQL text. */
+const runtimeLit = (expr: string) => `N'N''' + REPLACE(${expr}, N'''', N'''''') + N''''`;
+
+/**
+ * Fills @fox_ix with SQL for every index and unique constraint on `on`,
+ * scripted from the catalog when it runs. Fox's own index model has no filter,
+ * included columns or sort order, and recreating from it quietly turned a
+ * filtered unique index into an unfiltered one; the catalog has them all, and
+ * also finds an index that only INCLUDEs the column. Per index:
+ * - `drop_sql` drops it;
+ * - `create_sql` recreates it — on `copy.column` in place of `on`, and named
+ *   with `copy.suffix`, when `copy` is given (the new column of large-table mode);
+ * - `rename_sql` gives `<name>__new` the old name, when that index exists.
+ * An index counts when the column is a key, an included column, or named in
+ * its filter: SQL Server blocks ALTER and sp_rename on a column a filter names.
+ * `filtered` keeps only filtered indexes, or only unfiltered ones.
+ * No `;`: it runs inside one batch.
+ */
+function scriptIndexesFor(
+  ctx: ColumnChangeContext,
+  on: string,
+  copy?: { column: string; suffix: string },
+  filtered?: 'only' | 'none'
+): string[] {
+  const t = table(ctx).replace(/'/g, "''");
+  const swapped = (expr: string) =>
+    copy ? `REPLACE(${expr}, QUOTENAME(${lit(on)}), QUOTENAME(${lit(copy.column)}))` : expr;
+  const colsOf = (included: 0 | 1, withOrder: boolean) =>
+    `SELECT STRING_AGG(${swapped('QUOTENAME(c.name)')}${withOrder ? ` + CASE WHEN ic.is_descending_key = 1 THEN N' DESC' ELSE N'' END` : ''}, N', ') ` +
+    `WITHIN GROUP (ORDER BY ic.key_ordinal, ic.index_column_id) AS cols FROM sys.index_columns AS ic ` +
+    `JOIN sys.columns AS c ON c.object_id = ic.object_id AND c.column_id = ic.column_id ` +
+    `WHERE ic.object_id = i.object_id AND ic.index_id = i.index_id AND ic.is_included_column = ${included}`;
+  const name = copy ? `QUOTENAME(i.name + ${lit(copy.suffix)})` : 'QUOTENAME(i.name)';
+  const newName = `i.name + N'__new'`;
+  const schemaDot = schemaOf(ctx).replace(/'/g, "''") + '.';
+  const tableDot = `${schemaDot}${ctx.table.replace(/'/g, "''")}.`;
+  return [
+    'DECLARE @fox_ix TABLE (n int IDENTITY, drop_sql nvarchar(max), create_sql nvarchar(max), rename_sql nvarchar(max))',
+    'INSERT @fox_ix (drop_sql, create_sql, rename_sql) SELECT',
+    `    CASE WHEN i.is_unique_constraint = 1 THEN N'ALTER TABLE ${t} DROP CONSTRAINT ' + QUOTENAME(i.name)`,
+    `      ELSE N'DROP INDEX ' + QUOTENAME(i.name) + N' ON ${t}' END,`,
+    `    CASE WHEN i.is_unique_constraint = 1`,
+    `      THEN N'ALTER TABLE ${t} ADD CONSTRAINT ' + ${name} + N' UNIQUE ' + i.type_desc + N' (' + k.cols + N')'`,
+    `      ELSE N'CREATE ' + CASE WHEN i.is_unique = 1 THEN N'UNIQUE ' ELSE N'' END + i.type_desc + N' INDEX ' + ${name}`,
+    `        + N' ON ${t} (' + k.cols + N')' + ISNULL(N' INCLUDE (' + inc.cols + N')', N'') + ISNULL(N' WHERE ' + ${swapped('i.filter_definition')}, N'') END,`,
+    `    CASE WHEN NOT EXISTS (SELECT 1 FROM sys.indexes AS x WHERE x.object_id = i.object_id AND x.name = ${newName}) THEN NULL`,
+    `      WHEN i.is_unique_constraint = 1 THEN N'EXEC sp_rename ' + ${runtimeLit(`N'${schemaDot}' + ${newName}`)} + N', ' + ${runtimeLit('i.name')} + N', N''OBJECT'''`,
+    `      ELSE N'EXEC sp_rename ' + ${runtimeLit(`N'${tableDot}' + ${newName}`)} + N', ' + ${runtimeLit('i.name')} + N', N''INDEX''' END`,
+    '  FROM sys.indexes AS i',
+    `  CROSS APPLY (${colsOf(0, true)}) AS k`,
+    `  OUTER APPLY (${colsOf(1, false)}) AS inc`,
+    `  WHERE i.object_id = OBJECT_ID(${lit(schemaOf(ctx), ctx.table)}) AND i.is_primary_key = 0 AND i.type IN (1, 2)` +
+      (filtered === 'only' ? ' AND i.has_filter = 1' : filtered === 'none' ? ' AND i.has_filter = 0' : ''),
+    `    AND (EXISTS (SELECT 1 FROM sys.index_columns AS ic JOIN sys.columns AS c ON c.object_id = ic.object_id AND c.column_id = ic.column_id`,
+    `      WHERE ic.object_id = i.object_id AND ic.index_id = i.index_id AND c.name = ${lit(on)})`,
+    `      OR (i.has_filter = 1 AND CHARINDEX(QUOTENAME(${lit(on)}), i.filter_definition) > 0))`,
+    'DECLARE @fox_n int = 1, @fox_sql nvarchar(max)',
+  ];
+}
+
+/** Runs one column of @fox_ix in order, skipping a NULL. No `;`. */
+const runScripted = (column: 'drop_sql' | 'create_sql' | 'rename_sql') =>
+  `SET @fox_n = 1 WHILE @fox_n <= (SELECT COUNT(*) FROM @fox_ix) BEGIN SELECT @fox_sql = ${column} FROM @fox_ix WHERE n = @fox_n ` +
+  `IF @fox_sql IS NOT NULL EXEC sp_executesql @fox_sql SET @fox_n += 1 END`;
+
+function sqlServerAlterType(ctx: ColumnChangeContext): ColumnChangeStep {
+  const t = table(ctx);
+  const col = q(ctx.column.name);
+  const collate = ctx.column.collation && /char|text/i.test(ctx.targetType) ? ` COLLATE ${ctx.column.collation}` : '';
+  const alter = `ALTER TABLE ${t} ALTER COLUMN ${col} ${ctx.targetType}${collate} ${ctx.column.nullable ? 'NULL' : 'NOT NULL'}`;
+  const parentOf = (fk: ColumnChangeContext['outboundForeignKeys'][number]) =>
+    `${q(fk.referencedSchema || schemaOf(ctx))}.${q(fk.referencedTable)}`;
+  // SQL Server refuses ALTER COLUMN while an index, a key or (for a new base
+  // type) a default sits on the column: take them off, change it, put them back.
+  // Foreign keys off first and on last: one may need an index dropped here.
+  // Indexes are always scripted, even when Fox knows of none here: its model
+  // leaves out an index that only INCLUDEs the column, which blocks the ALTER too.
+  const before = [
+    ...ctx.outboundForeignKeys.map((fk) => `ALTER TABLE ${t} DROP CONSTRAINT ${q(fk.name)}`),
+    ...scriptIndexesFor(ctx, ctx.column.name),
+    runScripted('drop_sql'),
+    ...(ctx.column.defaultValue ? [dropDefaultFor(ctx, ctx.column.name)] : []),
+  ];
+  const after = [
+    ...(ctx.column.defaultValue ? [`ALTER TABLE ${t} ADD DEFAULT ${ctx.column.defaultValue} FOR ${col}`] : []),
+    runScripted('create_sql'),
+    ...ctx.outboundForeignKeys.map(
+      (fk) =>
+        `ALTER TABLE ${t} ADD CONSTRAINT ${q(fk.name)} FOREIGN KEY (${fk.columns.map(q).join(', ')}) ` +
+        `REFERENCES ${parentOf(fk)} (${fk.referencedColumns.map(q).join(', ')})`
+    ),
+  ];
+
+  const note =
+    'Most type changes rewrite every row and block the table while they run; lengthening a varchar does not. ' +
+    'Any index, foreign key or default on the column is dropped first and recreated after, as SQL Server requires, ' +
+    'in one transaction in one batch: a failure, such as a value that does not convert, undoes all of it. The indexes ' +
+    'are scripted from the catalog as it runs, so their filters, included columns and sort order come back; options ' +
+    'such as fill factor and compression do not.';
+  return {
+    phase: 'add',
+    title: `Change ${ctx.column.name} to ${ctx.targetType}`,
+    rerunSafe: false,
+    // One batch, so one statement for the splitter: no `;` until COMMIT.
+    sql: [
+      'SET XACT_ABORT ON',
+      'BEGIN TRANSACTION',
+      ...before.map((s) => `  ${s}`),
+      `  ${alter}`,
+      ...after.map((s) => `  ${s}`),
+      'COMMIT TRANSACTION;',
+    ].join('\n'),
+    note,
+  };
+}
+
 export const sqlServerColumnChange: ColumnChangeDialect = {
   triggers: true,
   foreignKeyTypesMustMatch: true,
+  viewsBlockTypeChange: false,
+
+  alterTypeSteps: (ctx) => [sqlServerAlterType(ctx)],
 
   renameSteps: (ctx) => [
       {
@@ -127,14 +258,15 @@ export const sqlServerColumnChange: ColumnChangeDialect = {
     if (ctx.column.defaultValue && !ctx.typeChanged) {
       constraints.push(`ALTER TABLE ${t} ADD DEFAULT ${ctx.column.defaultValue} FOR ${next};`);
     }
-    for (const idx of ctx.indexes) {
-      const cols = swap(idx.columns, ctx.column.name, ctx.newColumn).map(q).join(', ');
-      constraints.push(
-        idx.constraint
-          ? `ALTER TABLE ${t} ADD CONSTRAINT ${q(`${idx.name}__new`)} UNIQUE (${cols});`
-          : `CREATE ${idx.unique ? 'UNIQUE ' : ''}INDEX ${q(`${idx.name}__new`)} ON ${t} (${cols});`
-      );
-    }
+    // Every unfiltered index on the old column again on the new one, as
+    // `<name>__new`, scripted from the catalog so includes and sort order come
+    // too. Filtered ones move at the switch-over, where the column is renamed.
+    constraints.push(
+      [
+        ...scriptIndexesFor(ctx, ctx.column.name, { column: ctx.newColumn, suffix: '__new' }, 'none'),
+        runScripted('create_sql'),
+      ].join('\n') + ';'
+    );
     for (const fk of ctx.outboundForeignKeys) {
       const cols = swap(fk.columns, ctx.column.name, ctx.newColumn).map(q).join(', ');
       const parent = `${q(fk.referencedSchema || schemaOf(ctx))}.${q(fk.referencedTable)}`;
@@ -162,52 +294,50 @@ export const sqlServerColumnChange: ColumnChangeDialect = {
       // One batch, so one statement: drivers send each statement as its own
       // batch, and SQL Server refuses a batch that ends inside a transaction.
       // XACT_ABORT rolls the whole switch back if any part of it fails.
+      // A filtered index whose filter names the column blocks sp_rename, so
+      // those move here: dropped from the old column, recreated on the new one
+      // under its final name, inside the same transaction.
       sql: [
         'SET XACT_ABORT ON',
         'BEGIN TRANSACTION',
         `  DROP TRIGGER IF EXISTS ${trigger}`,
+        ...scriptIndexesFor(ctx, ctx.column.name, { column: ctx.targetName, suffix: '' }, 'only').map((s) => `  ${s}`),
+        `  ${runScripted('drop_sql')}`,
         `  EXEC sp_rename ${lit(schemaOf(ctx), ctx.table, ctx.column.name)}, ${lit(ctx.oldColumn)}, N'COLUMN'`,
         `  EXEC sp_rename ${lit(schemaOf(ctx), ctx.table, ctx.newColumn)}, ${lit(ctx.targetName)}, N'COLUMN'`,
+        `  ${runScripted('create_sql')}`,
         'COMMIT TRANSACTION;',
       ].join('\n'),
-      note: 'One transaction in one batch: readers see the old column or the new one, never neither, and a failure undoes all of it.',
+      note:
+        'One transaction in one batch: readers see the old column or the new one, never neither, and a failure undoes all of it. ' +
+        'A filtered index on the column moves across here, since SQL Server will not rename a column a filter names; it is ' +
+        'rebuilt inside the transaction.',
     });
 
-    const finish: string[] = [];
-    for (const fk of ctx.outboundForeignKeys) finish.push(`ALTER TABLE ${t} DROP CONSTRAINT ${q(fk.name)};`);
-    for (const idx of ctx.indexes) {
-      finish.push(idx.constraint ? `ALTER TABLE ${t} DROP CONSTRAINT ${q(idx.name)};` : `DROP INDEX ${q(idx.name)} ON ${t};`);
-    }
-    // A DEFAULT constraint has a generated name; find it by the column. One
-    // statement, so the variable lives as long as it is needed.
-    // EXEC() takes only literals and variables, so the statement is built in
-    // @sql first.
-    finish.push(
-      `DECLARE @df sysname, @sql nvarchar(max) SELECT @df = dc.name FROM sys.default_constraints AS dc ` +
-        `JOIN sys.columns AS c ON c.object_id = dc.parent_object_id AND c.column_id = dc.parent_column_id ` +
-        `WHERE dc.parent_object_id = OBJECT_ID(${lit(schemaOf(ctx), ctx.table)}) AND c.name = ${lit(ctx.oldColumn)} ` +
-        `IF @df IS NOT NULL BEGIN SET @sql = N'ALTER TABLE ${t.replace(/'/g, "''")} DROP CONSTRAINT ' + QUOTENAME(@df) ` +
-        `EXEC sp_executesql @sql END;`
-    );
-    finish.push(`ALTER TABLE ${t} DROP COLUMN ${q(ctx.oldColumn)};`);
-    for (const idx of ctx.indexes) {
-      finish.push(
-        idx.constraint
-          ? `EXEC sp_rename ${lit(schemaOf(ctx), `${idx.name}__new`)}, ${lit(idx.name)}, N'OBJECT';`
-          : `EXEC sp_rename ${lit(schemaOf(ctx), ctx.table, `${idx.name}__new`)}, ${lit(idx.name)}, N'INDEX';`
-      );
-    }
-    for (const fk of ctx.outboundForeignKeys) {
-      finish.push(`EXEC sp_rename ${lit(schemaOf(ctx), `${fk.name}__new`)}, ${lit(fk.name)}, N'OBJECT';`);
-    }
+    // One batch in one transaction: @fox_ix lives only inside its batch, and a
+    // failure part way leaves neither column without its indexes. The old
+    // column's indexes are found in the catalog, the ones Fox's model misses too.
+    const finish = [
+      ...ctx.outboundForeignKeys.map((fk) => `ALTER TABLE ${t} DROP CONSTRAINT ${q(fk.name)}`),
+      ...scriptIndexesFor(ctx, ctx.oldColumn),
+      runScripted('drop_sql'),
+      // A DEFAULT constraint has a generated name; find it by the column.
+      dropDefaultFor(ctx, ctx.oldColumn),
+      `ALTER TABLE ${t} DROP COLUMN ${q(ctx.oldColumn)}`,
+      runScripted('rename_sql'),
+      ...ctx.outboundForeignKeys.map(
+        (fk) => `EXEC sp_rename ${lit(schemaOf(ctx), `${fk.name}__new`)}, ${lit(fk.name)}, N'OBJECT'`
+      ),
+    ];
     steps.push({
       phase: 'finish',
       title: `Drop the old column ${ctx.oldColumn}`,
       rerunSafe: false,
-      sql: finish.join('\n'),
+      sql: ['SET XACT_ABORT ON', 'BEGIN TRANSACTION', ...finish.map((s) => `  ${s}`), 'COMMIT TRANSACTION;'].join('\n'),
       note:
         'Only after you have checked the new column and the applications using it. Its indexes, foreign keys and default ' +
-        'are dropped first, as SQL Server requires; the new ones then take their names.',
+        'are dropped first, as SQL Server requires, and the new ones then take their names — in one transaction, so a ' +
+        'failure undoes all of it.',
     });
     const rebuilt = sqlServerRebuildTriggers(ctx);
     if (rebuilt) steps.push(rebuilt);
diff --git a/packages/ui-shared/src/index.ts b/packages/ui-shared/src/index.ts
index ad28f7335..704b3af2e 100644
--- a/packages/ui-shared/src/index.ts
+++ b/packages/ui-shared/src/index.ts
@@ -167,10 +167,11 @@ export type {
 } from '@foxschema/sql';
 
 // Safe column change: what a rename or type change touches, and its steps as SQL to review.
-export { DEFAULT_COLUMN_CHANGE_BATCH, COLUMN_CHANGE_PHASES, planColumnChange } from '@foxschema/sql';
+export { DEFAULT_COLUMN_CHANGE_BATCH, COLUMN_CHANGE_PHASES, planColumnChange, columnChangeLargeTable } from '@foxschema/sql';
 export type {
   ColumnChange,
   ColumnChangeImpact,
+  ColumnChangeMode,
   ColumnChangePlan,
   ColumnChangeStep,
   ColumnChangePhase,

From 2e5ab8c8b761ae52920065eca54b3c0ac8c67fbf Mon Sep 17 00:00:00 2001
From: huyplb <huyplb@live.com>
Date: Sun, 8 Nov 2026 14:47:05 -0600
Subject: [PATCH 2/4] docs: 0.3.1 release notes, and what's in 0.3 and how to
 update in the READMEs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                      |  39 +++-
 apps/cli/README.md             |  28 ++-
 docs/releases/RELEASE_0.3.1.md | 396 +++++++++++++++++++++++++++++++++
 docs/releases/SUMMARY.md       |   5 +
 docs/releases/UNRELEASED.md    | 361 ------------------------------
 5 files changed, 461 insertions(+), 368 deletions(-)
 create mode 100644 docs/releases/RELEASE_0.3.1.md

diff --git a/README.md b/README.md
index 71e36ac07..0524320dd 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,6 @@
 
 # Fox Schema
 
-## 0.3.X COMMING SOON, NEED TO DO MORE MANUALLY TEST *
-
 **Compare schemas · generate migrations · run SQL — across 14 SQL dialects.**
 
 Install once, then open the local web UI (`foxschema`) for **Compare**, the
@@ -47,6 +45,18 @@ npm install -g foxschema
 
 Full matrix: **[docs/install.md](docs/install.md)**.
 
+## Update
+
+```bash
+npm install -g foxschema@latest          # npm
+brew update && brew upgrade foxschema    # Homebrew
+docker pull 5nickels/foxschema:latest    # Docker, then recreate the container
+```
+
+A running `foxschema` also tells you when a new version is out, links to
+**What's new**, and on a local install offers **Update now**.
+Release notes: [0.3.1](docs/releases/RELEASE_0.3.1.md) · [all versions](docs/releases/SUMMARY.md).
+
 ## Use the app
 
 ```bash
@@ -64,7 +74,23 @@ foxschema migrate --source a --target b
 foxschema tui
 ```
 
-## SQL Editor (0.2)
+## What's in 0.3
+
+| Area | What you get |
+|------|----------------|
+| **Compare & deploy** | Color-coded schema diff, cross-dialect readiness, an execute gate that reviews a missing foreign key or a narrowing type before it runs, streamed deploy progress |
+| **Snapshots** | Capture a schema version, browse the timeline and graph, compare two versions, revert, or force-migrate a version to another database |
+| **Migrations in Git** | Commit a migration to a repository, pull and push, track what was applied where |
+| **SQL Editor** | Multi-destination run, notebook cells, FoxScript, Data Peek, Safe mode, one transaction where the engine can roll back (below) |
+| **Data compare & migrate** | Compare 2,000 rows in key order between two databases, then apply up to 2,000 changes with a backup snapshot you can restore |
+| **Utilities** | **Rename Column** (in place, or Large table mode with a batched copy, on every SQL engine), Index management, Backup & Restore commands, SQL Tracer, Server insights, Clone table |
+| **Access** | Database accounts, a permission builder that writes GRANT / REVOKE, an inspector of who holds what, an access report |
+| **Workspaces & sign-in** | Personal and team workspaces, invites, Google / Microsoft / GitHub sign-in, admin roles and a role → permission matrix |
+| **Workflow** | Optional designer and engine for scheduled and triggered jobs (below) |
+
+Every feature, where it lives and how it is tested: [docs/FEATURE_MAP.md](docs/FEATURE_MAP.md).
+
+## SQL Editor
 
 A full query workbench next to Schema Sync — not a thin prompt.
 
@@ -81,7 +107,7 @@ A full query workbench next to Schema Sync — not a thin prompt.
 | **Schema explorer** | Insert names, autocomplete, edit table / view source |
 | **Variables & secrets** | `${{name}}`, `@set`, session secrets, code-cell `vars` |
 | **Safe mode** | Confirm writes; bookmarks & samples included |
-| **Access control** | Optional `admin` / `editor` / `viewer` roles when multi-user login is on |
+| **Access control** | Sign-in on every install; `admin` / `editor` / `viewer` roles and per-workspace roles |
 
 Walkthrough: [User guide → SQL Editor](docs/user-guide.md#sql-editor).
 
@@ -133,8 +159,9 @@ Open **http://localhost:3210**. Guide: [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md).
 PostgreSQL · CockroachDB · YugabyteDB · MySQL · MariaDB · TiDB · SQL Server ·
 Azure SQL · Oracle · IBM Db2 · SQLite · DuckDB · ClickHouse · Amazon Redshift
 
-MongoDB and Redis appear in the connection list (settings only — no schema
-compare). One product — Docker image includes Db2 on linux/amd64.
+MongoDB and Redis run a SQL subset in the editor (single-table SELECT, INSERT,
+UPDATE, DELETE; Redis keys read as tables) — no schema compare. One product —
+Docker image includes Db2 on linux/amd64.
 
 ## Package notes (npm)
 
diff --git a/apps/cli/README.md b/apps/cli/README.md
index 2110974a7..a27679214 100644
--- a/apps/cli/README.md
+++ b/apps/cli/README.md
@@ -14,7 +14,33 @@ npm install -g foxschema
 foxschema                 # UI → http://localhost:3210
 ```
 
-## SQL Editor (0.2)
+## Update
+
+```bash
+npm install -g foxschema@latest          # npm
+brew update && brew upgrade foxschema    # Homebrew
+docker pull 5nickels/foxschema:latest    # Docker, then recreate the container
+```
+
+A running `foxschema` tells you when a new version is out and offers **Update now**.
+What's new: [0.3.1 release notes](https://github.com/tedious-code/foxschema/blob/main/docs/releases/RELEASE_0.3.1.md).
+
+## What's in 0.3
+
+| | |
+|--|--|
+| Compare & deploy | Schema diff, cross-dialect readiness, a review before a missing FK or a narrowing type runs |
+| Snapshots | Capture schema versions, compare, revert, force-migrate to another database |
+| Migrations in Git | Commit, pull and push migrations; track what was applied |
+| SQL Editor | Multi-destination run, notebook cells, Data Peek, Safe mode, one transaction |
+| Data compare & migrate | 2,000 rows in key order; apply up to 2,000 changes with a restorable backup |
+| Utilities | **Rename Column** on every SQL engine (in place or a batched copy), indexes, backup commands, SQL Tracer |
+| Access | Database accounts, GRANT / REVOKE builder, who-holds-what inspector |
+| Workspaces & sign-in | Team workspaces, invites, Google / Microsoft / GitHub sign-in, roles |
+
+All features: [FEATURE_MAP.md](https://github.com/tedious-code/foxschema/blob/main/docs/FEATURE_MAP.md).
+
+## SQL Editor
 
 Multi-destination queries, notebook-style cells, Data Peek, FoxScript, variables,
 and Safe mode — next to Schema Sync in the same UI.
diff --git a/docs/releases/RELEASE_0.3.1.md b/docs/releases/RELEASE_0.3.1.md
new file mode 100644
index 000000000..28aef7c4e
--- /dev/null
+++ b/docs/releases/RELEASE_0.3.1.md
@@ -0,0 +1,396 @@
+# Fox Schema 0.3.1 — What's new
+
+> **For users:** this is the page the in-app update toast links to (**What's new**).
+
+Since **`v0.2.111`**, the last tagged release (npm last shipped `0.2.220`). npm `foxschema@0.3.1`, Homebrew `foxschema 0.3.1`, and Docker
+Hub / GHCR `5nickels/foxschema:v0.3.1` and `ghcr.io/tedious-code/foxschema:v0.3.1`.
+
+## Update
+
+```bash
+npm install -g foxschema@latest          # npm
+brew update && brew upgrade foxschema    # Homebrew
+docker pull 5nickels/foxschema:latest    # Docker, then recreate the container
+```
+
+A running `foxschema open` also offers **Update now** in its update toast.
+**Every install now requires sign-in**: the first start after updating asks you to
+create an account (or open the one-time launch link `foxschema open` prints).
+
+---
+
+## Rename Column: in place by default, every SQL engine
+
+**Rename Column** (Utilities) renames a column, changes its type, or both.
+
+- **A type change is one `ALTER` in place by default**: `ALTER COLUMN … TYPE`
+  on the PostgreSQL family, `MODIFY COLUMN` on MySQL, MariaDB and TiDB
+  (restating NOT NULL, the default, the collation and the comment, which
+  `MODIFY` would otherwise drop), and on SQL Server one transaction that takes
+  the column's indexes, foreign keys and default off and puts them back. The
+  indexes are scripted from the catalog as it runs, so filters, included
+  columns and sort order come back.
+- **Large table mode** (a checkbox) does it in three parts instead, so a big
+  table stays writable: add a nullable column, copy rows in batches with
+  **processed / total**, then constraints, triggers and the switch-over. On
+  PostgreSQL, YugabyteDB, CockroachDB, MySQL, MariaDB, TiDB, SQL Server and
+  Azure SQL.
+- **A size warning** from the catalog's estimate: from about a million rows or
+  1 GB, Fox says the ALTER can block writes and points at large-table mode.
+- **Narrowing** a type, text to a number or boolean, or another conversion
+  that can fail or truncate is a warning to acknowledge before Run.
+- A type change alone lists views, triggers, functions and procedures that may
+  use the column in one line each; a rename shows the lines that name it, with
+  the new name.
+
+**Now on every SQL engine.** Oracle (`MODIFY`), Db2 (`SET DATA TYPE`, then a
+`REORG` Db2 needs before it takes writes), SQLite (rename only; a type change
+needs a table rebuild, not covered yet), DuckDB (refused while the table has an
+index, which DuckDB will not alter), Redshift (rename, and lengthening a
+VARCHAR), ClickHouse (`MODIFY COLUMN`, a nullable column stays `Nullable`; not a
+sorting-key column). Fox refuses a change an engine cannot make, with the
+reason, instead of SQL that fails there.
+
+Run live on PostgreSQL, MySQL, MariaDB, TiDB, SQL Server, CockroachDB, Oracle,
+Db2, SQLite, DuckDB and ClickHouse.
+
+## Data compare: 2,000 rows in key order; migrate the same window
+
+**Compare data** still lines up the pages each grid has already loaded, and
+one-sided rows on a cut-short page stay unresolved. **Compare 2,000 rows**
+re-reads both sides in key order — a fixed window, not a setting — and
+classifies every row inside it. Filters (All / Changed / Only in source /
+Only in target / Unresolved / Matching) and pages (50–500) walk that window
+in memory. **Back to loaded rows** returns to the grids you ran. Redis and
+MongoDB have no ordered window.
+
+**Data migrate** applies up to **2,000** row ops. The screen and
+`POST /api/data-migrate/execute` share one number (`DATA_MIGRATE_MAX_OPS`),
+so a compare window's differences can be applied from the screen that found
+them. Past 2,000 ops still points at Server Beam.
+
+## Read-only is a permission
+
+**Save and change** (`app.write`) is install-wide. Without it an account may
+call only GET, or a route that declares it reads (running a SELECT, comparing,
+loading a schema). The **Demo** role is the role without it and without
+**Manage own account** — a published demo's shared login. Strip `app.write`
+from any role and those accounts read only too. A new POST is closed to such
+an account until its route declares `reads`. See
+[DEPLOYMENT.md](../DEPLOYMENT.md#publishing-a-demo).
+
+## Personal workspaces lend no more than the account holds
+
+A viewer account can still share its workspace and manage members, but it
+invites viewers only — never an editor or owner who could run DDL or GRANT
+with credentials handed out for reading. A membership stored above that
+ceiling still acts at the ceiling. A demo login is a viewer in every
+workspace. Shared workspace owners can still grant owner.
+
+## Redis keys as tables
+
+A Redis prefix (`users` → `users:*`) is one table, one key per row: hash
+fields and JSON object fields become columns. A list, set, sorted set or
+stream key is a table of its own; its elements are the rows. Every read is
+bounded (no `KEYS`, no whole-key `LRANGE`).
+
+## One workspace on the rail
+
+The workspace you are in sits under the Fox mark on the left rail — switch,
+invites (amber dot), settings, public join, and create. It is no longer inside
+the profile menu. A launch session hides the button. SQL editor tabs in this
+browser follow the workspace.
+
+## SQL Editor: the schema you are browsing, and one transaction
+
+Run applies the saved connection's schema (`CURRENT SCHEMA` / `search_path`)
+so unqualified names resolve to the tables the explorer shows, not the
+database user's default. Picking a connection in the explorer checks that
+destination alone. **One transaction** wraps a multi-statement SQL run per
+destination; a failure rolls it back. Code cells and `-- @set` stay statement
+by statement. Redis, MongoDB and ClickHouse cannot roll back, so a Run with One
+transaction is refused there.
+
+## SQL Editor: the run rail, and installing a missing driver
+
+Each statement's ▶ and run checkbox sit on a rail left of the editor, with its
+**In [n]** number — the one the Run tooltip and `Out [n]` use. Click the number
+to select the statement. With Safe mode on it turns amber for a write Run will
+confirm, and red with `!` for an UPDATE or DELETE with no WHERE. Two statements
+on one line get a row each, and a long statement's row stays at the top while
+you read through it. Hover a row for its copy button, which copies the
+statement with its variables filled in (secrets masked).
+
+When a credential's driver package is missing, the schema browser and a failed
+run — in either results layout — offer **Install driver**. Installing runs npm
+on the server, so it needs the new **Install drivers** permission (admins by
+default, from the account role); without it the banner gives the command to run.
+Every Install button shares one status, and the server runs one install at a time.
+
+Home → **Drivers** (under Services) lists each driver package this install can
+load, with its version. Opening Home checks npm for newer releases. **Install**,
+**Update**, and **Remove** use the same **Install drivers** permission; only
+SQLite (`better-sqlite3`, the metadata store) cannot be removed. Install saves
+the package on `@foxschema/db` so a missing peer (Redis, MongoDB) is actually
+fetched, including nested dependencies. **Update** also pins every workspace
+that already lists the package (so SQL Server is not stuck on the web app's
+`12.7.13` while only `@foxschema/db` moves), and rewrites a caret peer that
+would block a major (`^1.5` vs DuckDB 2). Two clicks queue rather than
+running two npm processes in one `node_modules` (that was the `ENOTEMPTY`
+failure). Remove/update retries leftover rename dirs and does not reload the
+page when the lockfile changes. Load and npm errors keep a package-relative
+file (`@clickhouse/client/dist/index.js`), not the install directory; action
+responses no longer return `cwd` / raw npm output. A dropped TCP socket
+(`ECONNRESET`) is explained as the database closing before login.
+
+## Workflow: steer a paused run; connections stay in their workspace
+
+**Runs** can cancel a live job and answer **Ask a person**. Saving or running
+a workflow that names another workspace's connection is refused — the engine
+is install-wide; the connection is not.
+
+## Index custom SQL is read-only; Db2 reorgs the table's indexes
+
+A custom fragmentation probe must be one `SELECT`. GRANT / REVOKE scripts stop
+at the first failure. Db2 defrag reorganises every index on the table, quoting
+catalog names.
+
+## Left-rail views
+
+- **Snapshots** is its own left-rail view (schema history / Lokee). **Applies**
+  at the bottom of the rail is migration-run history. They are not the same list.
+- **Utils** is its own view (Index Management, **Backup & Restore**, Clone
+  Table, insights, Query files, DB users & grants) — not a SQL Editor sidebar.
+- Saved credentials are counted by dialect on Home (no host, user, or name list); Home continues last compare / query.
+  **⌘K** / the command palette list the same views the rail shows.
+
+## Team workspaces
+
+Connections, snapshots, migration runs, secrets and data-migrate history belong
+to a **workspace**, not to one account. Every account has a personal workspace
+(always private; its role follows the account). Admins create shared ones;
+**Members can create workspaces** lets others. Invite by email — they join when
+they accept (14 days). A workspace is **private** (invite only) or **public**
+(anyone signed in can join as viewer or editor, never owner). Admins see every
+workspace under Access control → Workspaces and open one only by joining.
+Install keys (code cells, Git, workflow, admin, create-workspace) come from the
+account role; the rest from the member’s role in this workspace.
+
+## Execute opens the review for a conflict
+
+A missing foreign-key target or an unacknowledged narrowing type change used
+to leave Execute looking runnable while a click still deployed. The button
+stays clickable and **opens that review** instead. Drop dependencies,
+destructive drops, MySQL binlog risk, a required Git commit and a disconnected
+target still disable it.
+
+## SQL is classified the way the database reads it
+
+Permission gates, data-migrate and the single-statement check lex SQL with
+the destination dialect’s readings (MySQL `#` / `/*!…*/`, PostgreSQL dollar
+quotes, session `sql_mode`, …). A closed `-- @node` … `-- @end` fence that
+reaches `/sql/execute` is two comments; the SQL between them is still priced.
+The splitter and the keyword-scan stripper share one tokenizer.
+
+## Send feedback
+
+**Send feedback** on the profile menu turns a bug, an idea or a question into a
+GitHub issue. It opens pre-filled on GitHub and you submit it with your own
+account: Fox Schema holds no token and posts nothing. The app details it adds
+(version, browser, workspace, engines in use, never a host or database) are
+listed first and can be left out, and a line that looks like a password is
+flagged before anything leaves.
+
+## A development server stays on this machine
+
+- Without `NODE_ENV=production`, `npm start` in `apps/web` now listens on
+  `127.0.0.1` instead of every address, and a network `LISTEN_HOST` is refused
+  at startup. Such a server encrypts saved credentials with a development key
+  and sends its session cookie without the Secure flag. To serve the network,
+  set `NODE_ENV=production` (with `APP_ENCRYPTION_KEY`), as Docker does; for a
+  development server on a network you trust, set `FOX_INSECURE_DEV=1`.
+
+## Origin policy
+
+`npm run dev` allows this machine's own literal IPs on ports 5173 / 5199 / 3210 /
+3211, so a Vite **Network:** URL works. Arbitrary hostnames are still refused.
+Production stays same-origin; set `FOX_ALLOWED_ORIGINS` for a split hostname.
+See [DEPLOYMENT.md](../DEPLOYMENT.md#origin-policy).
+
+## Schema history (Lokee): definitions are compared the way Compare compares them
+
+Compare and Lokee used to decide "is this view / routine / trigger the same?"
+differently. Compare folded case and dropped schema qualifiers; Lokee only
+collapsed whitespace. So an object Compare called **unchanged** could still get
+a new Lokee version — for example after the engine re-cased a view on storage,
+or when the same body was captured with and without its `schema.` prefix.
+
+Both now use one rule (`normalizeDefinitionText` in `@foxschema/sql`):
+
+- whitespace and a trailing `;` are formatting;
+- keyword and identifier case is folded;
+- the history's own schema qualifier is ignored (`app.orders` = `orders`);
+- **the case inside string literals is kept**: `status = 'Active'` and
+  `status = 'active'` select different rows. Compare used to fold these too and
+  report a real change as unchanged; it now reports it as modified.
+
+Lokee applies the rule only when computing an object's hash. The definition it
+stores is still exactly as captured, because revert builds its DDL from it.
+
+### What you will see once
+
+Hashes of views, routines and triggers change under the new rule. The first
+capture of each existing history after upgrading records **one new version**
+listing those objects as modified, although their text has not changed. After
+that capture, versions appear only for real changes.
+
+Revert and force-migrate are not affected by the boundary: when two stored
+versions' hashes differ, both sides are re-hashed with the current rule before
+deciding whether an object changed.
+
+## Sign-in is required on every install
+
+Fox used to open straight into the workspace on a personal install, and a
+multi-user server let anyone register. Both are gone: **every install now asks
+for an email and password**, and only an administrator can create accounts.
+
+- **First launch** shows *Create the administrator account*. On an install used
+  before, this claims the existing local account, so saved connections, history
+  and workflows stay where they are. When the install is bound to an email
+  (`APP_USER_EMAIL`), that email is used.
+- **Setup code.** From the machine Fox runs on, setup needs only the password.
+  From anywhere else, including through a reverse proxy, setup also asks for a
+  one-time code that the server prints to its log (`docker logs <container>` on
+  Docker). Setup closes for good once an account can sign in.
+- **No self-registration.** `POST /api/auth/register` answers 403. Admins add
+  people from the **Add user** form in the admin Access panel with a starting password and a role.
+- **SSO signs in existing accounts only.** A first SSO sign-in no longer creates
+  an account; an admin adds the email first.
+- **Sign-in is rate-limited** to 20 attempts per 15 minutes per client.
+- A server that already ran with `LOCAL_SINGLE_USER=false` keeps its accounts and
+  is never offered setup. `AUTH_REQUIRED` is no longer read; `LOCAL_SINGLE_USER`
+  now only marks a personal install (machine-level actions such as driver
+  install and updates).
+
+## Start using Fox before creating an account
+
+`foxschema open` now opens straight into the workspace on a personal install,
+signed in as its owner through a one-time launch link: no account first. A
+banner asks you to **Create your account** (also in the profile menu, where *App
+users & roles* waits for the account); after 7 days
+(`FOX_REGISTRATION_GRACE_DAYS`) Fox asks for it before anything else, and adding
+users or changing sign-in settings needs it from the start. The *Get product
+updates* screen is skipped: the account form offers Fox news instead.
+
+- The link works once, for two minutes, only from the machine Fox runs on, and
+  only while Fox listens on that machine alone. Docker images, shared servers
+  and installs opened to the network keep first-run setup as before.
+- **Verify your email.** The account created at setup is sent a code, entered in
+  a banner. It goes through the install's SMTP relay when one is set up,
+  otherwise through the Fox mail service on foxschema.com (`FOX_VERIFY_MAIL_URL`;
+  `off` to send nowhere). Accounts an admin adds are not asked.
+
+## Sign-in: invites, forgot password, Google / Microsoft / GitHub
+
+- **New sign-in pages.** First launch is a *Create your account* page; the
+  sign-in page adds **Forgot password?** and **Have an invite or reset code?**.
+  New passwords are checked as you type against the server's own rules, and a
+  Caps Lock warning shows on password fields.
+- **Invites.** *Add user* without a password sends a one-time invite code; the
+  person chooses their own password. Unaccepted invites are marked *Invited*,
+  and each user row can resend an invite or send a reset code.
+- **Forgot password.** A one-time code (30 minutes, single use) by email, or,
+  without email set up, in the server log and via
+  `foxschema reset-password [email]`. Setting the new password signs out every
+  other session. The reply never says whether the email has an account.
+- **Email me Fox news** on *Create your account* and when accepting an invite:
+  unticked by default; when ticked, the email goes to the Fox subscriber list
+  (the same foxschema.com endpoint as the first-run wizard, which notifies
+  contact@foxschema.com). Never sent on a password reset, and a signup service
+  that is down never blocks creating the account.
+- **Google and GitHub with no OAuth app of your own**: turn on *Use the Fox
+  sign-in service* (Access control → Sign-in, or `FOX_SSO_BROKER=on`).
+  foxschema.com does the sign-in and returns a signed, single-use assertion
+  bound to this install's callback and the browser that started; only
+  existing accounts sign in. Off by default, since it trusts foxschema.com to
+  say who is signing in.
+- **Admin → Access control → Sign-in** configures Google, Microsoft and GitHub
+  sign-in (with the redirect URL to register), the email relay (Hostinger /
+  Gmail / Microsoft 365 presets and a test button) and the public URL — for the
+  desktop app, where there are no environment variables to set. Environment
+  variables still win and show read-only.
+
+### Security fixes
+
+- **SSO accepted unverified emails.** Microsoft's `email` claim with the
+  multi-tenant endpoint is whatever any tenant's admin typed, so an attacker
+  with their own tenant could sign in as any Fox user whose email they set
+  ("nOAuth"). Microsoft now accepts only personal accounts, verified domains
+  (`xms_edov`) or the configured tenant; Google requires `email_verified`;
+  GitHub uses only the verified primary address. SSO also uses PKCE now.
+- **Rate limits could be skipped** by sending a made-up `X-Forwarded-For`: every
+  peer's forwarding headers were trusted. Now only loopback and private-network
+  peers are (`FOX_TRUST_PROXY` to change).
+- **Per-email sign-in lockout**: 5 failures lock the email for 15 minutes, for
+  emails with and without accounts alike; a wrong email now costs the same
+  time as a wrong password.
+- **Session tokens are stored hashed.** Migration 20 clears existing sessions,
+  so **everyone signs in once more** after upgrading.
+- **Password rules**: at least 10 characters, not a common password, not the
+  email name. Existing passwords keep working.
+
+## Migrations in Git
+
+Commit a migration to a Git repository before it runs, and run teammates'
+migrations from theirs. Built in (no `git` binary needed); works with GitHub,
+GitLab, Bitbucket and Azure DevOps over HTTPS with an access token.
+
+- **Access control → Git** (new `git.manage` permission): add repositories —
+  HTTPS URL, default branch, folder, access token (encrypted, never shown
+  again), and optionally **require a commit** before any migration runs.
+- **Migrate → Commit to Git**: pick a branch or create one, write a note (the
+  commit message), review the exact file, then Commit or Commit & push.
+  **Execute** then runs the migration *from that commit*.
+- **Applies → Git** (new `git.view` permission, granted once on upgrade to
+  roles that can browse or compare schemas): fetch, pull and push; each
+  migration marked applied or incoming for the connected target; review and
+  run incoming ones from their commit.
+- Migration files are plain SQL with the steps kept in comments, so Fox runs
+  exactly what was reviewed. Passwords in account statements are replaced with
+  `<password>`, and a file that still carries a credential is refused.
+- Remotes are `https://` only; on a shared server, private and internal
+  addresses are refused at connect time (including IPv6 spellings of them).
+
+## Backup & Restore
+
+**Utils → Backup & Restore** writes the engine's backup and restore commands
+for the credential at the top of the workspace.
+
+- The amber banner says where the command runs (your machine, the database
+  server, or a cloud snapshot) — that is what the folder field means.
+- Passwords stay out of the command. Folder / format / scope can be saved as
+  *your default for this engine* (`GET` / `PUT /api/backup-settings`).
+- SQL commands (SQL Server, CockroachDB, ClickHouse, DuckDB) open in the
+  Editor; shell tools you copy.
+- Where the backup is server-side SQL, **Run backup now** runs it after a
+  confirmation (needs Change schema). SQL Server, Db2 and ClickHouse list the
+  backups they recorded; pick one and the restore reads it. Restores still only
+  open in the SQL Editor.
+
+See [user-guide.md](../user-guide.md#utilities).
+
+## Access: Grants show what is held
+
+**Access → Permissions → Grants** opens on the privileges that principal
+already holds. The SQL is only the difference (new ticks GRANT, cleared boxes
+REVOKE). EXECUTE on procedures and functions is read too, so those rows open
+ticked. Privileges the grid cannot show — CONNECT, schema USAGE, DENY — are
+listed under it and not revoked as a side-effect of ticking one table. Permission **Diff** is a
+separate tab (desired state vs catalog, including DENY).
+
+## Sessions
+
+A session unused for 8 hours ends (`FOX_SESSION_IDLE_HOURS`; `0` turns this
+off), whatever its 7-day expiry. **Sign out other sessions** is on the profile
+menu.
+
diff --git a/docs/releases/SUMMARY.md b/docs/releases/SUMMARY.md
index e4c65ee1d..8f705e89e 100644
--- a/docs/releases/SUMMARY.md
+++ b/docs/releases/SUMMARY.md
@@ -8,6 +8,11 @@ Current map of the product: [CODE_MAP.md](../CODE_MAP.md). How to install: [inst
 
 [UNRELEASED.md](UNRELEASED.md)
 
+## 0.3.1
+
+[RELEASE_0.3.1.md](RELEASE_0.3.1.md) — since 0.2.111
+
+- Rename Column: a type change is one ALTER in place by default, Large table mode copies in batches, and every SQL engine is covered.
 - Snapshots (schema history) and Applies (migration runs) are separate rail items. Utils is its own view.
 - Connections, snapshots, secrets, and migration history belong to a workspace. One workspace is active at a time.
 - Every install requires sign-in. `foxschema open` on a personal machine can start with a one-time launch link, then asks you to create an account.
diff --git a/docs/releases/UNRELEASED.md b/docs/releases/UNRELEASED.md
index 27a6cd3ff..0cd34532a 100644
--- a/docs/releases/UNRELEASED.md
+++ b/docs/releases/UNRELEASED.md
@@ -2,364 +2,3 @@
 
 Notes for the next release. At ship time, rename this file to that version's
 `RELEASE_<version>.md` and use it as the GitHub Release body.
-
-## Rename Column: three parts, and Run from Utils
-
-**Rename Column** (Utilities) is add → copy → finish. The first part creates the new
-column nullable, with no default. The second copies rows in a loop of batches
-and shows **processed / total** (preview SQL is the loop; Run still patches
-one batch at a time). The third moves constraints, indexes, the catalog
-comment, and table triggers, then switches over. Each part has preview SQL:
-**Copy** or **Run** here (Safe mode confirms). **Execute all** runs every part
-in order. Copy all / Open in editor still send the whole script.
-
-Narrowing a type (bigger to smaller), converting text to a number or boolean,
-or another conversion that can fail or truncate is a warning: acknowledge it
-before Run or Execute all.
-
-Generated scripts were executed live on PostgreSQL, YugabyteDB, CockroachDB,
-MySQL, MariaDB, TiDB, and SQL Server (Azure SQL uses the same T-SQL). TiDB
-cannot rename two columns in one ALTER, so the switch is two statements.
-Oracle, SQLite, Redshift, Db2, ClickHouse, and DuckDB still refuse with
-“not yet.”
-
-## Data compare: 2,000 rows in key order; migrate the same window
-
-**Compare data** still lines up the pages each grid has already loaded, and
-one-sided rows on a cut-short page stay unresolved. **Compare 2,000 rows**
-re-reads both sides in key order — a fixed window, not a setting — and
-classifies every row inside it. Filters (All / Changed / Only in source /
-Only in target / Unresolved / Matching) and pages (50–500) walk that window
-in memory. **Back to loaded rows** returns to the grids you ran. Redis and
-MongoDB have no ordered window.
-
-**Data migrate** applies up to **2,000** row ops. The screen and
-`POST /api/data-migrate/execute` share one number (`DATA_MIGRATE_MAX_OPS`),
-so a compare window's differences can be applied from the screen that found
-them. Past 2,000 ops still points at Server Beam.
-
-## Read-only is a permission
-
-**Save and change** (`app.write`) is install-wide. Without it an account may
-call only GET, or a route that declares it reads (running a SELECT, comparing,
-loading a schema). The **Demo** role is the role without it and without
-**Manage own account** — a published demo's shared login. Strip `app.write`
-from any role and those accounts read only too. A new POST is closed to such
-an account until its route declares `reads`. See
-[DEPLOYMENT.md](../DEPLOYMENT.md#publishing-a-demo).
-
-## Personal workspaces lend no more than the account holds
-
-A viewer account can still share its workspace and manage members, but it
-invites viewers only — never an editor or owner who could run DDL or GRANT
-with credentials handed out for reading. A membership stored above that
-ceiling still acts at the ceiling. A demo login is a viewer in every
-workspace. Shared workspace owners can still grant owner.
-
-## Redis keys as tables
-
-A Redis prefix (`users` → `users:*`) is one table, one key per row: hash
-fields and JSON object fields become columns. A list, set, sorted set or
-stream key is a table of its own; its elements are the rows. Every read is
-bounded (no `KEYS`, no whole-key `LRANGE`).
-
-## One workspace on the rail
-
-The workspace you are in sits under the Fox mark on the left rail — switch,
-invites (amber dot), settings, public join, and create. It is no longer inside
-the profile menu. A launch session hides the button. SQL editor tabs in this
-browser follow the workspace.
-
-## SQL Editor: the schema you are browsing, and one transaction
-
-Run applies the saved connection's schema (`CURRENT SCHEMA` / `search_path`)
-so unqualified names resolve to the tables the explorer shows, not the
-database user's default. Picking a connection in the explorer checks that
-destination alone. **One transaction** wraps a multi-statement SQL run per
-destination; a failure rolls it back. Code cells and `-- @set` stay statement
-by statement. Redis, MongoDB and ClickHouse cannot roll back, so a Run with One
-transaction is refused there.
-
-## SQL Editor: the run rail, and installing a missing driver
-
-Each statement's ▶ and run checkbox sit on a rail left of the editor, with its
-**In [n]** number — the one the Run tooltip and `Out [n]` use. Click the number
-to select the statement. With Safe mode on it turns amber for a write Run will
-confirm, and red with `!` for an UPDATE or DELETE with no WHERE. Two statements
-on one line get a row each, and a long statement's row stays at the top while
-you read through it. Hover a row for its copy button, which copies the
-statement with its variables filled in (secrets masked).
-
-When a credential's driver package is missing, the schema browser and a failed
-run — in either results layout — offer **Install driver**. Installing runs npm
-on the server, so it needs the new **Install drivers** permission (admins by
-default, from the account role); without it the banner gives the command to run.
-Every Install button shares one status, and the server runs one install at a time.
-
-Home → **Drivers** (under Services) lists each driver package this install can
-load, with its version. Opening Home checks npm for newer releases. **Install**,
-**Update**, and **Remove** use the same **Install drivers** permission; only
-SQLite (`better-sqlite3`, the metadata store) cannot be removed. Install saves
-the package on `@foxschema/db` so a missing peer (Redis, MongoDB) is actually
-fetched, including nested dependencies. **Update** also pins every workspace
-that already lists the package (so SQL Server is not stuck on the web app's
-`12.7.13` while only `@foxschema/db` moves), and rewrites a caret peer that
-would block a major (`^1.5` vs DuckDB 2). Two clicks queue rather than
-running two npm processes in one `node_modules` (that was the `ENOTEMPTY`
-failure). Remove/update retries leftover rename dirs and does not reload the
-page when the lockfile changes. Load and npm errors keep a package-relative
-file (`@clickhouse/client/dist/index.js`), not the install directory; action
-responses no longer return `cwd` / raw npm output. A dropped TCP socket
-(`ECONNRESET`) is explained as the database closing before login.
-
-## Workflow: steer a paused run; connections stay in their workspace
-
-**Runs** can cancel a live job and answer **Ask a person**. Saving or running
-a workflow that names another workspace's connection is refused — the engine
-is install-wide; the connection is not.
-
-## Index custom SQL is read-only; Db2 reorgs the table's indexes
-
-A custom fragmentation probe must be one `SELECT`. GRANT / REVOKE scripts stop
-at the first failure. Db2 defrag reorganises every index on the table, quoting
-catalog names.
-
-## Left-rail views
-
-- **Snapshots** is its own left-rail view (schema history / Lokee). **Applies**
-  at the bottom of the rail is migration-run history. They are not the same list.
-- **Utils** is its own view (Index Management, **Backup & Restore**, Clone
-  Table, insights, Query files, DB users & grants) — not a SQL Editor sidebar.
-- Saved credentials are counted by dialect on Home (no host, user, or name list); Home continues last compare / query.
-  **⌘K** / the command palette list the same views the rail shows.
-
-## Team workspaces
-
-Connections, snapshots, migration runs, secrets and data-migrate history belong
-to a **workspace**, not to one account. Every account has a personal workspace
-(always private; its role follows the account). Admins create shared ones;
-**Members can create workspaces** lets others. Invite by email — they join when
-they accept (14 days). A workspace is **private** (invite only) or **public**
-(anyone signed in can join as viewer or editor, never owner). Admins see every
-workspace under Access control → Workspaces and open one only by joining.
-Install keys (code cells, Git, workflow, admin, create-workspace) come from the
-account role; the rest from the member’s role in this workspace.
-
-## Execute opens the review for a conflict
-
-A missing foreign-key target or an unacknowledged narrowing type change used
-to leave Execute looking runnable while a click still deployed. The button
-stays clickable and **opens that review** instead. Drop dependencies,
-destructive drops, MySQL binlog risk, a required Git commit and a disconnected
-target still disable it.
-
-## SQL is classified the way the database reads it
-
-Permission gates, data-migrate and the single-statement check lex SQL with
-the destination dialect’s readings (MySQL `#` / `/*!…*/`, PostgreSQL dollar
-quotes, session `sql_mode`, …). A closed `-- @node` … `-- @end` fence that
-reaches `/sql/execute` is two comments; the SQL between them is still priced.
-The splitter and the keyword-scan stripper share one tokenizer.
-
-## Send feedback
-
-**Send feedback** on the profile menu turns a bug, an idea or a question into a
-GitHub issue. It opens pre-filled on GitHub and you submit it with your own
-account: Fox Schema holds no token and posts nothing. The app details it adds
-(version, browser, workspace, engines in use, never a host or database) are
-listed first and can be left out, and a line that looks like a password is
-flagged before anything leaves.
-
-## A development server stays on this machine
-
-- Without `NODE_ENV=production`, `npm start` in `apps/web` now listens on
-  `127.0.0.1` instead of every address, and a network `LISTEN_HOST` is refused
-  at startup. Such a server encrypts saved credentials with a development key
-  and sends its session cookie without the Secure flag. To serve the network,
-  set `NODE_ENV=production` (with `APP_ENCRYPTION_KEY`), as Docker does; for a
-  development server on a network you trust, set `FOX_INSECURE_DEV=1`.
-
-## Origin policy
-
-`npm run dev` allows this machine's own literal IPs on ports 5173 / 5199 / 3210 /
-3211, so a Vite **Network:** URL works. Arbitrary hostnames are still refused.
-Production stays same-origin; set `FOX_ALLOWED_ORIGINS` for a split hostname.
-See [DEPLOYMENT.md](../DEPLOYMENT.md#origin-policy).
-
-## Schema history (Lokee): definitions are compared the way Compare compares them
-
-Compare and Lokee used to decide "is this view / routine / trigger the same?"
-differently. Compare folded case and dropped schema qualifiers; Lokee only
-collapsed whitespace. So an object Compare called **unchanged** could still get
-a new Lokee version — for example after the engine re-cased a view on storage,
-or when the same body was captured with and without its `schema.` prefix.
-
-Both now use one rule (`normalizeDefinitionText` in `@foxschema/sql`):
-
-- whitespace and a trailing `;` are formatting;
-- keyword and identifier case is folded;
-- the history's own schema qualifier is ignored (`app.orders` = `orders`);
-- **the case inside string literals is kept**: `status = 'Active'` and
-  `status = 'active'` select different rows. Compare used to fold these too and
-  report a real change as unchanged; it now reports it as modified.
-
-Lokee applies the rule only when computing an object's hash. The definition it
-stores is still exactly as captured, because revert builds its DDL from it.
-
-### What you will see once
-
-Hashes of views, routines and triggers change under the new rule. The first
-capture of each existing history after upgrading records **one new version**
-listing those objects as modified, although their text has not changed. After
-that capture, versions appear only for real changes.
-
-Revert and force-migrate are not affected by the boundary: when two stored
-versions' hashes differ, both sides are re-hashed with the current rule before
-deciding whether an object changed.
-
-## Sign-in is required on every install
-
-Fox used to open straight into the workspace on a personal install, and a
-multi-user server let anyone register. Both are gone: **every install now asks
-for an email and password**, and only an administrator can create accounts.
-
-- **First launch** shows *Create the administrator account*. On an install used
-  before, this claims the existing local account, so saved connections, history
-  and workflows stay where they are. When the install is bound to an email
-  (`APP_USER_EMAIL`), that email is used.
-- **Setup code.** From the machine Fox runs on, setup needs only the password.
-  From anywhere else, including through a reverse proxy, setup also asks for a
-  one-time code that the server prints to its log (`docker logs <container>` on
-  Docker). Setup closes for good once an account can sign in.
-- **No self-registration.** `POST /api/auth/register` answers 403. Admins add
-  people from the **Add user** form in the admin Access panel with a starting password and a role.
-- **SSO signs in existing accounts only.** A first SSO sign-in no longer creates
-  an account; an admin adds the email first.
-- **Sign-in is rate-limited** to 20 attempts per 15 minutes per client.
-- A server that already ran with `LOCAL_SINGLE_USER=false` keeps its accounts and
-  is never offered setup. `AUTH_REQUIRED` is no longer read; `LOCAL_SINGLE_USER`
-  now only marks a personal install (machine-level actions such as driver
-  install and updates).
-
-## Start using Fox before creating an account
-
-`foxschema open` now opens straight into the workspace on a personal install,
-signed in as its owner through a one-time launch link: no account first. A
-banner asks you to **Create your account** (also in the profile menu, where *App
-users & roles* waits for the account); after 7 days
-(`FOX_REGISTRATION_GRACE_DAYS`) Fox asks for it before anything else, and adding
-users or changing sign-in settings needs it from the start. The *Get product
-updates* screen is skipped: the account form offers Fox news instead.
-
-- The link works once, for two minutes, only from the machine Fox runs on, and
-  only while Fox listens on that machine alone. Docker images, shared servers
-  and installs opened to the network keep first-run setup as before.
-- **Verify your email.** The account created at setup is sent a code, entered in
-  a banner. It goes through the install's SMTP relay when one is set up,
-  otherwise through the Fox mail service on foxschema.com (`FOX_VERIFY_MAIL_URL`;
-  `off` to send nowhere). Accounts an admin adds are not asked.
-
-## Sign-in: invites, forgot password, Google / Microsoft / GitHub
-
-- **New sign-in pages.** First launch is a *Create your account* page; the
-  sign-in page adds **Forgot password?** and **Have an invite or reset code?**.
-  New passwords are checked as you type against the server's own rules, and a
-  Caps Lock warning shows on password fields.
-- **Invites.** *Add user* without a password sends a one-time invite code; the
-  person chooses their own password. Unaccepted invites are marked *Invited*,
-  and each user row can resend an invite or send a reset code.
-- **Forgot password.** A one-time code (30 minutes, single use) by email, or,
-  without email set up, in the server log and via
-  `foxschema reset-password [email]`. Setting the new password signs out every
-  other session. The reply never says whether the email has an account.
-- **Email me Fox news** on *Create your account* and when accepting an invite:
-  unticked by default; when ticked, the email goes to the Fox subscriber list
-  (the same foxschema.com endpoint as the first-run wizard, which notifies
-  contact@foxschema.com). Never sent on a password reset, and a signup service
-  that is down never blocks creating the account.
-- **Google and GitHub with no OAuth app of your own**: turn on *Use the Fox
-  sign-in service* (Access control → Sign-in, or `FOX_SSO_BROKER=on`).
-  foxschema.com does the sign-in and returns a signed, single-use assertion
-  bound to this install's callback and the browser that started; only
-  existing accounts sign in. Off by default, since it trusts foxschema.com to
-  say who is signing in.
-- **Admin → Access control → Sign-in** configures Google, Microsoft and GitHub
-  sign-in (with the redirect URL to register), the email relay (Hostinger /
-  Gmail / Microsoft 365 presets and a test button) and the public URL — for the
-  desktop app, where there are no environment variables to set. Environment
-  variables still win and show read-only.
-
-### Security fixes
-
-- **SSO accepted unverified emails.** Microsoft's `email` claim with the
-  multi-tenant endpoint is whatever any tenant's admin typed, so an attacker
-  with their own tenant could sign in as any Fox user whose email they set
-  ("nOAuth"). Microsoft now accepts only personal accounts, verified domains
-  (`xms_edov`) or the configured tenant; Google requires `email_verified`;
-  GitHub uses only the verified primary address. SSO also uses PKCE now.
-- **Rate limits could be skipped** by sending a made-up `X-Forwarded-For`: every
-  peer's forwarding headers were trusted. Now only loopback and private-network
-  peers are (`FOX_TRUST_PROXY` to change).
-- **Per-email sign-in lockout**: 5 failures lock the email for 15 minutes, for
-  emails with and without accounts alike; a wrong email now costs the same
-  time as a wrong password.
-- **Session tokens are stored hashed.** Migration 20 clears existing sessions,
-  so **everyone signs in once more** after upgrading.
-- **Password rules**: at least 10 characters, not a common password, not the
-  email name. Existing passwords keep working.
-
-## Migrations in Git
-
-Commit a migration to a Git repository before it runs, and run teammates'
-migrations from theirs. Built in (no `git` binary needed); works with GitHub,
-GitLab, Bitbucket and Azure DevOps over HTTPS with an access token.
-
-- **Access control → Git** (new `git.manage` permission): add repositories —
-  HTTPS URL, default branch, folder, access token (encrypted, never shown
-  again), and optionally **require a commit** before any migration runs.
-- **Migrate → Commit to Git**: pick a branch or create one, write a note (the
-  commit message), review the exact file, then Commit or Commit & push.
-  **Execute** then runs the migration *from that commit*.
-- **Applies → Git** (new `git.view` permission, granted once on upgrade to
-  roles that can browse or compare schemas): fetch, pull and push; each
-  migration marked applied or incoming for the connected target; review and
-  run incoming ones from their commit.
-- Migration files are plain SQL with the steps kept in comments, so Fox runs
-  exactly what was reviewed. Passwords in account statements are replaced with
-  `<password>`, and a file that still carries a credential is refused.
-- Remotes are `https://` only; on a shared server, private and internal
-  addresses are refused at connect time (including IPv6 spellings of them).
-
-## Backup & Restore
-
-**Utils → Backup & Restore** writes the engine's backup and restore commands
-for the credential at the top of the workspace.
-
-- The amber banner says where the command runs (your machine, the database
-  server, or a cloud snapshot) — that is what the folder field means.
-- Passwords stay out of the command. Folder / format / scope can be saved as
-  *your default for this engine* (`GET` / `PUT /api/backup-settings`).
-- SQL commands (SQL Server, CockroachDB, ClickHouse, DuckDB) open in the
-  Editor; shell tools you copy.
-- Where the backup is server-side SQL, **Run backup now** runs it after a
-  confirmation (needs Change schema). SQL Server, Db2 and ClickHouse list the
-  backups they recorded; pick one and the restore reads it. Restores still only
-  open in the SQL Editor.
-
-See [user-guide.md](../user-guide.md#utilities).
-
-## Access: Grants show what is held
-
-**Access → Permissions → Grants** opens on the privileges that principal
-already holds. The SQL is only the difference (new ticks GRANT, cleared boxes
-REVOKE). EXECUTE on procedures and functions is read too, so those rows open
-ticked. Privileges the grid cannot show — CONNECT, schema USAGE, DENY — are
-listed under it and not revoked as a side-effect of ticking one table. Permission **Diff** is a
-separate tab (desired state vs catalog, including DENY).
-
-## Sessions
-
-A session unused for 8 hours ends (`FOX_SESSION_IDLE_HOURS`; `0` turns this
-off), whatever its 7-day expiry. **Sign out other sessions** is on the profile
-menu.
-

From 006484724e96ad6cfe68f0efc970c90eae02925f Mon Sep 17 00:00:00 2001
From: huyplb <huyplb@live.com>
Date: Sun, 8 Nov 2026 14:47:05 -0600
Subject: [PATCH 3/4] chore: release 0.3.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/cli/package.json    |  2 +-
 apps/web/package.json    |  2 +-
 package-lock.json        | 10 +++++-----
 package.json             |  2 +-
 packages/db/package.json |  2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/apps/cli/package.json b/apps/cli/package.json
index 8f2a62d7d..324017736 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@foxschema/cli",
-  "version": "0.2.396",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "description": "Fox Schema CLI — schema diff, migrations, and a rich SQL Editor (TypeScript / Node ESM)",
diff --git a/apps/web/package.json b/apps/web/package.json
index e543f59c7..e60106efd 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@foxschema/web",
   "private": true,
-  "version": "0.2.396",
+  "version": "0.3.1",
   "type": "module",
   "exports": {
     "./package.json": "./package.json"
diff --git a/package-lock.json b/package-lock.json
index 934b43520..b1680ca0c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "foxschema",
-  "version": "0.2.396",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "foxschema",
-      "version": "0.2.396",
+      "version": "0.3.1",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/*",
@@ -32,7 +32,7 @@
     },
     "apps/cli": {
       "name": "@foxschema/cli",
-      "version": "0.2.396",
+      "version": "0.3.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@foxschema/db": "*",
@@ -94,7 +94,7 @@
     },
     "apps/web": {
       "name": "@foxschema/web",
-      "version": "0.2.396",
+      "version": "0.3.1",
       "dependencies": {
         "@clickhouse/client": "1.24.1",
         "@duckdb/node-api": "1.5.4-r.1",
@@ -11605,7 +11605,7 @@
     },
     "packages/db": {
       "name": "@foxschema/db",
-      "version": "0.2.396",
+      "version": "0.3.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@foxschema/sql": "*"
diff --git a/package.json b/package.json
index cfd6b5e98..94a619a26 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "foxschema",
   "author": "Huy Phan <huyplb@gmail.com>",
   "private": true,
-  "version": "0.2.396",
+  "version": "0.3.1",
   "packageManager": "npm@11.6.2",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/db/package.json b/packages/db/package.json
index 1f9d01e0d..06e026faa 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@foxschema/db",
-  "version": "0.2.396",
+  "version": "0.3.1",
   "description": "The FoxSchema Node runtime: database drivers, pooling, and migration execution. Re-exports @foxschema/sql for the dialect layer.",
   "type": "module",
   "license": "Apache-2.0",

From 8e55e5abad62db56b351223d4f23c0932e6d6477 Mon Sep 17 00:00:00 2001
From: huyplb <huyplb@live.com>
Date: Sun, 8 Nov 2026 14:50:02 -0600
Subject: [PATCH 4/4] fix(sql): read a Redshift VARCHAR length without a
 backtracking regex

security/detect-unsafe-regex flagged the one-pattern parse in CI. Split
the name and the optional "(n)" by hand; same results, tests unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../providers/redshift/redshift.column-change.ts   | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/packages/sql/src/providers/redshift/redshift.column-change.ts b/packages/sql/src/providers/redshift/redshift.column-change.ts
index ef4e667c6..ec1f8cb95 100644
--- a/packages/sql/src/providers/redshift/redshift.column-change.ts
+++ b/packages/sql/src/providers/redshift/redshift.column-change.ts
@@ -18,11 +18,17 @@ const VARCHAR_MAX = 65535;
 
 /** The length of a VARCHAR type, or undefined for any other type. */
 export function redshiftVarcharLength(type: string): number | undefined {
-  const m = type.trim().match(/^(?:character\s+varying|varchar|nvarchar|text)\s*(?:\(\s*(\d+|max)\s*\))?$/i);
-  if (!m) return undefined;
+  // Split by hand rather than with one pattern: name, then an optional "(n)".
+  const t = type.trim().toLowerCase().replace(/\s+/g, ' ');
+  const open = t.indexOf('(');
+  const name = (open < 0 ? t : t.slice(0, open)).trim();
+  if (!['character varying', 'varchar', 'nvarchar', 'text'].includes(name)) return undefined;
   // A bare VARCHAR, and TEXT, are VARCHAR(256) on Redshift.
-  if (!m[1]) return 256;
-  return /^max$/i.test(m[1]) ? VARCHAR_MAX : Number(m[1]);
+  if (open < 0) return 256;
+  if (!t.endsWith(')')) return undefined;
+  const arg = t.slice(open + 1, -1).trim();
+  if (arg === 'max') return VARCHAR_MAX;
+  return /^\d+$/.test(arg) ? Number(arg) : undefined;
 }
 
 export const redshiftColumnChange: ColumnChangeDialect = {