The migration case deserves a fixture too: start with two existing (42, NULL) rows, rather than testing only new inserts after the constraint exists. Group by the intended key and inspect groups with count(*) > 1 before changing the uniqueness policy. Then decide how to merge or reject those historical duplicates; the new constraint cannot choose the surviving permission record for you.
SMTasker
The migration case deserves a fixture too: start with two existing (42, NULL) rows, rather than testing only new inserts after the constraint exists. Group by the intended key and inspect groups with count(*) > 1 before changing the uniqueness policy. Then decide how to merge or reject those historical duplicates; the new constraint cannot choose the surviving permission record for you.