@@ -138,9 +138,10 @@ Initial rows: `(1, 'a', 10)`, `(2, 'b', 20)`, `(3, 'c', 30)`. Scans return rows
 `id INTEGER NOT NULL PRIMARY KEY`, `label VARCHAR`; rows `(1, 'x')`, `(2, 'y')`. Read-only: no
 insert, update or delete function, but the same constraint declarations as `items`.
 `UPDATE t.main.labels ...` must fail with the engine's `does not support UPDATE`, not with a
-constraint-profile error. (The SDK must negotiate `vgi.constraint.enforce.v1` because `items` is a
-writable table with constraints; the extension checks that negotiation before the table's write
-modes, so a missing profile shows up on `labels` too.)
+constraint-profile error. (The SDK must still negotiate `vgi.constraint.enforce.v1`, because `items`
+is a writable table with constraints. Before vgi v2.0 commit "check the declared write before the
+constraint-enforcement profile", the extension checked that negotiation first, so a missing profile
+showed up on `labels` too; it now reports the undeclared operation first.)
 
 ## Transaction hooks (transactional attaches only)
 
 
@@ -48,7 +48,6 @@ static int WriteResultModeRank(const string &mode) {
 }
 
 static void RequireWriteResultMode(const VgiTableEntry &table, const string &operation, bool return_chunk) {
-	vgi::RequireNativeConstraintWrite(*table.GetCatalog().Cast<VgiCatalog>().attach_result(), table.GetTableInfo());
 	const auto requested = return_chunk ? "rows" : "count";
 	const auto &modes = table.GetTableInfo().write_result_modes;
 	auto entry = modes.find(operation);
@@ -59,6 +58,11 @@ static void RequireWriteResultMode(const VgiTableEntry &table, const string &ope
 		        .Set(vgi::error_key::kOperation, StringUtil::Upper(operation)),
 		    StringUtil::Format("Table '%s' does not support %s", table.name, StringUtil::Upper(operation)));
 	}
+	// Only a table that declares this operation needs the constraint-enforcement
+	// profile. Checked after the operation itself, so a read-only constrained
+	// table reports "does not support UPDATE" whether or not the worker
+	// negotiated vgi.constraint.enforce.v1.
+	vgi::RequireNativeConstraintWrite(*table.GetCatalog().Cast<VgiCatalog>().attach_result(), table.GetTableInfo());
 	if (WriteResultModeRank(entry->second) < WriteResultModeRank(requested)) {
 		throw BinderException(
 		    vgi::ErrorInfo(vgi::error_subtype::kUnsupported)
 
@@ -200,15 +200,28 @@ PRIMARY KEY	4
 UNIQUE	2
 
 # ============================================================================
-# Reading immutable constraint facts does not authorize constrained writes.
-# This must fail at native planning, before fallback write-function discovery.
-# Count mode has no RETURNING requirement to accidentally mask the missing gate.
+# A constrained table that declares no write function is read-only: writes
+# fail at native planning, before fallback write-function discovery, as
+# unsupported operations, whether or not the worker negotiated the
+# constraint-enforcement profile (only a declared write needs it; see
+# table/rowid_constraint_metadata.test). Count mode has no RETURNING
+# requirement to mask the check.
 # ============================================================================
 
 statement error
 INSERT INTO example.data.departments (id, name, budget) VALUES (99, 'unauthorized', 100);
 ----
-constraint enforcement profile was not negotiated
+<REGEX>:.*Table '.*departments.*' does not support INSERT.*
+
+statement error
+UPDATE example.data.departments SET budget = 1 WHERE id = 1;
+----
+<REGEX>:.*Table '.*departments.*' does not support UPDATE.*
+
+statement error
+DELETE FROM example.data.departments WHERE id = 1;
+----
+<REGEX>:.*Table '.*departments.*' does not support DELETE.*
 
 query I
 SELECT count(*) FROM example.data.departments;
 
@@ -6,12 +6,16 @@
 # a different set of constraint records per catalog name:
 #   enforced_keys       items PRIMARY KEY (id)
 #                       items_no_returning PRIMARY KEY (id), UNIQUE (name)
+#                       items_insert_only PRIMARY KEY (id)
 #   rowid_keys          items PRIMARY KEY (rowid)
 #                       items_no_returning PRIMARY KEY (id, rowid), UNIQUE (rowid, name)
 #   metadata_only_keys  items PRIMARY KEY (id), METADATA_ONLY / UNVALIDATED
 # Every record except METADATA_ONLY is ENFORCED + ALL_ROWS. Informational
 # (METADATA_ONLY) constraints are not supported. The fixture serves its records
-# unvalidated so these assertions exercise the extension's own checks.
+# unvalidated so these assertions exercise the extension's own checks. It
+# negotiates the constraint read profile only, never vgi.constraint.enforce.v1,
+# yet keeps serving the tables' declared writes (vgi-python alone would serve
+# them read-only).
 
 require-env VGI_ROWID_CONSTRAINT_WORKER
 
@@ -37,6 +41,7 @@ WHERE database_name = 'e' AND constraint_type IN ('PRIMARY KEY', 'UNIQUE')
 ORDER BY 1, 2;
 ----
 items	PRIMARY KEY	[id]
+items_insert_only	PRIMARY KEY	[id]
 items_no_returning	PRIMARY KEY	[id]
 items_no_returning	UNIQUE	[name]
 
@@ -59,6 +64,59 @@ SELECT count(rowid), count(id) FROM e.main.items_no_returning;
 ----
 0	0
 
+# --- Writes without the constraint-enforcement profile ----------------------
+# A write the table declares needs vgi.constraint.enforce.v1, which this worker
+# never negotiates, so it fails at planning on the missing profile. A write the
+# table does not declare is reported as unsupported first: the missing profile
+# is irrelevant to it.
+
+statement error
+INSERT INTO e.main.items VALUES (1, 'a', 10);
+----
+constraint enforcement profile was not negotiated
+
+statement error
+UPDATE e.main.items SET qty = 1;
+----
+constraint enforcement profile was not negotiated
+
+statement error
+DELETE FROM e.main.items;
+----
+constraint enforcement profile was not negotiated
+
+statement error
+INSERT INTO e.main.items_insert_only VALUES (1, 'a');
+----
+constraint enforcement profile was not negotiated
+
+# The profile is checked before the result mode: items_no_returning is
+# count-only, but the missing profile is what this attach lacks.
+statement error
+INSERT INTO e.main.items_no_returning VALUES (1, 'a', 10) RETURNING *;
+----
+constraint enforcement profile was not negotiated
+
+statement error
+UPDATE e.main.items_insert_only SET name = 'b';
+----
+<REGEX>:.*Table '.*items_insert_only.*' does not support UPDATE.*
+
+statement error
+DELETE FROM e.main.items_insert_only;
+----
+<REGEX>:.*Table '.*items_insert_only.*' does not support DELETE.*
+
+statement error
+UPDATE e.main.items_insert_only SET name = 'b';
+----
+<!REGEX>:.*constraint enforcement profile.*
+
+query I
+SELECT count(*) FROM e.main.items;
+----
+0
+
 # --- Keys naming the rowid column are rejected ------------------------------
 
 statement ok
 
@@ -10,6 +10,7 @@
 * ``enforced_keys``  — supported records, all ENFORCED + ALL_ROWS:
     ``items``               PRIMARY KEY (id)
     ``items_no_returning``  PRIMARY KEY (id), UNIQUE (name)
+    ``items_insert_only``   PRIMARY KEY (id)   (declares INSERT only)
 * ``rowid_keys``     — ENFORCED + ALL_ROWS records that name the rowid column:
     ``items``               PRIMARY KEY (rowid)
     ``items_no_returning``  PRIMARY KEY (id, rowid), UNIQUE (rowid, name)
@@ -57,6 +58,7 @@
                 (ConstraintKind.PRIMARY_KEY, ["id"], _TRUSTED),
                 (ConstraintKind.UNIQUE, ["name"], _TRUSTED),
             ],
+            "items_insert_only": [(ConstraintKind.PRIMARY_KEY, ["id"], _TRUSTED)],
         },
     ),
     "rowid_keys": (
@@ -83,12 +85,25 @@
     raise RuntimeError("vgi.worker.validate_constraint_records moved; update this fixture")
 vgi.worker.validate_constraint_records = lambda *args, **kwargs: None
 
+# vgi-python also serves a table with constraint records read-only (drops its
+# write functions and modes) unless the attachment selected
+# vgi.constraint.enforce.v1. Keep the declared writes, so the extension's own
+# planning check is what refuses them. Same loud failure if the hook moves.
+if not hasattr(vgi.worker.Worker, "_table_for_capabilities"):
+    raise RuntimeError("vgi.worker.Worker._table_for_capabilities moved; update this fixture")
+
 
 class RowidConstraintCatalog(SimpleWritableCatalog):
     """SimpleWritableCatalog whose tables carry the records of the attached mode."""
 
     def catalog_capabilities(self, *, attach_opaque_data):  # type: ignore[no-untyped-def,override]
-        """Serve constraint records; writes are not offered, so the tables are read-only."""
+        """Serve constraint records but never negotiate vgi.constraint.enforce.v1.
+
+        The tables keep their simple_writable writes (see
+        ``RowidConstraintWorker._table_for_capabilities``), so a write a table
+        declares fails on the missing enforcement profile and one it does not
+        declare fails as unsupported.
+        """
         del attach_opaque_data
         return CatalogCapabilities(read=[CONSTRAINT_RECORDS_READ])
 
@@ -136,6 +151,17 @@ class RowidConstraintWorker(SimpleWritableWorker):
 
     catalog_interface = RowidConstraintCatalog
 
+    @staticmethod
+    def _table_for_capabilities(info, selected):  # type: ignore[no-untyped-def,override]
+        served = SimpleWritableWorker._table_for_capabilities(info, selected)
+        return dataclasses.replace(
+            served,
+            write_result_modes=info.write_result_modes,
+            insert_function=info.insert_function,
+            update_function=info.update_function,
+            delete_function=info.delete_function,
+        )
+
 
 if __name__ == "__main__":
     RowidConstraintWorker.main()