diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0f65d6a..7e1e953 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -41,6 +41,9 @@ jobs:
     - name: Run tests
       run: |
         pytest -v
+    - name: Run autocommit tests just on 3.14/Ubuntu
+      if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.14'
+      run: pytest --sqlite-autocommit
     - name: run mypy
       run: mypy sqlite_utils tests
     - name: run flake8
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 765b0e0..fbc58d8 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -4,6 +4,33 @@
  Changelog
 ===========
 
+.. _unreleased:
+
+Unreleased
+----------
+
+Breaking changes:
+
+- Write statements executed with ``db.execute()`` are now committed automatically, unless a transaction is already open in which case they join it. Previously they opened an implicit transaction that stayed open until something committed it - writes appeared to work when read on the same connection but were silently rolled back when the connection closed. Code that relied on rolling back uncommitted ``db.execute()`` writes should use the new ``db.begin()`` method to open an explicit transaction first. The transaction model is documented in full at :ref:`python_api_transactions`.
+- ``db.query()`` now executes its SQL as soon as it is called, rather than waiting until the returned generator is first iterated. Rows are still fetched lazily during iteration. SQL errors are now raised at the call site, statements such as ``INSERT ... RETURNING`` take effect without needing to iterate over their results, and passing a statement that returns no rows - previously a silent no-op - now raises a ``ValueError`` recommending ``db.execute()`` instead.
+- Python API validation errors now raise ``ValueError`` instead of ``AssertionError``. Previously invalid arguments - such as ``create_table()`` with no columns, ``transform()`` on a table that does not exist, or passing both ``ignore=True`` and ``replace=True`` - were rejected using bare ``assert`` statements, which are silently skipped when Python runs with the ``-O`` flag. Code that caught ``AssertionError`` for these cases should catch ``ValueError`` instead.
+- ``table.upsert()`` and ``table.upsert_all()`` now raise ``PrimaryKeyRequired`` if a record is missing a value for any primary key column, or has a value of ``None`` for one. Previously such records - which can never match an existing row - were quietly inserted as brand new rows, or triggered a confusing ``KeyError`` after the insert had already taken place.
+- ``db.enable_wal()`` and ``db.disable_wal()`` now raise a ``sqlite_utils.db.TransactionError`` if called while a transaction is open. Previously they would silently commit the open transaction as a side effect of changing the journal mode, breaking the rollback guarantee of ``db.atomic()`` and of user-managed transactions.
+- The ``View`` class no longer has an ``enable_fts()`` method. It existed only to raise ``NotImplementedError``, since full-text search is not supported for views - calling it now raises ``AttributeError`` instead, and the method no longer appears in the API reference. The ``sqlite-utils enable-fts`` command shows a clean error when pointed at a view.
+- The no-op ``-d/--detect-types`` flag has been removed from the ``insert`` and ``upsert`` commands. Type detection has been the default for CSV/TSV data since 4.0a1, so the flag did nothing - invocations using it should simply drop it. ``--no-detect-types`` remains available to disable detection.
+- ``Database()`` now raises a ``sqlite_utils.db.TransactionError`` if passed a connection created with the Python 3.12+ ``sqlite3.connect(..., autocommit=True)`` or ``autocommit=False`` options. ``commit()`` and ``rollback()`` behave differently on those connections, which previously caused every write made by the library to be silently discarded when the connection closed.
+
+Everything else:
+
+- Fixed a bug where ``table.delete_where()``, ``table.optimize()`` and ``table.rebuild_fts()`` did not commit their changes, leaving the connection inside an open transaction. Their work - and any subsequent writes - could then be silently rolled back when the connection was closed. All three now use ``db.atomic()``, consistent with the other write methods.
+- The ``sqlite-utils drop-table`` command now refuses to drop a view, and ``drop-view`` refuses to drop a table. Previously each would silently drop the wrong type of object if the name matched. Both now exit with an error suggesting the correct command to use.
+- Migrations applied by the new :ref:`migrations system <migrations>` now run inside a transaction, together with the record of the migration having been applied. If a migration raises an exception its changes are rolled back and it stays pending, so it can be safely re-applied after the error is fixed. Migrations that cannot run inside a transaction, such as those executing ``VACUUM``, can opt out using ``@migrations(transactional=False)`` - see :ref:`migrations_transactions`.
+- ``table.upsert()`` and ``table.upsert_all()`` now detect the primary key or compound primary key of an existing table, so the ``pk=`` argument is no longer required when upserting into a table that already has a primary key.
+- ``db.table(table_name).insert({})`` can now be used to insert a row consisting entirely of default values into an existing table, using ``INSERT INTO ... DEFAULT VALUES``. (:issue:`759`)
+- Improvements to the ``sqlite-utils migrate`` command: ``--stop-before`` values that do not match any known migration are now an error instead of being silently ignored, ``--stop-before`` now works correctly with migration files that still use the older ``sqlite_migrate.Migrations`` class, and ``--list`` is now a read-only operation that no longer creates the database file or the migrations tracking table. ``migrations.applied()`` now returns migrations in the order they were applied.
+- New ``db.begin()``, ``db.commit()`` and ``db.rollback()`` methods for taking manual control of transactions, as an alternative to the ``db.atomic()`` context manager.
+- New documentation: :ref:`python_api_transactions` describes how transactions work and when changes are committed, and a new :ref:`upgrading` page details the changes needed to move between major versions.
+
 .. _v4_0rc1:
 
 4.0rc1 (2026-06-21)
diff --git a/docs/cli-reference.rst b/docs/cli-reference.rst
index 48d0145..cbac48b 100644
--- a/docs/cli-reference.rst
+++ b/docs/cli-reference.rst
@@ -286,7 +286,6 @@ See :ref:`cli_inserting_data`, :ref:`cli_insert_csv_tsv`, :ref:`cli_insert_unstr
       --alter                   Alter existing table to add any missing columns
       --not-null TEXT           Columns that should be created as NOT NULL
       --default <TEXT TEXT>...  Default value that should be set for a column
-      -d, --detect-types        Detect types for columns in CSV/TSV data (default)
       --no-detect-types         Treat all CSV/TSV columns as TEXT
       --analyze                 Run ANALYZE at the end of this operation
       --load-extension TEXT     Path to SQLite extension, with optional :entrypoint
@@ -344,7 +343,6 @@ See :ref:`cli_upsert`.
       --alter                   Alter existing table to add any missing columns
       --not-null TEXT           Columns that should be created as NOT NULL
       --default <TEXT TEXT>...  Default value that should be set for a column
-      -d, --detect-types        Detect types for columns in CSV/TSV data (default)
       --no-detect-types         Treat all CSV/TSV columns as TEXT
       --analyze                 Run ANALYZE at the end of this operation
       --load-extension TEXT     Path to SQLite extension, with optional :entrypoint
diff --git a/docs/index.rst b/docs/index.rst
index 052b790..f190d47 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -40,5 +40,6 @@ Contents
    plugins
    reference
    cli-reference
+   upgrading
    contributing
    changelog
diff --git a/docs/migrations.rst b/docs/migrations.rst
index 948b468..e685936 100644
--- a/docs/migrations.rst
+++ b/docs/migrations.rst
@@ -70,6 +70,25 @@ When you apply a set of migrations you can stop part way through by specifying a
 
     migrations.apply(db, stop_before="add_weight")
 
+.. _migrations_transactions:
+
+Migrations and transactions
+===========================
+
+Each migration runs inside a transaction, together with the ``_sqlite_migrations`` record of it having been applied. If a migration function raises an exception, everything it did is rolled back, no record is written and the migration stays pending - so fixing the error and re-applying will run that migration again from a clean state. Migrations that completed earlier in the same ``apply()`` run stay applied.
+
+Some operations cannot run inside a transaction, for example ``VACUUM`` or changing the journal mode with ``db.enable_wal()``. Register migrations like these with ``transactional=False``:
+
+.. code-block:: python
+
+    @migrations(transactional=False)
+    def compact(db):
+        db.execute("VACUUM")
+
+A migration registered with ``transactional=False`` runs without a wrapping transaction, so if it fails part way through any changes it already made will not be rolled back, and re-applying will run the whole function again.
+
+Avoid calling ``db.commit()`` or otherwise managing transactions manually inside a transactional migration - register the migration with ``transactional=False`` if it needs to control its own transactions. Using ``with db.atomic():`` blocks inside a migration is fine: they nest as savepoints within the migration's transaction, so the migration as a whole still commits or rolls back as a single unit. See :ref:`python_api_transactions`.
+
 Applying migrations using the CLI
 =================================
 
@@ -98,7 +117,7 @@ Running the command repeatedly is safe. Migrations that already have a matching
 Listing migrations
 ==================
 
-Use ``--list`` to show applied and pending migrations without running them:
+Use ``--list`` to show applied and pending migrations without running them. This is a read-only operation - it will not create the database file or the ``_sqlite_migrations`` table:
 
 .. code-block:: bash
 
@@ -138,6 +157,8 @@ You can also target a specific migration set using ``migration_set:migration_nam
 
 The ``--stop-before`` option can be passed more than once.
 
+If a ``--stop-before`` value does not match any known migration the command exits with an error, rather than silently applying everything.
+
 Verbose output
 ==============
 
diff --git a/docs/plugins.rst b/docs/plugins.rst
index 6357ad9..99588ee 100644
--- a/docs/plugins.rst
+++ b/docs/plugins.rst
@@ -140,9 +140,7 @@ As a special niche feature, if your plugin needs to import some files and then a
 prepare_connection(conn)
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
-This hook is called when a new SQLite database connection is created. You can
-use it to `register custom SQL functions <https://docs.python.org/2/library/sqlite3.html#sqlite3.Connection.create_function>`_,
-aggregates and collations. For example:
+This hook is called when a new SQLite database connection is created. You can use it to `register custom SQL functions <https://docs.python.org/2/library/sqlite3.html#sqlite3.Connection.create_function>`_, aggregates and collations. For example:
 
 .. code-block:: python
 
@@ -154,8 +152,7 @@ aggregates and collations. For example:
             "hello", 1, lambda name: f"Hello, {name}!"
         )
 
-This registers a SQL function called ``hello`` which takes a single
-argument and can be called like this:
+This registers a SQL function called ``hello`` which takes a single argument and can be called like this:
 
 .. code-block:: sql
 
diff --git a/docs/python-api.rst b/docs/python-api.rst
index eab858e..e9eb371 100644
--- a/docs/python-api.rst
+++ b/docs/python-api.rst
@@ -33,6 +33,8 @@ Here's how to create a new SQLite database file containing a new ``chickens`` ta
         "color": "black",
     }])
 
+The inserted rows are saved to the database file straight away - methods like ``insert_all()`` commit their own changes, so no ``commit()`` call is needed. See :ref:`python_api_transactions` for how this works.
+
 You can loop through those rows like this:
 
 .. code-block:: python
@@ -93,6 +95,8 @@ Instead of a file path you can pass in an existing SQLite connection:
 
     db = Database(sqlite3.connect("my_database.db"))
 
+The connection must use Python's default transaction handling. Connections created with the Python 3.12+ ``sqlite3.connect(..., autocommit=True)`` or ``autocommit=False`` options are rejected with a ``sqlite_utils.db.TransactionError`` - see :ref:`python_api_transactions_modes`.
+
 If you want to create an in-memory database, you can do so like this:
 
 .. code-block:: python
@@ -144,6 +148,12 @@ The ``Database`` object also works as a context manager, which will automaticall
         db["my_table"].insert({"name": "Example"})
     # Connection is automatically closed here
 
+Exiting the block is equivalent to calling ``db.close()``: the connection is closed and any transaction still open at that point is rolled back. This matches SQLite's own behavior when a connection closes.
+
+This rarely matters in practice. Everything that writes to the database - including raw ``db.execute()`` statements - commits automatically, so a transaction can only be open here if you explicitly started one with ``db.begin()`` and have not yet committed it. In that case the decision to commit stays with you: committing automatically on exit could silently persist half-finished work, for example if your code returned early from the block. Call ``db.commit()`` when the work is complete.
+
+Note this differs from the ``sqlite3.Connection`` context manager in the standard library, which commits on success but does not close the connection. See :ref:`python_api_transactions` for the full transaction model.
+
 .. _python_api_attach:
 
 Attaching additional databases
@@ -219,6 +229,10 @@ The ``db.query(sql)`` function executes a SQL query and returns an iterator over
     # {'name': 'Cleo'}
     # {'name': 'Pancakes'}
 
+The SQL query is executed as soon as ``db.query()`` is called. The resulting rows are fetched lazily as you iterate, so large result sets are not loaded into memory all at once. Because execution is immediate, an error in your SQL will raise an exception straight away, and a statement such as ``INSERT ... RETURNING`` will take effect even if you do not iterate over its results.
+
+``db.query()`` can only be used with SQL that returns rows. Passing a statement that returns no rows - an ``INSERT`` or ``UPDATE`` without a ``RETURNING`` clause, for example - will raise a ``ValueError``. Use :ref:`db.execute() <python_api_execute>` for those statements instead.
+
 .. _python_api_execute:
 
 db.execute(sql, params)
@@ -239,34 +253,8 @@ The ``db.execute()`` and ``db.executescript()`` methods provide wrappers around
 
 Other cursor methods such as ``.fetchone()`` and ``.fetchall()`` are also available, see the `standard library documentation <https://docs.python.org/3/library/sqlite3.html#sqlite3.Cursor>`__.
 
-.. _python_api_atomic:
-
-Transactions with db.atomic()
------------------------------
-
-Use ``db.atomic()`` to group multiple operations in a transaction:
-
-.. code-block:: python
-
-    with db.atomic():
-        db.table("dogs").insert({"id": 1, "name": "Cleo"}, pk="id")
-        db.table("dogs").insert({"id": 2, "name": "Pancakes"})
-
-If an exception is raised, changes made inside the block will be rolled back.
-
-``db.atomic()`` can be nested. Nested blocks use SQLite savepoints, so an exception in an inner block can roll back to that savepoint without rolling back the entire outer transaction:
-
-.. code-block:: python
-
-    with db.atomic():
-        db.table("dogs").insert({"id": 1, "name": "Cleo"}, pk="id")
-        try:
-            with db.atomic():
-                db.table("dogs").insert({"id": 2, "name": "Pancakes"})
-                raise ValueError("skip this one")
-        except ValueError:
-            pass
-        db.table("dogs").insert({"id": 3, "name": "Marnie"})
+.. note::
+    Write statements executed this way are committed automatically, unless a transaction is already open in which case they become part of it - see :ref:`python_api_transactions_execute`.
 
 .. _python_api_parameters:
 
@@ -296,6 +284,114 @@ Named parameters using ``:name`` can be filled using a dictionary:
 
 In this example ``next()`` is used to retrieve the first result in the iterator returned by the ``db.query()`` method.
 
+.. _python_api_transactions:
+
+Transactions and saving your changes
+====================================
+
+Every method in this library that writes to the database - ``insert()``, ``upsert()``, ``update()``, ``delete()``, ``delete_where()``, ``transform()``, ``create_table()``, ``create_index()``, ``enable_fts()`` and the rest - runs inside its own transaction and commits it before returning. Your changes are saved to disk as soon as the method call finishes:
+
+.. code-block:: python
+
+    db = Database("data.db")
+    db.table("news").insert({"headline": "Dog wins award"})
+    # The new row is already saved - no commit() required
+
+The same applies to raw SQL executed with :ref:`db.execute() <python_api_transactions_execute>` - a write statement is committed as soon as it has run.
+
+You never need to call ``commit()``, and you do not need to close the database to persist your changes. There are exactly two situations where you need to think about transactions:
+
+1. You want to group several write operations together, so they either all succeed or all fail - use :ref:`db.atomic() <python_api_atomic>`.
+2. You are :ref:`managing a transaction yourself <python_api_transactions_manual>` with ``db.begin()``, in which case nothing is committed until you commit - the library will never commit a transaction you opened.
+
+.. _python_api_atomic:
+
+Grouping changes with db.atomic()
+---------------------------------
+
+Use ``db.atomic()`` to group multiple operations in a single transaction:
+
+.. code-block:: python
+
+    with db.atomic():
+        db.table("dogs").insert({"id": 1, "name": "Cleo"}, pk="id")
+        db.table("dogs").insert({"id": 2, "name": "Pancakes"})
+
+The transaction commits when the block exits. If an exception is raised, changes made inside the block will be rolled back.
+
+``db.atomic()`` can be nested. Nested blocks use SQLite savepoints, so an exception in an inner block can roll back to that savepoint without rolling back the entire outer transaction:
+
+.. code-block:: python
+
+    with db.atomic():
+        db.table("dogs").insert({"id": 1, "name": "Cleo"}, pk="id")
+        try:
+            with db.atomic():
+                db.table("dogs").insert({"id": 2, "name": "Pancakes"})
+                raise ValueError("skip this one")
+        except ValueError:
+            pass
+        db.table("dogs").insert({"id": 3, "name": "Marnie"})
+
+The transaction is opened with a deferred ``BEGIN`` - SQLite takes the necessary locks when the first statement inside the block runs.
+
+.. _python_api_transactions_execute:
+
+Raw SQL writes with db.execute()
+--------------------------------
+
+Write statements executed with :ref:`db.execute() <python_api_execute>` follow the same rule as everything else: they are committed automatically as soon as they have run.
+
+.. code-block:: python
+
+    db.execute("insert into news (headline) values (?)", ["Dog wins award"])
+    # Already committed
+
+If a transaction is open - because the call happens inside a ``db.atomic()`` block, or after ``db.begin()`` - the statement becomes part of that transaction instead, and commits when the transaction commits:
+
+.. code-block:: python
+
+    with db.atomic():
+        db.execute("insert into news (headline) values (?)", ["Dog wins award"])
+        db.execute("insert into news (headline) values (?)", ["Cat unimpressed"])
+    # Both rows committed together
+
+One corner case: a row-returning write such as ``INSERT ... RETURNING`` executed through ``db.execute()`` cannot be auto-committed, because its rows have not been read yet - call ``db.commit()`` after fetching them, or use :ref:`db.query() <python_api_query>` for those statements, which commits automatically once you have iterated over the results.
+
+.. _python_api_transactions_manual:
+
+Managing transactions yourself
+------------------------------
+
+You can take full manual control using the ``db.begin()``, ``db.commit()`` and ``db.rollback()`` methods:
+
+.. code-block:: python
+
+    db.begin()
+    db.table("news").insert({"headline": "Dog wins award"})
+    if all_looks_good:
+        db.commit()
+    else:
+        db.rollback()
+
+``db.begin()`` raises ``sqlite3.OperationalError`` if a transaction is already open. ``db.commit()`` and ``db.rollback()`` do nothing if there is no open transaction.
+
+The library will never commit a transaction you opened. If you call write methods such as ``insert()`` - or use ``db.atomic()`` - while your transaction is open, they participate in it using SQLite savepoints instead of committing: exiting an ``atomic()`` block releases its savepoint, but nothing is saved to disk until you commit the outer transaction yourself. If you roll back, their changes are rolled back too.
+
+Two related safeguards to be aware of:
+
+- ``db.enable_wal()`` and ``db.disable_wal()`` raise a ``sqlite_utils.db.TransactionError`` if called while a transaction is open, because changing the journal mode would commit it as a side effect.
+- Closing the database - explicitly with ``db.close()``, or by exiting a ``with Database(...) as db:`` block - rolls back any transaction that is still open, see :ref:`python_api_close`.
+
+.. _python_api_transactions_modes:
+
+Supported connection modes
+--------------------------
+
+``db.atomic()`` and the automatic per-method transactions require a connection in Python's default transaction handling mode. Passing a connection created with the Python 3.12+ ``sqlite3.connect(..., autocommit=True)`` or ``autocommit=False`` options to ``Database()`` raises a ``sqlite_utils.db.TransactionError``.
+
+This is because ``commit()`` and ``rollback()`` behave differently on those connections - under ``autocommit=True`` they are documented no-ops - which would cause every write made by this library to be silently discarded when the connection closed, rather than failing loudly.
+
 .. _python_api_table:
 
 Accessing tables
@@ -984,8 +1080,7 @@ You can delete all records in a table that match a specific WHERE statement usin
 
     >>> db = sqlite_utils.Database("dogs.db")
     >>> # Delete every dog with age less than 3
-    >>> with db.atomic():
-    >>>     db.table("dogs").delete_where("age < ?", [3])
+    >>> db.table("dogs").delete_where("age < ?", [3])
 
 Calling ``table.delete_where()`` with no other arguments will delete every row in the table.
 
@@ -1018,6 +1113,8 @@ Note that the ``pk`` and ``column_order`` parameters here are optional if you ar
 
 An ``upsert_all()`` method is also available, which behaves like ``insert_all()`` but performs upserts instead.
 
+Every record passed to ``upsert()`` or ``upsert_all()`` must include a value for each primary key column - a record without one could never match an existing row, so a ``sqlite_utils.db.PrimaryKeyRequired`` exception is raised instead of quietly inserting a new row.
+
 .. note::
     ``.upsert()`` and ``.upsert_all()`` in sqlite-utils 1.x worked like ``.insert(..., replace=True)`` and ``.insert_all(..., replace=True)`` do in 2.x. See `issue #66 <https://github.com/simonw/sqlite-utils/issues/66>`__ for details of this change.
 
@@ -2697,6 +2794,8 @@ You can disable WAL mode using ``.disable_wal()``:
 
     Database("my_database.db").disable_wal()
 
+The journal mode can only be changed outside of a transaction. Calling either method while a transaction is open - inside a ``db.atomic()`` block, for example - raises a ``sqlite_utils.db.TransactionError``, unless the database is already in the requested mode in which case the call is a no-op.
+
 You can check the current journal mode for a database using the ``journal_mode`` property:
 
 .. code-block:: python
diff --git a/docs/upgrading.rst b/docs/upgrading.rst
new file mode 100644
index 0000000..3109a7c
--- /dev/null
+++ b/docs/upgrading.rst
@@ -0,0 +1,117 @@
+.. _upgrading:
+
+===========
+ Upgrading
+===========
+
+This page describes the changes you may need to make to your own code or scripts when upgrading between major versions of ``sqlite-utils``.
+
+For the full list of changes in every release see the :ref:`changelog`.
+
+.. _upgrading_3_to_4:
+
+Upgrading from 3.x to 4.0
+=========================
+
+Requirements
+------------
+
+- Python 3.10 or higher is required.
+- The ``click`` dependency must be version 8.3.1 or later.
+
+Command-line changes
+--------------------
+
+**Type detection is now the default for CSV and TSV imports.** ``sqlite-utils insert`` and ``sqlite-utils upsert`` now detect column types when importing CSV or TSV data - previously every column was created as ``TEXT`` unless you passed ``--detect-types``. To restore the old behavior pass the new ``--no-detect-types`` flag:
+
+.. code-block:: bash
+
+    sqlite-utils insert data.db rows data.csv --csv --no-detect-types
+
+Two related things have been removed:
+
+- The ``SQLITE_UTILS_DETECT_TYPES`` environment variable.
+- The old ``-d/--detect-types`` flag itself. Since detection is now the default the flag did nothing - remove it from any scripts that used it.
+
+**The convert command no longer skips falsey values.** ``sqlite-utils convert`` previously skipped values that evaluated to ``False`` (empty strings, ``0``) unless you passed ``--no-skip-false``. All values are now converted and the ``--no-skip-false`` flag has been removed.
+
+**drop-table and drop-view check the object type.** ``sqlite-utils drop-table`` now refuses to drop a view, and ``drop-view`` refuses to drop a table. Previously each would silently drop the wrong type of object if the name matched. If you relied on that (unlikely), use the matching command instead.
+
+**sqlite-utils tui has moved to a plugin.** The optional terminal interface is now provided by the `sqlite-utils-tui <https://github.com/simonw/sqlite-utils-tui>`__ plugin:
+
+.. code-block:: bash
+
+    sqlite-utils install sqlite-utils-tui
+
+Python API changes
+------------------
+
+**db.table() no longer returns views.** ``db.table(name)`` now raises a ``sqlite_utils.db.NoTable`` exception if ``name`` is a SQL view. Use the new ``db.view(name)`` method for views:
+
+.. code-block:: python
+
+    table = db.table("my_table")
+    view = db.view("my_view")
+
+``db["name"]`` still returns either a ``Table`` or a ``View`` depending on what exists in the database.
+
+**db.query() executes immediately.** ``db.query(sql)`` previously returned a generator that did not execute the SQL until you started iterating over it. The SQL now runs as soon as the method is called - rows are still fetched lazily. Two consequences:
+
+- Errors in your SQL now raise at the ``db.query()`` call site rather than on first iteration.
+- Passing a statement that returns no rows - such as an ``INSERT`` or ``UPDATE`` without a ``RETURNING`` clause - previously did nothing at all, silently. It now raises a ``ValueError``. Use ``db.execute()`` for statements that do not return rows.
+
+**Upserts use INSERT ... ON CONFLICT.** Upsert operations now use SQLite's ``INSERT ... ON CONFLICT SET`` syntax rather than the previous ``INSERT OR IGNORE`` followed by ``UPDATE``. If your code depends on the old behavior, pass ``use_old_upsert=True`` to the ``Database()`` constructor - see :ref:`python_api_old_upsert`.
+
+**Upsert records must include their primary keys.** ``table.upsert()`` and ``table.upsert_all()`` now raise ``sqlite_utils.db.PrimaryKeyRequired`` if a record is missing a value for any primary key column (or has ``None`` for one). Previously such records were quietly inserted as new rows. Relatedly, ``pk=`` is now optional when the table already exists with a primary key - it is detected automatically.
+
+**Floating point columns are now REAL.** Auto-detected floating point columns are created with the correct SQLite type ``REAL`` instead of ``FLOAT``. Code that inspects column types should expect ``REAL``.
+
+**Generated schemas use double quotes.** Tables created by this library now wrap table and column names in ``"double-quotes"`` where they previously used ``[square-braces]``. If you compare ``table.schema`` strings against expected values you will need to update them.
+
+**table.convert() no longer skips falsey values.** Matching the CLI change above, ``table.convert()`` now converts every value. The ``skip_false`` parameter has been removed - previously it defaulted to ``True``, skipping empty strings and other falsey values.
+
+**View.enable_fts() has been removed.** The ``View`` class previously had an ``enable_fts()`` method that existed only to raise ``NotImplementedError`` - full-text search is not supported for views. Calling it now raises ``AttributeError`` like any other missing method.
+
+**Validation errors raise ValueError.** Invalid arguments to Python API methods - for example ``create_table()`` with no columns, or ``ignore=True`` together with ``replace=True`` - now raise ``ValueError``. They previously raised ``AssertionError`` from bare ``assert`` statements, which were silently skipped under ``python -O``.
+
+**Transaction behavior is now well-defined.** 4.0 introduces the :ref:`db.atomic() <python_api_atomic>` context manager and uses it consistently for every write operation - the full model is described in :ref:`python_api_transactions`. Changes you may notice:
+
+- Write statements executed with raw ``db.execute()`` calls now commit automatically, unless a transaction is already open in which case they join it. Previously they opened an implicit transaction that nothing committed - if your code used ``db.execute()`` for writes and relied on ``db.conn.rollback()`` to undo them, open an explicit transaction with the new ``db.begin()`` method first.
+- Multi-step operations such as ``table.transform()`` no longer commit an existing transaction you have open - they use savepoints inside it instead.
+- ``db.enable_wal()`` and ``db.disable_wal()`` raise a ``sqlite_utils.db.TransactionError`` if called while a transaction is open, instead of silently committing it.
+- Using ``Database`` as a context manager (``with Database(path) as db:``) closes the connection on exit *without* committing - a transaction you explicitly opened with ``db.begin()`` and did not commit is rolled back.
+- ``Database()`` rejects connections created with the Python 3.12+ ``sqlite3.connect(..., autocommit=True)`` or ``autocommit=False`` options, raising ``sqlite_utils.db.TransactionError``. On those connections every write the library made was silently discarded when the connection closed.
+
+Packaging changes
+-----------------
+
+- ``sqlite-utils`` now uses ``pyproject.toml`` in place of ``setup.py``.
+- ``pip`` is now a runtime dependency, used by the ``sqlite-utils install`` and ``uninstall`` commands.
+
+New features to be aware of
+---------------------------
+
+Not breaking changes, but new in 4.0 and worth knowing about when you upgrade:
+
+- A :ref:`database migrations system <migrations>`, incorporating the functionality of the ``sqlite-migrate`` plugin. If you used that plugin, the built-in system reads the same ``_sqlite_migrations`` table - your applied migrations will not run again. Update your migration files to use ``from sqlite_utils import Migrations``.
+- :ref:`db.atomic() <python_api_atomic>` for nested transaction support.
+- ``table.insert_all()`` and ``table.upsert_all()`` accept an iterator of lists or tuples as an alternative to dictionaries - see :ref:`python_api_insert_lists`.
+
+.. _upgrading_2_to_3:
+
+Upgrading from 2.x to 3.0
+=========================
+
+The 3.0 release redesigned search. The breaking changes were minor:
+
+- ``table.search()`` returns a generator of dictionaries, sorted by relevance. It previously returned a list of tuples sorted by ``rowid``.
+- The ``-c`` shortcut for ``--csv`` and the ``-f`` shortcut for ``--fmt`` were removed from the CLI - use the full option names.
+
+.. _upgrading_1_to_2:
+
+Upgrading from 1.x to 2.0
+=========================
+
+The 2.0 release changed the meaning of *upsert*. In 1.x, ``table.upsert()`` and ``table.upsert_all()`` actually performed ``INSERT OR REPLACE`` operations - entirely replacing the existing row. Since 2.0 an upsert updates only the columns you provide, leaving other columns untouched.
+
+If you want the 1.x behavior, use ``table.insert(..., replace=True)`` or ``table.insert_all(..., replace=True)`` instead.
diff --git a/pyproject.toml b/pyproject.toml
index 2c86f85..4ad1bd9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -72,7 +72,8 @@ CI = "https://github.com/simonw/sqlite-utils/actions"
 sqlite-utils = "sqlite_utils.cli:cli"
 
 [build-system]
-requires = ["setuptools"]
+# setuptools 77+ is needed for the PEP 639 license = "Apache-2.0" expression
+requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"
 
 [tool.flake8]
diff --git a/sqlite_utils/cli.py b/sqlite_utils/cli.py
index f15850d..a30f79a 100644
--- a/sqlite_utils/cli.py
+++ b/sqlite_utils/cli.py
@@ -14,6 +14,7 @@ from sqlite_utils.db import (
     DEFAULT,
     DescIndex,
     NoTable,
+    NoView,
     quote_identifier,
 )
 from sqlite_utils.plugins import ensure_plugins_loaded, pm, get_plugins
@@ -701,14 +702,14 @@ def enable_fts(
     _register_db_for_cleanup(db)
     _load_extensions(db, load_extension)
     try:
-        db[table].enable_fts(
+        db.table(table).enable_fts(
             column,
             fts_version=fts_version,
             tokenize=tokenize,
             create_triggers=create_triggers,
             replace=replace,
         )
-    except OperationalError as ex:
+    except (NoTable, OperationalError) as ex:
         raise click.ClickException(str(ex))
 
 
@@ -939,12 +940,6 @@ def insert_upsert_options(*, require_pk=False):
                     type=(str, str),
                     help="Default value that should be set for a column",
                 ),
-                click.option(
-                    "-d",
-                    "--detect-types",
-                    is_flag=True,
-                    help="Detect types for columns in CSV/TSV data (default)",
-                ),
                 click.option(
                     "--no-detect-types",
                     is_flag=True,
@@ -999,7 +994,6 @@ def insert_upsert_implementation(
     truncate=False,
     not_null=None,
     default=None,
-    detect_types=None,
     no_detect_types=False,
     analyze=False,
     load_extension=None,
@@ -1066,7 +1060,7 @@ def insert_upsert_implementation(
                 )
             else:
                 docs = (dict(zip(headers, row)) for row in reader)
-            # detect_types is now the default, unless --no-detect-types is passed
+            # Type detection is the default, unless --no-detect-types is passed
             if not no_detect_types:
                 tracker = TypeTracker()
                 docs = tracker.wrap(docs)
@@ -1146,7 +1140,7 @@ def insert_upsert_implementation(
             else:
                 doc_chunks = [docs]
             for doc_chunk in doc_chunks:
-                with db.conn:
+                with db.atomic():
                     db.conn.cursor().executemany(bulk_sql, doc_chunk)
             return
 
@@ -1154,6 +1148,8 @@ def insert_upsert_implementation(
             db.table(table).insert_all(
                 docs, pk=pk, batch_size=batch_size, alter=alter, **extra_kwargs
             )
+        except NoTable as e:
+            raise click.ClickException(str(e))
         except Exception as e:
             if (
                 isinstance(e, OperationalError)
@@ -1238,7 +1234,6 @@ def insert(
     batch_size,
     stop_after,
     alter,
-    detect_types,
     no_detect_types,
     analyze,
     load_extension,
@@ -1321,7 +1316,6 @@ def insert(
             ignore=ignore,
             replace=replace,
             truncate=truncate,
-            detect_types=detect_types,
             no_detect_types=no_detect_types,
             analyze=analyze,
             load_extension=load_extension,
@@ -1360,7 +1354,6 @@ def upsert(
     alter,
     not_null,
     default,
-    detect_types,
     no_detect_types,
     analyze,
     load_extension,
@@ -1406,7 +1399,6 @@ def upsert(
             upsert=True,
             not_null=not_null,
             default=default,
-            detect_types=detect_types,
             no_detect_types=no_detect_types,
             analyze=analyze,
             load_extension=load_extension,
@@ -1494,7 +1486,6 @@ def bulk(
             upsert=False,
             not_null=set(),
             default={},
-            detect_types=False,
             no_detect_types=True,
             load_extension=load_extension,
             silent=False,
@@ -1725,7 +1716,13 @@ def drop_table(path, table, ignore, load_extension):
     _register_db_for_cleanup(db)
     _load_extensions(db, load_extension)
     try:
-        db[table].drop(ignore=ignore)
+        db.table(table).drop(ignore=ignore)
+    except NoTable:
+        # A view exists with this name
+        if not ignore:
+            raise click.ClickException(
+                '"{}" is a view, not a table - use drop-view to drop it'.format(table)
+            )
     except OperationalError:
         raise click.ClickException('Table "{}" does not exist'.format(table))
 
@@ -1797,8 +1794,14 @@ def drop_view(path, view, ignore, load_extension):
     _register_db_for_cleanup(db)
     _load_extensions(db, load_extension)
     try:
-        db[view].drop(ignore=ignore)
-    except OperationalError:
+        db.view(view).drop(ignore=ignore)
+    except NoView:
+        if ignore:
+            return
+        if view in db.table_names():
+            raise click.ClickException(
+                '"{}" is a table, not a view - use drop-table to drop it'.format(view)
+            )
         raise click.ClickException('View "{}" does not exist'.format(view))
 
 
@@ -3374,24 +3377,57 @@ def migrate(db_path, migrations, stop_before, list_, verbose):
     if not migration_sets:
         raise click.ClickException("No migrations.py files found")
 
-    db = sqlite_utils.Database(db_path)
-    _register_db_for_cleanup(db)
-
     if list_:
+        if pathlib.Path(db_path).exists():
+            db = sqlite_utils.Database(db_path)
+        else:
+            # Listing is read-only - don't create the database file
+            db = sqlite_utils.Database(memory=True)
+        _register_db_for_cleanup(db)
         _display_migration_list(db, migration_sets)
         return
 
+    db = sqlite_utils.Database(db_path)
+    _register_db_for_cleanup(db)
+
     prev_schema = db.schema
     if verbose:
         click.echo("Migrating {}".format(db_path))
         click.echo("\nSchema before:\n")
         click.echo(textwrap.indent(prev_schema, "  ") or "  (empty)")
         click.echo()
+    if stop_before:
+        # Every --stop-before value must match at least one known migration
+        known_names = set()
+        for migration_set in migration_sets:
+            names = {m.name for m in migration_set.pending(db)}
+            names.update(m.name for m in migration_set.applied(db))
+            known_names.update(names)
+            known_names.update(
+                "{}:{}".format(migration_set.name, name) for name in names
+            )
+        unknown = [value for value in stop_before if value not in known_names]
+        if unknown:
+            raise click.ClickException(
+                "--stop-before did not match any migrations: {}".format(
+                    ", ".join(unknown)
+                )
+            )
     for migration_set in migration_sets:
-        migration_set.apply(
-            db,
-            stop_before=_stop_before_for_migration_set(stop_before, migration_set.name),
-        )
+        matches = _stop_before_for_migration_set(stop_before, migration_set.name)
+        if isinstance(migration_set, sqlite_utils.Migrations):
+            migration_set.apply(db, stop_before=matches)
+        else:
+            # Legacy sqlite-migrate Migrations objects take a single string
+            # for stop_before, not a list
+            distinct = list(dict.fromkeys(matches))
+            if len(distinct) > 1:
+                raise click.ClickException(
+                    "Migration set '{}' uses the older sqlite-migrate class, "
+                    "which only supports a single --stop-before value - "
+                    "got: {}".format(migration_set.name, ", ".join(distinct))
+                )
+            migration_set.apply(db, stop_before=distinct[0] if distinct else None)
     if verbose:
         click.echo("Schema after:\n")
         post_schema = db.schema
diff --git a/sqlite_utils/db.py b/sqlite_utils/db.py
index ae99322..ef367e1 100644
--- a/sqlite_utils/db.py
+++ b/sqlite_utils/db.py
@@ -301,6 +301,10 @@ class InvalidColumns(Exception):
     "Specified columns do not exist"
 
 
+class TransactionError(Exception):
+    "Operation cannot be performed while a transaction is open"
+
+
 class DescIndex(str):
     pass
 
@@ -320,6 +324,16 @@ CREATE TABLE IF NOT EXISTS "{}"(
 """.strip()
 
 
+_TRANSACTION_CONTROL_PREFIXES = (
+    "BEGIN",
+    "COMMIT",
+    "END",
+    "ROLLBACK",
+    "SAVEPOINT",
+    "RELEASE",
+)
+
+
 class Database:
     """
     Wrapper for a SQLite database connection that adds a variety of useful utility methods.
@@ -367,9 +381,11 @@ class Database:
         self.memory_name = None
         self.memory = False
         self.use_old_upsert = use_old_upsert
-        assert (filename_or_conn is not None and (not memory and not memory_name)) or (
-            filename_or_conn is None and (memory or memory_name)
-        ), "Either specify a filename_or_conn or pass memory=True"
+        if not (
+            (filename_or_conn is not None and (not memory and not memory_name))
+            or (filename_or_conn is None and (memory or memory_name))
+        ):
+            raise ValueError("Either specify a filename_or_conn or pass memory=True")
         if memory_name:
             uri = "file:{}?mode=memory&cache=shared".format(memory_name)
             self.conn = sqlite3.connect(
@@ -393,8 +409,21 @@ class Database:
                     raise
             self.conn = sqlite3.connect(str(filename_or_conn))
         else:
-            assert not recreate, "recreate cannot be used with connections, only paths"
+            if recreate:
+                raise ValueError("recreate cannot be used with connections, only paths")
             self.conn = cast(sqlite3.Connection, filename_or_conn)
+            # Python 3.12+ autocommit=True/False connections make commit()
+            # and rollback() behave differently, silently breaking the
+            # transaction handling used by every write method
+            autocommit = getattr(self.conn, "autocommit", None)
+            if autocommit is not None and autocommit != getattr(
+                sqlite3, "LEGACY_TRANSACTION_CONTROL", -1
+            ):
+                raise TransactionError(
+                    "sqlite-utils requires a connection that uses the default "
+                    "transaction handling - connections created with "
+                    "autocommit=True or autocommit=False are not supported"
+                )
         self._tracer: Optional[Tracer] = tracer
         if recursive_triggers:
             self.execute("PRAGMA recursive_triggers=on;")
@@ -443,15 +472,42 @@ class Database:
             try:
                 yield self
             except BaseException:
-                self.conn.rollback()
+                self.conn.execute("ROLLBACK")
                 raise
             else:
                 try:
-                    self.conn.commit()
+                    self.conn.execute("COMMIT")
                 except BaseException:
-                    self.conn.rollback()
+                    self.conn.execute("ROLLBACK")
                     raise
 
+    def begin(self) -> None:
+        """
+        Start a transaction with ``BEGIN``, taking manual control of transaction
+        handling. End it by calling :meth:`commit` or :meth:`rollback`.
+
+        Raises ``sqlite3.OperationalError`` if a transaction is already open.
+
+        Most code should use the :meth:`atomic` context manager instead, which
+        commits and rolls back automatically. See :ref:`python_api_transactions`.
+        """
+        self.execute("BEGIN")
+
+    def commit(self) -> None:
+        """
+        Commit the current transaction. Does nothing if no transaction is open.
+        """
+        if self.conn.in_transaction:
+            self.conn.execute("COMMIT")
+
+    def rollback(self) -> None:
+        """
+        Roll back the current transaction, discarding its changes. Does nothing
+        if no transaction is open.
+        """
+        if self.conn.in_transaction:
+            self.conn.execute("ROLLBACK")
+
     @contextlib.contextmanager
     def ensure_autocommit_off(self) -> Generator[None, None, None]:
         """
@@ -499,10 +555,12 @@ class Database:
 
     def __getitem__(self, table_name: str) -> Union["Table", "View"]:
         """
-        ``db[table_name]`` returns a :class:`.Table` object for the table with the specified name.
-        If the table does not exist yet it will be created the first time data is inserted into it.
+        ``db[name]`` returns a :class:`.Table` object for the table with the specified name,
+        or a :class:`.View` object if the name matches an existing SQL view.
+        If neither exists yet, a table is assumed - it will be created the first
+        time data is inserted into it.
 
-        :param table_name: The name of the table
+        :param table_name: The name of the table or view
         """
         if table_name in self.view_names():
             return self.view(table_name)
@@ -593,14 +651,34 @@ class Database:
         """
         Execute ``sql`` and return an iterable of dictionaries representing each row.
 
+        The SQL is executed as soon as this method is called - the resulting rows
+        are then fetched lazily as the returned iterable is iterated over.
+
         :param sql: SQL query to execute
         :param params: Parameters to use in that query - an iterable for ``where id = ?``
           parameters, or a dictionary for ``where id = :id``
+        :raises ValueError: if the SQL statement does not return rows - use
+          :meth:`execute` for those statements instead
         """
+        was_in_transaction = self.conn.in_transaction
         cursor = self.execute(sql, params or tuple())
+        if cursor.description is None:
+            raise ValueError(
+                "query() can only be used with SQL that returns rows - "
+                "use execute() for other statements"
+            )
         keys = [d[0] for d in cursor.description]
-        for row in cursor:
-            yield dict(zip(keys, row))
+
+        def rows() -> Generator[dict, None, None]:
+            for row in cursor:
+                yield dict(zip(keys, row))
+            if not was_in_transaction and self.conn.in_transaction:
+                # A row-returning write such as INSERT ... RETURNING opened
+                # an implicit transaction - commit it now that its rows have
+                # been consumed
+                self.conn.execute("COMMIT")
+
+        return rows()
 
     def execute(
         self, sql: str, parameters: Optional[Union[Sequence, Dict[str, Any]]] = None
@@ -608,16 +686,33 @@ class Database:
         """
         Execute SQL query and return a ``sqlite3.Cursor``.
 
+        A write statement - ``INSERT``, ``UPDATE``, ``CREATE TABLE`` and so on -
+        is committed automatically, unless a transaction is already open, in
+        which case it becomes part of that transaction. See
+        :ref:`python_api_transactions`.
+
         :param sql: SQL query to execute
         :param parameters: Parameters to use in that query - an iterable for ``where id = ?``
           parameters, or a dictionary for ``where id = :id``
         """
         if self._tracer:
             self._tracer(sql, parameters)
+        was_in_transaction = self.conn.in_transaction
         if parameters is not None:
-            return self.conn.execute(sql, parameters)
+            cursor = self.conn.execute(sql, parameters)
         else:
-            return self.conn.execute(sql)
+            cursor = self.conn.execute(sql)
+        if (
+            not was_in_transaction
+            and self.conn.in_transaction
+            and cursor.description is None
+            and not sql.lstrip().upper().startswith(_TRANSACTION_CONTROL_PREFIXES)
+        ):
+            # The statement opened an implicit transaction - commit it, so
+            # that execute() behaves consistently with the rest of the
+            # library and identically across connection modes
+            self.conn.execute("COMMIT")
+        return cursor
 
     def executescript(self, sql: str) -> sqlite3.Cursor:
         """
@@ -658,6 +753,12 @@ class Database:
         :param view_name: Name of the view
         """
         if view_name not in self.view_names():
+            if view_name in self.table_names():
+                raise NoView(
+                    "View {name} does not exist - {name} is a table".format(
+                        name=view_name
+                    )
+                )
             raise NoView("View {} does not exist".format(view_name))
         return View(self, view_name)
 
@@ -840,17 +941,36 @@ class Database:
     def enable_wal(self) -> None:
         """
         Sets ``journal_mode`` to ``'wal'`` to enable Write-Ahead Log mode.
+
+        :raises TransactionError: if called while a transaction is open - the
+          journal mode can only be changed outside of a transaction
         """
         if self.journal_mode != "wal":
+            self._ensure_no_open_transaction("enable_wal()")
             with self.ensure_autocommit_off():
                 self.execute("PRAGMA journal_mode=wal;")
 
     def disable_wal(self) -> None:
-        "Sets ``journal_mode`` back to ``'delete'`` to disable Write-Ahead Log mode."
+        """
+        Sets ``journal_mode`` back to ``'delete'`` to disable Write-Ahead Log mode.
+
+        :raises TransactionError: if called while a transaction is open - the
+          journal mode can only be changed outside of a transaction
+        """
         if self.journal_mode != "delete":
+            self._ensure_no_open_transaction("disable_wal()")
             with self.ensure_autocommit_off():
                 self.execute("PRAGMA journal_mode=delete;")
 
+    def _ensure_no_open_transaction(self, operation: str) -> None:
+        # Changing journal mode assigns conn.isolation_level, which commits
+        # any open transaction as a side effect - breaking the rollback
+        # guarantee of atomic() and of user-managed transactions
+        if self.conn.in_transaction:
+            raise TransactionError(
+                "{} cannot be used while a transaction is open".format(operation)
+            )
+
     def _ensure_counts_table(self) -> None:
         with self.atomic():
             self.execute(_COUNTS_TABLE_CREATE_SQL.format(self._counts_table_name))
@@ -927,20 +1047,21 @@ class Database:
                 other_column = table.guess_foreign_column(other_table)
                 fks.append(ForeignKey(name, column, other_table, other_column))
             return fks
-        assert all(
-            isinstance(fk, (tuple, list)) for fk in foreign_keys
-        ), "foreign_keys= should be a list of tuples"
+        if not all(isinstance(fk, (tuple, list)) for fk in foreign_keys):
+            raise ValueError("foreign_keys= should be a list of tuples")
         fks = []
         for tuple_or_list in foreign_keys:
             if len(tuple_or_list) == 4:
-                assert (
-                    tuple_or_list[0] == name
-                ), "First item in {} should have been {}".format(tuple_or_list, name)
-            assert len(tuple_or_list) in (
-                2,
-                3,
-                4,
-            ), "foreign_keys= should be a list of tuple pairs or triples"
+                if tuple_or_list[0] != name:
+                    raise ValueError(
+                        "First item in {} should have been {}".format(
+                            tuple_or_list, name
+                        )
+                    )
+            if len(tuple_or_list) not in (2, 3, 4):
+                raise ValueError(
+                    "foreign_keys= should be a list of tuple pairs or triples"
+                )
             if len(tuple_or_list) in (3, 4):
                 if len(tuple_or_list) == 4:
                     tuple_or_list = cast(Tuple[str, str, str], tuple_or_list[1:])
@@ -1013,17 +1134,20 @@ class Database:
         # Soundness check not_null, and defaults if provided
         not_null = not_null or set()
         defaults = defaults or {}
-        assert columns, "Tables must have at least one column"
-        assert all(
-            n in columns for n in not_null
-        ), "not_null set {} includes items not in columns {}".format(
-            repr(not_null), repr(set(columns.keys()))
-        )
-        assert all(
-            n in columns for n in defaults
-        ), "defaults set {} includes items not in columns {}".format(
-            repr(set(defaults)), repr(set(columns.keys()))
-        )
+        if not columns:
+            raise ValueError("Tables must have at least one column")
+        if not all(n in columns for n in not_null):
+            raise ValueError(
+                "not_null set {} includes items not in columns {}".format(
+                    repr(not_null), repr(set(columns.keys()))
+                )
+            )
+        if not all(n in columns for n in defaults):
+            raise ValueError(
+                "defaults set {} includes items not in columns {}".format(
+                    repr(set(defaults)), repr(set(columns.keys()))
+                )
+            )
         column_items = list(columns.items())
         if column_order is not None:
 
@@ -1254,9 +1378,8 @@ class Database:
         :param ignore: Set to ``True`` to do nothing if a view with this name already exists
         :param replace: Set to ``True`` to replace the view if one with this name already exists
         """
-        assert not (
-            ignore and replace
-        ), "Use one or the other of ignore/replace, not both"
+        if ignore and replace:
+            raise ValueError("Use one or the other of ignore/replace, not both")
         create_sql = "CREATE VIEW {name} AS {sql}".format(
             name=quote_identifier(name), sql=sql
         )
@@ -1301,9 +1424,13 @@ class Database:
           tuples
         """
         # foreign_keys is a list of explicit 4-tuples
-        assert all(
+        if not all(
             len(fk) == 4 and isinstance(fk, (list, tuple)) for fk in foreign_keys
-        ), "foreign_keys must be a list of 4-tuples, (table, column, other_table, other_column)"
+        ):
+            raise ValueError(
+                "foreign_keys must be a list of 4-tuples, "
+                "(table, column, other_table, other_column)"
+            )
 
         foreign_keys_to_create = []
 
@@ -1585,7 +1712,8 @@ class Table(Queryable):
     :param not_null: List of columns that cannot be null
     :param defaults: Dictionary of column names and default values
     :param batch_size: Integer number of rows to insert at a time
-    :param hash_id: If True, use a hash of the row values as the primary key
+    :param hash_id: Name of a column to create and use as a primary key, where the
+      value of that primary key is derived from a hash of the row values
     :param hash_id_columns: List of columns to use for the hash_id
     :param alter: If True, automatically alter the table if it doesn't match the schema
     :param ignore: If True, ignore rows that already exist when inserting
@@ -1947,7 +2075,8 @@ class Table(Queryable):
         :param keep_table: If specified, the existing table will be renamed to this and will not be
           dropped
         """
-        assert self.exists(), "Cannot transform a table that doesn't exist yet"
+        if not self.exists():
+            raise ValueError("Cannot transform a table that doesn't exist yet")
         sqls = self.transform_sql(
             types=types,
             rename=rename,
@@ -2119,8 +2248,10 @@ class Table(Queryable):
         elif not not_null:
             pass
         else:
-            assert False, "not_null must be a dict or a set or None, it was {}".format(
-                repr(not_null)
+            raise ValueError(
+                "not_null must be a dict or a set or None, it was {}".format(
+                    repr(not_null)
+                )
             )
         # defaults=
         create_table_defaults = {
@@ -2755,11 +2886,12 @@ class Table(Queryable):
         if fts_table is None:
             # Assume this is itself an FTS table
             fts_table = self.name
-        self.db.execute(
-            "INSERT INTO {table}({table}) VALUES('rebuild');".format(
-                table=quote_identifier(fts_table)
+        with self.db.atomic():
+            self.db.execute(
+                "INSERT INTO {table}({table}) VALUES('rebuild');".format(
+                    table=quote_identifier(fts_table)
+                )
             )
-        )
         return self
 
     def detect_fts(self) -> Optional[str]:
@@ -2791,9 +2923,10 @@ class Table(Queryable):
         "Run the ``optimize`` operation against the associated full-text search index table."
         fts_table = self.detect_fts()
         if fts_table is not None:
-            self.db.execute("""
-                INSERT INTO {table} ({table}) VALUES ("optimize");
-            """.strip().format(table=quote_identifier(fts_table)))
+            with self.db.atomic():
+                self.db.execute("""
+                    INSERT INTO {table} ({table}) VALUES ("optimize");
+                """.strip().format(table=quote_identifier(fts_table)))
         return self
 
     def search_sql(
@@ -2826,9 +2959,10 @@ class Table(Queryable):
                 "{}.{}".format(original_quoted, quote_identifier(c)) for c in columns
             )
         fts_table = self.detect_fts()
-        assert fts_table, "Full-text search is not configured for table '{}'".format(
-            self.name
-        )
+        if not fts_table:
+            raise ValueError(
+                "Full-text search is not configured for table '{}'".format(self.name)
+            )
         fts_table_quoted = quote_identifier(fts_table)
         virtual_table_using = self.db.table(fts_table).virtual_table_using
         sql = textwrap.dedent("""
@@ -2966,7 +3100,8 @@ class Table(Queryable):
         sql = "delete from {}".format(quote_identifier(self.name))
         if where is not None:
             sql += " where " + where
-        self.db.execute(sql, where_args or [])
+        with self.db.atomic():
+            self.db.execute(sql, where_args or [])
         if analyze:
             self.analyze()
         return self
@@ -3074,7 +3209,8 @@ class Table(Queryable):
             )
 
         if output is not None:
-            assert len(columns) == 1, "output= can only be used with a single column"
+            if len(columns) != 1:
+                raise ValueError("output= can only be used with a single column")
             if output not in self.columns_dict:
                 self.add_column(output, output_type or "text")
 
@@ -3182,6 +3318,11 @@ class Table(Queryable):
         # Dict-mode insert({}) has no explicit columns; SQLite spells that as
         # DEFAULT VALUES. List mode with no columns is a different input shape.
         if not list_mode and not all_columns:
+            if upsert:
+                raise PrimaryKeyRequired(
+                    "upsert() requires a value for the primary key - "
+                    "an empty record cannot be upserted"
+                )
             or_clause = ""
             if replace:
                 or_clause = " OR REPLACE"
@@ -3269,6 +3410,26 @@ class Table(Queryable):
 
         # Everything from here on is for upsert=True
         pk_cols = [pk] if isinstance(pk, str) else list(pk)
+        # Every record must provide a value for every primary key column - a
+        # NULL primary key never matches ON CONFLICT, so the record would be
+        # inserted as a brand new row instead of upserted
+        missing_pk_cols = [c for c in pk_cols if c not in all_columns]
+        if missing_pk_cols:
+            raise PrimaryKeyRequired(
+                "upsert() requires a value for the primary key column{}: {}".format(
+                    "s" if len(missing_pk_cols) > 1 else "",
+                    ", ".join(missing_pk_cols),
+                )
+            )
+        pk_indexes = [all_columns.index(c) for c in pk_cols]
+        for record_values in values:
+            if any(record_values[i] is None for i in pk_indexes):
+                raise PrimaryKeyRequired(
+                    "upsert() requires a value for the primary key column{}: {}".format(
+                        "s" if len(pk_cols) > 1 else "",
+                        ", ".join(pk_cols),
+                    )
+                )
         non_pk_cols = [c for c in all_columns if c not in pk_cols]
         conflict_sql = ", ".join(quote_identifier(c) for c in pk_cols)
 
@@ -3562,15 +3723,15 @@ class Table(Queryable):
         if upsert and (not pk and not hash_id):
             raise PrimaryKeyRequired("upsert() requires a pk")
 
-        assert not (hash_id and pk), "Use either pk= or hash_id="
+        if hash_id and pk:
+            raise ValueError("Use either pk= or hash_id=")
         if hash_id_columns and (hash_id is None):
             hash_id = "id"
         if hash_id:
             pk = hash_id
 
-        assert not (
-            ignore and replace
-        ), "Use either ignore=True or replace=True, not both"
+        if ignore and replace:
+            raise ValueError("Use either ignore=True or replace=True, not both")
         all_columns = []
         first = True
         num_records_processed = 0
@@ -3619,9 +3780,10 @@ class Table(Queryable):
             first_record = cast(Dict[str, Any], first_record)
             num_columns = len(first_record.keys())
 
-        assert (
-            num_columns <= SQLITE_MAX_VARS
-        ), "Rows can have a maximum of {} columns".format(SQLITE_MAX_VARS)
+        if num_columns > SQLITE_MAX_VARS:
+            raise ValueError(
+                "Rows can have a maximum of {} columns".format(SQLITE_MAX_VARS)
+            )
         batch_size = (
             1
             if num_columns == 0
@@ -3876,10 +4038,12 @@ class Table(Queryable):
         :param extra_values: Additional column values to be used only if creating a new record
         :param strict: Boolean, apply STRICT mode if creating the table.
         """
-        assert isinstance(lookup_values, dict)
-        assert pk is not None
-        if extra_values is not None:
-            assert isinstance(extra_values, dict)
+        if not isinstance(lookup_values, dict):
+            raise ValueError("lookup_values must be a dictionary")
+        if pk is None:
+            raise ValueError("pk cannot be None")
+        if extra_values is not None and not isinstance(extra_values, dict):
+            raise ValueError("extra_values must be a dictionary")
         combined_values = dict(lookup_values)
         if extra_values is not None:
             combined_values.update(extra_values)
@@ -3964,9 +4128,10 @@ class Table(Queryable):
             other_table = self.db.table(other_table, pk=pk)
         our_id = self.last_pk
         if lookup is not None:
-            assert record_or_iterable is None, "Provide lookup= or record, not both"
-        else:
-            assert record_or_iterable is not None, "Provide lookup= or record, not both"
+            if record_or_iterable is not None:
+                raise ValueError("Provide lookup= or record, not both")
+        elif record_or_iterable is None:
+            raise ValueError("Provide lookup= or record, not both")
         tables = list(sorted([self.name, other_table.name]))
         columns = ["{}_id".format(t) for t in tables]
         if m2m_table is not None:
@@ -4228,12 +4393,6 @@ class View(Queryable):
             if not ignore:
                 raise
 
-    def enable_fts(self, *args: object, **kwargs: object) -> None:
-        "``enable_fts()`` is supported on tables but not on views."
-        raise NotImplementedError(
-            "enable_fts() is supported on tables but not on views"
-        )
-
 
 def jsonify_if_needed(value: object) -> object:
     if isinstance(value, decimal.Decimal):
diff --git a/sqlite_utils/migrations.py b/sqlite_utils/migrations.py
index f349b17..36e053d 100644
--- a/sqlite_utils/migrations.py
+++ b/sqlite_utils/migrations.py
@@ -14,11 +14,14 @@ class Migrations:
     class _Migration:
         name: str
         fn: Callable
+        transactional: bool = True
 
     @dataclass
     class _AppliedMigration:
         name: str
-        applied_at: datetime.datetime
+        # A string timestamp such as "2026-07-04 12:00:00.000000+00:00" -
+        # stored as TEXT in the _sqlite_migrations table
+        applied_at: str
 
     def __init__(self, name: str):
         """
@@ -27,15 +30,29 @@ class Migrations:
         self.name = name
         self._migrations: list[Migrations._Migration] = []
 
-    def __call__(self, *, name: str | None = None) -> Callable:
+    def __call__(
+        self, *, name: str | None = None, transactional: bool = True
+    ) -> Callable:
         """
         :param name: The name to use for this migration - if not provided,
           the name of the function will be used.
+        :param transactional: If ``True`` (the default) the migration and the
+          record of it having been applied are wrapped in a transaction, which
+          will be rolled back if the migration raises an exception. Pass
+          ``False`` for migrations that cannot run inside a transaction, for
+          example those that execute ``VACUUM``.
         """
 
         def inner(func: Callable) -> Callable:
+            migration_name = name or getattr(func, "__name__")
+            if any(m.name == migration_name for m in self._migrations):
+                raise ValueError(
+                    "Migration '{}' is already registered in set '{}'".format(
+                        migration_name, self.name
+                    )
+                )
             self._migrations.append(
-                self._Migration(name or getattr(func, "__name__"), func)
+                self._Migration(migration_name, func, transactional)
             )
             return func
 
@@ -44,14 +61,10 @@ class Migrations:
     def pending(self, db: "Database") -> list["Migrations._Migration"]:
         """
         Return a list of pending migrations.
+
+        This is a read-only operation - it does not write to the database.
         """
-        self.ensure_migrations_table(db)
-        already_applied = {
-            r["name"]
-            for r in db[self.migrations_table].rows_where(
-                "migration_set = ?", [self.name]
-            )
-        }
+        already_applied = {migration.name for migration in self.applied(db)}
         return [
             migration
             for migration in self._migrations
@@ -60,19 +73,29 @@ class Migrations:
 
     def applied(self, db: "Database") -> list["Migrations._AppliedMigration"]:
         """
-        Return a list of applied migrations.
+        Return a list of applied migrations, in the order they were applied.
+
+        This is a read-only operation - it does not write to the database.
         """
-        self.ensure_migrations_table(db)
+        table = _table(db, self.migrations_table)
+        if not table.exists():
+            return []
         return [
             self._AppliedMigration(name=row["name"], applied_at=row["applied_at"])
-            for row in db[self.migrations_table].rows_where(
-                "migration_set = ?", [self.name]
+            for row in table.rows_where(
+                "migration_set = ?", [self.name], order_by="rowid"
             )
         ]
 
     def apply(self, db: "Database", *, stop_before: str | Iterable[str] | None = None):
         """
         Apply any pending migrations to the database.
+
+        Each migration runs inside a transaction, together with the record of
+        it having been applied - if the migration raises an exception its
+        changes are rolled back, no record is written and the migration stays
+        pending. Migrations registered with ``transactional=False`` run
+        outside of a transaction.
         """
         self.ensure_migrations_table(db)
         if stop_before is None:
@@ -85,14 +108,22 @@ class Migrations:
             name = migration.name
             if name in stop_before_names:
                 return
-            migration.fn(db)
-            _table(db, self.migrations_table).insert(
-                {
-                    "migration_set": self.name,
-                    "name": name,
-                    "applied_at": str(datetime.datetime.now(datetime.timezone.utc)),
-                }
-            )
+            if migration.transactional:
+                with db.atomic():
+                    migration.fn(db)
+                    self._record_applied(db, name)
+            else:
+                migration.fn(db)
+                self._record_applied(db, name)
+
+    def _record_applied(self, db: "Database", name: str):
+        _table(db, self.migrations_table).insert(
+            {
+                "migration_set": self.name,
+                "name": name,
+                "applied_at": str(datetime.datetime.now(datetime.timezone.utc)),
+            }
+        )
 
     def ensure_migrations_table(self, db: "Database"):
         """
diff --git a/tests/conftest.py b/tests/conftest.py
index 6fd35b8..728db7b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -8,11 +8,36 @@ create table Gosh2 (c1 text, c2 text, c3 text);
 """
 
 
+def pytest_addoption(parser):
+    parser.addoption(
+        "--sqlite-autocommit",
+        action="store_true",
+        default=False,
+        help=(
+            "Run every test against connections created with the Python 3.12+ "
+            "sqlite3.connect(autocommit=True) mode"
+        ),
+    )
+
+
 def pytest_configure(config):
     import sys
 
     sys._called_from_test = True  # type: ignore[attr-defined]
 
+    if config.getoption("--sqlite-autocommit"):
+        if sys.version_info < (3, 12):
+            raise pytest.UsageError(
+                "--sqlite-autocommit requires Python 3.12 or higher"
+            )
+        real_connect = sqlite3.connect
+
+        def autocommit_connect(*args, **kwargs):
+            kwargs.setdefault("autocommit", True)
+            return real_connect(*args, **kwargs)
+
+        sqlite3.connect = autocommit_connect
+
 
 @pytest.fixture(autouse=True)
 def close_all_databases():
diff --git a/tests/test_atomic.py b/tests/test_atomic.py
index acd5474..a8e3563 100644
--- a/tests/test_atomic.py
+++ b/tests/test_atomic.py
@@ -1,6 +1,6 @@
 import pytest
 
-from sqlite_utils.db import _iter_complete_sql_statements
+from sqlite_utils.db import Database, _iter_complete_sql_statements
 from sqlite_utils.utils import sqlite3
 
 
@@ -172,3 +172,93 @@ def test_transform_detects_foreign_key_check_violations(fresh_db):
 
     assert fresh_db["books"].foreign_keys == []
     assert fresh_db.conn.execute("PRAGMA foreign_keys").fetchone()[0]
+
+
+def test_atomic_inside_manual_transaction_uses_savepoint(fresh_db):
+    fresh_db["t"].insert({"id": 1}, pk="id")
+    fresh_db.execute("begin")
+    with fresh_db.atomic():
+        fresh_db["t"].insert({"id": 2}, pk="id")
+    # Nothing is committed until the user's own transaction commits
+    assert fresh_db.conn.in_transaction
+    fresh_db.rollback()
+    assert [r["id"] for r in fresh_db["t"].rows] == [1]
+    # And with a commit instead, the atomic block's writes persist
+    fresh_db.execute("begin")
+    with fresh_db.atomic():
+        fresh_db["t"].insert({"id": 3}, pk="id")
+    fresh_db.commit()
+    assert [r["id"] for r in fresh_db["t"].rows] == [1, 3]
+
+
+def test_begin_commit_rollback(tmpdir):
+    path = str(tmpdir / "test.db")
+    db = Database(path)
+    db["t"].insert({"id": 1}, pk="id")
+    db.begin()
+    db["t"].insert({"id": 2}, pk="id")
+    assert db.conn.in_transaction
+    db.rollback()
+    assert not db.conn.in_transaction
+    assert [r["id"] for r in db["t"].rows] == [1]
+    db.begin()
+    db["t"].insert({"id": 3}, pk="id")
+    db.commit()
+    db.close()
+    db2 = Database(path)
+    assert [r["id"] for r in db2["t"].rows] == [1, 3]
+    db2.close()
+
+
+def test_begin_inside_transaction_errors(fresh_db):
+    fresh_db.begin()
+    with pytest.raises(sqlite3.OperationalError):
+        fresh_db.begin()
+    fresh_db.rollback()
+
+
+def test_commit_and_rollback_without_transaction_are_noops(fresh_db):
+    fresh_db.commit()
+    fresh_db.rollback()
+    assert not fresh_db.conn.in_transaction
+
+
+def test_execute_write_commits_immediately(tmpdir):
+    path = str(tmpdir / "test.db")
+    db = Database(path)
+    db["t"].insert({"id": 1}, pk="id")
+    db.execute("insert into t (id) values (2)")
+    # No implicit transaction is left open
+    assert not db.conn.in_transaction
+    # A completely separate connection sees the row straight away
+    other = sqlite3.connect(path)
+    assert other.execute("select count(*) from t").fetchone()[0] == 2
+    other.close()
+    db.close()
+
+
+def test_execute_write_respects_explicit_transaction(fresh_db):
+    fresh_db["t"].insert({"id": 1}, pk="id")
+    fresh_db.begin()
+    fresh_db.execute("insert into t (id) values (2)")
+    # Still inside the explicit transaction - not committed
+    assert fresh_db.conn.in_transaction
+    fresh_db.rollback()
+    assert [r["id"] for r in fresh_db["t"].rows] == [1]
+
+
+def test_query_returning_commits_after_iteration(tmpdir):
+    if sqlite3.sqlite_version_info < (3, 35, 0):
+        import pytest as _pytest
+
+        _pytest.skip("RETURNING requires SQLite 3.35.0 or higher")
+    path = str(tmpdir / "test.db")
+    db = Database(path)
+    db["t"].insert({"id": 1}, pk="id")
+    rows = list(db.query("insert into t (id) values (2) returning id"))
+    assert rows == [{"id": 2}]
+    assert not db.conn.in_transaction
+    other = sqlite3.connect(path)
+    assert other.execute("select count(*) from t").fetchone()[0] == 2
+    other.close()
+    db.close()
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 565fbc2..d26e4dd 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1467,6 +1467,24 @@ def test_drop_table_error():
         assert result.exit_code == 0
 
 
+def test_drop_table_on_view_errors():
+    runner = CliRunner()
+    with runner.isolated_filesystem():
+        db = Database("test.db")
+        db["t"].insert({"id": 1})
+        db.create_view("v", "select * from t")
+        result = runner.invoke(cli.cli, ["drop-table", "test.db", "v"])
+        assert result.exit_code == 1
+        assert 'Error: "v" is a view, not a table - use drop-view to drop it' == (
+            result.output.strip()
+        )
+        assert "v" in db.view_names()
+        # --ignore exits cleanly but must still not drop the view
+        result = runner.invoke(cli.cli, ["drop-table", "test.db", "v", "--ignore"])
+        assert result.exit_code == 0
+        assert "v" in db.view_names()
+
+
 def test_drop_view():
     runner = CliRunner()
     with runner.isolated_filesystem():
@@ -1485,6 +1503,23 @@ def test_drop_view():
         assert "hello" not in db.view_names()
 
 
+def test_drop_view_on_table_errors():
+    runner = CliRunner()
+    with runner.isolated_filesystem():
+        db = Database("test.db")
+        db["t"].insert({"id": 1})
+        result = runner.invoke(cli.cli, ["drop-view", "test.db", "t"])
+        assert result.exit_code == 1
+        assert 'Error: "t" is a table, not a view - use drop-table to drop it' == (
+            result.output.strip()
+        )
+        assert "t" in db.table_names()
+        # --ignore exits cleanly but must still not drop the table
+        result = runner.invoke(cli.cli, ["drop-view", "test.db", "t", "--ignore"])
+        assert result.exit_code == 0
+        assert "t" in db.table_names()
+
+
 def test_drop_view_error():
     runner = CliRunner()
     with runner.isolated_filesystem():
@@ -2296,18 +2331,14 @@ def test_csv_insert_bom(tmpdir):
     ]
 
 
-@pytest.mark.parametrize("option", (None, "-d", "--detect-types"))
-def test_insert_detect_types(tmpdir, option):
-    """Test that type detection is now the default behavior"""
+def test_insert_detect_types(tmpdir):
+    """Test that type detection is the default behavior"""
     db_path = str(tmpdir / "test.db")
     data = "name,age,weight\nCleo,6,45.5\nDori,1,3.5"
-    extra = []
-    if option:
-        extra = [option]
 
     result = CliRunner().invoke(
         cli.cli,
-        ["insert", db_path, "creatures", "-", "--csv"] + extra,
+        ["insert", db_path, "creatures", "-", "--csv"],
         catch_exceptions=False,
         input=data,
     )
@@ -2319,17 +2350,27 @@ def test_insert_detect_types(tmpdir, option):
     ]
 
 
-@pytest.mark.parametrize("option", (None, "-d", "--detect-types"))
-def test_upsert_detect_types(tmpdir, option):
-    """Test that type detection is now the default behavior for upsert"""
+@pytest.mark.parametrize("command", ("insert", "upsert"))
+@pytest.mark.parametrize("option", ("-d", "--detect-types"))
+def test_detect_types_flag_removed(tmpdir, command, option):
+    # The old no-op flag was removed in 4.0 - it should now error
     db_path = str(tmpdir / "test.db")
-    data = "id,name,age,weight\n1,Cleo,6,45.5\n2,Dori,1,3.5"
-    extra = []
-    if option:
-        extra = [option]
     result = CliRunner().invoke(
         cli.cli,
-        ["upsert", db_path, "creatures", "-", "--csv", "--pk", "id"] + extra,
+        [command, db_path, "creatures", "-", "--csv", "--pk", "id", option],
+        input="id,name\n1,Cleo",
+    )
+    assert result.exit_code == 2
+    assert "No such option" in result.output
+
+
+def test_upsert_detect_types(tmpdir):
+    """Test that type detection is the default behavior for upsert"""
+    db_path = str(tmpdir / "test.db")
+    data = "id,name,age,weight\n1,Cleo,6,45.5\n2,Dori,1,3.5"
+    result = CliRunner().invoke(
+        cli.cli,
+        ["upsert", db_path, "creatures", "-", "--csv", "--pk", "id"],
         catch_exceptions=False,
         input=data,
     )
diff --git a/tests/test_cli_insert.py b/tests/test_cli_insert.py
index 5812851..2df1e0c 100644
--- a/tests/test_cli_insert.py
+++ b/tests/test_cli_insert.py
@@ -615,3 +615,16 @@ def test_insert_csv_headers_only(tmpdir):
     # Table should not exist since there were no data rows
     db = Database(db_path)
     assert not db["data"].exists()
+
+
+def test_insert_into_view_errors(tmpdir):
+    db_path = str(tmpdir / "test.db")
+    db = Database(db_path)
+    db["t"].insert({"id": 1})
+    db.create_view("v", "select * from t")
+    db.close()
+    result = CliRunner().invoke(
+        cli.cli, ["insert", db_path, "v", "-"], input='{"id": 2}'
+    )
+    assert result.exit_code == 1
+    assert result.output.strip() == "Error: Table v is actually a view"
diff --git a/tests/test_cli_migrate.py b/tests/test_cli_migrate.py
index 229bc9c..1cdf8e7 100644
--- a/tests/test_cli_migrate.py
+++ b/tests/test_cli_migrate.py
@@ -301,3 +301,165 @@ def test_stop_before_multiple_qualified(two_sets_same_migration_name):
     assert not db["creature_weights"].exists()
     assert db["sales"].exists()
     assert not db["sales_weights"].exists()
+
+
+LEGACY_MIGRATIONS = """
+import datetime
+
+class _Migration:
+    def __init__(self, name, fn):
+        self.name = name
+        self.fn = fn
+
+class _Applied:
+    def __init__(self, name, applied_at):
+        self.name = name
+        self.applied_at = applied_at
+
+class LegacyMigrations:
+    # Mimics the sqlite-migrate 0.x Migrations class, in particular
+    # apply(db, stop_before=None) taking a single string
+    migrations_table = "_sqlite_migrations"
+
+    def __init__(self, name):
+        self.name = name
+        self._migrations = []
+
+    def __call__(self, fn):
+        self._migrations.append(_Migration(fn.__name__, fn))
+        return fn
+
+    def ensure_migrations_table(self, db):
+        db[self.migrations_table].create(
+            {"migration_set": str, "name": str, "applied_at": str},
+            pk=("migration_set", "name"),
+            if_not_exists=True,
+        )
+
+    def applied(self, db):
+        self.ensure_migrations_table(db)
+        return [
+            _Applied(row["name"], row["applied_at"])
+            for row in db[self.migrations_table].rows_where(
+                "migration_set = ?", [self.name]
+            )
+        ]
+
+    def pending(self, db):
+        applied = {m.name for m in self.applied(db)}
+        return [m for m in self._migrations if m.name not in applied]
+
+    def apply(self, db, stop_before=None):
+        for migration in self.pending(db):
+            if migration.name == stop_before:
+                return
+            migration.fn(db)
+            db[self.migrations_table].insert(
+                {
+                    "migration_set": self.name,
+                    "name": migration.name,
+                    "applied_at": str(
+                        datetime.datetime.now(datetime.timezone.utc)
+                    ),
+                }
+            )
+
+legacy = LegacyMigrations("legacy_set")
+
+@legacy
+def first(db):
+    db["first"].insert({"hello": "world"})
+
+@legacy
+def second(db):
+    db["second"].insert({"hello": "world"})
+"""
+
+
+def test_stop_before_unknown_name_errors(two_migrations):
+    path, _ = two_migrations
+    db_path = str(path / "test.db")
+    runner = CliRunner()
+    result = runner.invoke(
+        sqlite_utils.cli.cli,
+        ["migrate", db_path, str(path), "--stop-before", "fooo"],
+    )
+    assert result.exit_code == 1
+    assert "--stop-before did not match any migrations: fooo" in result.output
+    # Nothing should have been applied
+    db = sqlite_utils.Database(db_path)
+    assert "foo" not in db.table_names()
+    assert "bar" not in db.table_names()
+
+
+def test_stop_before_with_legacy_migrations_class(tmpdir):
+    path = pathlib.Path(tmpdir)
+    (path / "migrations.py").write_text(LEGACY_MIGRATIONS, "utf-8")
+    db_path = str(path / "test.db")
+    runner = CliRunner()
+    result = runner.invoke(
+        sqlite_utils.cli.cli,
+        ["migrate", db_path, str(path), "--stop-before", "second"],
+    )
+    assert result.exit_code == 0, result.output
+    db = sqlite_utils.Database(db_path)
+    assert "first" in db.table_names()
+    assert "second" not in db.table_names()
+
+
+def test_stop_before_multiple_values_for_legacy_set_errors(tmpdir):
+    path = pathlib.Path(tmpdir)
+    (path / "migrations.py").write_text(LEGACY_MIGRATIONS, "utf-8")
+    db_path = str(path / "test.db")
+    runner = CliRunner()
+    result = runner.invoke(
+        sqlite_utils.cli.cli,
+        [
+            "migrate",
+            db_path,
+            str(path),
+            "--stop-before",
+            "legacy_set:first",
+            "--stop-before",
+            "legacy_set:second",
+        ],
+    )
+    assert result.exit_code == 1
+    assert "single --stop-before" in result.output
+
+
+def test_list_does_not_create_database_file(two_migrations):
+    path, _ = two_migrations
+    db_path = path / "test.db"
+    runner = CliRunner()
+    result = runner.invoke(
+        sqlite_utils.cli.cli, ["migrate", str(db_path), str(path), "--list"]
+    )
+    assert result.exit_code == 0, result.output
+    assert "Pending:\n    foo\n    bar" in result.output
+    # Listing migrations must not create the database file
+    assert not db_path.exists()
+
+
+def test_list_does_not_upgrade_legacy_migrations_table(two_migrations):
+    path, _ = two_migrations
+    db_path = str(path / "test.db")
+    db = sqlite_utils.Database(db_path)
+    db["_sqlite_migrations"].create(
+        {"migration_set": str, "name": str, "applied_at": str},
+        pk=("migration_set", "name"),
+    )
+    db["_sqlite_migrations"].insert(
+        {"migration_set": "hello", "name": "foo", "applied_at": "x"}
+    )
+    db.close()
+    runner = CliRunner()
+    result = runner.invoke(
+        sqlite_utils.cli.cli, ["migrate", db_path, str(path), "--list"]
+    )
+    assert result.exit_code == 0, result.output
+    assert "foo - x" in result.output
+    # --list must not perform the one-way legacy schema upgrade
+    db2 = sqlite_utils.Database(db_path)
+    assert db2["_sqlite_migrations"].pks == ["migration_set", "name"]
+    db2.close()
diff --git a/tests/test_constructor.py b/tests/test_constructor.py
index 8743911..7714f26 100644
--- a/tests/test_constructor.py
+++ b/tests/test_constructor.py
@@ -1,6 +1,8 @@
 from sqlite_utils import Database
+from sqlite_utils.db import TransactionError
 from sqlite_utils.utils import sqlite3
 import pytest
+import sys
 
 
 def test_recursive_triggers():
@@ -29,6 +31,24 @@ def test_sqlite_version():
     assert actual == as_string
 
 
+def test_database_context_manager(tmpdir):
+    path = str(tmpdir / "test.db")
+    with Database(path) as db:
+        db["t"].insert({"id": 1})
+        # Raw writes commit automatically too
+        db.execute("insert into t (id) values (2)")
+        # An explicitly opened transaction left uncommitted on purpose:
+        db.begin()
+        db.execute("insert into t (id) values (3)")
+    # The connection is closed...
+    with pytest.raises(sqlite3.ProgrammingError):
+        db.execute("select 1")
+    # ... and the open explicit transaction was rolled back, not committed
+    db2 = Database(path)
+    assert [r["id"] for r in db2["t"].rows] == [1, 2]
+    db2.close()
+
+
 @pytest.mark.parametrize("memory", [True, False])
 def test_database_close(tmpdir, memory):
     if memory:
@@ -39,3 +59,31 @@ def test_database_close(tmpdir, memory):
     db.close()
     with pytest.raises(sqlite3.ProgrammingError):
         db.execute("select 1 + 1")
+
+
+@pytest.mark.skipif(
+    sys.version_info < (3, 12),
+    reason="sqlite3.connect(autocommit=) requires Python 3.12",
+)
+@pytest.mark.parametrize("autocommit", [True, False])
+def test_autocommit_connections_are_rejected(tmpdir, autocommit):
+    # These connection modes break commit()/rollback() in ways that
+    # silently lose data, so the constructor refuses them
+    conn = sqlite3.connect(str(tmpdir / "test.db"), autocommit=autocommit)
+    with pytest.raises(TransactionError):
+        Database(conn)
+    conn.close()
+
+
+@pytest.mark.skipif(
+    sys.version_info < (3, 12),
+    reason="sqlite3.LEGACY_TRANSACTION_CONTROL requires Python 3.12",
+)
+def test_legacy_transaction_control_connection_is_accepted(tmpdir):
+    conn = sqlite3.connect(
+        str(tmpdir / "test.db"), autocommit=sqlite3.LEGACY_TRANSACTION_CONTROL
+    )
+    db = Database(conn)
+    db["t"].insert({"id": 1}, pk="id")
+    assert [r["id"] for r in db["t"].rows] == [1]
+    db.close()
diff --git a/tests/test_convert.py b/tests/test_convert.py
index 848b39a..ea3fd96 100644
--- a/tests/test_convert.py
+++ b/tests/test_convert.py
@@ -77,7 +77,7 @@ def test_convert_output(fresh_db, drop, expected):
 
 def test_convert_output_multiple_column_error(fresh_db):
     table = fresh_db["table"]
-    with pytest.raises(AssertionError) as excinfo:
+    with pytest.raises(ValueError) as excinfo:
         table.convert(["title", "other"], lambda v: v, output="out")
         assert "output= can only be used with a single column" in str(excinfo.value)
 
diff --git a/tests/test_create.py b/tests/test_create.py
index b1a6ad1..decefcf 100644
--- a/tests/test_create.py
+++ b/tests/test_create.py
@@ -108,7 +108,7 @@ def test_create_table_with_defaults(fresh_db):
 
 
 def test_create_table_with_bad_not_null(fresh_db):
-    with pytest.raises(AssertionError):
+    with pytest.raises(ValueError):
         fresh_db.create_table(
             "players", {"name": str, "score": int}, not_null={"mouse"}
         )
@@ -243,11 +243,11 @@ def test_create_table_column_order(fresh_db, use_table_factory):
         # If you specify a column that doesn't point to a table, you  get an error:
         (("one_id", "two_id", "three_id"), NoObviousTable),
         # Tuples of the wrong length get an error:
-        ((("one_id", "one", "id", "five"), ("two_id", "two", "id")), AssertionError),
+        ((("one_id", "one", "id", "five"), ("two_id", "two", "id")), ValueError),
         # Likewise a bad column:
         ((("one_id", "one", "id2"),), AlterError),
         # Or a list of dicts
-        (({"one_id": "one"},), AssertionError),
+        (({"one_id": "one"},), ValueError),
     ),
 )
 @pytest.mark.parametrize("use_table_factory", [True, False])
@@ -700,7 +700,7 @@ def test_bulk_insert_more_than_999_values(fresh_db):
 def test_error_if_more_than_999_columns(fresh_db, num_columns, should_error):
     record = dict([("c{}".format(i), i) for i in range(num_columns)])
     if should_error:
-        with pytest.raises(AssertionError):
+        with pytest.raises(ValueError):
             fresh_db["big"].insert(record)
     else:
         fresh_db["big"].insert(record)
@@ -1061,7 +1061,7 @@ def test_create_table_numpy(fresh_db):
 
 def test_cannot_provide_both_filename_and_memory():
     with pytest.raises(
-        AssertionError, match="Either specify a filename_or_conn or pass memory=True"
+        ValueError, match="Either specify a filename_or_conn or pass memory=True"
     ):
         Database("/tmp/foo.db", memory=True)
 
@@ -1214,7 +1214,7 @@ def test_create_if_not_exists(fresh_db):
 
 
 def test_create_if_no_columns(fresh_db):
-    with pytest.raises(AssertionError) as error:
+    with pytest.raises(ValueError) as error:
         fresh_db["t"].create({})
     assert error.value.args[0] == "Tables must have at least one column"
 
@@ -1382,7 +1382,10 @@ def test_bad_table_and_view_exceptions(fresh_db):
     assert ex.value.args[0] == "Table v is actually a view"
     with pytest.raises(NoView) as ex2:
         fresh_db.view("t")
-    assert ex2.value.args[0] == "View t does not exist"
+    assert ex2.value.args[0] == "View t does not exist - t is a table"
+    with pytest.raises(NoView) as ex3:
+        fresh_db.view("missing")
+    assert ex3.value.args[0] == "View missing does not exist"
 
 
 # Tests for issue #655: Table configuration should be stored in _defaults
diff --git a/tests/test_create_view.py b/tests/test_create_view.py
index f0e2855..056e246 100644
--- a/tests/test_create_view.py
+++ b/tests/test_create_view.py
@@ -15,7 +15,7 @@ def test_create_view_error(fresh_db):
 
 
 def test_create_view_only_arrow_one_param(fresh_db):
-    with pytest.raises(AssertionError):
+    with pytest.raises(ValueError):
         fresh_db.create_view("bar", "select 1 + 2", ignore=True, replace=True)
 
 
diff --git a/tests/test_delete.py b/tests/test_delete.py
index 652096c..a2d93aa 100644
--- a/tests/test_delete.py
+++ b/tests/test_delete.py
@@ -1,3 +1,6 @@
+import sqlite_utils
+
+
 def test_delete_rowid_table(fresh_db):
     table = fresh_db["table"]
     table.insert({"foo": 1}).last_pk
@@ -32,6 +35,21 @@ def test_delete_where_all(fresh_db):
     assert table.count == 0
 
 
+def test_delete_where_commits(tmpdir):
+    path = str(tmpdir / "test.db")
+    db = sqlite_utils.Database(path)
+    db["table"].insert_all([{"id": i} for i in range(5)], pk="id")
+    db["table"].delete_where("id > ?", [2])
+    # The connection must not be left inside an open transaction,
+    # otherwise subsequent atomic() blocks never commit either
+    assert not db.conn.in_transaction
+    db["table"].insert({"id": 100})
+    db.close()
+    db2 = sqlite_utils.Database(path)
+    assert [r["id"] for r in db2["table"].rows] == [0, 1, 2, 100]
+    db2.close()
+
+
 def test_delete_where_analyze(fresh_db):
     table = fresh_db["table"]
     table.insert_all(({"id": i, "i": i} for i in range(10)), pk="id")
diff --git a/tests/test_fts.py b/tests/test_fts.py
index ba4b32c..3f7c5a9 100644
--- a/tests/test_fts.py
+++ b/tests/test_fts.py
@@ -336,6 +336,24 @@ def test_rebuild_fts(fresh_db):
     assert len(rows2) == 2
 
 
+@pytest.mark.parametrize("method", ["optimize", "rebuild_fts"])
+def test_optimize_and_rebuild_fts_commit(tmpdir, method):
+    path = str(tmpdir / "test.db")
+    db = Database(path)
+    table = db["searchable"]
+    table.insert(search_records[0])
+    table.enable_fts(["text", "country"])
+    getattr(table, method)()
+    # The connection must not be left inside an open transaction,
+    # otherwise this and all subsequent writes are lost on close
+    assert not db.conn.in_transaction
+    table.insert(search_records[1])
+    db.close()
+    db2 = Database(path)
+    assert db2["searchable"].count == 2
+    db2.close()
+
+
 @pytest.mark.parametrize("invalid_table", ["does_not_exist", "not_searchable"])
 def test_rebuild_fts_invalid(fresh_db, invalid_table):
     fresh_db["not_searchable"].insert({"foo": "bar"})
@@ -443,12 +461,12 @@ def test_enable_fts_replace_handles_legacy_bracket_quoted_content_table():
     assert 'content="books"' in db["books_fts"].schema
 
 
-def test_enable_fts_error_message_on_views():
+def test_view_has_no_enable_fts():
     db = Database(memory=True)
     db.create_view("hello", "select 1 + 1")
-    with pytest.raises(NotImplementedError) as e:
-        db["hello"].enable_fts()  # type: ignore[call-arg]
-        assert e.value.args[0] == "enable_fts() is supported on tables but not on views"
+    # Views deliberately do not have an enable_fts() method
+    with pytest.raises(AttributeError):
+        db["hello"].enable_fts()  # type: ignore[union-attr]
 
 
 @pytest.mark.parametrize(
@@ -700,3 +718,17 @@ def test_search_quote(fresh_db):
         list(table.search(query))
     # No exception with quote=True
     list(table.search(query, quote=True))
+
+
+def test_enable_fts_cli_on_view_errors(tmpdir):
+    db_path = str(tmpdir / "test.db")
+    db = Database(db_path)
+    db["t"].insert({"text": "hello"})
+    db.create_view("v", "select * from t")
+    db.close()
+    from click.testing import CliRunner
+    from sqlite_utils import cli as cli_module
+
+    result = CliRunner().invoke(cli_module.cli, ["enable-fts", db_path, "v", "text"])
+    assert result.exit_code == 1
+    assert result.output.strip() == "Error: Table v is actually a view"
diff --git a/tests/test_m2m.py b/tests/test_m2m.py
index 2cb2ca3..d613bb9 100644
--- a/tests/test_m2m.py
+++ b/tests/test_m2m.py
@@ -139,9 +139,9 @@ def test_m2m_lookup(fresh_db):
 
 def test_m2m_requires_either_records_or_lookup(fresh_db):
     people = fresh_db.table("people", pk="id").insert({"name": "Wahyu"})
-    with pytest.raises(AssertionError):
+    with pytest.raises(ValueError):
         people.m2m("tags")
-    with pytest.raises(AssertionError):
+    with pytest.raises(ValueError):
         people.m2m("tags", {"tag": "hello"}, lookup={"foo": "bar"})
 
 
diff --git a/tests/test_migrations.py b/tests/test_migrations.py
index 6a0dd33..5634d79 100644
--- a/tests/test_migrations.py
+++ b/tests/test_migrations.py
@@ -14,7 +14,7 @@ def migrations():
     @migrations()
     def m002(db):
         db["cats"].create({"name": str})
-        db.query("insert into dogs (name) values ('Pancakes')")
+        db.execute("insert into dogs (name) values ('Pancakes')")
 
     return migrations
 
@@ -32,7 +32,7 @@ def migrations_not_ordered_alphabetically():
     @migrations()
     def m001(db):
         db["cats"].create({"name": str})
-        db.query("insert into dogs (name) values ('Pancakes')")
+        db.execute("insert into dogs (name) values ('Pancakes')")
 
     return migrations
 
@@ -80,6 +80,88 @@ def test_order_does_not_matter(migrations, migrations_not_ordered_alphabetically
     assert db1.schema == db2.schema
 
 
+def test_applied_at_is_a_string(migrations):
+    db = sqlite_utils.Database(memory=True)
+    migrations.apply(db)
+    applied = migrations.applied(db)
+    assert len(applied) == 2
+    for migration in applied:
+        # applied_at is the TEXT timestamp straight from the
+        # _sqlite_migrations table, e.g. "2026-07-04 12:00:00.000000+00:00"
+        assert isinstance(migration.applied_at, str)
+        assert migration.applied_at.endswith("+00:00")
+
+
+def test_failing_migration_rolls_back(migrations):
+    @migrations()
+    def m003(db):
+        db["birds"].create({"name": str})
+        db.execute("insert into dogs (name) values ('Dozer')")
+        raise ValueError("boom")
+
+    db = sqlite_utils.Database(memory=True)
+    with pytest.raises(ValueError):
+        migrations.apply(db)
+    # m001 and m002 committed before the failure and stay applied
+    assert set(db.table_names()) == {"_sqlite_migrations", "dogs", "cats"}
+    assert [r["name"] for r in db["dogs"].rows] == ["Cleo", "Pancakes"]
+    assert [m.name for m in migrations.applied(db)] == ["m001", "m002"]
+    # Everything m003 did was rolled back and it is still pending
+    assert [m.name for m in migrations.pending(db)] == ["m003"]
+
+
+def test_rerun_after_failure_applies_each_migration_once():
+    state = {"fail": True}
+    migrations = Migrations("test")
+
+    @migrations()
+    def m001(db):
+        db["dogs"].insert({"name": "Cleo"})
+
+    @migrations()
+    def m002(db):
+        db["dogs"].insert({"name": "Pancakes"})
+        if state["fail"]:
+            raise ValueError("boom")
+
+    db = sqlite_utils.Database(memory=True)
+    with pytest.raises(ValueError):
+        migrations.apply(db)
+    state["fail"] = False
+    migrations.apply(db)
+    # m001 must not have been re-applied, m002 applied exactly once
+    assert [r["name"] for r in db["dogs"].rows] == ["Cleo", "Pancakes"]
+    assert [m.name for m in migrations.applied(db)] == ["m001", "m002"]
+
+
+def test_non_transactional_migration_allows_vacuum(tmpdir):
+    path = str(tmpdir / "test.db")
+    db = sqlite_utils.Database(path)
+    migrations = Migrations("test")
+
+    @migrations()
+    def m001(db):
+        db["dogs"].insert({"name": "Cleo"})
+
+    @migrations(transactional=False)
+    def m002(db):
+        db.execute("VACUUM")
+
+    migrations.apply(db)
+    assert [m.name for m in migrations.applied(db)] == ["m001", "m002"]
+    db.close()
+
+
+def test_apply_composes_inside_outer_transaction(migrations):
+    db = sqlite_utils.Database(memory=True)
+    with pytest.raises(ZeroDivisionError):
+        with db.atomic():
+            migrations.apply(db)
+            raise ZeroDivisionError
+    # The outer transaction rolled back, taking the migrations with it
+    assert db.table_names() == []
+
+
 @pytest.mark.parametrize(
     "create_table,pk",
     (
@@ -108,3 +190,27 @@ def test_upgrades_sqlite_migrations(migrations, create_table, pk):
     assert db["_sqlite_migrations"].pks == ([pk] if isinstance(pk, str) else list(pk))
     migrations.apply(db)
     assert db["_sqlite_migrations"].pks == ["id"]
+
+
+def test_pending_and_applied_are_read_only(migrations):
+    db = sqlite_utils.Database(memory=True)
+    assert [m.name for m in migrations.pending(db)] == ["m001", "m002"]
+    assert migrations.applied(db) == []
+    # Neither call should have created the tracking table
+    assert db.table_names() == []
+
+
+def test_duplicate_migration_name_errors():
+    migrations = Migrations("test")
+
+    @migrations()
+    def m001(db):
+        pass
+
+    with pytest.raises(ValueError) as ex:
+
+        @migrations(name="m001")
+        def m001_again(db):
+            pass
+
+    assert "m001" in str(ex.value)
diff --git a/tests/test_query.py b/tests/test_query.py
index fe79cc0..91bf1ac 100644
--- a/tests/test_query.py
+++ b/tests/test_query.py
@@ -1,5 +1,8 @@
+import pytest
 import types
 
+from sqlite_utils.utils import sqlite3
+
 
 def test_query(fresh_db):
     fresh_db["dogs"].insert_all([{"name": "Cleo"}, {"name": "Pancakes"}])
@@ -8,6 +11,33 @@ def test_query(fresh_db):
     assert list(results) == [{"name": "Pancakes"}, {"name": "Cleo"}]
 
 
+def test_query_executes_eagerly(fresh_db):
+    # The SQL runs when query() is called, not when the result is iterated,
+    # so errors are raised at the call site
+    with pytest.raises(sqlite3.OperationalError):
+        fresh_db.query("select * from missing_table")
+
+
+def test_query_rejects_statements_that_return_no_rows(fresh_db):
+    fresh_db["dogs"].insert({"name": "Cleo"})
+    with pytest.raises(ValueError) as ex:
+        fresh_db.query("update dogs set name = 'Cleopaws'")
+    assert "execute()" in str(ex.value)
+
+
+@pytest.mark.skipif(
+    sqlite3.sqlite_version_info < (3, 35, 0),
+    reason="RETURNING requires SQLite 3.35.0 or higher",
+)
+def test_query_insert_returning(fresh_db):
+    fresh_db["dogs"].insert({"name": "Cleo"})
+    rows = list(
+        fresh_db.query("insert into dogs (name) values ('Pancakes') returning name")
+    )
+    assert rows == [{"name": "Pancakes"}]
+    assert fresh_db["dogs"].count == 2
+
+
 def test_execute_returning_dicts(fresh_db):
     # Like db.query() but returns a list, included for backwards compatibility
     # see https://github.com/simonw/sqlite-utils/issues/290
diff --git a/tests/test_recreate.py b/tests/test_recreate.py
index 224d182..bce53d5 100644
--- a/tests/test_recreate.py
+++ b/tests/test_recreate.py
@@ -15,7 +15,7 @@ def test_recreate_ignored_for_in_memory():
 def test_recreate_not_allowed_for_connection():
     conn = sqlite3.connect(":memory:")
     try:
-        with pytest.raises(AssertionError):
+        with pytest.raises(ValueError):
             Database(conn, recreate=True)
     finally:
         conn.close()
diff --git a/tests/test_sniff.py b/tests/test_sniff.py
index 62fac86..4bbdb66 100644
--- a/tests/test_sniff.py
+++ b/tests/test_sniff.py
@@ -6,7 +6,7 @@ import pytest
 sniff_dir = pathlib.Path(__file__).parent / "sniff"
 
 
-@pytest.mark.parametrize("filepath", sniff_dir.glob("example*"))
+@pytest.mark.parametrize("filepath", sorted(sniff_dir.glob("example*")))
 def test_sniff(tmpdir, filepath):
     db_path = str(tmpdir / "test.db")
     runner = CliRunner()
diff --git a/tests/test_upsert.py b/tests/test_upsert.py
index 09783bb..a782b26 100644
--- a/tests/test_upsert.py
+++ b/tests/test_upsert.py
@@ -49,6 +49,42 @@ def test_upsert_error_if_no_pk(fresh_db):
         table.upsert({"id": 1, "name": "Cleo"})
 
 
+@pytest.mark.parametrize("use_old_upsert", (False, True))
+def test_upsert_empty_record_errors(use_old_upsert):
+    db = Database(memory=True, use_old_upsert=use_old_upsert)
+    table = db["table"]
+    table.insert({"id": 1, "name": "Cleo"}, pk="id")
+    with pytest.raises(PrimaryKeyRequired):
+        table.upsert({}, pk="id")
+    with pytest.raises(PrimaryKeyRequired):
+        table.upsert_all([{}, {}], pk="id")
+    # No rows can have been inserted
+    assert table.count == 1
+
+
+@pytest.mark.parametrize("use_old_upsert", (False, True))
+def test_upsert_missing_pk_value_errors(use_old_upsert):
+    db = Database(memory=True, use_old_upsert=use_old_upsert)
+    table = db["table"]
+    table.insert({"id": 1, "name": "Cleo"}, pk="id")
+    # Records that omit the pk column entirely
+    with pytest.raises(PrimaryKeyRequired):
+        table.upsert_all([{"name": "Pancakes"}, {"name": "Marnie"}], pk="id")
+    # A record with an explicit None pk value can never conflict
+    with pytest.raises(PrimaryKeyRequired):
+        table.upsert({"id": None, "name": "Pancakes"}, pk="id")
+    assert list(table.rows) == [{"id": 1, "name": "Cleo"}]
+
+
+def test_upsert_missing_compound_pk_value_errors(fresh_db):
+    table = fresh_db["table"]
+    table.insert({"a": "x", "b": "y", "v": 1}, pk=("a", "b"))
+    # Missing one component of the detected compound primary key
+    with pytest.raises(PrimaryKeyRequired):
+        table.upsert({"a": "x", "v": 2})
+    assert list(table.rows) == [{"a": "x", "b": "y", "v": 1}]
+
+
 def test_upsert_error_if_existing_table_has_no_pk(fresh_db):
     table = fresh_db.create_table("table", {"id": int, "name": str})
     with pytest.raises(PrimaryKeyRequired):
diff --git a/tests/test_wal.py b/tests/test_wal.py
index 23ca144..ee7ecf0 100644
--- a/tests/test_wal.py
+++ b/tests/test_wal.py
@@ -1,5 +1,6 @@
 import pytest
 from sqlite_utils import Database
+from sqlite_utils.db import TransactionError
 
 
 @pytest.fixture
@@ -21,3 +22,39 @@ def test_enable_disable_wal(db_path_tmpdir):
     db.disable_wal()
     assert "delete" == db.journal_mode
     assert "test.db-wal" not in [f.basename for f in tmpdir.listdir()]
+
+
+def test_enable_wal_inside_transaction_raises(db_path_tmpdir):
+    db, path, tmpdir = db_path_tmpdir
+    db["test"].insert({"id": 1}, pk="id")
+    with pytest.raises(TransactionError):
+        with db.atomic():
+            db["test"].insert({"id": 2}, pk="id")
+            db.enable_wal()
+    # The atomic() block must have rolled back cleanly and the
+    # journal mode must be unchanged
+    assert db.journal_mode == "delete"
+    assert [r["id"] for r in db["test"].rows] == [1]
+
+
+def test_disable_wal_inside_transaction_raises(db_path_tmpdir):
+    db, path, tmpdir = db_path_tmpdir
+    db.enable_wal()
+    db["test"].insert({"id": 1}, pk="id")
+    with pytest.raises(TransactionError):
+        with db.atomic():
+            db["test"].insert({"id": 2}, pk="id")
+            db.disable_wal()
+    assert db.journal_mode == "wal"
+    assert [r["id"] for r in db["test"].rows] == [1]
+
+
+def test_enable_wal_noop_inside_transaction_is_allowed(db_path_tmpdir):
+    # Calling enable_wal() when WAL is already enabled is a no-op,
+    # so it is fine inside a transaction
+    db, path, tmpdir = db_path_tmpdir
+    db.enable_wal()
+    with db.atomic():
+        db["test"].insert({"id": 1}, pk="id")
+        db.enable_wal()
+    assert [r["id"] for r in db["test"].rows] == [1]