fix(sql): refuse per-row sequence accessors instead of returning NULL

nextval/currval/setval only evaluate through SqlCatalog's sequence
state at plan time, in a FROM-less SELECT or a column DEFAULT. A call
over a FROM relation instead reached the row evaluator, which holds no
sequence state and silently returned NULL for every row.

Name the three accessor names once in a shared sequence_accessor
module and use it from both the constant folder and the new resolver
gate. TableScope::is_row_scope and ColumnScope::is_row_scope report
whether an expression sits behind a relation; convert_function_depth
refuses a sequence accessor there with the new
SqlError::SequencePerRowUnsupported.

Wire the refusal through to SQLSTATE 0A000 (feature_not_supported) on
both the plan-error and pgwire error-mapping paths via a new
crate::Error::FeatureNotSupported, and through error_classify for the
native surface.

Author: farhan-syah

nodedb-sql/src/error.rs

@@ -19,6 +19,22 @@ pub enum SqlError {
     #[error("function {name}(...) does not exist")]
     UndefinedFunction { name: String },
 
+    /// A sequence accessor appeared where every output row needs its own
+    /// allocation, such as a SELECT list over a FROM clause.
+    ///
+    /// Rendered as SQLSTATE `0A000` (feature_not_supported). Constant
+    /// contexts evaluate the call for real: a FROM-less `SELECT`, a column
+    /// `DEFAULT`, a `VALUES` list. The refusal keeps a per-row call from
+    /// reaching the row evaluator, which has no sequence state and would
+    /// return `NULL` for every row.
+    #[error(
+        "{name}(...) is not supported in a per-row context; \
+         a SELECT list, WHERE clause, or SET clause over a FROM relation \
+         evaluates once per row. Call it in a FROM-less SELECT or a column \
+         DEFAULT instead"
+    )]
+    SequencePerRowUnsupported { name: String },
+
     /// A statement names a database object that does not exist — a sequence,
     /// most commonly. Distinct from [`SqlError::UndefinedFunction`]: the
     /// function exists, the object it names does not. PostgreSQL rejects the

nodedb-sql/src/functions/mod.rs

@@ -4,6 +4,7 @@ pub mod arg_types;
 pub mod builtins;
 pub mod fts_ops;
 pub mod registry;
+pub mod sequence_accessor;
 
 pub use registry::{
     ArgTypeSpec, FunctionCategory, FunctionMeta, FunctionRegistry, SearchTrigger, Version,

nodedb-sql/src/functions/sequence_accessor.rs

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The sequence-accessor function names, named once for every gate that
+//! treats them apart from other scalars.
+
+/// The accessors the planner routes to `SqlCatalog` sequence state.
+pub const SEQUENCE_ACCESSORS: [&str; 3] = ["nextval", "currval", "setval"];
+
+/// Whether `name` calls a sequence accessor. Comparison ignores ASCII case.
+pub fn is_sequence_accessor(name: &str) -> bool {
+    SEQUENCE_ACCESSORS
+        .iter()
+        .any(|accessor| name.eq_ignore_ascii_case(accessor))
+}

nodedb-sql/src/planner/catalog_expr_fold.rs

@@ -55,7 +55,7 @@ pub(super) fn eval_sequence_accessor(
         return Ok(None);
     };
     let lowered = name.to_ascii_lowercase();
-    if !matches!(lowered.as_str(), "nextval" | "currval" | "setval") {
+    if !crate::functions::sequence_accessor::is_sequence_accessor(&lowered) {
         return Ok(None);
     }
     let sequence = match args.first() {

nodedb-sql/src/resolver/columns.rs

@@ -123,6 +123,15 @@ impl TableScope {
         }
     }
 
+    /// Whether an expression here is evaluated once per row of some relation.
+    ///
+    /// A scope with no relation of its own and no enclosing query stands
+    /// behind a FROM-less `SELECT`, which produces exactly one row and
+    /// evaluates its projection at plan time.
+    pub fn is_row_scope(&self) -> bool {
+        !self.tables.is_empty() || self.outer.is_some()
+    }
+
     /// A copy of this scope nested inside `outer`, for planning a correlated
     /// subquery body.
     pub fn nested_in(mut self, outer: TableScope) -> Self {

nodedb-sql/src/resolver/expr/functions.rs

@@ -86,6 +86,16 @@ pub(super) fn convert_function_depth(
         return Err(SqlError::UndefinedFunction { name });
     }
 
+    // Per-row gate: a sequence accessor is evaluated at plan time, by
+    // `planner::catalog_expr_fold` for a FROM-less SELECT and by
+    // `planner::defaults` for a column DEFAULT. A call over a FROM relation
+    // reaches the row evaluator instead, which holds no sequence state and
+    // answers `NULL` for every row. Refuse it here so the statement fails
+    // loudly at plan time.
+    if scope.is_row_scope() && crate::functions::sequence_accessor::is_sequence_accessor(&name) {
+        return Err(SqlError::SequencePerRowUnsupported { name });
+    }
+
     let args = collect_function_args(func, depth, scope)?;
 
     let distinct = match &func.args {
@@ -297,4 +307,41 @@ mod tests {
             "quoted 'UPPER' must still resolve via case-insensitive registry lookup"
         );
     }
+
+    /// A FROM-less SELECT resolves against an empty relation set, where the
+    /// planner evaluates the accessor through the catalog.
+    #[test]
+    fn a_sequence_accessor_resolves_without_a_relation() {
+        let func = function_ast("SELECT nextval('s')");
+        let mut depth = 0;
+        let scope = crate::resolver::columns::TableScope::new();
+        let expr = convert_function_depth(&func, &mut depth, &ColumnScope::Relations(&scope))
+            .expect("a FROM-less sequence accessor must resolve");
+        match expr {
+            SqlExpr::Function { name, .. } => assert_eq!(name, "nextval"),
+            other => panic!("expected SqlExpr::Function, got {other:?}"),
+        }
+    }
+
+    /// A relation in scope makes the call per-row, which the row evaluator
+    /// cannot serve, so the resolver refuses it.
+    #[test]
+    fn a_sequence_accessor_over_a_relation_is_refused() {
+        let mut depth = 0;
+        let outer = crate::resolver::columns::TableScope::new();
+        let scope = crate::resolver::columns::TableScope::new().nested_in(outer);
+        for call in [
+            "SELECT nextval('s')",
+            "SELECT currval('s')",
+            "SELECT setval('s', 1)",
+        ] {
+            let func = function_ast(call);
+            let err = convert_function_depth(&func, &mut depth, &ColumnScope::Relations(&scope))
+                .unwrap_err();
+            assert!(
+                matches!(err, SqlError::SequencePerRowUnsupported { .. }),
+                "expected SqlError::SequencePerRowUnsupported for {call}, got {err:?}"
+            );
+        }
+    }
 }

nodedb-sql/src/resolver/scope.rs

@@ -31,4 +31,15 @@ impl ColumnScope<'_> {
             Self::Relations(scope) => scope.check_name(table_ref, column),
         }
     }
+
+    /// Whether an expression here is evaluated once per row of some relation.
+    ///
+    /// `Unchecked` stands behind stored DEFAULTs, index predicates, and the
+    /// constant folders, none of which iterate rows.
+    pub fn is_row_scope(&self) -> bool {
+        match self {
+            Self::Unchecked => false,
+            Self::Relations(scope) => scope.is_row_scope(),
+        }
+    }
 }

nodedb/src/control/planner/plan_error_map.rs

@@ -35,6 +35,13 @@ pub(crate) fn map_plan_error(
         nodedb_sql::SqlError::UndefinedFunction { name } => {
             crate::Error::UndefinedFunction { name }
         }
+        // A per-row sequence accessor is a refusal, not a syntax error, so it
+        // keeps SQLSTATE `0A000` rather than the `42601` the fallback gives.
+        nodedb_sql::SqlError::SequencePerRowUnsupported { .. } => {
+            crate::Error::FeatureNotSupported {
+                detail: error.to_string(),
+            }
+        }
         nodedb_sql::SqlError::UndefinedObject { kind, name } => {
             crate::Error::UndefinedObject { kind, name }
         }

nodedb/src/control/server/pgwire/types/error_map.rs

@@ -45,6 +45,9 @@ pub fn error_to_sqlstate(err: &crate::Error) -> (&'static str, &'static str, Str
                  it is hard-deleted"
             ),
         ),
+        crate::Error::FeatureNotSupported { detail } => {
+            ("ERROR", sqlstate::FEATURE_NOT_SUPPORTED, detail.clone())
+        }
         crate::Error::UndefinedFunction { name } => (
             "ERROR",
             sqlstate::UNDEFINED_FUNCTION,

nodedb/src/error/types.rs

@@ -276,6 +276,14 @@ pub enum Error {
     #[error("query plan error: {detail}")]
     PlanError { detail: String },
 
+    /// A statement asked for a SQL feature this server does not implement.
+    /// Propagated from a planner refusal such as
+    /// `SqlError::SequencePerRowUnsupported`; the pgwire layer renders this
+    /// as SQLSTATE `0A000` (feature_not_supported), so a client stops rather
+    /// than retries.
+    #[error("{detail}")]
+    FeatureNotSupported { detail: String },
+
     /// A function call in a query names no registered scalar, aggregate, or
     /// window function. Propagated from `SqlError::UndefinedFunction`; the
     /// pgwire layer renders this as SQLSTATE `42883` (undefined_function).