Merge #154031 #154408 #154495 #154556

craig[bot] · rail · arulajmani · craig[bot] · commit 325aac07bd05 · 2025-10-01T22:40:31.000Z
154031: WORKSPACE: update pgo profile r=mgartner a=rail Benchstat results: ``` │ benchstat_old.txt │ benchstat.txt │ │ queries/sec │ queries/sec vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 25.86k ± 3% 27.15k ± 1% +5.00% (p=0.000 n=20) │ benchstat_old.txt │ benchstat.txt │ │ txns/sec │ txns/sec vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 1.293k ± 3% 1.358k ± 1% +5.00% (p=0.000 n=20) │ benchstat_old.txt │ benchstat.txt │ │ ms/min │ ms/min vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 13.00 ± 4% 12.13 ± 5% -6.69% (p=0.000 n=20) │ benchstat_old.txt │ benchstat.txt │ │ ms/avg │ ms/avg vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 49.50 ± 3% 47.14 ± 1% -4.77% (p=0.000 n=20) │ benchstat_old.txt │ benchstat.txt │ │ ms/p95 │ ms/p95 vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 77.89 ± 3% 71.83 ± 2% -7.79% (p=0.000 n=20) │ benchstat_old.txt │ benchstat.txt │ │ ms/max │ ms/max vs base │ Sysbench/a=oltp_read_write/nodes=3/cpu=8/conc=64 251.4 ± 6% 216.9 ± 12% ~ (p=0.086 n=20) ``` Fixes: REL-3226 Release note: None 154408: rangefeed: make TestUnrecoverableErrors work with multi-tenancy r=tbg a=arulajmani This test wants to see errors because of strict GC enforcement policies. To do so, it creates a scratch range and tries to trigger an error there. Strict GC enforcement policies don't apply to the scratch range out of the box, so to sidestep this, the test would explicitly configure the scratch range's span config. This explicit configuration only worked for the system tenant previously; this patch extends it to secondary tenants. Closes #109472 Release note: None 154495: sql: add guardrail for approximate max schema objects r=rafiss a=rafiss This adds a new cluster setting `sql.schema.approx_max_object_count` that operators can use to limit the total number of schema objects (tables, databases, schemas, types, functions) in a cluster. The implementation uses cached table statistics from TableStatisticsCache to count descriptors in system.descriptor, avoiding expensive `COUNT(*)` queries. If cached statistics are unavailable, object creation is allowed. The check is enforced in both the legacy and declarative schema changers. fixes #148286 Release note (ops change): Added cluster setting `sql.schema.approx_max_object_count` (default: 20,000) to prevent creation of new schema objects when the limit is exceeded. The check uses cached table statistics for performance and is approximate - it may not be immediately accurate until table statistics are updated by the background statistics refreshing job. Clusters that have been running stably with a larger object count should raise the limit or disable the limit by setting the value to 0. In future releases, the default value for this setting will be raised as more CockroachDB features support larger object counts. 154556: build: enable custom toolchain use in crlib r=RaduBerinde a=RaduBerinde We set up a patch to enable the crdb-specific code in crlib/crsync. We add a test in syncutil which verifies that the correct path is being used. Epic: none Release note: None Co-authored-by: Rail Aliiev <rail@iqchoice.com> Co-authored-by: Arul Ajmani <arulajmani@gmail.com> Co-authored-by: Rafi Shamim <rafi@cockroachlabs.com> Co-authored-by: Radu Berinde <radu@cockroachlabs.com>
diff --git a/DEPS.bzl b/DEPS.bzl
@@ -1750,10 +1750,14 @@ def go_deps():
         name = "com_github_cockroachdb_crlib",
         build_file_proto_mode = "disable_global",
         importpath = "github.com/cockroachdb/crlib",
-        sha256 = "4e2aad9df48f99411a51186fdf92041c881adc642c87106776734e8a64578077",
-        strip_prefix = "github.com/cockroachdb/crlib@v0.0.0-20250916151006-1094cb39adac",
+        patch_args = ["-p1"],
+        patches = [
+            "@com_github_cockroachdb_cockroach//build/patches:com_github_cockroachdb_crlib.patch",
+        ],
+        sha256 = "539dd737ca1da53ee5c296ea0f3aad92f6d59f577e0d169dffb5a4ad706e1728",
+        strip_prefix = "github.com/cockroachdb/crlib@v0.0.0-20251001180057-2a49e1873587",
         urls = [
-            "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/crlib/com_github_cockroachdb_crlib-v0.0.0-20250916151006-1094cb39adac.zip",
+            "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/crlib/com_github_cockroachdb_crlib-v0.0.0-20251001180057-2a49e1873587.zip",
         ],
     )
     go_repository(
diff --git a/WORKSPACE b/WORKSPACE
@@ -641,8 +641,8 @@ load("//build:pgo.bzl", "pgo_profile")
 
 pgo_profile(
     name = "pgo_profile",
-    sha256 = "57414977040f9ed887a4e2b0434ca97f0047229928d8456a25acb3e08b4a71f2",
-    url = "https://storage.googleapis.com/cockroach-profiles/20250616172238-909ceb6ada01354d34416f1087fc256a066daa17.pb.gz",
+    sha256 = "7500eeeecba8edc9d25fd65b178568e7c543b50b3ef3ffc5e6e13af186ae2023",
+    url = "https://storage.googleapis.com/cockroach-profiles/20250926213937-4c6b4ce4dd320a7aa835757ed60f295f6e7c692c.pb.gz",
 )
 
 # Download and register the FIPS enabled Go toolchain at the end to avoid toolchain conflicts for gazelle.
diff --git a/build/bazelutil/distdir_files.bzl b/build/bazelutil/distdir_files.bzl
@@ -346,7 +346,7 @@ DISTDIR_FILES = {
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/cmux/com_github_cockroachdb_cmux-v0.0.0-20250514152509-914d3bf9ec58.zip": "c1cf4cd99a1ad6a00f2ccd4188cbcf004cb0d56895670b2c171061ce564cd791",
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/cockroach-go/v2/com_github_cockroachdb_cockroach_go_v2-v2.4.1.zip": "ba646db91152f3121a6812c7b74d12d8c0e126f7b4d3b927618b159692ceb424",
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/crlfmt/com_github_cockroachdb_crlfmt-v0.0.0-20221214225007-b2fc5c302548.zip": "fedc01bdd6d964da0425d5eaac8efadc951e78e13f102292cc0774197f09ab63",
-    "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/crlib/com_github_cockroachdb_crlib-v0.0.0-20250916151006-1094cb39adac.zip": "4e2aad9df48f99411a51186fdf92041c881adc642c87106776734e8a64578077",
+    "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/crlib/com_github_cockroachdb_crlib-v0.0.0-20251001180057-2a49e1873587.zip": "539dd737ca1da53ee5c296ea0f3aad92f6d59f577e0d169dffb5a4ad706e1728",
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/datadriven/com_github_cockroachdb_datadriven-v1.0.3-0.20250911232732-d959cf14706c.zip": "417027b5ff27774000129768f79e9ae62021b95d3ac9d3181e132dbe46b44da3",
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/drpc/com_github_cockroachdb_drpc-v0.0.0-20250924114114-78d4e121902a.zip": "98b44a51f82873f93f77da80230212ab40f35044e8d38645cb1392ae03462f0b",
     "https://storage.googleapis.com/cockroach-godeps/gomod/github.com/cockroachdb/errors/com_github_cockroachdb_errors-v1.12.0.zip": "f73d8a5f4d8fcbc4ed61db2b47f17e2601d8b32e9a49c0665667489d9d9d6e7c",
diff --git a/build/patches/com_github_cockroachdb_crlib.patch b/build/patches/com_github_cockroachdb_crlib.patch
@@ -0,0 +1,28 @@
+diff --git a/crsync/BUILD.bazel b/crsync/BUILD.bazel
+index e787597..0c25863 100644
+--- a/crsync/BUILD.bazel
++++ b/crsync/BUILD.bazel
+@@ -4,13 +4,22 @@ go_library(
+     name = "crsync",
+     srcs = [
+         "counters.go",
+-        "sharding_vanilla.go",
++        ":gen-sharding_crdb",
+         "typed_atomic.go",
+     ],
+     importpath = "github.com/cockroachdb/crlib/crsync",
+     visibility = ["//visibility:public"],
+ )
+ 
++REMOVE_GO_BUILD_CONSTRAINTS = "cat $< | grep -v '//go:build' | grep -v '// +build' > $@"
++
++genrule(
++    name = "gen-sharding_crdb",
++    srcs = ["sharding_crdb.go"],
++    outs = ["gen-sharding_crdb.go"],
++    cmd = REMOVE_GO_BUILD_CONSTRAINTS,
++)
++
+ alias(
+     name = "go_default_library",
+     actual = ":crsync",
diff --git a/build/scripts/patch-apply.sh b/build/scripts/patch-apply.sh
@@ -49,6 +49,9 @@ echo ""
 
 if patch -p1 < "$PATCH_FILE"; then
   echo "Patch applied successfully."
+  echo ""
+  echo "If you get an error applying the patch when building: comment out the patch in DEPS.bzl,"
+  echo "build cockroach, then inspect the relevant files in _bazel/cockroach/external/<repo>".
 else
   echo "Failed to apply patch."
   echo "Make sure the repository is at the proper commit."
diff --git a/docs/generated/settings/settings-for-tenants.txt b/docs/generated/settings/settings-for-tenants.txt
@@ -346,6 +346,7 @@ sql.multiple_modifications_of_table.enabled	boolean	false	if true, allow stateme
 sql.multiregion.drop_primary_region.enabled	boolean	true	allows dropping the PRIMARY REGION of a database if it is the last region	application
 sql.notices.enabled	boolean	true	enable notices in the server/client protocol being sent	application
 sql.optimizer.uniqueness_checks_for_gen_random_uuid.enabled	boolean	false	if enabled, uniqueness checks may be planned for mutations of UUID columns updated with gen_random_uuid(); otherwise, uniqueness is assumed due to near-zero collision probability	application
+sql.schema.approx_max_object_count	integer	20000	approximate maximum number of schema objects allowed in the cluster; the check uses cached statistics, so the actual count may slightly exceed this limit; set to 0 to disable	application
 sql.schema.telemetry.recurrence	string	@weekly	cron-tab recurrence for SQL schema telemetry job	system-visible
 sql.spatial.experimental_box2d_comparison_operators.enabled	boolean	false	enables the use of certain experimental box2d comparison operators	application
 sql.sqlcommenter.enabled	boolean	false	enables support for sqlcommenter. Key value parsed from sqlcommenter comments will be included in sql insights and sql logs. See https://google.github.io/sqlcommenter/ for more details.	application
diff --git a/docs/generated/settings/settings.html b/docs/generated/settings/settings.html
@@ -301,6 +301,7 @@
 <tr><td><div id="setting-sql-multiregion-drop-primary-region-enabled" class="anchored"><code>sql.multiregion.drop_primary_region.enabled</code></div></td><td>boolean</td><td><code>true</code></td><td>allows dropping the PRIMARY REGION of a database if it is the last region</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
 <tr><td><div id="setting-sql-notices-enabled" class="anchored"><code>sql.notices.enabled</code></div></td><td>boolean</td><td><code>true</code></td><td>enable notices in the server/client protocol being sent</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
 <tr><td><div id="setting-sql-optimizer-uniqueness-checks-for-gen-random-uuid-enabled" class="anchored"><code>sql.optimizer.uniqueness_checks_for_gen_random_uuid.enabled</code></div></td><td>boolean</td><td><code>false</code></td><td>if enabled, uniqueness checks may be planned for mutations of UUID columns updated with gen_random_uuid(); otherwise, uniqueness is assumed due to near-zero collision probability</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
+<tr><td><div id="setting-sql-schema-approx-max-object-count" class="anchored"><code>sql.schema.approx_max_object_count</code></div></td><td>integer</td><td><code>20000</code></td><td>approximate maximum number of schema objects allowed in the cluster; the check uses cached statistics, so the actual count may slightly exceed this limit; set to 0 to disable</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
 <tr><td><div id="setting-sql-schema-telemetry-recurrence" class="anchored"><code>sql.schema.telemetry.recurrence</code></div></td><td>string</td><td><code>@weekly</code></td><td>cron-tab recurrence for SQL schema telemetry job</td><td>Advanced/Self-hosted (read-write); Basic/Standard (read-only)</td></tr>
 <tr><td><div id="setting-sql-spatial-experimental-box2d-comparison-operators-enabled" class="anchored"><code>sql.spatial.experimental_box2d_comparison_operators.enabled</code></div></td><td>boolean</td><td><code>false</code></td><td>enables the use of certain experimental box2d comparison operators</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
 <tr><td><div id="setting-sql-sqlcommenter-enabled" class="anchored"><code>sql.sqlcommenter.enabled</code></div></td><td>boolean</td><td><code>false</code></td><td>enables support for sqlcommenter. Key value parsed from sqlcommenter comments will be included in sql insights and sql logs. See https://google.github.io/sqlcommenter/ for more details.</td><td>Basic/Standard/Advanced/Self-Hosted</td></tr>
diff --git a/go.mod b/go.mod
@@ -136,7 +136,7 @@ require (
 	github.com/cockroachdb/cmux v0.0.0-20250514152509-914d3bf9ec58
 	github.com/cockroachdb/cockroach-go/v2 v2.4.1
 	github.com/cockroachdb/crlfmt v0.0.0-20221214225007-b2fc5c302548
-	github.com/cockroachdb/crlib v0.0.0-20250916151006-1094cb39adac
+	github.com/cockroachdb/crlib v0.0.0-20251001180057-2a49e1873587
 	github.com/cockroachdb/datadriven v1.0.3-0.20250911232732-d959cf14706c
 	github.com/cockroachdb/errors v1.12.0
 	github.com/cockroachdb/go-test-teamcity v0.0.0-20191211140407-cff980ad0a55
diff --git a/go.sum b/go.sum
@@ -555,8 +555,8 @@ github.com/cockroachdb/cockroach-go/v2 v2.4.1 h1:ACVT/zXsuK6waRPVYtDQpsM8pPA7IA/
 github.com/cockroachdb/cockroach-go/v2 v2.4.1/go.mod h1:9U179XbCx4qFWtNhc7BiWLPfuyMVQ7qdAhfrwLz1vH0=
 github.com/cockroachdb/crlfmt v0.0.0-20221214225007-b2fc5c302548 h1:i0bnjanlWAvM50wHMT7EFyxlt5HQusznWrkwl+HBIsU=
 github.com/cockroachdb/crlfmt v0.0.0-20221214225007-b2fc5c302548/go.mod h1:qtkxNlt5i3rrdirfJE/bQeW/IeLajKexErv7jEIV+Uc=
-github.com/cockroachdb/crlib v0.0.0-20250916151006-1094cb39adac h1:L+7nhSrQ9WzW91AJHP0LmjwMHEed2nl5b7PvN9eIw58=
-github.com/cockroachdb/crlib v0.0.0-20250916151006-1094cb39adac/go.mod h1:Gq51ZeKaFCXk6QwuGM0w1dnaOqc/F5zKT2zA9D6Xeac=
+github.com/cockroachdb/crlib v0.0.0-20251001180057-2a49e1873587 h1:qjG2TrBrPbGRVYp5obcAi8OSsuFJ8s1AElDImHLV9tY=
+github.com/cockroachdb/crlib v0.0.0-20251001180057-2a49e1873587/go.mod h1:ae57yNis2F1FThSNdPdoXfiPOVi8G1TLreCBQYPOdqo=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
 github.com/cockroachdb/datadriven v1.0.3-0.20250911232732-d959cf14706c h1:a0m7gmtv2mzJQ4wP9BkxCmJAnjZ7fsvCi2IORGD1als=
diff --git a/pkg/BUILD.bazel b/pkg/BUILD.bazel
@@ -2311,6 +2311,7 @@ GO_TARGETS = [
     "//pkg/sql/schemachanger/sctest:sctest",
     "//pkg/sql/schemachanger:schemachanger",
     "//pkg/sql/schemachanger:schemachanger_test",
+    "//pkg/sql/schemaobjectlimit:schemaobjectlimit",
     "//pkg/sql/scrub/scrubtestutils:scrubtestutils",
     "//pkg/sql/scrub:scrub",
     "//pkg/sql/sem/asof:asof",
diff --git a/pkg/kv/kvclient/rangefeed/rangefeed_external_test.go b/pkg/kv/kvclient/rangefeed/rangefeed_external_test.go
@@ -958,7 +958,6 @@ func TestUnrecoverableErrors(t *testing.T) {
 		// handle duplicated events.
 		kvserver.RangefeedUseBufferedSender.Override(ctx, &settings.SV, rt.useBufferedSender)
 		srv, sqlDB, kvDB := serverutils.StartServer(t, base.TestServerArgs{
-			DefaultTestTenant: base.TestIsForStuffThatShouldWorkWithSecondaryTenantsButDoesntYet(109472),
 			Knobs: base.TestingKnobs{
 				SpanConfig: &spanconfig.TestingKnobs{
 					ConfigureScratchRange: true,
diff --git a/pkg/spanconfig/spanconfigsqltranslator/sqltranslator.go b/pkg/spanconfig/spanconfigsqltranslator/sqltranslator.go
@@ -661,7 +661,7 @@ func (s *SQLTranslator) maybeGeneratePseudoTableRecords(
 func (s *SQLTranslator) maybeGenerateScratchRangeRecord(
 	ctx context.Context, ids descpb.IDs,
 ) (spanconfig.Record, error) {
-	if !s.knobs.ConfigureScratchRange || !s.codec.ForSystemTenant() {
+	if !s.knobs.ConfigureScratchRange {
 		return spanconfig.Record{}, nil // nothing to do
 	}
 
@@ -677,10 +677,12 @@ func (s *SQLTranslator) maybeGenerateScratchRangeRecord(
 			return spanconfig.Record{}, err
 		}
 
+		scratchKey := append(s.codec.TenantPrefix(), keys.ScratchRangeMin...)
+		scratchKey = scratchKey[:len(scratchKey):len(scratchKey)]
 		record, err := spanconfig.MakeRecord(
 			spanconfig.MakeTargetFromSpan(roachpb.Span{
-				Key:    keys.ScratchRangeMin,
-				EndKey: keys.ScratchRangeMax,
+				Key:    scratchKey,
+				EndKey: scratchKey.PrefixEnd(),
 			}), zone.AsSpanConfig())
 		if err != nil {
 			return spanconfig.Record{}, err
diff --git a/pkg/sql/BUILD.bazel b/pkg/sql/BUILD.bazel
@@ -502,6 +502,7 @@ go_library(
         "//pkg/sql/schemachanger/scpb",
         "//pkg/sql/schemachanger/scplan",
         "//pkg/sql/schemachanger/scrun",
+        "//pkg/sql/schemaobjectlimit",
         "//pkg/sql/scrub",
         "//pkg/sql/sem/asof",
         "//pkg/sql/sem/builtins",
diff --git a/pkg/sql/descriptor.go b/pkg/sql/descriptor.go
@@ -27,6 +27,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgerror"
 	"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgnotice"
 	"github.com/cockroachdb/cockroach/pkg/sql/regions"
+	"github.com/cockroachdb/cockroach/pkg/sql/schemaobjectlimit"
 	"github.com/cockroachdb/cockroach/pkg/sql/sem/catconstants"
 	"github.com/cockroachdb/cockroach/pkg/sql/sem/eval"
 	"github.com/cockroachdb/cockroach/pkg/sql/sem/tree"
@@ -206,6 +207,13 @@ func (p *planner) createDescriptor(
 			"expected new descriptor, not a modification of version %d",
 			descriptor.OriginalVersion())
 	}
+
+	if err := schemaobjectlimit.CheckMaxSchemaObjects(
+		ctx, p.InternalSQLTxn(), p.Descriptors(), p.execCfg.TableStatsCache, p.execCfg.Settings, 1,
+	); err != nil {
+		return err
+	}
+
 	b := p.Txn().NewBatch()
 	kvTrace := p.ExtendedEvalContext().Tracing.KVTracingEnabled()
 	if err := p.Descriptors().WriteDescToBatch(ctx, kvTrace, descriptor, b); err != nil {
diff --git a/pkg/sql/schema_change_plan_node.go b/pkg/sql/schema_change_plan_node.go
@@ -318,6 +318,7 @@ func newSchemaChangerTxnRunDependencies(
 		metaDataUpdater,
 		evalContext.Planner,
 		execCfg.StatsRefresher,
+		execCfg.TableStatsCache,
 		execCfg.DeclarativeSchemaChangerTestingKnobs,
 		kvTrace,
 		schemaChangerJobID,
diff --git a/pkg/sql/schemachanger/scdeps/BUILD.bazel b/pkg/sql/schemachanger/scdeps/BUILD.bazel
@@ -36,12 +36,14 @@ go_library(
         "//pkg/sql/schemachanger/scexec/backfiller",
         "//pkg/sql/schemachanger/scexec/scmutationexec",
         "//pkg/sql/schemachanger/scrun",
+        "//pkg/sql/schemaobjectlimit",
         "//pkg/sql/sem/catconstants",
         "//pkg/sql/sem/eval",
         "//pkg/sql/sem/tree",
         "//pkg/sql/sessiondata",
         "//pkg/sql/sqlerrors",
         "//pkg/sql/sqltelemetry",
+        "//pkg/sql/stats",
         "//pkg/sql/types",
         "//pkg/util/admission/admissionpb",
         "//pkg/util/syncutil",
diff --git a/pkg/sql/schemachanger/scdeps/exec_deps.go b/pkg/sql/schemachanger/scdeps/exec_deps.go
@@ -27,9 +27,11 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/sql/isql"
 	"github.com/cockroachdb/cockroach/pkg/sql/schemachanger/scexec"
 	"github.com/cockroachdb/cockroach/pkg/sql/schemachanger/scexec/scmutationexec"
+	"github.com/cockroachdb/cockroach/pkg/sql/schemaobjectlimit"
 	"github.com/cockroachdb/cockroach/pkg/sql/sem/tree"
 	"github.com/cockroachdb/cockroach/pkg/sql/sessiondata"
 	"github.com/cockroachdb/cockroach/pkg/sql/sqltelemetry"
+	"github.com/cockroachdb/cockroach/pkg/sql/stats"
 	"github.com/cockroachdb/errors"
 )
 
@@ -64,6 +66,7 @@ func NewExecutorDependencies(
 	metadataUpdater scexec.DescriptorMetadataUpdater,
 	temporarySchemaCreator scexec.TemporarySchemaCreator,
 	statsRefresher scexec.StatsRefresher,
+	tableStatsCache *stats.TableStatisticsCache,
 	testingKnobs *scexec.TestingKnobs,
 	kvTrace bool,
 	schemaChangerJobID jobspb.JobID,
@@ -77,6 +80,7 @@ func NewExecutorDependencies(
 			jobRegistry:        jobRegistry,
 			validator:          validator,
 			statsRefresher:     statsRefresher,
+			tableStatsCache:    tableStatsCache,
 			schemaChangerJobID: schemaChangerJobID,
 			schemaChangerJob:   nil,
 			kvTrace:            kvTrace,
@@ -105,6 +109,7 @@ type txnDeps struct {
 	createdJobs         []jobspb.JobID
 	validator           scexec.Validator
 	statsRefresher      scexec.StatsRefresher
+	tableStatsCache     *stats.TableStatisticsCache
 	tableStatsToRefresh []descpb.ID
 	schemaChangerJobID  jobspb.JobID
 	schemaChangerJob    *jobs.Job
@@ -370,6 +375,18 @@ func (d *txnDeps) InitializeSequence(id descpb.ID, startVal int64) {
 	batch.Inc(sequenceKey, startVal)
 }
 
+// CheckMaxSchemaObjects implements the scexec.Catalog interface.
+func (d *txnDeps) CheckMaxSchemaObjects(ctx context.Context, numNewObjects int) error {
+	return schemaobjectlimit.CheckMaxSchemaObjects(
+		ctx,
+		d.txn,
+		d.descsCollection,
+		d.tableStatsCache,
+		d.settings,
+		numNewObjects,
+	)
+}
+
 // Reset implements the scexec.Catalog interface.
 func (d *txnDeps) Reset(ctx context.Context) error {
 	d.descsCollection.ResetUncommitted(ctx)
diff --git a/pkg/sql/schemachanger/scdeps/run_deps.go b/pkg/sql/schemachanger/scdeps/run_deps.go
@@ -21,6 +21,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/sql/schemachanger/scexec/backfiller"
 	"github.com/cockroachdb/cockroach/pkg/sql/schemachanger/scrun"
 	"github.com/cockroachdb/cockroach/pkg/sql/sessiondata"
+	"github.com/cockroachdb/cockroach/pkg/sql/stats"
 	"github.com/cockroachdb/cockroach/pkg/util/syncutil"
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 )
@@ -42,6 +43,7 @@ func NewJobRunDependencies(
 	indexValidator scexec.Validator,
 	metadataUpdaterFactory MetadataUpdaterFactory,
 	statsRefresher scexec.StatsRefresher,
+	tableStatsCache *stats.TableStatisticsCache,
 	testingKnobs *scexec.TestingKnobs,
 	statements []string,
 	sessionData *sessiondata.SessionData,
@@ -66,13 +68,15 @@ func NewJobRunDependencies(
 		sessionData:           sessionData,
 		kvTrace:               kvTrace,
 		statsRefresher:        statsRefresher,
+		tableStatsCache:       tableStatsCache,
 	}
 }
 
 type jobExecutionDeps struct {
 	collectionFactory     *descs.CollectionFactory
 	db                    descs.DB
 	statsRefresher        scexec.StatsRefresher
+	tableStatsCache       *stats.TableStatisticsCache
 	backfiller            scexec.Backfiller
 	spanSplitter          scexec.IndexSpanSplitter
 	merger                scexec.Merger
@@ -120,6 +124,7 @@ func (d *jobExecutionDeps) WithTxnInJob(ctx context.Context, fn scrun.JobTxnFunc
 				jobRegistry:        d.jobRegistry,
 				validator:          d.indexValidator,
 				statsRefresher:     d.statsRefresher,
+				tableStatsCache:    d.tableStatsCache,
 				schemaChangerJobID: d.job.ID(),
 				schemaChangerJob:   d.job,
 				kvTrace:            d.kvTrace,
diff --git a/pkg/sql/schemachanger/scdeps/sctestdeps/test_deps.go b/pkg/sql/schemachanger/scdeps/sctestdeps/test_deps.go
@@ -1550,6 +1550,12 @@ func (s *TestState) InitializeSequence(id descpb.ID, startVal int64) {
 	s.LogSideEffectf("initializing sequence %d with starting value of %d", id, startVal)
 }
 
+// CheckMaxSchemaObjects is part of the scexec.Catalog interface.
+func (s *TestState) CheckMaxSchemaObjects(ctx context.Context, numNewObjects int) error {
+	// In tests, we don't enforce the limit.
+	return nil
+}
+
 // TemporarySchemaName is part of scbuild.TemporarySchemaProvider interface.
 func (s *TestState) TemporarySchemaName() string {
 	return fmt.Sprintf("pg_temp_%d_%d", 123, 456)
diff --git a/pkg/sql/schemachanger/scexec/dependencies.go b/pkg/sql/schemachanger/scexec/dependencies.go
@@ -119,6 +119,11 @@ type Catalog interface {
 
 	// InitializeSequence initializes the initial value for a sequence.
 	InitializeSequence(id descpb.ID, startVal int64)
+
+	// CheckMaxSchemaObjects checks if the number of schema objects in the
+	// cluster plus the new objects being created would exceed the configured
+	// limit. Returns an error if the limit would be exceeded.
+	CheckMaxSchemaObjects(ctx context.Context, numNewObjects int) error
 }
 
 // Telemetry encapsulates metrics gather for the declarative schema changer.
diff --git a/pkg/sql/schemachanger/scexec/exec_immediate_mutation.go b/pkg/sql/schemachanger/scexec/exec_immediate_mutation.go
@@ -218,6 +218,13 @@ func (s *immediateState) exec(ctx context.Context, c Catalog) error {
 	s.descriptorsToDelete.ForEach(func(id descpb.ID) {
 		s.modifiedDescriptors.Remove(id)
 	})
+
+	if len(s.newDescriptors) > 0 {
+		if err := c.CheckMaxSchemaObjects(ctx, len(s.newDescriptors)); err != nil {
+			return err
+		}
+	}
+
 	for _, newDescID := range getOrderedNewDescriptorIDs(s.newDescriptors) {
 		// Create new descs by the ascending order of their ID. This determinism
 		// helps avoid flakes in end-to-end tests in which we assert a particular
diff --git a/pkg/sql/schemachanger/scexec/executor_external_test.go b/pkg/sql/schemachanger/scexec/executor_external_test.go
@@ -76,6 +76,7 @@ func (ti testInfra) newExecDeps(txn descs.Txn) scexec.Dependencies {
 		noopMetadataUpdater{},
 		noopTemporarySchemaCreator{},
 		noopStatsReferesher{},
+		nil, /* tableStatsCache */
 		&scexec.TestingKnobs{},
 		kvTrace,
 		schemaChangerJobID,
diff --git a/pkg/sql/schemachanger/scexec/mocks_generated_test.go b/pkg/sql/schemachanger/scexec/mocks_generated_test.go
diff --git a/pkg/sql/schemachanger/schemachanger_test.go b/pkg/sql/schemachanger/schemachanger_test.go
diff --git a/pkg/sql/schemachanger/scjob/job.go b/pkg/sql/schemachanger/scjob/job.go
diff --git a/pkg/sql/schemaobjectlimit/BUILD.bazel b/pkg/sql/schemaobjectlimit/BUILD.bazel
diff --git a/pkg/sql/schemaobjectlimit/check.go b/pkg/sql/schemaobjectlimit/check.go
diff --git a/pkg/sql/sqlclustersettings/clustersettings.go b/pkg/sql/sqlclustersettings/clustersettings.go
diff --git a/pkg/util/syncutil/BUILD.bazel b/pkg/util/syncutil/BUILD.bazel
diff --git a/pkg/util/syncutil/crsync_test.go b/pkg/util/syncutil/crsync_test.go

Original file line number	Diff line number	Diff line change
`@@ -641,8 +641,8 @@ load("//build:pgo.bzl", "pgo_profile")`
`641`	`641`
`642`	`642`	`pgo_profile(`
`643`	`643`	`name = "pgo_profile",`
`644`		`- sha256 = "57414977040f9ed887a4e2b0434ca97f0047229928d8456a25acb3e08b4a71f2",`
`645`		`- url = "https://storage.googleapis.com/cockroach-profiles/20250616172238-909ceb6ada01354d34416f1087fc256a066daa17.pb.gz",`
	`644`	`+ sha256 = "7500eeeecba8edc9d25fd65b178568e7c543b50b3ef3ffc5e6e13af186ae2023",`
	`645`	`+ url = "https://storage.googleapis.com/cockroach-profiles/20250926213937-4c6b4ce4dd320a7aa835757ed60f295f6e7c692c.pb.gz",`
`646`	`646`	`)`
`647`	`647`
`648`	`648`	`# Download and register the FIPS enabled Go toolchain at the end to avoid toolchain conflicts for gazelle.`