@@ -2,17 +2,26 @@
 //
 // CHECK-expression comparison. Postgres rewrites a stored CHECK body so the raw
 // text we generate and the introspected text differ textually but mean the same
-// thing. This reduces both to ONE canonical form for comparison. Reliable here
-// because every check expression we emit is machine-derived with a simple, known
-// shape (comparison / IN / length / regex) — there is no arbitrary author SQL to
-// mis-normalize. The rewrites PG applies (verified against a live server):
+// thing. This reduces both to ONE canonical form for comparison.
+//
+// It was written when every expression reaching it was machine-derived with a simple,
+// known shape (comparison / IN / length / regex), and the header said there was "no
+// arbitrary author SQL to mis-normalize". That stopped being true when `index.lookup`'s
+// `@expr` and `@where` began using the same canonicalizer: those are AUTHOR-written SQL.
+// Each rewrite below is therefore justified on the stronger ground it now needs — that
+// the difference it erases is not semantic in ANY valid SQL, not merely in the shapes we
+// emit. The rewrites PG applies (verified against a live server):
 //   - parenthesizes terms:  `col >= 0 AND col <= 100`  →  `(col >= 0) AND (col <= 100)`
 //   - rewrites IN-lists:     `status IN ('A','B')`      →  `status = ANY (ARRAY['A'::text, 'B'::text])`
 //   - appends type casts:    string literals gain `::text`
 // All three are canonicalized below so an enum/range CHECK introspected from PG
 // compares equal to the one we generate (idempotency on the --from-db / verify paths).
 
-/** Canonical form: drop casts/brackets/parens, fold `= ANY (ARRAY[…])` back to `IN`, lower-case, collapse whitespace. */
+/**
+ * Canonical form: drop casts/brackets/parens, fold `= ANY (ARRAY[…])` back to `IN`,
+ * lower-case, collapse whitespace, and collapse spacing around commas and SYMBOLIC
+ * operators (outside single-quoted literals).
+ */
 export function normalizeCheckExpr(expr: string): string {
   const stripped = expr
     .toLowerCase()
@@ -37,17 +46,48 @@ export function normalizeCheckExpr(expr: string): string {
   // PG stores `col IN (…)` as `col = ANY (ARRAY[…])`; after the bracket strip above
   // that reads `col = any array …`. Fold it back to the `col in …` form we emit.
   const folded = stripped.replace(/=\s*any\s+array/g, "in").replace(/\s+/g, " ").trim();
-  // Normalize spacing AROUND COMMAS so a generated IN-list (`'a', 'b'`) compares equal
-  // to a hand-written one (`'a','b'`) — the separator commas are never semantically
-  // meaningful, and a hand SQLite migration omits the space. This is done OUTSIDE
-  // single-quoted literals only: a comma inside a string/regex literal (`'a, b'`, or a
-  // quantifier `'{1, 3}'`) IS meaningful, so two checks that differ only there must
-  // stay distinct (else a real regex/predicate change reads as clean drift).
-  return collapseCommaSpacingOutsideQuotes(folded);
+  // Normalize spacing around COMMAS and SYMBOLIC OPERATORS, so the spelling a human
+  // writes compares equal to the one Postgres hands back.
+  //
+  // Commas: a generated IN-list (`'a', 'b'`) must equal a hand-written one (`'a','b'`) —
+  // a hand SQLite migration omits the space.
+  //
+  // Operators: `pg_get_expr` re-emits every operator SPACED, and a person authoring an
+  // `index.lookup @expr` writes it tight. So `(request_context->>'device_id')` — the
+  // natural spelling — normalized to `request_context->>'device_id'` while the live index
+  // introspected to `request_context ->> 'device_id'`, and `verify --db` proposed DROP +
+  // CREATE against an index the database already held, exactly as declared. Casts and
+  // redundant parens were ALREADY canonicalized above, so the one difference left was the
+  // spacing — and it was the one difference a human actually produces.
+  //
+  // Safe because whitespace around a symbolic operator is not semantic in ANY valid SQL:
+  // where two spellings differ only there, at most one of them parses. Postgres lexes a
+  // maximal run of operator characters as a SINGLE token, so `a =- 1` is not `a = -1`
+  // spelled differently — it is a syntax error. Only SYMBOLIC operators are touched;
+  // collapsing around an alphabetic one would turn `a AND b` into `aANDb`.
+  //
+  // Both are done OUTSIDE single-quoted literals: a comma or an operator character inside
+  // a string/regex literal (`'a, b'`, a quantifier `'{1, 3}'`, a pattern `'a ->> b'`) IS
+  // meaningful, so two checks differing only there must stay distinct — else a real
+  // pattern change reads as clean drift, which is this file's failure in the other
+  // direction and the worse of the two.
+  return collapseSeparatorSpacingOutsideQuotes(folded);
 }
 
-/** Collapse `\s*,\s*` → `,` OUTSIDE single-quoted literals (see normalizeCheckExpr). */
-function collapseCommaSpacingOutsideQuotes(s: string): string {
+/**
+ * Postgres' operator characters. A maximal run of these is ONE operator token — which is
+ * why `->>` and `!~*` survive intact rather than being split apart. Derived as the
+ * character SET rather than a list of known operators, so a spelling this file has never
+ * seen (`@>`, `?|`, a user-defined operator) normalizes by the same rule instead of
+ * needing an edit here.
+ */
+const OPERATOR_CHARS = new Set([..."+-*/<>=~!@#%^&|?"]);
+
+/**
+ * Collapse whitespace around commas and symbolic-operator runs, OUTSIDE single-quoted
+ * literals (see normalizeCheckExpr).
+ */
+function collapseSeparatorSpacingOutsideQuotes(s: string): string {
   let out = "";
   let i = 0;
   const n = s.length;
@@ -75,6 +115,13 @@ function collapseCommaSpacingOutsideQuotes(s: string): string {
       while (i < n && /\s/.test(s[i]!)) i++;    // skip whitespace after it
       continue;
     }
+    if (OPERATOR_CHARS.has(ch)) {
+      out = out.replace(/\s+$/, "");           // drop whitespace already emitted before it
+      // Copy the WHOLE run, so `->>` stays one token rather than three.
+      while (i < n && OPERATOR_CHARS.has(s[i]!)) { out += s[i]!; i++; }
+      while (i < n && /\s/.test(s[i]!)) i++;    // skip whitespace after it
+      continue;
+    }
     out += ch;
     i++;
   }
 
@@ -3,8 +3,11 @@ import { normalizeCheckExpr, checkExprEquals, stripCheckWrapper } from "../../sr
 
 describe("normalizeCheckExpr", () => {
   test("strips parens, collapses whitespace, lowercases", () => {
-    expect(normalizeCheckExpr("(price >= 0) AND (price <= 100)")).toBe("price >= 0 and price <= 100");
-    expect(normalizeCheckExpr("price >= 0 AND price <= 100")).toBe("price >= 0 and price <= 100");
+    expect(normalizeCheckExpr("(price >= 0) AND (price <= 100)")).toBe("price>=0 and price<=100");
+    expect(normalizeCheckExpr("price >= 0 AND price <= 100")).toBe("price>=0 and price<=100");
+    // Spacing around a SYMBOLIC operator is canonicalized away; spacing around an
+    // ALPHABETIC one (`and`) is load-bearing and must survive.
+    expect(normalizeCheckExpr("price>=0 AND price<=100")).toBe("price>=0 and price<=100");
   });
   test("PG-rewritten form equals the generated form", () => {
     expect(checkExprEquals("(col >= 0) AND (col <= 100)", "col >= 0 AND col <= 100")).toBe(true);
@@ -31,7 +34,7 @@ describe("normalizeCheckExpr", () => {
     // the cast-strip must not corrupt a regex literal containing `::`, else two
     // distinct regex CHECKs would compare equal and a pattern change be missed.
     expect(checkExprEquals("slug ~ 'a::foo'", "slug ~ 'a::bar'")).toBe(false);
-    expect(normalizeCheckExpr("slug ~ 'a::foo'")).toBe("slug ~ 'a::foo'");
+    expect(normalizeCheckExpr("slug ~ 'a::foo'")).toBe("slug~'a::foo'");
     // but PG's post-literal `::text` cast (enum form) is still stripped
     expect(normalizeCheckExpr("'open'::text")).toBe("'open'");
   });
@@ -40,7 +43,7 @@ describe("normalizeCheckExpr", () => {
     // produces after bracket-stripping). A quoted literal that merely contains
     // the words must be left intact — a stray quote breaks the `=…any…array`
     // adjacency, so there is no `in` rewrite.
-    expect(normalizeCheckExpr("note = 'pick any array item'")).toBe("note = 'pick any array item'");
+    expect(normalizeCheckExpr("note = 'pick any array item'")).toBe("note='pick any array item'");
     expect(checkExprEquals(
       "note = 'pick any array item'",
       "note in 'pick', 'item'",
@@ -50,6 +53,45 @@ describe("normalizeCheckExpr", () => {
     expect(checkExprEquals("col >= 0", "col >= 5")).toBe(false);
   });
 
+  test("operator spacing is not semantic: the natural `@expr` spelling matches pg_get_expr", () => {
+    // THE defect. An `index.lookup @expr` is AUTHOR-written SQL and a person writes it
+    // tight; `pg_get_expr` hands it back spaced and cast. Casts and redundant parens were
+    // already canonicalized, so the one surviving difference was the spacing — and
+    // `verify --db` proposed DROP + CREATE against an index the database already held
+    // exactly as declared. Measured on a live postgres:16 across five spellings.
+    const introspected = "((request_context ->> 'device_id'::text))";
+    for (const authored of [
+      "(request_context->>'device_id')",
+      "(request_context ->> 'device_id')",
+      "((request_context ->> 'device_id'))",
+      "((request_context ->> 'device_id'::text))",
+      "((request_context->>'device_id'::text))",
+    ]) {
+      expect(checkExprEquals(authored, introspected)).toBe(true);
+    }
+    // A multi-character operator survives as ONE token rather than being split apart.
+    expect(normalizeCheckExpr("a #>> b")).toBe("a#>>b");
+    expect(normalizeCheckExpr("a !~* b")).toBe("a!~*b");
+    // An operator this file has never seen normalizes by the same rule — the set is
+    // PG's operator CHARACTERS, not a list of operators anyone has to maintain.
+    expect(checkExprEquals("tags @> '{a}'", "tags@>'{a}'")).toBe(true);
+  });
+
+  test("...and collapsing spacing does not make different expressions equal", () => {
+    // The dangerous direction. Whitespace around a symbolic operator is never semantic,
+    // so nothing here may compare equal — if it did, a real predicate change would read
+    // as clean drift.
+    expect(checkExprEquals("a ->> 'x'", "a ->> 'y'")).toBe(false);
+    expect(checkExprEquals("a ->> 'x'", "a -> 'x'")).toBe(false);
+    expect(checkExprEquals("a >= b", "a > b")).toBe(false);
+    expect(checkExprEquals("a <> b", "a = b")).toBe(false);
+    // An operator character INSIDE a literal is data, not an operator.
+    expect(checkExprEquals("code ~ '^a >> b$'", "code ~ '^a>>b$'")).toBe(false);
+    // And an ALPHABETIC operator keeps its separators — `a and b` must never become `aandb`.
+    expect(normalizeCheckExpr("a AND b")).toBe("a and b");
+    expect(checkExprEquals("a AND b", "a OR b")).toBe(false);
+  });
+
   test("separator commas normalize, but a comma INSIDE a literal stays meaningful", () => {
     // Separator commas (outside quotes) collapse, so a generated IN-list matches a
     // hand-written one regardless of spacing...
 
@@ -0,0 +1,172 @@
+/**
+ * An `index.lookup @expr` written the way a person writes it must not read as drift.
+ *
+ * `pg_get_expr` re-emits every operator SPACED and appends casts:
+ *
+ *   authored     (request_context->>'device_id')
+ *   introspected ((request_context ->> 'device_id'::text))
+ *
+ * The comparator already canonicalized the casts and the redundant parens, so the ONE
+ * surviving difference was the whitespace around the operator — and it was the one
+ * difference a human actually produces. `verify --db` therefore reported drift, and
+ * `migrate` proposed DROP + CREATE, against an index the database already held exactly
+ * as declared. Found by an adopter estate running the 1.0 RC: its own README told it to
+ * retire a hand-written index adjunct "the moment #342 ships", and following that
+ * instruction produced a proposed DROP against a live production index.
+ *
+ * A unit test over the normalizer proves the strings converge. It cannot prove that the
+ * string PG hands back is the one being converged ON — which is the half that was wrong.
+ * So the gate is a REAL engine, per this package's doctrine:
+ *   1. Create the index in Postgres from the AUTHORED spelling.
+ *   2. Read back what PG actually stored (asserted, so a future PG that re-emits
+ *      differently fails HERE rather than silently making the test vacuous).
+ *   3. Diff metadata carrying the natural tight spelling against it → MUST be empty.
+ *   4. Prove the gate can still convict: a genuinely different expression → drift.
+ *
+ * Skips gracefully when MIGRATE_TS_PG_URL is not set (ts-slow CI provides a PG sidecar).
+ */
+
+import { test, expect, beforeAll, afterAll, describe } from "bun:test";
+import { Pool } from "pg";
+import { Kysely, PostgresDialect, sql } from "kysely";
+import { MetaDataLoader, InMemoryStringSource } from "@metaobjectsdev/metadata";
+import { buildExpectedSchema } from "../../src/expected-schema.js";
+import { introspectPostgres } from "../../src/introspect/postgres.js";
+import { diff } from "../../src/diff/index.js";
+
+const PG_URL = process.env["MIGRATE_TS_PG_URL"];
+
+/** `expr` is the authored spelling under test. */
+const meta = (expr: string): string =>
+  JSON.stringify({
+    "metadata.root": {
+      package: "acme",
+      children: [
+        {
+          "object.entity": {
+            name: "Notification",
+            children: [
+              { "source.rdb": { "@table": "notification" } },
+              { "field.long": { name: "id" } },
+              // An open/untyped JSON map: a `field.string` with a jsonb physical type, which
+              // is what the loader's own error message prescribes for a bare object.
+              { "field.string": { name: "requestContext", "@column": "request_context", "@dbColumnType": "jsonb" } },
+              { "identity.primary": { name: "pk", "@fields": ["id"], "@generation": "increment" } },
+              { "index.lookup": { name: "byDevice", "@expr": expr } },
+            ],
+          },
+        },
+      ],
+    },
+  });
+
+describe("an expression index written the human way is not drift (PG)", () => {
+  if (!PG_URL) {
+    test.skip("skipped — MIGRATE_TS_PG_URL not set", () => {});
+    return;
+  }
+
+  let kysely: Kysely<Record<string, unknown>>;
+  let pool: Pool;
+
+  const reset = async (): Promise<void> => {
+    await sql.raw("DROP TABLE IF EXISTS notification CASCADE").execute(kysely);
+    await sql
+      .raw(
+        `CREATE TABLE notification (
+           id bigserial PRIMARY KEY,
+           request_context jsonb
+         )`,
+      )
+      .execute(kysely);
+    // Created from the AUTHORED spelling — tight, no cast. PG stores its own rendering.
+    // Named as the metadata names it, so the diff compares EXPRESSIONS: an index-name
+    // mismatch presents as drop+add too, and would mask the thing under test.
+    await sql
+      .raw(
+        `CREATE INDEX "byDevice"
+           ON notification ((request_context->>'device_id'))`,
+      )
+      .execute(kysely);
+  };
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: PG_URL });
+    kysely = new Kysely<Record<string, unknown>>({ dialect: new PostgresDialect({ pool }) });
+    await reset();
+  });
+
+  afterAll(async () => {
+    await sql.raw("DROP TABLE IF EXISTS notification CASCADE").execute(kysely);
+    await pool.end();
+  });
+
+  test("PG really does re-emit the expression spaced and cast", async () => {
+    // Asserted rather than assumed. If a future Postgres rendered the expression the way
+    // it was authored, every case below would pass while proving nothing, and this is the
+    // line that would tell us.
+    const actual = await introspectPostgres(kysely);
+    const ix = actual.tables
+      .find((t) => t.name === "notification")
+      ?.indexes?.find((i) => i.name === "byDevice");
+    expect(ix).toBeDefined();
+    expect(ix?.expr).toBeDefined();
+    expect(ix?.expr).toContain(" ->> ");   // spaced — the difference that caused the drift
+    expect(ix?.expr).toContain("::text");  // and cast
+  });
+
+  test("REGRESSION: the natural tight spelling diffs EMPTY against the live index", async () => {
+    const loaded = await new MetaDataLoader().load([
+      new InMemoryStringSource(meta("(request_context->>'device_id')")),
+    ]);
+    expect(loaded.errors).toEqual([]);
+
+    const actual = await introspectPostgres(kysely);
+    const d = await diff({
+      expected: buildExpectedSchema(loaded.root, { dialect: "postgres" }),
+      actual,
+      dialect: "postgres",
+      allow: { dropIndex: true },
+    });
+    // Pre-fix this was drop-index + add-index against an index already correct.
+    expect(d.changes.filter((c) => c.kind === "drop-index" || c.kind === "add-index")).toEqual([]);
+    expect(d.changes).toEqual([]);
+  });
+
+  test("...and every other spelling of the same expression agrees with it", async () => {
+    const actual = await introspectPostgres(kysely);
+    for (const authored of [
+      "(request_context ->> 'device_id')",
+      "((request_context ->> 'device_id'))",
+      "((request_context ->> 'device_id'::text))",
+      "((request_context->>'device_id'::text))",
+    ]) {
+      const loaded = await new MetaDataLoader().load([new InMemoryStringSource(meta(authored))]);
+      expect(loaded.errors).toEqual([]);
+      const d = await diff({
+        expected: buildExpectedSchema(loaded.root, { dialect: "postgres" }),
+        actual,
+        dialect: "postgres",
+        allow: { dropIndex: true },
+      });
+      expect(`${authored}: ${JSON.stringify(d.changes)}`).toBe(`${authored}: []`);
+    }
+  });
+
+  test("the gate can still CONVICT: a genuinely different key is drift", async () => {
+    // The other half. A comparator that erases whitespace must not erase the key.
+    const loaded = await new MetaDataLoader().load([
+      new InMemoryStringSource(meta("(request_context->>'session_id')")),
+    ]);
+    expect(loaded.errors).toEqual([]);
+    const actual = await introspectPostgres(kysely);
+    const d = await diff({
+      expected: buildExpectedSchema(loaded.root, { dialect: "postgres" }),
+      actual,
+      dialect: "postgres",
+      allow: { dropIndex: true },
+    });
+    expect(d.changes.some((c) => c.kind === "drop-index")).toBe(true);
+    expect(d.changes.some((c) => c.kind === "add-index")).toBe(true);
+  });
+});