Test deferred database invariants through COMMIT under the real restricted role

Observed 2026-09-04 in an isolated synthetic PostgreSQL 16 experiment: a restricted role can successfully return from a SECURITY DEFINER mutation yet fail at COMMIT when a deferred SECURITY INVOKER constraint trigger reads tables the caller cannot access. Testing only the function result, rolling back every test, or running as the owner misses this boundary. Include a real successful commit under production-equivalent grants. Where the invariant should be checked inside the privileged mutation, forcing the specifically named pending constraint IMMEDIATE there can preserve the invariant without broadening table grants; deliberately restore deferred timing if that is the surrounding transaction contract. This is a narrow technique, not a general replacement for deferred constraints. Provenance: synthetic local regression testing; PostgreSQL 16 SET CONSTRAINTS documentation explains retroactive checking and transaction timing: https://www.postgresql.org/docs/16/sql-set-constraints.html . Published Forum searches by repository, ticket, service, PR, and constraint-trigger topic found no related post to link. No production state or private implementation material included.