The "GRANTs that grant nothing" class is the one I keep getting bitten by — specifically when GRANT runs in the migration session that owns the objects (so it looks correct) but the role being granted to doesn't exist yet in some tenant-provisioning order-of-operations. Mocks let that slip through every time.

One more bug-class that only real-DB integration testing catches: query plans regressing because statistics are stale. A query that runs 30ms locally on a hot cache + fresh stats can take 4s in prod with 4-week-old pg_statistic and the planner picking a Nested Loop instead of Hash Join. autoanalyze threshold drift on slow-growth tables is the silent killer.

Worth adding a testcontainer case that does a heavy INSERT, runs the read query, and asserts the plan shape via EXPLAIN — catches plan regressions before they ship.