@dbsp/cli 3.0.0 → 4.0.0

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   createDbConnection,
   generateSchemaFileWithDiagnostics,
   redactDbUrl
-} from "./chunk-G6NS4BAV.js";
+} from "./chunk-MFQPE7CY.js";
 import {
   loadSchema,
   loadSchemaFromCwd
@@ -15,37 +15,40 @@ import {
 
 // src/index.ts
 import { createRequire } from "module";
-import { Command as Command12, CommanderError } from "commander";
+import { Command as Command13, CommanderError } from "commander";
 
 // src/commands/apply.ts
 import { AsyncLocalStorage } from "async_hooks";
-import { createHash as createHash3 } from "crypto";
+import { createHash } from "crypto";
 import { readFile } from "fs/promises";
 import { createInterface } from "readline/promises";
 import {
   appendIntentJournal,
-  appendTransitionAuthorization,
   createPgTransitionLessor as createPgTransitionLessor3,
-  createPgTransitionPack as createPgTransitionPack2,
   escapeDiagnosticText as escapeDiagnosticText3,
-  preparePgExecutionSession,
+  executionIdsForRun,
+  readPgLedgerAddressChain,
+  readPgLedgerReservationsForExecution,
   readTransitionJournal,
   TransitionRunIdentityMismatchError,
-  validatePgManagedLedgerCurrency,
   withPgTransitionRunLock
 } from "@dbsp/adapter-pgsql";
-import { lockPgJournalRun } from "@dbsp/adapter-pgsql/internal";
+import {
+  applyPgTransitionRun,
+  comparePgsqlDeclaredAdoptionSchema as comparePgsqlDeclaredAdoptionSchema2,
+  executeGeneratorPlan,
+  lockPgJournalRun,
+  modelForDeclaredAdoption as modelForDeclaredAdoption2
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireExclusiveTransitionLease,
   acquireTransitionLease as acquireTransitionLease3,
-  createApplier,
-  createPackRegistry as createPackRegistry2,
   selectorMatchesResource,
   transitionPlanDigest as transitionPlanDigest2,
-  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest3
+  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest2
 } from "@dbsp/core";
 import { mintDurablyLoadedRun } from "@dbsp/core/internal";
-import { REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
+import { ledgerAddressKey, REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
 import { Command as Command2 } from "commander";
 
 // src/utils/output.ts
@@ -59,932 +62,47 @@ function printCliJson(value) {
   console.log(serializeCliJson(value));
 }
 
-// src/commands/generator-execution.ts
-import { createHash, randomUUID } from "crypto";
-import { isDeepStrictEqual } from "util";
-import {
-  compareSchemata,
-  createPgsqlAdapter,
-  dbTypesEqual,
-  executePgAdmittedOperation,
-  executePgDeclaredAdoption,
-  executePgPersistedTableReaddress,
-  preflightPgDeclaredAdoption,
-  readPgCatalogueIdentity,
-  readPgLedgerAddressChain,
-  readPgLedgerScopeCurrency,
-  readPgRemovalEffectsClosure
-} from "@dbsp/adapter-pgsql";
-import {
-  outcomeClaimEventId,
-  outcomeClaimId,
-  projectLedgerChain,
-  validateNormalizedManagedStepManifest
-} from "@dbsp/core";
-import { decideDestructiveDecision } from "@dbsp/core/internal";
-import { ledgerAddressKey } from "@dbsp/types";
-function managedSteps(manifest) {
-  return manifest.steps;
-}
-function matchesReviewedReplacementSelector(reviewed, provided) {
-  return provided === reviewed || reviewed.startsWith("table:") && provided === reviewed.slice("table:".length);
-}
-function modelForAdoption(table) {
-  const tables = /* @__PURE__ */ new Map([[table.name, table]]);
-  const relations = /* @__PURE__ */ new Map();
-  return {
-    tables,
-    relations,
-    getTable: (name) => tables.get(name),
-    getRelation: (name) => relations.get(name),
-    getRelationsFrom: () => [],
-    getRelationsTo: () => [],
-    isAmbiguous: () => ({ ambiguous: false, options: [] })
-  };
-}
-async function adoptionShapeMatches(pool, schema, shape) {
-  const live = await createPgsqlAdapter(pool).introspect({ schema });
-  const diff = compareSchemata(modelForAdoption(shape), live);
-  return !diff.changes.some((change) => change.table === shape.name);
-}
-var SYSTEM_LEDGER_SCHEMAS = /* @__PURE__ */ new Set([
-  "pg_toast",
-  "pg_catalog",
-  "information_schema"
-]);
-var SystemSchemaLedgerHomeError = class extends Error {
-  address;
-  constructor(address) {
-    super(
-      `SystemSchemaLedgerHomeError: ledger home is unavailable for system schema ${address.schema}: ${ledgerAddressKey(address)}`
-    );
-    this.name = "SystemSchemaLedgerHomeError";
-    this.address = address;
-  }
-};
-function home(address) {
-  if (address.scope !== "database" && address.schema && SYSTEM_LEDGER_SCHEMAS.has(address.schema))
-    throw new SystemSchemaLedgerHomeError(address);
-  return address.scope === "database" ? { scope: "database" } : address.schema ? { scope: "schema", schema: address.schema } : (() => {
-    throw new Error(
-      `schema-scoped generated address ${address.name} has no schema ledger`
-    );
-  })();
-}
-function acceptance(planDigest, approval) {
-  return approval.approvals.some(
-    (grant) => grant.class === `destructive-plan-accepted:${planDigest}`
-  ) === true ? "destructive-plan-accepted" : "absent";
-}
-function withheldDestructiveAuthority(evidence) {
-  if (evidence.declaration !== "requires-removal" && evidence.declaration !== "requires-lossy-change" && evidence.declaration !== "replacement-requested-by-plan")
-    return "destructive declaration authority";
-  if (evidence.ownership !== "managed-by-me")
-    return "destructive ownership authority";
-  if (evidence.catalogueIdentity !== "matches-recorded")
-    return "destructive catalogue identity authority";
-  if (evidence.operatorAcceptance !== "destructive-plan-accepted")
-    return "destructive operator acceptance authority";
-  if (evidence.containment !== void 0 && evidence.containment !== "all-contained-or-managed")
-    return "destructive containment authority";
-  if (evidence.ledgerLineage !== "matches-database")
-    return "destructive ledger lineage authority";
-  return void 0;
-}
-function withheldDestructiveAuthorityFromReason(reason) {
-  if (reason.includes("operator acceptance"))
-    return "destructive operator acceptance authority";
-  if (reason.includes("ledger lineage"))
-    return "destructive ledger lineage authority";
-  return void 0;
-}
-async function databaseId(pool) {
-  const result = await pool.query("SELECT current_database() AS database_id");
-  const database = result.rows[0]?.database_id;
-  if (typeof database !== "string" || database.length === 0)
-    throw new Error(
-      "schema-differ generator could not read current database identity"
-    );
-  return database;
-}
-async function managed(executor, address) {
-  const chain = await readPgLedgerAddressChain(
-    executor,
-    home(address),
-    address
-  );
-  const projection = projectLedgerChain(chain);
-  return projection.kind === "projected-ledger-chain" && projection.stableState === "managed";
-}
-async function alreadyAppliedCreation(executor, address) {
-  const live = await readPgCatalogueIdentity(executor, address);
-  if (!live?.catalogueIdentity) return false;
-  const chain = await readPgLedgerAddressChain(
-    executor,
-    home(address),
-    address
-  );
-  const projection = projectLedgerChain(chain);
-  const recorded = chain.terminalMember?.catalogueIdentity;
-  return projection.kind === "projected-ledger-chain" && projection.stableState === "managed" && recorded !== void 0 && isDeepStrictEqual(recorded, live.catalogueIdentity);
-}
-function observed(address) {
-  return {
-    value: { kind: address.kind, name: address.name },
-    digest: `generator:${address.kind}:${address.name}`
-  };
-}
-function normalizedDefinition(value) {
-  return value.replaceAll('"', "").replace(/\s+/gu, " ").replace(/;$/u, "").trim().toLowerCase();
-}
-function generatedPayload(value) {
-  return {
-    value,
-    digest: createHash("sha256").update(JSON.stringify(value)).digest("hex")
-  };
-}
-function textList(value) {
-  return Array.isArray(value) ? value.map((item) => String(item)) : [];
-}
-function foreignKeyAction(code) {
-  switch (code) {
-    case "a":
-      return "NO ACTION";
-    case "r":
-      return "RESTRICT";
-    case "c":
-      return "CASCADE";
-    case "n":
-      return "SET NULL";
-    case "d":
-      return "SET DEFAULT";
-    default:
-      return void 0;
-  }
-}
-function generatedPostcondition(step, address) {
-  const value = step.expectedDeclaration?.value;
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new Error(
-      `generated ${address.kind} step ${step.stepKey} has no structural postcondition`
-    );
-  const postcondition = value;
-  return postcondition;
-}
-async function readGeneratedPostcondition(executor, step, address) {
-  const parent = address.parent?.name;
-  if (address.kind === "column" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "column")
-      throw new Error(
-        `generated column ${address.name} has a non-column structural postcondition`
-      );
-    const expected = postcondition.column;
-    if (expected.name !== address.name)
-      throw new Error(
-        `generated column ${address.name} structural postcondition names another column`
-      );
-    const row = (await executor.query(
-      `SELECT pg_catalog.format_type(attribute.atttypid, attribute.atttypmod) AS column_type, attribute.attnotnull AS is_not_null, pg_catalog.pg_get_expr(default_value.adbin, default_value.adrelid) AS column_default, collation.collname AS collation_name, attribute.attidentity AS identity_kind FROM pg_catalog.pg_attribute attribute JOIN pg_catalog.pg_class relation ON relation.oid = attribute.attrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_attrdef default_value ON default_value.adrelid = attribute.attrelid AND default_value.adnum = attribute.attnum LEFT JOIN pg_catalog.pg_collation collation ON collation.oid = attribute.attcollation WHERE namespace.nspname = $1 AND relation.relname = $2 AND attribute.attname = $3 AND attribute.attnum > 0 AND NOT attribute.attisdropped`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated column ${address.name} is absent`);
-    const type = String(row.column_type ?? "");
-    const nullable = row.is_not_null === true ? false : row.is_not_null === false ? true : void 0;
-    const actualDefault = row.column_default == null ? void 0 : String(row.column_default);
-    const actualCollation = row.collation_name == null ? null : String(row.collation_name);
-    const actualIdentity = row.identity_kind === "a" ? "always" : row.identity_kind === "d" ? "byDefault" : null;
-    if (expected.type !== void 0 && !dbTypesEqual(type, expected.type))
-      throw new Error(
-        `generated column ${address.name} type postcondition differs`
-      );
-    if (expected.nullable !== void 0 && nullable !== expected.nullable)
-      throw new Error(
-        `generated column ${address.name} nullability postcondition differs`
-      );
-    if (expected.hasDefault === true && (actualDefault === void 0 || expected.default === void 0 || actualDefault !== expected.default))
-      throw new Error(
-        `generated column ${address.name} default postcondition differs`
-      );
-    if (expected.hasDefault === false && actualDefault !== void 0)
-      throw new Error(
-        `generated column ${address.name} default postcondition differs`
-      );
-    if (expected.collation !== void 0 && actualCollation !== expected.collation)
-      throw new Error(
-        `generated column ${address.name} collation postcondition differs`
-      );
-    if (expected.identity !== void 0 && actualIdentity !== expected.identity)
-      throw new Error(
-        `generated column ${address.name} identity postcondition differs`
-      );
-    return generatedPayload({
-      kind: "column",
-      type,
-      nullable,
-      default: actualDefault
-    });
-  }
-  if (address.kind === "constraint" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "constraint")
-      throw new Error(
-        `generated constraint ${address.name} has a non-constraint structural postcondition`
-      );
-    const expected = postcondition.constraint;
-    const row = (await executor.query(
-      `SELECT constraint_item.contype AS constraint_type, pg_catalog.pg_get_constraintdef(constraint_item.oid, true) AS constraint_definition, ARRAY(SELECT attribute.attname::text FROM unnest(constraint_item.conkey) WITH ORDINALITY AS key_column(attnum, position) JOIN pg_catalog.pg_attribute attribute ON attribute.attrelid = constraint_item.conrelid AND attribute.attnum = key_column.attnum ORDER BY key_column.position) AS key_columns, referenced_namespace.nspname AS referenced_schema, referenced_relation.relname AS referenced_table, ARRAY(SELECT attribute.attname::text FROM unnest(constraint_item.confkey) WITH ORDINALITY AS key_column(attnum, position) JOIN pg_catalog.pg_attribute attribute ON attribute.attrelid = constraint_item.confrelid AND attribute.attnum = key_column.attnum ORDER BY key_column.position) AS referenced_columns, constraint_item.confdeltype AS on_delete, constraint_item.confupdtype AS on_update, constraint_item.condeferrable AS is_deferrable, constraint_item.condeferred AS is_deferred, constraint_item.convalidated AS is_validated FROM pg_catalog.pg_constraint constraint_item JOIN pg_catalog.pg_class relation ON relation.oid = constraint_item.conrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_class referenced_relation ON referenced_relation.oid = constraint_item.confrelid LEFT JOIN pg_catalog.pg_namespace referenced_namespace ON referenced_namespace.oid = referenced_relation.relnamespace WHERE namespace.nspname = $1 AND relation.relname = $2 AND constraint_item.conname = $3`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated constraint ${address.name} is absent`);
-    const definition = String(row.constraint_definition ?? "");
-    if (String(row.constraint_type) !== expected.type)
-      throw new Error(
-        `generated constraint ${address.name} postcondition differs`
-      );
-    if ((expected.type === "p" || expected.type === "u") && JSON.stringify(textList(row.key_columns)) !== JSON.stringify(expected.columns))
-      throw new Error(
-        `generated constraint ${address.name} postcondition differs`
-      );
-    if (expected.type === "c") {
-      if (normalizedDefinition(definition) !== normalizedDefinition(expected.definition) || row.is_validated === true === expected.notValid)
-        throw new Error(
-          `generated constraint ${address.name} postcondition differs`
-        );
-    }
-    if (expected.type === "f") {
-      if (JSON.stringify(textList(row.key_columns)) !== JSON.stringify(expected.columns) || String(row.referenced_table ?? "") !== expected.references.table || expected.references.schema !== void 0 && String(row.referenced_schema ?? "") !== expected.references.schema || JSON.stringify(textList(row.referenced_columns)) !== JSON.stringify(expected.references.columns) || foreignKeyAction(row.on_delete) !== expected.onDelete || foreignKeyAction(row.on_update) !== expected.onUpdate || (row.is_deferrable === true && row.is_deferred === true) !== expected.deferred || row.is_validated === true === expected.notValid)
-        throw new Error(
-          `generated constraint ${address.name} postcondition differs`
-        );
-    }
-    return generatedPayload({
-      kind: "constraint",
-      type: String(row.constraint_type ?? ""),
-      definition
-    });
-  }
-  if (address.kind === "index" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "index")
-      throw new Error(
-        `generated index ${address.name} has a non-index structural postcondition`
-      );
-    const row = (await executor.query(
-      `SELECT index_relation.relname AS index_name, index_meta.indisunique AS is_unique, pg_catalog.pg_get_indexdef(index_meta.indexrelid, 0, true) AS index_definition FROM pg_catalog.pg_index index_meta JOIN pg_catalog.pg_class relation ON relation.oid = index_meta.indrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace JOIN pg_catalog.pg_class index_relation ON index_relation.oid = index_meta.indexrelid WHERE namespace.nspname = $1 AND relation.relname = $2 AND index_relation.relname = $3`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated index ${address.name} is absent`);
-    const definition = String(row.index_definition ?? "");
-    if (normalizedDefinition(definition) !== normalizedDefinition(postcondition.definition))
-      throw new Error(`generated index ${address.name} postcondition differs`);
-    return generatedPayload({
-      kind: "index",
-      unique: row.is_unique === true,
-      definition
-    });
-  }
-  if (address.kind === "table" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "table")
-      throw new Error(
-        `generated table ${address.name} has a non-table structural postcondition`
-      );
-    const rows = (await executor.query(
-      `SELECT attribute.attname AS column_name, pg_catalog.format_type(attribute.atttypid, attribute.atttypmod) AS column_type, attribute.attnotnull AS is_not_null, pg_catalog.pg_get_expr(default_value.adbin, default_value.adrelid) AS column_default FROM pg_catalog.pg_attribute attribute JOIN pg_catalog.pg_class relation ON relation.oid = attribute.attrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_attrdef default_value ON default_value.adrelid = attribute.attrelid AND default_value.adnum = attribute.attnum WHERE namespace.nspname = $1 AND relation.relname = $2 AND attribute.attnum > 0 AND NOT attribute.attisdropped ORDER BY attribute.attnum`,
-      [address.schema, address.name]
-    )).rows;
-    const expected = postcondition.columns;
-    if (expected.length === 0 || rows.length !== expected.length)
-      throw new Error(
-        `generated table ${address.name} column postcondition differs: expected ${JSON.stringify(expected)}, live ${JSON.stringify(rows)}`
-      );
-    for (const specification of expected) {
-      const actual = rows.find((row) => row.column_name === specification.name);
-      if (!actual || specification.type !== void 0 && !dbTypesEqual(
-        String(actual.column_type ?? ""),
-        specification.type
-      ) || specification.nullable !== void 0 && actual.is_not_null !== true !== specification.nullable || specification.hasDefault === true && (specification.default === void 0 || actual.column_default == null || String(actual.column_default) !== specification.default) || specification.hasDefault === false && actual.column_default != null)
-        throw new Error(
-          `generated table ${address.name} column postcondition differs: expected ${JSON.stringify(specification)}, live ${JSON.stringify(actual)}`
-        );
-    }
-    return generatedPayload({
-      kind: "table",
-      columns: rows.map((row) => ({
-        name: String(row.column_name),
-        type: String(row.column_type),
-        nullable: row.is_not_null !== true,
-        default: row.column_default == null ? void 0 : String(row.column_default)
-      }))
-    });
-  }
-  if (address.kind === "enum" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "enum")
-      throw new Error(
-        `generated enum ${address.name} has a non-enum structural postcondition`
-      );
-    const rows = (await executor.query(
-      `SELECT enum_label.enumlabel AS label FROM pg_catalog.pg_type type JOIN pg_catalog.pg_namespace namespace ON namespace.oid = type.typnamespace JOIN pg_catalog.pg_enum enum_label ON enum_label.enumtypid = type.oid WHERE namespace.nspname = $1 AND type.typname = $2 ORDER BY enum_label.enumsortorder`,
-      [address.schema, address.name]
-    )).rows;
-    const labels = rows.map((row) => String(row.label));
-    if (JSON.stringify(labels) !== JSON.stringify(postcondition.labels))
-      throw new Error(`generated enum ${address.name} postcondition differs`);
-    return generatedPayload({ kind: "enum", labels });
-  }
-  if (address.kind === "sequence" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "sequence")
-      throw new Error(
-        `generated sequence ${address.name} has a non-sequence structural postcondition`
-      );
-    const row = (await executor.query(
-      `SELECT sequence.start_value::text AS start_value, sequence.increment_by::text AS increment_by, sequence.min_value::text AS min_value, sequence.max_value::text AS max_value, sequence.cache_size::text AS cache_size, sequence.cycle AS cycle FROM pg_catalog.pg_sequences sequence WHERE sequence.schemaname = $1 AND sequence.sequencename = $2`,
-      [address.schema, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated sequence ${address.name} is absent`);
-    const actual = {
-      startValue: String(row.start_value),
-      incrementBy: String(row.increment_by),
-      minValue: String(row.min_value),
-      maxValue: String(row.max_value),
-      cycle: row.cycle === true
-    };
-    for (const key of [
-      "startValue",
-      "incrementBy",
-      "minValue",
-      "maxValue",
-      "cycle"
-    ])
-      if (postcondition[key] !== void 0 && postcondition[key] !== actual[key])
-        throw new Error(
-          `generated sequence ${address.name} postcondition differs`
-        );
-    return generatedPayload({ kind: "sequence", ...row });
-  }
-  if (address.kind === "extension") {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "extension")
-      throw new Error(
-        `generated extension ${address.name} has a non-extension structural postcondition`
-      );
-    const row = (await executor.query(
-      `SELECT extension.extversion AS version FROM pg_catalog.pg_extension extension WHERE extension.extname = $1`,
-      [address.name]
-    )).rows[0];
-    if (!row)
-      throw new Error(
-        `generated extension ${address.name} version postcondition differs`
-      );
-    if (postcondition.version !== void 0 && String(row.version) !== postcondition.version)
-      throw new Error(
-        `generated extension ${address.name} version postcondition differs`
-      );
-    return generatedPayload({
-      kind: "extension",
-      version: String(row.version)
-    });
-  }
-  throw new Error(`generated ${address.kind} has no declarable read-back`);
-}
-function containedBy(root, candidate) {
-  for (let parent = candidate.parent; parent; parent = parent.parent) {
-    if (parent.engine === root.engine && parent.database === root.database && parent.schema === root.schema && parent.kind === root.kind && parent.name === root.name)
-      return true;
-  }
-  return false;
-}
-async function destructiveEvidence(input) {
-  const { executor, address } = input;
-  let ownership = "uncomputable";
-  let catalogueIdentity = "catalogue-unavailable";
-  let ledgerLineage = "unreadable";
-  try {
-    const chain = await readPgLedgerAddressChain(
-      executor,
-      home(address),
-      address
-    );
-    const projection = projectLedgerChain(chain);
-    ownership = projection.kind === "projected-ledger-chain" ? projection.stableState === "managed" ? "managed-by-me" : projection.stableState === "unknown" ? "unknown" : "blocked" : "uncomputable";
-    const live = await readPgCatalogueIdentity(executor, address);
-    const recorded = chain.terminalMember?.catalogueIdentity;
-    catalogueIdentity = !live ? "object-absent" : recorded === void 0 ? "differs" : isDeepStrictEqual(live.catalogueIdentity, recorded) ? "matches-recorded" : "differs";
-    const currency = await readPgLedgerScopeCurrency(executor, home(address));
-    ledgerLineage = currency.kind === "current" ? "matches-database" : "differs";
-  } catch {
-  }
-  let containment;
-  let containmentOutcome;
-  if (input.classification === "removal") {
-    containment = await readPgRemovalEffectsClosure({
-      executor,
-      root: address,
-      isManaged: (candidate) => managed(executor, candidate)
-    });
-    containmentOutcome = containment.kind;
-  }
-  return {
-    evidence: {
-      declaration: input.classification === "removal" ? input.selection?.kind === "replacement" ? "replacement-requested-by-plan" : "requires-removal" : "requires-lossy-change",
-      ...input.selection?.kind === "replacement" ? { replacementAddress: address } : {},
-      ownership,
-      catalogueIdentity,
-      operatorAcceptance: acceptance(input.planDigest, input.approval),
-      ...containmentOutcome === void 0 ? {} : { containment: containmentOutcome },
-      ...containment?.kind === "reaches-unmanaged" ? { containmentUnmanaged: containment.unmanaged } : {},
-      ...containment?.kind === "undecidable" ? { containmentReason: containment.reason } : {},
-      ledgerLineage
-    },
-    ...containment === void 0 ? {} : { containment }
-  };
-}
-async function removalContainment(executor, address) {
-  return readPgRemovalEffectsClosure({
-    executor,
-    root: address,
-    isManaged: (candidate) => managed(executor, candidate)
-  });
-}
-async function executeGeneratorPlan(input) {
-  const validation = input.manifest ? { ok: true, manifest: input.manifest } : validateNormalizedManagedStepManifest(
-    input.plan?.steps ?? []
-  );
-  if (!validation.ok)
-    return { outcome: "execution-failed", detail: validation.detail };
-  const manifest = validation.manifest;
-  const approval = input.approval ?? {
-    approvals: (input.accepts ?? []).map((value) => ({ class: value }))
-  };
-  const completedStepKeys = [];
-  let destructiveRefusal;
-  let destructiveClosureReplanRequired = false;
-  const partial = (detail) => completedStepKeys.length === 0 ? { outcome: "execution-failed", detail } : {
-    outcome: "partially-applied",
-    detail,
-    completedStepKeys,
-    notStartedStepKeys: managedSteps(manifest).filter((step) => !completedStepKeys.includes(step.stepKey)).map((step) => step.stepKey)
-  };
-  try {
-    const database = await databaseId(input.pool);
-    const executionId = `dbsp.generator.execution.${randomUUID()}`;
-    await input.recordAttempt?.(executionId);
-    const steps = managedSteps(manifest);
-    for (const step of steps) {
-      if (step.lifecycle?.kind === "adoption-refused")
-        return {
-          outcome: "adoption-refused",
-          detail: `declared adoption for ${step.address?.name ?? step.stepKey} refuses live shape mismatch`
-        };
-      const lifecycle = step.lifecycle;
-      if (lifecycle?.kind !== "adoption") continue;
-      const address = step.address;
-      if (!address || !step.expectedDeclaration || !step.expectedCatalogueIdentity)
-        return {
-          outcome: "execution-failed",
-          detail: `adoption step ${step.stepKey} has incomplete normalized material`
-        };
-      const preflight = await preflightPgDeclaredAdoption({
-        executor: input.pool,
-        home: home(address),
-        address,
-        declaration: step.expectedDeclaration,
-        expectedCatalogueIdentity: step.expectedCatalogueIdentity,
-        shapeMatches: () => adoptionShapeMatches(input.pool, input.schema, lifecycle.shape)
-      });
-      if (preflight.outcome !== "ready" && preflight.outcome !== "no-op")
-        return preflight.outcome === "adoption-refused" ? { outcome: "adoption-refused", detail: preflight.detail } : { outcome: "execution-failed", detail: preflight.detail };
-    }
-    const replacementSelectors = steps.filter((step) => step.selection?.kind === "replacement").map((step) => step.selection?.selector).filter((selector) => selector !== void 0);
-    if (replacementSelectors.length > 0 && !input.replaces?.length)
-      return {
-        outcome: "destructive-authority-refused",
-        detail: "replacement requires a named --replace selector from the reviewed plan",
-        refusal: { withheldAuthority: "destructive declaration authority" }
-      };
-    for (const selector of input.replaces ?? [])
-      if (!replacementSelectors.some(
-        (reviewed) => matchesReviewedReplacementSelector(reviewed, selector)
-      ))
-        return {
-          outcome: "destructive-authority-refused",
-          detail: `replacement ${selector} was not requested by the reviewed plan`,
-          refusal: { withheldAuthority: "destructive declaration authority" }
-        };
-    if (replacementSelectors.some(
-      (reviewed) => !input.replaces?.some(
-        (provided) => matchesReviewedReplacementSelector(reviewed, provided)
-      )
-    ))
-      return {
-        outcome: "selection-incomplete",
-        detail: "replacement selection does not cover every reviewed replacement"
-      };
-    for (const step of steps) {
-      if (step.lifecycle?.kind === "adoption-refused") continue;
-      if (step.lifecycle?.kind === "adoption") {
-        const lifecycle = step.lifecycle;
-        const address2 = step.address;
-        if (!address2 || !step.expectedDeclaration || !step.expectedCatalogueIdentity)
-          return {
-            outcome: "execution-failed",
-            detail: `adoption step ${step.stepKey} has incomplete normalized material`
-          };
-        const adopted = await executePgDeclaredAdoption({
-          executor: input.pool,
-          run: input.run,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          approval,
-          step,
-          home: home(address2),
-          address: address2,
-          declaration: step.expectedDeclaration,
-          expectedCatalogueIdentity: step.expectedCatalogueIdentity,
-          shapeMatches: () => adoptionShapeMatches(input.pool, input.schema, lifecycle.shape),
-          ...input.observer === void 0 ? {} : { observer: input.observer }
-        });
-        if (adopted.outcome === "completed" || adopted.outcome === "no-op") {
-          completedStepKeys.push(step.stepKey);
-          continue;
-        }
-        return adopted.outcome === "adoption-refused" ? { outcome: "adoption-refused", detail: adopted.detail } : { outcome: "execution-failed", detail: adopted.detail };
-      }
-      if (step.lifecycle?.kind === "readdress") {
-        const result = await executePgPersistedTableReaddress({
-          executor: input.pool,
-          run: input.run,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          approval,
-          step,
-          database,
-          targetSchema: input.schema,
-          ...input.observer === void 0 ? {} : { observer: input.observer }
-        });
-        if (result.outcome === "completed" || result.outcome === "no-op") {
-          completedStepKeys.push(step.stepKey);
-          continue;
-        }
-        return result;
-      }
-      if (step.statementBundle.statements.length === 0) {
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const address = step.address ?? step.closure?.root;
-      if (!address)
-        return {
-          outcome: "execution-failed",
-          detail: `managed step ${step.stepKey} has no address`
-        };
-      const plannedClaimKey = step.plannedClaimKeys[0];
-      if (!plannedClaimKey)
-        return {
-          outcome: "execution-failed",
-          detail: `managed step ${step.stepKey} has no planned claim key`
-        };
-      if (step.classification === "non-destructive" && step.requiresVacancy && await alreadyAppliedCreation(input.pool, address)) {
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const claimKind = step.claimKind;
-      const rootClaimId = outcomeClaimId(executionId, plannedClaimKey, address);
-      const claim = {
-        claimId: rootClaimId,
-        claimSpecies: "sql-bearing",
-        executionId,
-        plannedClaimKey,
-        claimGroupId: rootClaimId,
-        rootClaimId,
-        address,
-        claimKind,
-        statementBundle: step.statementBundle,
-        requiresVacancy: step.requiresVacancy
-      };
-      const baseReservation = {
-        address,
-        claimKind,
-        executionId,
-        rootClaimId: claim.claimId,
-        homeLedger: home(address)
-      };
-      if (step.classification === "non-destructive") {
-        const result = await executePgAdmittedOperation(input.pool, {
-          run: input.run,
-          approval,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          operation: {
-            kind: "single-outcome",
-            request: {
-              plan: claim,
-              reservations: [baseReservation],
-              resolution: {
-                eventId: outcomeClaimEventId(claim.claimId, "observed"),
-                eventKind: "observed"
-              },
-              // Transactional DDL is visible only on the admitted session until
-              // its terminal ledger fact commits with it.
-              readBack: async (session) => readGeneratedPostcondition(session, step, address),
-              recordCatalogueIdentity: true,
-              ...input.observer === void 0 ? {} : { observer: input.observer },
-              vacancy: async (executor) => await readPgCatalogueIdentity(executor, address) ? {
-                kind: "occupied",
-                reason: `creation claim ${claim.claimId} refuses occupied live address ${address.name}`
-              } : { kind: "vacant" }
-            }
-          }
-        });
-        if (result.kind === "outcome-recovery-required")
-          return {
-            outcome: "recovery-required",
-            claimId: result.claimId,
-            detail: `claim ${result.claimId} remains open and requires recovery: ${result.reason}`
-          };
-        if ("reason" in result) return partial(result.reason);
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const containment = step.classification === "removal" ? await removalContainment(input.pool, address) : void 0;
-      const closureMembers = /* @__PURE__ */ new Map();
-      for (const member of step.closure?.members ?? []) {
-        closureMembers.set(ledgerAddressKey(member.address), {
-          address: member.address,
-          plannedClaimKey: member.plannedClaimKey
-        });
-      }
-      if (containment?.kind === "all-contained-or-managed") {
-        for (const effect of containment.effects) {
-          if (effect.internalOwned) continue;
-          if (!containedBy(address, effect.address)) continue;
-          if (!await managed(input.pool, effect.address)) continue;
-          const key = ledgerAddressKey(effect.address);
-          if (closureMembers.has(key)) continue;
-          closureMembers.set(key, {
-            address: effect.address,
-            plannedClaimKey: `closure:${effect.address.kind}:${effect.address.name}`
-          });
-        }
-      }
-      const containedClaims = [];
-      for (const member of closureMembers.values()) {
-        const effect = member.address;
-        const childClaimId = outcomeClaimId(
-          executionId,
-          plannedClaimKey,
-          effect,
-          member.plannedClaimKey
-        );
-        const childReservation = {
-          ...baseReservation,
-          address: effect,
-          rootClaimId: claim.claimId
-        };
-        containedClaims.push({
-          plan: {
-            ...claim,
-            claimId: childClaimId,
-            claimSpecies: "cascade-covered",
-            address: effect,
-            plannedClaimKey: member.plannedClaimKey,
-            // Each member contributes only its terminal absence fact; SQL is
-            // exclusively carried by the destructive root manifest claim.
-            statementBundle: { statements: [] }
-          },
-          reservation: childReservation
-        });
-      }
-      const admitRequest = {
-        plan: claim,
-        reservations: [baseReservation],
-        members: containedClaims.map(({ plan, reservation }) => ({
-          plan,
-          reservations: [reservation]
-        })),
-        destructiveDecision: async (executor) => {
-          const lockedAuthority = await destructiveEvidence({
-            executor,
-            address,
-            classification: step.classification,
-            selection: step.selection,
-            planDigest: input.planDigest,
-            approval
-          });
-          if (step.classification === "removal" && (containment?.kind !== "all-contained-or-managed" || lockedAuthority.containment?.kind !== "all-contained-or-managed" || containment.closureDigest !== lockedAuthority.containment.closureDigest)) {
-            destructiveClosureReplanRequired = true;
-            const decision2 = decideDestructiveDecision(
-              { kind: "removal", address },
-              { ...lockedAuthority.evidence, containment: "undecidable" }
-            );
-            if (decision2.kind === "destructive-decision-refused")
-              destructiveRefusal = {
-                withheldAuthority: withheldDestructiveAuthority({
-                  ...lockedAuthority.evidence,
-                  containment: "undecidable"
-                }) ?? "destructive containment authority"
-              };
-            return decision2;
-          }
-          const decision = decideDestructiveDecision(
-            {
-              kind: step.classification === "removal" ? "removal" : "data-destructive",
-              address,
-              ...step.classification === "removal" && lockedAuthority.containment?.kind === "all-contained-or-managed" ? { closureDigest: lockedAuthority.containment.closureDigest } : {}
-            },
-            lockedAuthority.evidence
-          );
-          if (decision.kind === "destructive-decision-refused")
-            destructiveRefusal = {
-              withheldAuthority: withheldDestructiveAuthority(lockedAuthority.evidence) ?? "destructive authority"
-            };
-          return decision;
-        },
-        ...input.observer === void 0 ? {} : { observer: input.observer }
-      };
-      const executed = await executePgAdmittedOperation(input.pool, {
-        run: input.run,
-        approval,
-        manifest,
-        recomputedPlanDigest: input.planDigest,
-        operation: {
-          kind: "destructive-outcome",
-          request: admitRequest,
-          readBackAndResolve: async (session) => {
-            const live = await readPgCatalogueIdentity(session, address);
-            const survivors = step.classification === "removal" && live ? [address] : [];
-            const childLives = await Promise.all(
-              containedClaims.map(async (child) => ({
-                child,
-                live: await readPgCatalogueIdentity(
-                  session,
-                  child.plan.address
-                )
-              }))
-            );
-            for (const { child, live: childLive } of childLives)
-              if (childLive) survivors.push(child.plan.address);
-            if (survivors.length > 0) {
-              const survivorNames = survivors.map(
-                (survivor) => `${survivor.kind} ${survivor.schema ?? "<database>"}.${survivor.name}`
-              );
-              const survivorObservation = {
-                value: { survivors: survivorNames },
-                digest: createHash("sha256").update(JSON.stringify(survivorNames)).digest("hex")
-              };
-              return {
-                rootClaimId: claim.claimId,
-                members: [
-                  {
-                    target: home(address),
-                    member: {
-                      eventId: outcomeClaimEventId(
-                        claim.claimId,
-                        "indeterminate"
-                      ),
-                      executionId,
-                      plannedClaimKey: claim.plannedClaimKey,
-                      claimGroupId: claim.claimGroupId,
-                      rootClaimId: claim.rootClaimId,
-                      address,
-                      eventKind: "indeterminate",
-                      observed: survivorObservation
-                    }
-                  },
-                  ...containedClaims.map((child) => ({
-                    target: home(child.plan.address),
-                    member: {
-                      eventId: outcomeClaimEventId(
-                        child.plan.claimId,
-                        "indeterminate"
-                      ),
-                      executionId,
-                      plannedClaimKey: child.plan.plannedClaimKey,
-                      claimGroupId: claim.claimId,
-                      rootClaimId: claim.claimId,
-                      address: child.plan.address,
-                      eventKind: "indeterminate",
-                      observed: survivorObservation
-                    }
-                  }))
-                ],
-                reservations: [
-                  baseReservation,
-                  ...containedClaims.map(({ reservation }) => reservation)
-                ]
-              };
-            }
-            const terminals = [
-              {
-                target: home(address),
-                member: {
-                  eventId: outcomeClaimEventId(
-                    claim.claimId,
-                    step.classification === "removal" ? "absent" : "observed"
-                  ),
-                  executionId,
-                  plannedClaimKey: claim.plannedClaimKey,
-                  claimGroupId: claim.claimGroupId,
-                  rootClaimId: claim.rootClaimId,
-                  address,
-                  eventKind: step.classification === "removal" ? "absent" : "observed",
-                  // The append protocol reads this address's terminal on its
-                  // pinned transaction session after the post-DDL read-back.
-                  ...live?.catalogueIdentity ? { catalogueIdentity: live.catalogueIdentity } : {},
-                  ...step.classification === "removal" ? {} : { observed: observed(address) }
-                }
-              }
-            ];
-            for (const child of containedClaims) {
-              terminals.push({
-                target: home(child.plan.address),
-                member: {
-                  eventId: outcomeClaimEventId(child.plan.claimId, "absent"),
-                  executionId,
-                  plannedClaimKey: child.plan.plannedClaimKey,
-                  claimGroupId: claim.claimId,
-                  rootClaimId: claim.claimId,
-                  address: child.plan.address,
-                  eventKind: "absent",
-                  predecessor: child.plan.claimId
-                }
-              });
-            }
-            return {
-              rootClaimId: claim.claimId,
-              members: terminals,
-              reservations: [
-                baseReservation,
-                ...containedClaims.map(({ reservation }) => reservation)
-              ]
-            };
-          }
-        }
-      });
-      if (executed.kind === "outcome-recovery-required")
-        return {
-          outcome: "recovery-required",
-          claimId: executed.claimId,
-          detail: `claim ${executed.claimId} remains open and requires recovery: ${executed.reason}`
-        };
-      if (executed.kind === "outcome-transport-ambiguous")
-        return {
-          outcome: "execution-failed",
-          detail: executed.reason
-        };
-      if (executed.kind === "outcome-protocol-pending")
-        return partial(
-          `destructive claim ${claim.claimId} remains pending after executing: ${executed.reason}`
-        );
-      if (executed.kind !== "executed-destructive-outcome")
-        return {
-          outcome: "destructive-authority-refused",
-          detail: destructiveClosureReplanRequired ? `${executed.reason}; destructive closure changed under lock; replan required` : executed.reason,
-          ...destructiveRefusal === void 0 && withheldDestructiveAuthorityFromReason(executed.reason) === void 0 ? {} : {
-            refusal: destructiveRefusal ?? {
-              withheldAuthority: withheldDestructiveAuthorityFromReason(executed.reason) ?? "destructive authority"
-            }
-          }
-        };
-      completedStepKeys.push(step.stepKey);
-    }
-    return { outcome: "completed" };
-  } catch (error) {
-    return partial(error instanceof Error ? error.message : String(error));
-  }
-}
-
 // src/commands/generator-plan.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
 import {
   assertDeclarableChangeKind,
   classifyGeneratedMutation,
   comparePgsqlDatabaseSchema,
-  createPgsqlAdapter as createPgsqlAdapter2,
+  createPgPhysicalModel,
+  createPgsqlAdapter,
   createPgsqlGeneratedManagedStep,
   createPgTransitionLessor,
   createPgTransitionRunPersister,
   generatedPostconditionForChange,
   generateMigrationSQL,
-  readPgCatalogueIdentity as readPgCatalogueIdentity2,
+  ReferencedKeyRemovalError,
+  readPgCatalogueIdentity,
   renderPgTableReaddressStatements
 } from "@dbsp/adapter-pgsql";
+import {
+  collectReferencedKeyRemovalConflicts,
+  comparePgsqlDeclaredAdoptionSchema,
+  createPgsqlDeclaredAdoptionStep,
+  generateMigrationSQL as generateMigrationSQLForPhysicalDiff,
+  modelForDeclaredAdoption,
+  pgsqlDeclaredAdoptionDeclaration
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireTransitionLease,
+  canonicalJsonDigest,
   transitionPlanDigest,
-  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest2
+  validateNormalizedManagedStepManifest
 } from "@dbsp/core";
-function digest(value) {
-  return createHash2("sha256").update(JSON.stringify(value)).digest("hex");
-}
-function adoptionDeclaration(table) {
-  const value = JSON.parse(
-    JSON.stringify({ kind: "table", name: table.name, shape: table })
-  );
-  return { value, digest: digest(value) };
+function decodeGeneratorPlanMaterial(material) {
+  if (material === null || typeof material !== "object" || Array.isArray(material) || !("kind" in material) || material.kind !== "schema-differ-generator")
+    throw new Error("persisted generator material has an invalid kind");
+  const dbCasing = "dbCasing" in material ? material.dbCasing : void 0;
+  if (dbCasing !== void 0 && dbCasing !== "snake_case" && dbCasing !== "camelCase")
+    throw new Error("persisted generator material has an invalid dbCasing");
+  return {
+    ...material,
+    dbCasing: dbCasing ?? "preserve"
+  };
 }
 function replacementStatements(table, schema) {
   const quote = (value) => `"${value.replaceAll('"', '""')}"`;
@@ -1008,7 +126,7 @@ function replacementStatements(table, schema) {
   };
   return {
     retireStatements: [`DROP TABLE ${quote(schema)}.${quote(table.name)}`],
-    createStatements: generateMigrationSQL(createDiff, {
+    createStatements: generateMigrationSQLForPhysicalDiff(createDiff, {
       includeDestructive: true,
       schemaName: schema
     })
@@ -1127,6 +245,65 @@ function changeTargetsDeclaredTable(change, table) {
     "alter_sequence"
   ])).has(change.kind);
 }
+function getGeneratorPhase(kind) {
+  switch (kind) {
+    case "drop_foreign_key":
+    case "drop_check_constraint":
+      return 0;
+    case "drop_index":
+      return 1;
+    case "drop_column":
+      return 2;
+    case "drop_primary_key":
+      return 3;
+    case "drop_table":
+    case "drop_enum":
+    case "drop_extension":
+    case "drop_sequence":
+      return 4;
+    case "create_enum":
+    case "create_extension":
+    case "create_sequence":
+      return 5;
+    case "create_table":
+    case "readdress_table":
+      return 6;
+    case "add_column":
+      return 7;
+    case "alter_sequence":
+    case "alter_column_type":
+    case "alter_column_nullable":
+    case "alter_column_default":
+    case "alter_column_collation":
+    case "alter_column_identity":
+    case "alter_column_auto_increment":
+      return 8;
+    case "alter_column_unique":
+    case "add_primary_key":
+      return 9;
+    case "create_index":
+      return 10;
+    case "add_foreign_key":
+      return 11;
+    case "alter_foreign_key":
+      return 12;
+    case "add_check_constraint":
+      return 13;
+    case "alter_enum_add_value":
+      return 14;
+    case "add_comment":
+    case "drop_comment":
+      return 15;
+    case "validate_constraint":
+      return 16;
+    case "enable_rls":
+    case "disable_rls":
+      return 17;
+    case "create_policy":
+    case "drop_policy":
+      return 18;
+  }
+}
 function requiredAdoptionIdentity(identities, table) {
   const identity = identities.get(table);
   if (!identity)
@@ -1134,7 +311,7 @@ function requiredAdoptionIdentity(identities, table) {
   return identity;
 }
 function asDurableGeneratorPlan(material, steps) {
-  const validation = validateNormalizedManagedStepManifest2(steps);
+  const validation = validateNormalizedManagedStepManifest(steps);
   if (!validation.ok)
     throw new Error(
       `generator planning refuses invalid managed-step manifest: ${validation.detail}`
@@ -1169,7 +346,7 @@ function render(plan, planDigest) {
     ]
   ].join("\n");
 }
-async function databaseId2(pool) {
+async function databaseId(pool) {
   const result = await pool.query("SELECT current_database() AS database_id");
   const value = result.rows[0]?.database_id;
   if (typeof value !== "string" || value.length === 0)
@@ -1180,19 +357,39 @@ async function databaseId2(pool) {
 }
 async function runGeneratorPlan(input) {
   const loaded = await loadSchema(input.schemaFile);
+  for (const sequence of loaded.model.sequences?.values() ?? []) {
+    if (sequence.adopt === true)
+      throw new Error(
+        `generator planning refuses sequence adoption for ${sequence.name}: sequence adoption is available through convergePg / dbsp migrate`
+      );
+  }
+  const schema = input.schema ?? "public";
+  const dbCasing = loaded.dbCasing ?? "preserve";
+  const physical = createPgPhysicalModel({
+    mode: "logical",
+    model: loaded.model,
+    schema,
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
+  const physicalTable = (name) => physical.inventory.get({ kind: "table", schema, name });
+  for (const table of loaded.model.tables.values()) {
+    if (table.replace !== true) continue;
+    const physicalName = physicalTable(table.name);
+    if (physicalName !== table.name)
+      throw new Error(
+        `generator planning refuses replacement ${table.name}: dbCasing addresses physical table ${physicalName}; replacement requires preserve casing`
+      );
+  }
   const { pool } = await createDbConnection(input.db);
   try {
-    const schema = input.schema ?? "public";
     const diff = await comparePgsqlDatabaseSchema(
-      createPgsqlAdapter2(pool),
-      loaded.model,
+      createPgsqlAdapter(pool),
+      physical,
       {
-        schema,
         // `apply --schema` owns one schema. Extensions are database-scoped,
         // so an extension not declared by this schema must not become a
         // schema-plan removal merely because it is installed in the database.
-        ignoreUnmanagedExtensions: true,
-        ...loaded.dbCasing ? { dbCasing: loaded.dbCasing } : {}
+        ignoreUnmanagedExtensions: true
       }
     );
     const declaredLifecycleWork = [...loaded.model.tables.values()].some(
@@ -1221,39 +418,57 @@ async function runGeneratorPlan(input) {
         planDigest: null
       };
     }
-    const adoptionMismatches = new Set(
-      [...loaded.model.tables.values()].filter(
-        (table) => table.adopt === true && diff.changes.some(
-          (change) => changeTargetsDeclaredTable(change, table.name)
-        )
-      ).map((table) => table.name)
-    );
-    const database = await databaseId2(pool);
+    const adoptionPhysicalNames = /* @__PURE__ */ new Map();
+    const adoptionMismatches = /* @__PURE__ */ new Set();
+    for (const table of loaded.model.tables.values()) {
+      if (table.adopt !== true) continue;
+      const physicalName = physicalTable(table.name);
+      adoptionPhysicalNames.set(table.name, physicalName);
+      const compared = await comparePgsqlDeclaredAdoptionSchema({
+        executor: pool,
+        model: modelForDeclaredAdoption(table),
+        schema,
+        dbCasing
+      });
+      if (compared.changes.length > 0) adoptionMismatches.add(physicalName);
+    }
+    const database = await databaseId(pool);
     const adoptionIdentities = /* @__PURE__ */ new Map();
     for (const table of loaded.model.tables.values()) {
-      if (table.adopt !== true || adoptionMismatches.has(table.name)) continue;
-      const live = await readPgCatalogueIdentity2(pool, {
+      const physicalName = adoptionPhysicalNames.get(table.name);
+      if (table.adopt !== true || physicalName === void 0 || adoptionMismatches.has(physicalName))
+        continue;
+      const live = await readPgCatalogueIdentity(pool, {
         engine: "postgresql",
         database,
         schema: input.schema ?? "public",
         kind: "table",
-        name: table.name
+        name: physicalName
       });
       if (!live?.catalogueIdentity)
         throw new Error(
-          `declared adoption for ${table.name} refuses absent live identity`
+          `declared adoption for ${physicalName} refuses absent live identity`
         );
-      adoptionIdentities.set(table.name, live.catalogueIdentity);
+      adoptionIdentities.set(physicalName, live.catalogueIdentity);
     }
     const executableDiff = {
       ...diff,
       changes: diff.changes.filter(
         (change) => ![...loaded.model.tables.values()].some(
-          (table) => (table.adopt === true || table.replace === true) && changeTargetsDeclaredTable(change, table.name)
+          (table) => (table.adopt === true || table.replace === true) && changeTargetsDeclaredTable(
+            change,
+            table.adopt === true ? adoptionPhysicalNames.get(table.name) ?? table.name : table.name
+          )
         )
       )
     };
-    const ordinaryChanges = executableDiff.changes.map((change) => ({
+    const phaseOrderedChanges = [...executableDiff.changes].sort(
+      (left, right) => getGeneratorPhase(left.kind) - getGeneratorPhase(right.kind)
+    );
+    const referencedKeyConflicts = collectReferencedKeyRemovalConflicts(phaseOrderedChanges);
+    if (referencedKeyConflicts.length > 0)
+      throw new ReferencedKeyRemovalError(referencedKeyConflicts);
+    const ordinaryChanges = phaseOrderedChanges.map((change) => ({
       kind: change.kind,
       table: change.table,
       ...change.column ? { column: change.column } : {},
@@ -1264,45 +479,54 @@ async function runGeneratorPlan(input) {
         schema,
         change.meta.readdress
       ) : generateMigrationSQL(
-        { ...executableDiff, changes: [change] },
-        { includeDestructive: true, schemaName: schema }
+        { ...executableDiff, physical: diff.physical, changes: [change] },
+        { includeDestructive: true }
       ),
       ...change.kind === "readdress_table" && change.meta?.readdress ? { readdress: change.meta.readdress } : {}
     }));
     const material = {
       kind: "schema-differ-generator",
       planningSchema: schema,
+      ...dbCasing === "preserve" ? {} : { dbCasing },
       changes: [
         ...ordinaryChanges,
-        ...[...loaded.model.tables.values()].filter((table) => adoptionMismatches.has(table.name)).map((table) => ({
-          kind: "adoption_refused",
-          table: table.name,
-          classification: "non-destructive",
-          details: `Refuse adoption of table "${table.name}": live shape does not match declaration`,
-          statements: []
-        })),
-        // `comparePgsqlDatabaseSchema` has just compared each side through
-        // the established live canonicalisation path. An adopted table is
-        // admitted only when that comparison has no remaining change for it.
-        ...[...loaded.model.tables.values()].filter(
-          (table) => table.adopt === true && !diff.changes.some(
-            (change) => changeTargetsDeclaredTable(change, table.name)
-          )
-        ).map((table) => ({
-          kind: "adopt_table",
-          table: table.name,
-          classification: "non-destructive",
-          details: `Adopt existing table "${table.name}" after live shape match`,
-          statements: [],
-          adoption: {
-            declaration: adoptionDeclaration(table),
-            shape: table,
-            catalogueIdentity: requiredAdoptionIdentity(
-              adoptionIdentities,
-              table.name
-            )
-          }
-        })),
+        ...[...loaded.model.tables.values()].flatMap((table) => {
+          const physicalName = adoptionPhysicalNames.get(table.name);
+          if (physicalName === void 0 || !adoptionMismatches.has(physicalName))
+            return [];
+          return [
+            {
+              kind: "adoption_refused",
+              table: physicalName,
+              classification: "non-destructive",
+              details: `Refuse adoption of table "${physicalName}": live shape does not match declaration`,
+              statements: []
+            }
+          ];
+        }),
+        // Adoption is admitted only by its declaration-scoped comparison.
+        ...[...loaded.model.tables.values()].flatMap((table) => {
+          const physicalName = adoptionPhysicalNames.get(table.name);
+          if (table.adopt !== true || physicalName === void 0 || adoptionMismatches.has(physicalName))
+            return [];
+          return [
+            {
+              kind: "adopt_table",
+              table: physicalName,
+              classification: "non-destructive",
+              details: `Adopt existing table "${physicalName}" after live shape match`,
+              statements: [],
+              adoption: {
+                declaration: pgsqlDeclaredAdoptionDeclaration(table),
+                shape: table,
+                catalogueIdentity: requiredAdoptionIdentity(
+                  adoptionIdentities,
+                  physicalName
+                )
+              }
+            }
+          ];
+        }),
         ...[...loaded.model.tables.values()].filter((table) => table.replace === true).map((table) => ({
           kind: "replace_table",
           table: table.name,
@@ -1314,7 +538,7 @@ async function runGeneratorPlan(input) {
       ]
     };
     const ordinaryStepSources = [];
-    for (const [changeIndex, change] of executableDiff.changes.entries()) {
+    for (const [changeIndex, change] of phaseOrderedChanges.entries()) {
       const generated = ordinaryChanges[changeIndex];
       if (!generated)
         throw new Error(
@@ -1431,18 +655,27 @@ async function runGeneratorPlan(input) {
         continue;
       }
       if (change.kind === "adopt_table" && change.adoption) {
-        lifecycleSteps.push(
-          lifecycleStep({
-            ...base,
-            stepKey: `generator:${base.order}:adoption`,
-            classification: "non-destructive",
-            selection: { kind: "adoption", selector: `table:${change.table}` },
-            expectedDeclaration: change.adoption.declaration,
-            expectedCatalogueIdentity: change.adoption.catalogueIdentity,
-            claimKind: "adopt-intent",
-            lifecycle: { kind: "adoption", shape: change.adoption.shape }
-          })
-        );
+        const adoptionStep = createPgsqlDeclaredAdoptionStep({
+          address: {
+            scope: "schema",
+            engine: "postgresql",
+            database,
+            schema,
+            kind: "table",
+            name: change.table
+          },
+          table: change.adoption.shape,
+          stepKey: `generator:${base.order}:adoption`,
+          order: base.order,
+          catalogueIdentity: change.adoption.catalogueIdentity
+        });
+        lifecycleSteps.push({
+          ...adoptionStep,
+          selection: {
+            kind: "adoption",
+            selector: `table:${change.table}`
+          }
+        });
         continue;
       }
       lifecycleSteps.push(
@@ -1479,10 +712,13 @@ async function runGeneratorPlan(input) {
       plan
     );
     const run = {
-      runId: `dbsp-generator-${randomUUID2()}`,
+      runId: `dbsp-generator-${randomUUID()}`,
       planDigest,
-      targetContextDigest: digest({ database: await databaseId2(pool), schema }),
-      databaseId: await databaseId2(pool),
+      targetContextDigest: canonicalJsonDigest({
+        database: await databaseId(pool),
+        schema
+      }),
+      databaseId: await databaseId(pool),
       coreVersion: "schema-differ-generator-v1",
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       replayability: material.changes.some(
@@ -1521,20 +757,25 @@ async function runGeneratorPlan(input) {
 import {
   acquirePgTransitionClient,
   createPgExecutionContract,
-  createPgsqlAdapter as createPgsqlAdapter3,
+  createPgPhysicalModel as createPgPhysicalModel2,
+  createPgsqlAdapter as createPgsqlAdapter2,
   createPgTransitionLessor as createPgTransitionLessor2,
   createPgTransitionPack,
   createPgTransitionRunPersister as createPgTransitionRunPersister2,
   ensureTransitionJournal,
   escapeDiagnosticText,
-  getNamingPluginForDbCasing,
   PgExecutionContractDerivationError,
   pgTargetIdentityMismatch,
   readPgExecutionTargetFromClient,
   readPgObservationContextFromLessor
 } from "@dbsp/adapter-pgsql";
+import {
+  PgTransitionRunPersistenceIndeterminateError,
+  planPgTransitionRun
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireTransitionLease as acquireTransitionLease2,
+  assertCanonicalizableJson,
   bindDeclarationSet,
   bindExecutionContract,
   createComparator,
@@ -1545,6 +786,7 @@ import {
   validateDeclarationModel
 } from "@dbsp/core";
 import { Command } from "commander";
+var planPhysicalPgTransitionRun = planPgTransitionRun;
 var PlanPersistenceIndeterminateError = class extends Error {
   runId;
   result;
@@ -1594,6 +836,15 @@ var PlanOperationAndCleanupError = class extends AggregateError {
   cleanupError;
 };
 var noCleanupFailure = { kind: "not-failed" };
+function validateSourceDeclarationValues(model) {
+  for (const [tableKey, table] of model.tables)
+    for (const [index, column] of table.columns.entries())
+      if (column.default !== void 0)
+        assertCanonicalizableJson(
+          column.default,
+          `schema.tables[${JSON.stringify(tableKey)}].columns[${index}].default`
+        );
+}
 function equivalenceContext(context) {
   return {
     engine: context.engine,
@@ -1674,20 +925,20 @@ var defaultPlanDeps = {
   async loadCurrent(pool, schema, expectedTargetIdentity) {
     const lease = await acquirePgTransitionClient(pool);
     try {
-      const observed2 = await readPgExecutionTargetFromClient(
+      const observed = await readPgExecutionTargetFromClient(
         lease.client,
         [schema ?? "public"]
       );
       const mismatch = pgTargetIdentityMismatch(
         expectedTargetIdentity,
-        observed2.identity
+        observed.identity
       );
       if (mismatch) {
         throw new Error(
           `PostgreSQL introspection target identity does not match the captured target: ${mismatch}`
         );
       }
-      return await createPgsqlAdapter3(lease.client, {
+      return await createPgsqlAdapter2(lease.client, {
         borrowedClient: true
       }).introspect(schema === void 0 ? {} : { schema });
     } finally {
@@ -1702,18 +953,14 @@ var defaultPlanDeps = {
       expectedTargetIdentity
     );
   },
-  createPlanner(loaded) {
-    const registry2 = createPackRegistry([
-      createPgTransitionPack({
-        ...loaded.dbCasing ? { dbCasing: loaded.dbCasing } : {}
-      })
-    ]);
-    const comparator = createComparator(registry2);
-    const prover = createProver(registry2);
+  createPlanner() {
+    const registry = createPackRegistry([createPgTransitionPack()]);
+    const comparator = createComparator(registry);
+    const prover = createProver(registry);
     return {
       compare: (desired, current, context) => comparator.compare(desired, current, equivalenceContext(context)),
       prove: (compare, pool, context) => prover.prove(compare, createPgTransitionLessor2(pool), context),
-      render: (plan, context) => renderProvenPlanSql(registry2, plan, context)
+      render: (plan, context) => renderProvenPlanSql(registry, plan, context)
     };
   },
   async persist(pool, run, plan) {
@@ -1748,9 +995,9 @@ function executionContractBlockedAssessment(error) {
     ]
   };
 }
-function renderProvenPlanSql(registry2, plan, context) {
+function renderProvenPlanSql(registry, plan, context) {
   const statements = plan.steps.map((step) => {
-    const resolution = registry2.resolveOperation(step.operation);
+    const resolution = registry.resolveOperation(step.operation);
     if (!resolution.ok || !resolution.semantics.renderPlanSql) {
       throw new Error(
         `no SQL renderer is registered for proven operation ${step.operation.operationKind.name}`
@@ -1770,126 +1017,170 @@ async function runPlan(options, overrides) {
     throw new Error(`unsupported plan format ${format}; expected sql or json`);
   }
   const loaded = await deps.loadSchema(options.schemaFile);
-  validateDeclarationModel(loaded.model);
+  validateSourceDeclarationValues(loaded.model);
+  const physical = createPgPhysicalModel2({
+    mode: "logical",
+    model: loaded.model,
+    schema: options.schema ?? "public",
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
+  validateDeclarationModel(physical.model);
   const connection = await deps.createDbConnection(options.db);
   const { pool } = connection;
   let result;
+  let renderedSql;
   let operationError;
   let failed = false;
   try {
-    const targetIdentity = await deps.captureTargetIdentity(
-      pool,
-      options.schema
-    );
-    await deps.ensureTransitionJournal(pool);
-    const current = await deps.loadCurrent(
-      pool,
-      options.schema,
-      targetIdentity
-    );
-    const context = await deps.readContext(
-      pool,
-      options.schema,
-      targetIdentity
-    );
-    const planner = deps.createPlanner(loaded);
-    const compare = planner.compare(loaded.model, current, context);
-    const prove = await planner.prove(compare, pool, context);
-    if (prove.kind === "proven") {
-      let executionContract;
-      try {
-        executionContract = await deps.buildExecutionContract(
-          pool,
-          options.schema,
-          prove.plan,
-          targetIdentity
-        );
-      } catch (error) {
-        if (!(error instanceof PgExecutionContractDerivationError)) throw error;
+    if (overrides === void 0) {
+      const lifecycle = await planPhysicalPgTransitionRun(
+        physical,
+        async (client, schema) => createPgsqlAdapter2(client, {
+          borrowedClient: true
+        }).introspect(schema === void 0 ? {} : { schema }),
+        pool,
+        {
+          persist: options.dryRun !== true,
+          beforePersist: async (plan, proofContext) => {
+            renderedSql = deps.createPlanner().render(plan, proofContext);
+          }
+        }
+      );
+      if (lifecycle.kind === "proven") {
+        if (renderedSql === void 0)
+          throw new Error("internal error: durable plan SQL was not rendered");
         result = {
-          compareKind: compare.kind,
-          proveKind: "blocked",
-          assessment: executionContractBlockedAssessment(error),
+          compareKind: lifecycle.compare.kind,
+          proveKind: "proven",
+          assessment: lifecycle.assessment,
+          persisted: options.dryRun !== true,
+          runId: options.dryRun === true ? null : lifecycle.run.runId,
+          planDigest: lifecycle.run.planDigest,
+          plan: lifecycle.plan,
+          sql: renderedSql
+        };
+      } else {
+        result = {
+          compareKind: lifecycle.compare.kind,
+          proveKind: lifecycle.kind,
+          assessment: lifecycle.assessment,
           persisted: false,
           runId: null,
           planDigest: null
         };
       }
-      if (executionContract !== void 0) {
-        const contractedPlan = bindExecutionContract(
-          prove.plan,
-          executionContract
-        );
-        const durablePlan = bindDeclarationSet(
-          contractedPlan,
-          declarationSetFromModel(
-            loaded.model,
-            {
+    } else {
+      const targetIdentity = await deps.captureTargetIdentity(
+        pool,
+        physical.schema
+      );
+      await deps.ensureTransitionJournal(pool);
+      const current = await deps.loadCurrent(
+        pool,
+        physical.schema,
+        targetIdentity
+      );
+      const context = await deps.readContext(
+        pool,
+        physical.schema,
+        targetIdentity
+      );
+      const planner = deps.createPlanner();
+      const compare = planner.compare(physical.model, current, context);
+      const prove = await planner.prove(compare, pool, context);
+      if (prove.kind === "proven") {
+        let executionContract;
+        try {
+          executionContract = await deps.buildExecutionContract(
+            pool,
+            physical.schema,
+            prove.plan,
+            targetIdentity
+          );
+        } catch (error) {
+          if (!(error instanceof PgExecutionContractDerivationError))
+            throw error;
+          result = {
+            compareKind: compare.kind,
+            proveKind: "blocked",
+            assessment: executionContractBlockedAssessment(error),
+            persisted: false,
+            runId: null,
+            planDigest: null
+          };
+        }
+        if (executionContract !== void 0) {
+          const contractedPlan = bindExecutionContract(
+            prove.plan,
+            executionContract
+          );
+          const durablePlan = bindDeclarationSet(
+            contractedPlan,
+            declarationSetFromModel(physical.model, {
               engine: context.engine,
               database: context.databaseId,
-              schema: options.schema ?? "public"
-            },
-            getNamingPluginForDbCasing(loaded.dbCasing ?? "preserve")
-          )
-        );
-        const run = createTransitionRunMetadata(durablePlan);
-        const proofContext = prove.plan.observations.find(
-          (observation) => observation.role === "evidence"
-        )?.context;
-        if (!proofContext) {
-          throw new Error(
-            "internal error: minted proven plan has no evidence observation context"
+              schema: physical.schema
+            })
           );
-        }
-        const sql = planner.render(durablePlan, proofContext);
-        if (!options.dryRun) {
-          try {
-            await deps.persist(pool, run, durablePlan);
-          } catch (error) {
-            throw new PlanPersistenceIndeterminateError(
-              {
-                compareKind: compare.kind,
-                proveKind: prove.kind,
-                assessment: prove.assessment,
-                persisted: "indeterminate",
-                runId: run.runId,
-                planDigest: run.planDigest
-              },
-              error
+          const run = createTransitionRunMetadata(durablePlan);
+          const proofContext = prove.plan.observations.find(
+            (observation) => observation.role === "evidence"
+          )?.context;
+          if (!proofContext) {
+            throw new Error(
+              "internal error: minted proven plan has no evidence observation context"
             );
           }
+          const sql = planner.render(durablePlan, proofContext);
+          if (!options.dryRun) {
+            try {
+              await deps.persist(pool, run, durablePlan);
+            } catch (error) {
+              throw new PlanPersistenceIndeterminateError(
+                {
+                  compareKind: compare.kind,
+                  proveKind: prove.kind,
+                  assessment: prove.assessment,
+                  persisted: "indeterminate",
+                  runId: run.runId,
+                  planDigest: run.planDigest
+                },
+                error
+              );
+            }
+          }
+          result = {
+            compareKind: compare.kind,
+            proveKind: prove.kind,
+            assessment: prove.assessment,
+            persisted: !options.dryRun,
+            runId: options.dryRun ? null : run.runId,
+            planDigest: run.planDigest,
+            plan: durablePlan,
+            sql
+          };
         }
+      }
+      if (prove.kind === "no-drift") {
         result = {
           compareKind: compare.kind,
           proveKind: prove.kind,
           assessment: prove.assessment,
-          persisted: !options.dryRun,
-          runId: options.dryRun ? null : run.runId,
-          planDigest: run.planDigest,
-          plan: durablePlan,
-          sql
+          persisted: false,
+          runId: null,
+          planDigest: null
+        };
+      } else if (prove.kind !== "proven") {
+        result = {
+          compareKind: compare.kind,
+          proveKind: prove.kind,
+          assessment: prove.assessment,
+          persisted: false,
+          runId: null,
+          planDigest: null
         };
       }
     }
-    if (prove.kind === "no-drift") {
-      result = {
-        compareKind: compare.kind,
-        proveKind: prove.kind,
-        assessment: prove.assessment,
-        persisted: false,
-        runId: null,
-        planDigest: null
-      };
-    } else if (prove.kind !== "proven") {
-      result = {
-        compareKind: compare.kind,
-        proveKind: prove.kind,
-        assessment: prove.assessment,
-        persisted: false,
-        runId: null,
-        planDigest: null
-      };
-    }
   } catch (error) {
     failed = true;
     operationError = error;
@@ -1901,6 +1192,20 @@ async function runPlan(options, overrides) {
     cleanup = { kind: "failed", error };
   }
   if (failed) {
+    if (operationError instanceof PgTransitionRunPersistenceIndeterminateError) {
+      throw new PlanPersistenceIndeterminateError(
+        {
+          compareKind: operationError.compare.kind,
+          proveKind: "proven",
+          assessment: operationError.assessment,
+          persisted: "indeterminate",
+          runId: operationError.run.runId,
+          planDigest: operationError.run.planDigest
+        },
+        operationError.persistenceError,
+        cleanup
+      );
+    }
     if (operationError instanceof PlanPersistenceIndeterminateError) {
       throw new PlanPersistenceIndeterminateError(
         operationError.result,
@@ -2059,13 +1364,79 @@ function formatPreAppendRefusalHuman(line, refusal) {
     `resolving command: ${escapeDiagnosticText2(refusal.refusal.resolvingCommand)}`
   ].join("\n");
 }
-
-// src/commands/apply.ts
-function generatorRunHasPriorStepEvents(loaded) {
-  return loaded.events.some((event) => {
-    const executionId = event.event === "intent" && "executionId" in event.record ? event.record.executionId : void 0;
-    return !(typeof executionId === "string" && event.stepId === `dbsp.generator.attempt:${executionId}` && event.operationRef === "dbsp.generator.attempt");
-  });
+
+// src/commands/apply.ts
+function generatorRunHasPriorStepEvents(loaded) {
+  return loaded.events.some((event) => {
+    const executionId = event.event === "intent" && "executionId" in event.record ? event.record.executionId : void 0;
+    return !(typeof executionId === "string" && event.stepId === `dbsp.generator.attempt:${executionId}` && event.operationRef === "dbsp.generator.attempt");
+  });
+}
+function ledgerHomeForGeneratorAddress(address) {
+  if (address.scope === "database") return { scope: "database" };
+  if (!address.schema)
+    throw new Error(
+      `schema-scoped generated address ${address.name} has no schema ledger`
+    );
+  return { scope: "schema", schema: address.schema };
+}
+function generatorPlanLedgerAddresses(steps) {
+  const addresses = /* @__PURE__ */ new Map();
+  for (const step of steps) {
+    if (step.address !== void 0) {
+      addresses.set(ledgerAddressKey(step.address), step.address);
+      continue;
+    }
+    const closure = step.closure;
+    if (!closure)
+      throw new Error(`generated step ${step.stepKey} has no ledger address`);
+    const candidates = [
+      closure.root,
+      ...closure.members.map((member) => member.address)
+    ];
+    for (const address of candidates)
+      addresses.set(ledgerAddressKey(address), address);
+  }
+  return [...addresses.values()];
+}
+async function generatorRunHasLedgerEvidence(session, journal, steps) {
+  const executionIds = executionIdsForRun(journal);
+  const executionIdSet = new Set(executionIds);
+  const addresses = generatorPlanLedgerAddresses(steps);
+  const homes = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const home = ledgerHomeForGeneratorAddress(address);
+    homes.set(`${home.scope}:${home.schema ?? ""}`, home);
+  }
+  for (const home of homes.values()) {
+    for (const executionId of executionIds) {
+      const reservations = await readPgLedgerReservationsForExecution(
+        session,
+        home,
+        executionId
+      );
+      if (reservations.length > 0) return true;
+    }
+  }
+  for (const address of addresses) {
+    const chain = await readPgLedgerAddressChain(
+      session,
+      ledgerHomeForGeneratorAddress(address),
+      address
+    );
+    if (chain.events.some((event) => executionIdSet.has(event.executionId ?? "")))
+      return true;
+  }
+  return false;
+}
+async function generatorRunRequiresRecovery(target, journal, steps) {
+  if (generatorRunHasPriorStepEvents(journal)) return true;
+  const lease = await acquireExclusiveTransitionLease(target);
+  try {
+    return await generatorRunHasLedgerEvidence(lease.session, journal, steps);
+  } finally {
+    await lease.release();
+  }
 }
 var GENERATOR_ATTEMPT_OPERATION = {
   ref: "dbsp.generator.attempt",
@@ -2252,8 +1623,8 @@ function validateAssumptionAcceptance(value, path = "acceptance") {
   }
   return candidate;
 }
-function normaliseAcceptance(acceptance2) {
-  const validated = validateAssumptionAcceptance(acceptance2);
+function normaliseAcceptance(acceptance) {
+  const validated = validateAssumptionAcceptance(acceptance);
   const withinScope = validated.withinScope ? [
     ...new Map(
       validated.withinScope.map((item) => [canonicalJson(item), item])
@@ -2281,7 +1652,7 @@ function authorizationDigest(runId, planDigest, policy, grants, actor, authorize
   const authorizedInstant = new Date(authorizedAt);
   if (Number.isNaN(authorizedInstant.getTime()))
     throw new Error("authorization timestamp must be a valid instant");
-  return createHash3("sha256").update(
+  return createHash("sha256").update(
     canonicalJson({
       runId,
       planDigest,
@@ -2305,6 +1676,13 @@ function hasReusableAuthorization(authorizations, runId, planDigest, policy, gra
     )
   ) ?? false;
 }
+function acceptanceMatches(assumption, acceptance) {
+  return acceptance.class === assumption.class && (!acceptance.fromTrustRoot || canonicalJson(acceptance.fromTrustRoot) === canonicalJson(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance.withinScope || acceptance.withinScope.length === 0 : !acceptance.withinScope || acceptance.withinScope.length === 0 || assumption.scope.every(
+    (resource) => acceptance.withinScope?.some(
+      (selector) => selectorMatchesResource(selector, resource)
+    )
+  ));
+}
 async function effectiveApplyPolicy(options) {
   let fromFile = [];
   if (options.acceptPolicy) {
@@ -2329,9 +1707,6 @@ async function effectiveApplyPolicy(options) {
     )
   };
 }
-function registry() {
-  return createPackRegistry2([createPgTransitionPack2({})]);
-}
 var APPLY_OUTCOME_CONTRACT = [
   ["completed", 0, "all planned steps completed"],
   ["operation-failed-not-applied", 10, "operation failed before application"],
@@ -2370,7 +1745,7 @@ var APPLY_OUTCOME_CONTRACT = [
   [
     "prior-step-events-refusal",
     19,
-    "attempted runs must be classified by recover"
+    "attempted runs with prior generator step-attempt events must be classified by dbsp reconcile --db <database> <run-id>"
   ],
   [
     "compatibility-refusal",
@@ -2402,7 +1777,12 @@ var APPLY_OUTCOME_CONTRACT = [
   [
     "recovery-required",
     64,
-    "an admitted non-transactional claim remains open; run recover with the reported claim reference"
+    "an admitted claim remains open; run dbsp reconcile --db <database> <run-id>"
+  ],
+  [
+    "transport-ambiguous",
+    65,
+    "an admitted operation has an ambiguous transport outcome; reconcile the run before retrying"
   ],
   ["database-read-only", 34, "target cannot accept managed writes"],
   [
@@ -2455,6 +1835,7 @@ function exitCodeForApplyOutcome(outcome) {
   return applyExitCodes.get(outcome);
 }
 function outcomeForApplyResult(result) {
+  if (result.unresolvedOutcome) return result.unresolvedOutcome.kind;
   if (result.durableOutcome && isApplyExecutionOutcome(result.durableOutcome))
     return result.durableOutcome;
   if (result.assessment.lifecycle === "partially-applied")
@@ -2475,8 +1856,90 @@ function outcomeForApplyResult(result) {
     return "outcome-unknown";
   return "context-mismatch";
 }
+function generatorApplyCommandResult(execution, runId, refusal) {
+  const fields = refusal === void 0 ? {} : { refusal };
+  switch (execution.outcome) {
+    case "completed":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "partially-applied":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "selection-incomplete":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "adoption-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "readdress-unsupported":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "readdress-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "destructive-authority-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "prior-step-events-refusal":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "recovery-required":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "transport-ambiguous":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "execution-failed":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+  }
+}
 function formatApplyHuman(result) {
-  const line = `${result.outcome}: ${result.runId}`;
+  const line = `${escapeDiagnosticText3(result.outcome)}: ${escapeDiagnosticText3(result.runId)}`;
   if (result.refusal) {
     if ("address" in result.refusal)
       return formatPreAppendRefusalHuman(line, result.refusal);
@@ -2488,17 +1951,59 @@ function formatApplyHuman(result) {
       `resolving command: ${escapeDiagnosticText3(result.refusal.resolvingCommand)}`
     ].join("\n");
   }
-  if (result.outcome !== "plan-digest-mismatch" || !result.result) return line;
-  const detail = result.result.assessment.reasons[0]?.detail;
-  return detail ? `${line}
-${detail}` : line;
-}
-function acceptanceMatches(assumption, acceptance2) {
-  return acceptance2.class === assumption.class && (!acceptance2.fromTrustRoot || canonicalJson(acceptance2.fromTrustRoot) === canonicalJson(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance2.withinScope || acceptance2.withinScope.length === 0 : !acceptance2.withinScope || acceptance2.withinScope.length === 0 || assumption.scope.every(
-    (resource) => acceptance2.withinScope?.some(
-      (selector) => selectorMatchesResource(selector, resource)
-    )
-  ));
+  if (!("result" in result)) return line;
+  if ("assessment" in result.result) {
+    if (result.result.unresolvedOutcome) {
+      const unresolved = result.result.unresolvedOutcome;
+      return unresolved.kind === "recovery-required" ? [
+        line,
+        `claim: ${escapeDiagnosticText3(unresolved.claimId)}`,
+        `detail: ${escapeDiagnosticText3(unresolved.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n") : [
+        line,
+        `detail: ${escapeDiagnosticText3(unresolved.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    }
+    if (result.outcome !== "plan-digest-mismatch") return line;
+    const detail = result.result.assessment.reasons[0]?.detail;
+    return detail ? `${line}
+${escapeDiagnosticText3(detail)}` : line;
+  }
+  const execution = result.result;
+  switch (execution.outcome) {
+    case "completed":
+      return line;
+    case "recovery-required":
+      return [
+        line,
+        `claim: ${escapeDiagnosticText3(execution.claimId)}`,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    case "transport-ambiguous":
+      return [
+        line,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    case "partially-applied":
+    case "selection-incomplete":
+    case "adoption-refused":
+    case "readdress-unsupported":
+    case "readdress-refused":
+    case "destructive-authority-refused":
+    case "execution-failed":
+      return `${line}
+detail: ${escapeDiagnosticText3(execution.detail)}`;
+    case "prior-step-events-refusal":
+      return [
+        line,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+  }
 }
 function recordedPlanRefusal() {
   return { ...REFUSAL_VOCABULARY2["ERR-10"], state: "recorded-plan" };
@@ -2701,7 +2206,15 @@ async function runApplyInternal(runId, options, pool) {
             throw new Error(
               "persisted run no longer contains a generator plan"
             );
-          const recordedSchema = current.plan.generator.planningSchema;
+          let material;
+          try {
+            material = decodeGeneratorPlanMaterial(current.plan.generator);
+          } catch (error) {
+            throw new RecordedPlanDigestMismatchError(
+              `persisted generator material is invalid: ${errorDetail(error)}`
+            );
+          }
+          const recordedSchema = material.planningSchema;
           if (!recordedSchema)
             throw new Error(
               "persisted generator run has no recorded planning schema and is non-resumable"
@@ -2716,7 +2229,7 @@ async function runApplyInternal(runId, options, pool) {
           }
           if (actualDigest !== current.run.planDigest || actualDigest !== expectedPlanDigest)
             throw new RecordedPlanDigestMismatchError();
-          const manifest = validateNormalizedManagedStepManifest3(
+          const manifest = validateNormalizedManagedStepManifest2(
             current.plan.steps
           );
           if (!manifest.ok)
@@ -2730,10 +2243,14 @@ async function runApplyInternal(runId, options, pool) {
             throw new RecordedPlanDigestMismatchError(
               `persisted generator manifest is invalid: ${lifecycleError}`
             );
-          if (generatorRunHasPriorStepEvents(current))
+          if (await generatorRunRequiresRecovery(
+            target,
+            current,
+            manifest.manifest.steps
+          ))
             return {
               outcome: "prior-step-events-refusal",
-              detail: "run has prior generator step-attempt events; run dbsp recover instead"
+              detail: "run has prior generator step-attempt events; run dbsp reconcile --db <database> <run-id>"
             };
           return executeGeneratorPlan({
             pool: owned,
@@ -2760,6 +2277,18 @@ async function runApplyInternal(runId, options, pool) {
                 await journalLease.release();
               }
             },
+            verifyDeclaredAdoptionShape: async (executor, step) => {
+              if (step.lifecycle?.kind !== "adoption") return false;
+              const compared = await comparePgsqlDeclaredAdoptionSchema2({
+                // Outcome protocol provides its claimed pg session here. It is
+                // intentionally not the outer pool held by runApply.
+                executor,
+                model: modelForDeclaredAdoption2(step.lifecycle.shape),
+                schema: recordedSchema,
+                dbCasing: material.dbCasing
+              });
+              return compared.changes.length === 0;
+            },
             ...options.replace === void 0 ? {} : { replaces: options.replace },
             runId
           });
@@ -2780,96 +2309,68 @@ async function runApplyInternal(runId, options, pool) {
             withheldAuthority
           }
         };
-        result = {
-          outcome: execution.outcome,
+        result = generatorApplyCommandResult(
+          execution,
           runId,
-          result: execution,
-          ...preAppendRefusal === void 0 ? {} : { refusal: preAppendRefusal }
-        };
+          preAppendRefusal
+        );
       }
     } else {
-      const locked = await withPgTransitionRunLock(
+      const applied = await applyPgTransitionRun(
         owned,
         runId,
-        async (target) => {
-          const loadCurrent = async (id) => {
-            return loadOnTarget(target, id);
-          };
-          const applier = createApplier(registry(), {
-            // A durable apply only verifies the existing immutable row. The applier
-            // calls this before execution; a changed record remains a refusal.
-            persist: async () => void 0
-          });
-          return applier.applyDurable({
-            runId,
-            expectedPlanDigest,
-            loadCurrent,
-            prepareExecutionSession: async (session, contract, plan) => {
-              const currency = await validatePgManagedLedgerCurrency(
-                session,
-                plan
-              );
-              if (currency)
-                return {
-                  ok: false,
-                  kind: "refused",
-                  detail: currency
-                };
-              return preparePgExecutionSession(session, contract, plan);
-            },
-            policy,
-            target,
-            authorize: async (run, plan, session) => {
-              const current = await loadOnTarget(target, run.runId);
-              const grants = plan.assumptions.map((assumption) => ({
-                assumptionId: assumption.id,
-                grant: policy.accepts.findIndex(
-                  (grant) => acceptanceMatches(assumption, grant)
-                )
-              }));
-              if (hasReusableAuthorization(
-                current.authorizations,
+        policy,
+        expectedPlanDigest,
+        {
+          authorize: async ({ current, run, plan }) => {
+            const grants = plan.assumptions.map((assumption) => ({
+              assumptionId: assumption.id,
+              grant: policy.accepts.findIndex(
+                (grant) => acceptanceMatches(assumption, grant)
+              )
+            }));
+            const reusable = current.authorizations?.find(
+              (authorization) => hasReusableAuthorization(
+                [authorization],
                 run.runId,
                 transitionPlanDigest2(plan),
                 policy.accepts,
                 grants
-              ))
-                return;
-              const actor = process.env.USER ?? process.env.LOGNAME ?? "unknown-local-actor";
-              const authorizedAt = (/* @__PURE__ */ new Date()).toISOString();
-              const digest2 = authorizationDigest(
+              )
+            );
+            if (reusable) return reusable;
+            const actor = process.env.USER ?? process.env.LOGNAME ?? "unknown-local-actor";
+            const authorizedAt = (/* @__PURE__ */ new Date()).toISOString();
+            return {
+              runId: run.runId,
+              policy: policy.accepts,
+              grants,
+              digest: authorizationDigest(
                 run.runId,
                 transitionPlanDigest2(plan),
                 policy.accepts,
                 grants,
                 actor,
                 authorizedAt
-              );
-              const record2 = {
-                runId: run.runId,
-                policy: policy.accepts,
-                grants,
-                digest: digest2,
-                actor,
-                authorizedAt
-              };
-              await appendTransitionAuthorization(session, record2);
-            }
-          });
+              ),
+              actor,
+              authorizedAt
+            };
+          }
         }
       );
-      if (locked.kind === "busy") result = { outcome: "run-busy", runId };
+      if (applied.kind === "busy") result = { outcome: "run-busy", runId };
       else {
-        const outcome = outcomeForApplyResult(locked.value);
+        const outcome = outcomeForApplyResult(applied.result);
         const preAppendRefusal = applyPreAppendRefusal(
           outcome,
           persisted.plan,
-          locked.value
+          applied.result
         );
         result = {
           outcome,
           runId,
-          result: locked.value,
+          result: applied.result,
           ...preAppendRefusal === void 0 ? {} : { refusal: preAppendRefusal }
         };
       }
@@ -2965,9 +2466,7 @@ var applyCommand = new Command2("apply").description(
         console.log("confirmation-declined: persisted run was not executed");
       else if (result2.outcome === "not-executable") {
       } else if (result2.outcome !== "dry-run" && "result" in result2)
-        console.log(
-          "runId" in result2.result ? formatApplyHuman(result2.result) : `${result2.result.outcome}${"detail" in result2.result ? `: ${result2.result.detail}` : ""}`
-        );
+        console.log(formatApplyHuman(result2.result));
     }
     process.exitCode = exitCode2;
     return;
@@ -3066,13 +2565,19 @@ var generateCommand = new Command3("generate").description("Generate code from s
         case "ddl": {
           const dbCasing = mapCasingToDbCasing(options.casing) ?? schema.dbCasing ?? "snake_case";
           const casingLabel = formatGenerateCasingLabel(dbCasing);
-          const { createPgsqlCompileOnlyAdapter } = await import("@dbsp/adapter-pgsql");
+          const { createPgPhysicalModel: createPgPhysicalModel6, createPgsqlCompileOnlyAdapter } = await import("@dbsp/adapter-pgsql");
           const adapter = createPgsqlCompileOnlyAdapter({
             dbCasing,
             ...options.schemaName ? { schemaName: options.schemaName } : {}
           });
           {
-            const ddlStatements = adapter.generateDDL(schema.model, {
+            const physical = createPgPhysicalModel6({
+              mode: "logical",
+              model: schema.model,
+              schema: options.schemaName ?? "public",
+              dbCasing
+            });
+            const ddlStatements = adapter.generateDDL(physical, {
               ...options.drop !== void 0 && {
                 includeDropStatements: options.drop
               },
@@ -3137,16 +2642,16 @@ function formatGenerateCasingLabel(dbCasing) {
 }
 
 // src/commands/inspect.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual } from "util";
 import {
   createPgTransitionLessor as createPgTransitionLessor4,
   DBSP_LEDGER_EVENT_TABLE,
   escapeDiagnosticText as escapeDiagnosticText4,
-  readPgCatalogueIdentity as readPgCatalogueIdentity3,
+  readPgCatalogueIdentity as readPgCatalogueIdentity2,
   readPgLedgerAddressChain as readPgLedgerAddressChain2,
   readPgLedgerMarker
 } from "@dbsp/adapter-pgsql";
-import { acquireTransitionLease as acquireTransitionLease4, projectLedgerChain as projectLedgerChain2 } from "@dbsp/core";
+import { acquireTransitionLease as acquireTransitionLease4, projectLedgerChain } from "@dbsp/core";
 import {
   canonicalResourceParent
 } from "@dbsp/types";
@@ -3192,7 +2697,7 @@ function inspectLiveDrift(projection, live) {
       kind: "catalogue-drift",
       detail: "ledger records a present catalogue identity but the object is absent"
     };
-  return isDeepStrictEqual2(terminal.catalogueIdentity, live.catalogueIdentity) ? { kind: "matches-ledger" } : {
+  return isDeepStrictEqual(terminal.catalogueIdentity, live.catalogueIdentity) ? { kind: "matches-ledger" } : {
     kind: "catalogue-drift",
     detail: "live catalogue identity differs from the ledger terminal"
   };
@@ -3315,7 +2820,7 @@ async function runInspect(selector, options) {
       );
       let projection;
       try {
-        projection = projectLedgerChain2(
+        projection = projectLedgerChain(
           await readPgLedgerAddressChain2(lease.session, ledger, address)
         );
       } catch (error) {
@@ -3335,7 +2840,7 @@ async function runInspect(selector, options) {
         };
       }
       try {
-        const live = await readPgCatalogueIdentity3(lease.session, address);
+        const live = await readPgCatalogueIdentity2(lease.session, address);
         const refusal = inspectRefusal(projection);
         const openReaddress = projection?.kind === "projected-ledger-chain" && projection.openClaim?.kind === "readdress-intent" && projection.openClaim.event.pairId ? {
           pairId: projection.openClaim.event.pairId,
@@ -3416,83 +2921,423 @@ function reportWarnings(warnings) {
     console.log(`   \u26A0\uFE0F  ${warning}`);
   }
 }
-var introspectCommand = new Command5("introspect").description("Generate schema.ts from database introspection").requiredOption("-d, --db <url>", "Database connection URL (required)").option("-o, --out <file>", "Output schema file", "./dbsp.schema.ts").option("--schema-name <name>", "Database schema name", "public").option(
-  "--exclude <patterns>",
-  "Tables to exclude (comma-separated glob patterns)",
-  "_migrations,_prisma*,pg_*"
-).option("--include <patterns>", "Tables to include (comma-separated)").option("--no-db-type-comments", "Omit original DB type comments").option(
-  "--db-casing <casing>",
-  "Database column casing (snake_case \u2192 camelCase in generated code)",
-  "snake_case"
-).action(
-  async (options) => {
-    const redactedUrl = redactDbUrl(options.db);
-    console.log(`\u{1F50D} Introspecting database: ${redactedUrl}`);
-    console.log(`   Schema: ${options.schemaName}`);
-    if (options.exclude) {
-      console.log(`   Excluding: ${options.exclude}`);
-    }
-    console.log("");
-    try {
-      const { pool } = await createDbConnection(options.db);
+var introspectCommand = new Command5("introspect").description("Generate schema.ts from database introspection").requiredOption("-d, --db <url>", "Database connection URL (required)").option("-o, --out <file>", "Output schema file", "./dbsp.schema.ts").option("--schema-name <name>", "Database schema name", "public").option(
+  "--exclude <patterns>",
+  "Tables to exclude (comma-separated glob patterns)",
+  "_migrations,_prisma*,pg_*"
+).option("--include <patterns>", "Tables to include (comma-separated)").option("--no-db-type-comments", "Omit original DB type comments").option(
+  "--db-casing <casing>",
+  "Database column casing (snake_case \u2192 camelCase in generated code)",
+  "snake_case"
+).action(
+  async (options) => {
+    const redactedUrl = redactDbUrl(options.db);
+    console.log(`\u{1F50D} Introspecting database: ${redactedUrl}`);
+    console.log(`   Schema: ${options.schemaName}`);
+    if (options.exclude) {
+      console.log(`   Excluding: ${options.exclude}`);
+    }
+    console.log("");
+    try {
+      const { pool } = await createDbConnection(options.db);
+      try {
+        const { introspect } = await import("@dbsp/adapter-pgsql");
+        const excludePatterns = options.exclude ? options.exclude.split(",").map((s) => s.trim()) : void 0;
+        const includePatterns = options.include ? options.include.split(",").map((s) => s.trim()) : void 0;
+        const model = await introspect(pool, {
+          schema: options.schemaName,
+          ...excludePatterns ? { exclude: excludePatterns } : {},
+          ...includePatterns ? { include: includePatterns } : {}
+        });
+        const tableCount = model.tables.size;
+        const relationCount = model.relations.size;
+        const hierarchyCount = model.hierarchies?.length ?? 0;
+        console.log(
+          `\u{1F4CA} Found ${tableCount} tables, ${relationCount} relations, ${hierarchyCount} hierarchies`
+        );
+        const codegenOptions = {
+          sourceUrl: options.db,
+          includeDbTypeComments: options.dbTypeComments,
+          introspectedAt: model.introspectedAt,
+          dbCasing: options.dbCasing
+        };
+        const generated = generateSchemaFileWithDiagnostics(
+          model,
+          codegenOptions
+        );
+        const warnings = uniqueWarnings(generated.warnings);
+        if (warnings.length > 0) {
+          reportWarnings(warnings);
+        }
+        console.log("");
+        const outPath = resolve2(process.cwd(), options.out);
+        mkdirSync2(dirname2(outPath), { recursive: true });
+        writeFileSync2(outPath, generated.code, "utf-8");
+        console.log(`\u2705 Generated schema: ${outPath}`);
+        console.log(`   Tables: ${tableCount}`);
+        console.log(`   Relations: ${relationCount}`);
+      } finally {
+        await pool.end();
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`\u274C ${message}`);
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/migrate.ts
+import {
+  convergePg,
+  createPgPhysicalModel as createPgPhysicalModel3,
+  escapeDiagnosticText as escapeDiagnosticText5,
+  PgConvergeRefusalError
+} from "@dbsp/adapter-pgsql";
+import { Command as Command6 } from "commander";
+var MIGRATE_OUTCOME_CONTRACT = [
+  ["no-drift", 0, "database matches declaration"],
+  ["applied", 0, "admitted additions or adoptions applied"],
+  ["partially-applied", 11, "some target effects may be durable"],
+  ["busy", 21, "ledger lock or claims are busy; retry later"],
+  ["database-read-only", 34, "target cannot accept managed writes"],
+  ["load-failed", 27, "schema file could not be loaded"],
+  ["migrate-failed", 29, "migration, connection, or planning failure"],
+  ["adoption-refused", 62, "declared adoption no longer matches live object"],
+  [
+    "recovery-required",
+    64,
+    "admitted claim remains open; reconcile before retrying"
+  ],
+  [
+    "transport-ambiguous",
+    65,
+    "admitted operation has ambiguous transport outcome"
+  ],
+  [
+    "invalid-options",
+    70,
+    "an --external-index or --format value is malformed, or convergePg refused its options"
+  ],
+  ["ledger-absent", 71, "convergence ledger is not initialized"],
+  ["incompatible-ledger", 72, "ledger version is unsupported"],
+  ["unsupported-server", 73, "PostgreSQL server is unsupported"],
+  ["unsupported-change", 74, "requested schema change is not admitted"],
+  ["unmanaged-object", 75, "live object is not ledger-managed"],
+  ["unmanaged-parent", 76, "parent live object is not ledger-managed"],
+  ["concurrent-drift", 77, "live schema changed during admission"],
+  ["execution-refused", 78, "admitted execution step was refused"],
+  ["cleanup-failed", 79, "pool failed to close after convergence"]
+];
+var migrateExitCodes = new Map(
+  MIGRATE_OUTCOME_CONTRACT.map(([outcome, exitCode]) => [outcome, exitCode])
+);
+function exitCodeForMigrateOutcome(outcome) {
+  return migrateExitCodes.get(outcome);
+}
+var refusalOutcomes = {
+  "invalid-options": "invalid-options",
+  "unsupported-change": "unsupported-change",
+  "unmanaged-object": "unmanaged-object",
+  "unmanaged-parent": "unmanaged-parent",
+  "concurrent-drift": "concurrent-drift",
+  "ledger-absent": "ledger-absent",
+  "incompatible-ledger": "incompatible-ledger",
+  "unsupported-server": "unsupported-server",
+  busy: "busy",
+  "recovery-required": "recovery-required",
+  "database-read-only": "database-read-only",
+  "execution-refused": "execution-refused",
+  "adoption-refused": "adoption-refused",
+  // dbsp migrate never supplies application steps, but preserve the closed converge map.
+  "application-step-changed": "migrate-failed",
+  "application-step-failed": "migrate-failed",
+  // dbsp migrate never supplies initialize, but preserve the closed converge map.
+  "initialization-refused": "migrate-failed"
+};
+var defaultMigrateDeps = {
+  loadSchema,
+  createDbConnection,
+  converge: convergePg
+};
+function resolvedDeps2(overrides) {
+  return { ...defaultMigrateDeps, ...overrides };
+}
+function describeThrown2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function parseExternalIndexes(entries) {
+  if (entries === void 0 || entries.length === 0) return void 0;
+  return entries.map((entry) => {
+    const separator = entry.indexOf(":");
+    if (separator <= 0 || separator === entry.length - 1)
+      throw new Error(
+        `invalid --external-index ${entry}; expected <table>:<index>`
+      );
+    return {
+      table: entry.slice(0, separator),
+      name: entry.slice(separator + 1)
+    };
+  });
+}
+function resultForConverge(result, schema, schemaFile) {
+  switch (result.kind) {
+    case "no-drift":
+    case "applied":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        applied: result.applied
+      };
+    case "partially-applied":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        completedStepKeys: result.completedStepKeys,
+        notStartedStepKeys: result.notStartedStepKeys,
+        detail: result.detail
+      };
+    case "transport-ambiguous":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        detail: result.detail
+      };
+  }
+  const unhandled = result;
+  return unhandled;
+}
+function refusalResult(error, schema, schemaFile) {
+  const outcome = refusalOutcomes[error.refusal];
+  return {
+    outcome,
+    exitCode: exitCodeForMigrateOutcome(outcome),
+    schema,
+    schemaFile,
+    changes: error.changes,
+    ...error.detail === void 0 ? {} : { detail: error.detail },
+    ...error.runIds === void 0 ? {} : { runIds: error.runIds },
+    ...error.busyRunIds === void 0 ? {} : { busyRunIds: error.busyRunIds },
+    ...error.executionIds === void 0 ? {} : { executionIds: error.executionIds }
+  };
+}
+function failureResult(outcome, error, schema, schemaFile) {
+  return {
+    outcome,
+    exitCode: exitCodeForMigrateOutcome(outcome),
+    schema,
+    schemaFile,
+    error: describeThrown2(error)
+  };
+}
+async function runMigrate(schemaPath, options, overrides) {
+  const schema = options.schema ?? "public";
+  const deps = resolvedDeps2(overrides);
+  if (options.format !== void 0 && options.format !== "text" && options.format !== "json")
+    return failureResult(
+      "invalid-options",
+      new Error(
+        `unsupported migrate format ${options.format}; expected text or json`
+      ),
+      schema,
+      schemaPath
+    );
+  let externalIndexes;
+  try {
+    externalIndexes = parseExternalIndexes(options.externalIndex);
+  } catch (error) {
+    return failureResult("invalid-options", error, schema, schemaPath);
+  }
+  let loaded;
+  try {
+    loaded = await deps.loadSchema(schemaPath);
+  } catch (error) {
+    return failureResult("load-failed", error, schema, schemaPath);
+  }
+  let physical;
+  try {
+    physical = createPgPhysicalModel3({
+      mode: "logical",
+      model: loaded.model,
+      schema,
+      ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+    });
+  } catch (error) {
+    return failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  let pool;
+  try {
+    ({ pool } = await deps.createDbConnection(options.db));
+  } catch (error) {
+    return failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  let result;
+  let convergeResult;
+  try {
+    convergeResult = await deps.converge(pool, physical, {
+      ...externalIndexes === void 0 ? {} : { externalIndexes }
+    });
+    result = resultForConverge(convergeResult, schema, schemaPath);
+  } catch (error) {
+    result = error instanceof PgConvergeRefusalError ? refusalResult(error, schema, schemaPath) : failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  try {
+    await pool.end();
+  } catch (error) {
+    const cleanupError = describeThrown2(error);
+    if (result.exitCode === 0 && convergeResult !== void 0) {
+      return {
+        outcome: "cleanup-failed",
+        exitCode: exitCodeForMigrateOutcome("cleanup-failed"),
+        schema,
+        schemaFile: schemaPath,
+        cleanupError,
+        result: convergeResult
+      };
+    }
+    return { ...result, cleanupError };
+  }
+  return result;
+}
+function redactDiagnostic(value, db) {
+  const sensitive = /* @__PURE__ */ new Set([db]);
+  try {
+    const url = new URL(db);
+    const password = url.password;
+    if (password) {
+      sensitive.add(password);
       try {
-        const { introspect } = await import("@dbsp/adapter-pgsql");
-        const excludePatterns = options.exclude ? options.exclude.split(",").map((s) => s.trim()) : void 0;
-        const includePatterns = options.include ? options.include.split(",").map((s) => s.trim()) : void 0;
-        const model = await introspect(pool, {
-          schema: options.schemaName,
-          ...excludePatterns ? { exclude: excludePatterns } : {},
-          ...includePatterns ? { include: includePatterns } : {}
-        });
-        const tableCount = model.tables.size;
-        const relationCount = model.relations.size;
-        const hierarchyCount = model.hierarchies?.length ?? 0;
-        console.log(
-          `\u{1F4CA} Found ${tableCount} tables, ${relationCount} relations, ${hierarchyCount} hierarchies`
-        );
-        const codegenOptions = {
-          sourceUrl: options.db,
-          includeDbTypeComments: options.dbTypeComments,
-          introspectedAt: model.introspectedAt,
-          dbCasing: options.dbCasing
-        };
-        const generated = generateSchemaFileWithDiagnostics(
-          model,
-          codegenOptions
-        );
-        const warnings = uniqueWarnings(generated.warnings);
-        if (warnings.length > 0) {
-          reportWarnings(warnings);
-        }
-        console.log("");
-        const outPath = resolve2(process.cwd(), options.out);
-        mkdirSync2(dirname2(outPath), { recursive: true });
-        writeFileSync2(outPath, generated.code, "utf-8");
-        console.log(`\u2705 Generated schema: ${outPath}`);
-        console.log(`   Tables: ${tableCount}`);
-        console.log(`   Relations: ${relationCount}`);
-      } finally {
-        await pool.end();
+        sensitive.add(decodeURIComponent(password));
+      } catch {
       }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.error(`\u274C ${message}`);
-      process.exit(1);
     }
+    for (const password2 of url.searchParams.getAll("password"))
+      sensitive.add(password2);
+    for (const pair of url.search.slice(1).split("&")) {
+      const separator = pair.indexOf("=");
+      const name = separator === -1 ? pair : pair.slice(0, separator);
+      if (name !== "password") continue;
+      if (separator !== -1) sensitive.add(pair.slice(separator + 1));
+    }
+  } catch {
+    const match = /:\/\/[^/:]+:([^@]+)@/.exec(db);
+    if (match?.[1]) sensitive.add(match[1]);
+  }
+  return [...sensitive].filter((entry) => entry.length > 0).sort((left, right) => right.length - left.length).reduce((text, entry) => text.replaceAll(entry, "<redacted>"), value);
+}
+function redactedConvergeResult(result, db) {
+  return result.kind === "partially-applied" || result.kind === "transport-ambiguous" ? { ...result, detail: redactDiagnostic(result.detail, db) } : result;
+}
+function redactedResult(result, db) {
+  return {
+    ...result,
+    ...result.detail === void 0 ? {} : { detail: redactDiagnostic(result.detail, db) },
+    ...result.error === void 0 ? {} : { error: redactDiagnostic(result.error, db) },
+    ...result.cleanupError === void 0 ? {} : { cleanupError: redactDiagnostic(result.cleanupError, db) },
+    ...result.result === void 0 ? {} : { result: redactedConvergeResult(result.result, db) }
+  };
+}
+function formatMigrateJson(result, db) {
+  const safe = redactedResult(result, db);
+  const { schemaFile: _schemaFile, ...document } = safe;
+  return document;
+}
+function formatMigrateHuman(result, db) {
+  const safe = redactedResult(result, db);
+  const diagnostic = (value) => escapeDiagnosticText5(value);
+  const lines = [`${diagnostic(safe.outcome)}: ${diagnostic(safe.schema)}`];
+  if (safe.applied?.length)
+    for (const applied of safe.applied) lines.push(diagnostic(applied));
+  if (safe.outcome === "partially-applied") {
+    const stepKeys = (entries) => entries?.length ? entries.map(diagnostic).join(", ") : "none";
+    lines.push(`completed: ${stepKeys(safe.completedStepKeys)}`);
+    lines.push(`not started: ${stepKeys(safe.notStartedStepKeys)}`);
+  }
+  if (safe.detail !== void 0) lines.push(diagnostic(safe.detail));
+  if (safe.changes?.length)
+    for (const change of safe.changes)
+      lines.push(diagnostic(JSON.stringify(change)));
+  if (safe.outcome === "recovery-required") {
+    if (safe.runIds?.length) {
+      lines.push("dbsp reconcile --db <database> <run-id>");
+      for (const runId of safe.runIds)
+        lines.push(`run id: ${diagnostic(runId)}`);
+    }
+    if (safe.busyRunIds?.length) {
+      for (const busyRunId of safe.busyRunIds)
+        lines.push(`busy run id: ${diagnostic(busyRunId)}`);
+      lines.push("these runs are still executing; retry later");
+    }
+    if (safe.executionIds?.length) {
+      for (const executionId of safe.executionIds)
+        lines.push(`execution id: ${diagnostic(executionId)}`);
+      lines.push(
+        "no dbsp command resolves a claim by execution id; the owner named in the detail above must resolve these claims"
+      );
+    }
+  }
+  if (safe.outcome === "ledger-absent")
+    lines.push(
+      "dbsp preflight --reinitialize --db <database> --schema-file <schema-file> --scope <schema> --out <adoption-file>",
+      `schema file: ${diagnostic(safe.schemaFile)}`,
+      `schema: ${diagnostic(safe.schema)}`
+    );
+  if (safe.outcome === "cleanup-failed" && safe.result !== void 0) {
+    lines.push(`convergence: ${diagnostic(safe.result.kind)}`);
+    if ("applied" in safe.result && safe.result.applied.length)
+      for (const applied of safe.result.applied)
+        lines.push(diagnostic(applied));
+  }
+  if (safe.error !== void 0) lines.push(diagnostic(safe.error));
+  if (safe.cleanupError !== void 0)
+    lines.push(`Connection cleanup failed: ${diagnostic(safe.cleanupError)}`);
+  return lines.join("\n");
+}
+var migrateCommand = new Command6("migrate").description(
+  "Converge without confirmation: applies only additions and declared adoptions admitted by convergePg; refused changes send no DDL, but execution can still be refused or partially applied. Use dbsp plan plus dbsp apply for reviewed changes."
+).argument("<schema-file>", "Schema DSL file").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema <name>", "Database schema name", "public").option(
+  "--external-index <model-table:index>",
+  "Physical index to leave alone; the table is the model name (before dbCasing maps it), then the index by its exact PostgreSQL name; the table part cannot contain :; repeatable.",
+  (value, previous = []) => {
+    previous.push(value);
+    return previous;
+  }
+).option("--format <format>", "Output format: text or json", "text").addHelpText(
+  "after",
+  `
+Outcome contract:
+${MIGRATE_OUTCOME_CONTRACT.map(([outcome, exitCode, description]) => `  ${outcome} (${exitCode}): ${description}`).join("\n")}
+Command-line syntax errors (an unknown option, a missing --db or schema file) exit 1 with { status, error } under --format json, as for every dbsp command.`
+).exitOverride().configureOutput({ writeErr: () => {
+} }).action(
+  async (schemaFile, options) => {
+    const result = await runMigrate(schemaFile, options);
+    if (options.format === "json")
+      printCliJson(formatMigrateJson(result, options.db));
+    else if (result.exitCode === 0)
+      console.log(formatMigrateHuman(result, options.db));
+    else console.error(formatMigrateHuman(result, options.db));
+    process.exitCode = result.exitCode;
   }
 );
 
 // src/commands/preflight.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { mkdtemp, open, rename, rm } from "fs/promises";
 import { dirname as dirname3, join } from "path";
 import {
-  escapeDiagnosticText as escapeDiagnosticText5,
-  getNamingPluginForDbCasing as getNamingPluginForDbCasing2,
+  createPgPhysicalModel as createPgPhysicalModel4,
+  escapeDiagnosticText as escapeDiagnosticText6,
   runPgReinitializePreflight
 } from "@dbsp/adapter-pgsql";
 import { declarationSetFromModel as declarationSetFromModel2 } from "@dbsp/core";
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 var defaultDeps = { createDbConnection, loadSchema };
 var nodeAdoptionFileSystem = {
   mkdtemp,
@@ -3542,13 +3387,9 @@ async function databaseName(pool) {
     throw new Error("current database could not be read");
   return name;
 }
-function declarationsForScopes(model, database, scopes, naming) {
+function declarationsForScopes(model, database, scopes) {
   const declarations = scopes.flatMap(
-    (schema) => declarationSetFromModel2(
-      model,
-      { engine: "postgresql", database, schema },
-      naming
-    ).declarations
+    (schema) => declarationSetFromModel2(model, { engine: "postgresql", database, schema }).declarations
   );
   const seen = /* @__PURE__ */ new Set();
   const uniqueDeclarations = declarations.filter((declaration) => {
@@ -3568,7 +3409,7 @@ function declarationsForScopes(model, database, scopes, naming) {
   });
   return {
     version: 1,
-    digest: createHash4("sha256").update(canonical).digest("hex"),
+    digest: createHash2("sha256").update(canonical).digest("hex"),
     declarations: uniqueDeclarations
   };
 }
@@ -3583,19 +3424,25 @@ async function runPreflight(options, deps = defaultDeps) {
     throw new Error("dbsp preflight requires --reinitialize");
   if (!options.out)
     throw new Error("dbsp preflight --reinitialize requires --out <file>");
-  if (options.scopes.length === 0)
+  const physicalSchema = options.scopes[0];
+  if (physicalSchema === void 0)
     throw new Error(
       "dbsp preflight requires at least one explicit --scope <schema>"
     );
   const loaded = await deps.loadSchema(options.schemaFile);
+  const physical = createPgPhysicalModel4({
+    mode: "logical",
+    model: loaded.model,
+    schema: physicalSchema,
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
   const connection = await deps.createDbConnection(options.db);
   try {
     const database = await databaseName(connection.pool);
     const declarations = declarationsForScopes(
-      loaded.model,
+      physical.model,
       database,
-      options.scopes,
-      getNamingPluginForDbCasing2(loaded.dbCasing ?? "preserve")
+      options.scopes
     );
     return await runPgReinitializePreflight({
       pool: connection.pool,
@@ -3610,18 +3457,18 @@ async function runPreflight(options, deps = defaultDeps) {
 function formatScope(scope) {
   const name = scope.ledger.scope === "database" ? "dbsp_meta" : scope.ledger.schema ?? "unknown";
   if (scope.outcome === "failed")
-    return `${escapeDiagnosticText5(name)}: failed (${escapeDiagnosticText5(scope.reason.step)}: ${escapeDiagnosticText5(scope.reason.message)})`;
-  return scope.refusal ? `${escapeDiagnosticText5(name)}: ${escapeDiagnosticText5(scope.outcome)} (${escapeDiagnosticText5(scope.refusal.code)}: ${escapeDiagnosticText5(scope.refusal.detail)})` : `${escapeDiagnosticText5(name)}: ${escapeDiagnosticText5(scope.outcome)}`;
+    return `${escapeDiagnosticText6(name)}: failed (${escapeDiagnosticText6(scope.reason.step)}: ${escapeDiagnosticText6(scope.reason.message)})`;
+  return scope.refusal ? `${escapeDiagnosticText6(name)}: ${escapeDiagnosticText6(scope.outcome)} (${escapeDiagnosticText6(scope.refusal.code)}: ${escapeDiagnosticText6(scope.refusal.detail)})` : `${escapeDiagnosticText6(name)}: ${escapeDiagnosticText6(scope.outcome)}`;
 }
 function formatReinitializeSplit(scopes) {
   const names = (predicate) => scopes.filter(predicate).map(
-    (scope) => escapeDiagnosticText5(
+    (scope) => escapeDiagnosticText6(
       scope.ledger.scope === "database" ? "dbsp_meta" : scope.ledger.schema ?? "unknown"
     )
   ).join(",") || "none";
   return `reinitialize-split: changed=${names((scope) => scope.outcome === "current")}; failed=${names((scope) => scope.outcome === "failed")}; not-attempted=${names((scope) => scope.outcome === "not-attempted")}`;
 }
-var preflightCommand = new Command6("preflight").description(
+var preflightCommand = new Command7("preflight").description(
   "Run the separately privileged managed-ledger reinitialize cutover"
 ).requiredOption("-d, --db <url>", "Database connection URL (required)").requiredOption(
   "--reinitialize",
@@ -3646,7 +3493,7 @@ var preflightCommand = new Command6("preflight").description(
     );
   } catch (error) {
     console.error(
-      escapeDiagnosticText5(
+      escapeDiagnosticText6(
         error instanceof Error ? error.message : String(error)
       )
     );
@@ -3655,31 +3502,12 @@ var preflightCommand = new Command6("preflight").description(
 });
 
 // src/commands/reconcile.ts
-import { createHash as createHash5 } from "crypto";
 import {
-  assertCreateUniqueIndexConcurrentlyRecoveryNotInvalid,
-  assertPgDatabaseWritable,
-  escapeDiagnosticText as escapeDiagnosticText6,
-  isPgDatabaseReadOnlyError,
-  readPgLedgerAddressChain as readPgLedgerAddressChain3,
-  readPgLedgerReservationsForExecution,
-  readPgLedgerScopeCurrency as readPgLedgerScopeCurrency2,
-  readTransitionJournal as readTransitionJournal2,
-  readVerifiedPgLedgerReservationsForPair,
-  recoverPgReaddressPair,
-  withPgTransitionRunLock as withPgTransitionRunLock2
+  escapeDiagnosticText as escapeDiagnosticText7,
+  PgReconcileTransitionRunError,
+  reconcilePgTransitionRun
 } from "@dbsp/adapter-pgsql";
-import { recoverPgOutcomeClaim } from "@dbsp/adapter-pgsql/internal";
-import {
-  acquireExclusiveTransitionLease as acquireExclusiveTransitionLease2,
-  assumptionAccepted,
-  outcomeClaimId as outcomeClaimId2,
-  projectLedgerChain as projectLedgerChain3,
-  resourceScopeCovers,
-  transitionPlanDigest as transitionPlanDigest3
-} from "@dbsp/core";
-import { sameLedgerAddress } from "@dbsp/types";
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 function pgSqlState(error) {
   if (typeof error !== "object" || error === null || !("code" in error))
     return void 0;
@@ -3705,172 +3533,121 @@ function classifyReconcileFailure(error, stage) {
   if (stage === "journal") return "malformed-journal";
   return "catalogue";
 }
-function ledgerHome(address) {
-  if (address.scope === "database") return { scope: "database" };
-  if (!address.schema)
-    throw new Error(
-      `schema-scoped managed claim ${address.name} has no schema`
-    );
-  return { scope: "schema", schema: address.schema };
-}
-function recoveryPayload(identity) {
-  const value = JSON.parse(
-    JSON.stringify({ catalogueIdentity: identity })
+function isUnresolvedRecoveryOutcome(report) {
+  return [
+    "pending",
+    "blocked",
+    "malformed-chain",
+    "protocol-refused",
+    "transport-ambiguous",
+    "no-open-claim",
+    "indeterminate-appended",
+    "indeterminate-pair"
+  ].includes(report.outcome);
+}
+function ledgerCurrencyDetail(issue) {
+  return issue.currency.kind === "not-current" && issue.currency.reason === "lineage" ? "ledger lineage mismatch; run dbsp preflight --reinitialize" : `ledger marker ${issue.currency.marker.kind}; run dbsp preflight --reinitialize`;
+}
+function refusalForSelectedIssue(issue) {
+  if (issue === void 0) return void 0;
+  if (issue.kind === "ledger-not-current") {
+    const address = issue.affectedAddresses[0];
+    return address === void 0 ? void 0 : preAppendRefusalFor("ERR-03", { address, state: "unknown" });
+  }
+  if (issue.kind === "database-read-only") {
+    const address = issue.affectedAddresses[0];
+    return address === void 0 ? void 0 : preAppendRefusalFor("ERR-07", { address, state: "unknown" });
+  }
+  return preAppendRefusalFor(
+    issue.kind === "catalogue-unavailable" ? "ERR-09" : "ERR-08",
+    { address: issue.address, state: "unknown" }
   );
-  return {
-    value,
-    digest: createHash5("sha256").update(JSON.stringify(value)).digest("hex")
-  };
 }
-function recoveryReport(address, result) {
-  if (result.kind === "outcome-recovery-appended") {
-    return {
-      address,
-      outcome: result.append.kind === "already-appended-outcome-resolution" ? "already-appended" : "appended",
-      reason: result.classification.resolution.reason
-    };
-  }
-  if (result.kind === "outcome-recovery-no-open-claim")
-    return { address, outcome: "no-open-claim" };
-  if (result.kind === "outcome-recovery-pending")
-    return {
-      address,
-      outcome: "pending",
-      reason: result.reason,
-      ...result.reasonCode === "catalogue-unavailable" ? { failureCause: "catalogue" } : {},
-      ...result.reasonCode === "catalogue-unavailable" ? {
-        refusal: preAppendRefusalFor("ERR-09", {
-          address,
-          state: "unknown"
-        })
-      } : {}
-    };
-  if (result.kind === "outcome-recovery-blocked")
-    return { address, outcome: "blocked", reason: result.reason };
-  if (result.kind === "outcome-recovery-malformed-chain")
-    return {
-      address,
-      outcome: "malformed-chain",
-      reason: result.reason,
-      failureCause: "malformed-journal",
-      refusal: preAppendRefusalFor("ERR-08", { address, state: "unknown" })
-    };
-  if (result.kind === "outcome-transport-ambiguous")
+function mapRecovery(reports, issue) {
+  if (reports === void 0) return void 0;
+  const markerDetail = issue?.kind === "ledger-not-current" ? ledgerCurrencyDetail(issue) : void 0;
+  return reports.map((report) => ({
+    ...report,
+    ...markerDetail === void 0 ? {} : { reason: markerDetail },
+    ...issue?.kind === "ledger-not-current" ? {
+      refusal: preAppendRefusalFor("ERR-03", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : report.failureCause === "catalogue" ? {
+      refusal: preAppendRefusalFor("ERR-09", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : report.failureCause === "malformed-journal" ? {
+      refusal: preAppendRefusalFor("ERR-08", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : {}
+  }));
+}
+function unresolvedRecoveryDetail(reports) {
+  const unresolved = reports.filter(isUnresolvedRecoveryOutcome);
+  if (unresolved.length === 0) return void 0;
+  return unresolved.map(
+    (report) => `${escapeDiagnosticText7(report.address.name)}: ${escapeDiagnosticText7(report.reason ?? report.outcome)}`
+  ).join("; ");
+}
+function formatReconcileHuman(result) {
+  const line = `${escapeDiagnosticText7(result.outcome)}: ${escapeDiagnosticText7(result.runId)}`;
+  const base = result.refusal ? formatPreAppendRefusalHuman(line, result.refusal) : line;
+  if (result.outcome === "reconcile-completed" || !result.recovery) return base;
+  const unresolved = result.recovery.filter(isUnresolvedRecoveryOutcome);
+  return unresolved.length === 0 ? base : [
+    base,
+    ...unresolved.map(
+      (report) => `${escapeDiagnosticText7(report.address.name)}: ${escapeDiagnosticText7(report.outcome)}${report.reason ? `: ${escapeDiagnosticText7(report.reason)}` : ""}`
+    )
+  ].join("\n");
+}
+function mapAdapterResult(result) {
+  if (result.kind === "busy")
     return {
-      address,
-      outcome: "transport-ambiguous",
-      reason: result.reason,
-      failureCause: "transport"
+      outcome: "reconcile-run-unavailable",
+      runId: result.runId,
+      addresses: []
     };
-  return { address, outcome: "protocol-refused", reason: result.reason };
-}
-function readdressRecoveryReport(reservations, result) {
-  const first = reservations[0];
-  if (!first) throw new Error("re-address recovery has no reservation");
-  if (result.kind === "readdress-recovery-refused-pair")
+  if (result.kind === "selection-unavailable")
     return {
-      address: first.address,
-      outcome: "refused-pair",
-      pairId: result.pairId
+      outcome: "reconcile-claim-selection-unavailable",
+      runId: result.runId,
+      addresses: result.addresses,
+      ...result.detail === void 0 ? {} : { detail: result.detail }
     };
-  if (result.kind === "readdress-recovery-indeterminate-pair")
+  if (result.kind === "database-read-only") {
+    const refusal = refusalForSelectedIssue(result.selectedIssue);
     return {
-      address: first.address,
-      outcome: "indeterminate-pair",
-      reason: result.reason,
-      pairId: result.pairId
+      outcome: "database-read-only",
+      runId: result.runId,
+      addresses: result.addresses,
+      detail: result.selectedIssue.reason,
+      ...refusal === void 0 ? {} : { refusal }
     };
-  if (result.kind === "readdress-recovery-transport-ambiguous-pair")
+  }
+  const recovery = mapRecovery(result.recovery, result.selectedIssue);
+  const detail = result.selectedIssue?.kind === "ledger-not-current" ? ledgerCurrencyDetail(result.selectedIssue) : recovery === void 0 ? void 0 : unresolvedRecoveryDetail(recovery);
+  if (result.kind === "unresolved") {
+    const refusal = refusalForSelectedIssue(result.selectedIssue);
     return {
-      address: first.address,
-      outcome: "transport-ambiguous",
-      reason: result.reason,
-      failureCause: "transport",
-      pairId: result.pairId
+      outcome: "reconcile-unresolved",
+      runId: result.runId,
+      addresses: result.addresses,
+      ...detail === void 0 ? {} : { detail },
+      ...recovery === void 0 ? {} : { recovery },
+      ...refusal === void 0 ? {} : { refusal }
     };
-  return {
-    address: first.address,
-    outcome: "pending",
-    reason: result.reason,
-    pairId: result.pairId
-  };
-}
-function unresolvedRecoveryDetail(reports) {
-  const unresolved = reports.filter(
-    (report) => report.outcome === "pending" || report.outcome === "blocked" || report.outcome === "malformed-chain" || report.outcome === "protocol-refused" || report.outcome === "transport-ambiguous" || report.outcome === "no-open-claim" || report.outcome === "indeterminate-pair"
-  );
-  if (unresolved.length === 0) return void 0;
-  return unresolved.map(
-    (report) => `${escapeDiagnosticText6(report.address.name)}: ${escapeDiagnosticText6(report.reason ?? report.outcome)}`
-  ).join("; ");
-}
-function formatReconcileHuman(result) {
-  const line = `${escapeDiagnosticText6(result.outcome)}: ${escapeDiagnosticText6(result.runId)}`;
-  return result.refusal ? formatPreAppendRefusalHuman(line, result.refusal) : line;
-}
-function executionIdsForRun(journal) {
-  const executionIds = /* @__PURE__ */ new Set([journal.run.runId]);
-  for (const event of journal.events) {
-    const record2 = event.record;
-    if (event.event === "intent" && "executionId" in record2 && typeof record2.executionId === "string")
-      executionIds.add(record2.executionId);
-    if (event.event === "observed" && "intent" in record2 && record2.intent && typeof record2.intent.executionId === "string")
-      executionIds.add(record2.intent.executionId);
   }
-  if ("generator" in journal.plan)
-    executionIds.add(`dbsp.generator.execution.${journal.run.runId}`);
-  return [...executionIds];
-}
-function statementBundleDigest(statements) {
-  return createHash5("sha256").update(
-    JSON.stringify(statements.map(({ ordinal, sql }) => [ordinal, sql]))
-  ).digest("hex");
-}
-function recoveryEvidenceForClaim(input) {
-  if (transitionPlanDigest3(input.journal.plan) !== input.journal.run.planDigest)
-    return void 0;
-  const step = input.journal.plan.steps.find(
-    (candidate) => candidate.managedClaim?.plannedClaimKey === input.plannedClaimKey
-  );
-  const claim = step?.managedClaim;
-  if (!step || !claim || !sameLedgerAddress(claim.address, input.row.address) || outcomeClaimId2(
-    input.row.executionId,
-    input.plannedClaimKey,
-    input.row.address
-  ) !== input.row.rootClaimId)
-    return void 0;
-  const binding = step.guards.find(
-    (guard) => guard.protocol.binding.kind === "external-ddl-exclusion" && resourceScopeCovers(guard.protocol.binding.scope, [input.row.address])
-  )?.protocol.binding;
-  if (binding?.kind !== "external-ddl-exclusion") return void 0;
-  const assumption = input.journal.plan.assumptions.find(
-    (candidate) => candidate.id === binding.assumption && candidate.class === "external-ddl-exclusion" && step.restsOnAssumptions.includes(candidate.id) && resourceScopeCovers(candidate.scope, [input.row.address])
-  );
-  if (!assumption) return void 0;
-  const accepted = input.journal.authorizations?.some((authorization) => {
-    const grant = authorization.grants.find(
-      (candidate) => candidate.assumptionId === assumption.id
-    );
-    if (!grant) return false;
-    const acceptance2 = authorization.policy[grant.grant];
-    return acceptance2 !== void 0 && assumptionAccepted(assumption, { accepts: [acceptance2] });
-  });
-  if (!accepted) return void 0;
-  const bundleDigest = statementBundleDigest(claim.statementBundle.statements);
   return {
-    runId: input.journal.run.runId,
-    planDigest: input.journal.run.planDigest,
-    executionId: input.row.executionId,
-    claimId: input.row.rootClaimId,
-    plannedClaimKey: input.plannedClaimKey,
-    admittedBundleDigest: bundleDigest,
-    persistedBundleDigest: bundleDigest,
-    recordedPreState: input.stableStateBeforeClaim,
-    externalDdlExclusion: {
-      planDigest: input.journal.run.planDigest,
-      address: input.row.address,
-      trustRoot: JSON.stringify(assumption.asserter)
-    }
+    outcome: "reconcile-completed",
+    runId: result.runId,
+    addresses: result.addresses,
+    ...recovery === void 0 ? {} : { recovery }
   };
 }
 async function runReconcile(runId, options, pool) {
@@ -3885,303 +3662,28 @@ async function runReconcile(runId, options, pool) {
       failureCause: classifyReconcileFailure(error, "reconcile")
     };
   }
-  let stage = "reconcile";
   try {
-    const locked = await withPgTransitionRunLock2(
-      owned,
-      runId,
-      async (target) => {
-        const lease = await acquireExclusiveTransitionLease2(target);
-        try {
-          stage = "journal";
-          const journal = await readTransitionJournal2(lease.session, runId, {
-            ensure: false
-          });
-          stage = "reconcile";
-          const material = journal.plan.steps.map((step) => {
-            const generatedStep = step;
-            const generated = generatedStep.address;
-            return step.managedClaim ?? (generated === void 0 ? void 0 : {
-              address: generated,
-              ...generatedStep.plannedClaimKeys?.[0] === void 0 ? {} : {
-                plannedClaimKey: generatedStep.plannedClaimKeys[0]
-              }
-            });
-          }).filter(
-            (claim) => claim !== void 0
-          );
-          try {
-            await assertPgDatabaseWritable(lease.session);
-          } catch (error) {
-            if (isPgDatabaseReadOnlyError(error))
-              return {
-                kind: "database-read-only",
-                detail: error.message,
-                addresses: material.map((claim) => claim.address)
-              };
-            throw error;
-          }
-          if (material.length === 0)
-            return {
-              kind: "selection-unavailable",
-              addresses: journal.plan.declarations?.declarations.map(
-                (declaration) => declaration.address
-              ) ?? []
-            };
-          const homes = /* @__PURE__ */ new Map();
-          for (const claim of material) {
-            const home2 = ledgerHome(claim.address);
-            homes.set(`${home2.scope}:${home2.schema ?? ""}`, home2);
-          }
-          for (const home2 of homes.values()) {
-            const currency = await readPgLedgerScopeCurrency2(
-              lease.session,
-              home2
-            );
-            if (currency.kind === "current") continue;
-            const detail = currency.kind === "not-current" && currency.reason === "lineage" ? "ledger lineage mismatch; run dbsp preflight --reinitialize" : `ledger marker ${currency.marker.kind}; run dbsp preflight --reinitialize`;
-            const affected = material.filter((claim) => {
-              const claimHome = ledgerHome(claim.address);
-              return claimHome.scope === home2.scope && claimHome.schema === home2.schema;
-            });
-            return {
-              kind: "unresolved",
-              addresses: affected.map((claim) => claim.address),
-              detail,
-              recovery: affected.map((claim) => ({
-                address: claim.address,
-                outcome: "blocked",
-                reason: detail,
-                refusal: preAppendRefusalFor("ERR-03", {
-                  address: claim.address,
-                  state: "unknown"
-                })
-              }))
-            };
-          }
-          const executionIds = executionIdsForRun(journal);
-          const reservations = (await Promise.all(
-            [...homes.values()].flatMap(
-              (home2) => executionIds.map(
-                (executionId) => readPgLedgerReservationsForExecution(
-                  lease.session,
-                  home2,
-                  executionId
-                )
-              )
-            )
-          )).flat();
-          if (reservations.length === 0)
-            return {
-              kind: "selection-unavailable",
-              addresses: material.map((x) => x.address)
-            };
-          const readdressPairs = /* @__PURE__ */ new Map();
-          const byRoot = /* @__PURE__ */ new Map();
-          for (const row of reservations) {
-            if (row.claimKind === "readdress-intent" && row.pairId !== void 0) {
-              const pairKey = `${row.executionId}:${row.pairId}`;
-              readdressPairs.set(pairKey, [
-                ...readdressPairs.get(pairKey) ?? [],
-                row
-              ]);
-              continue;
-            }
-            byRoot.set(row.rootClaimId, [
-              ...byRoot.get(row.rootClaimId) ?? [],
-              row
-            ]);
-          }
-          const recovery = [];
-          for (const [_pairKey, pairRows] of readdressPairs) {
-            const pairId = pairRows[0]?.pairId;
-            const executionId = pairRows[0]?.executionId;
-            if (!pairId || !executionId) continue;
-            const readPairInSelectedHomes = readVerifiedPgLedgerReservationsForPair;
-            const closure = await readPairInSelectedHomes(
-              lease.session,
-              pairId,
-              [...homes.values()]
-            );
-            const recovered = await recoverPgReaddressPair(lease.session, {
-              pairId,
-              executionId,
-              reservations: closure
-            });
-            recovery.push(readdressRecoveryReport(closure, recovered));
-          }
-          for (const rows of byRoot.values()) {
-            const rootClaimId = rows[0]?.rootClaimId;
-            if (!rootClaimId) continue;
-            if (rows.some(
-              (row) => !executionIds.includes(row.executionId) || row.rootClaimId !== rootClaimId
-            ))
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `reservation disagreement for root claim ${rootClaimId}`
-              };
-            const rootCandidates = [];
-            for (const row of rows) {
-              stage = "catalogue";
-              const chain = await readPgLedgerAddressChain3(
-                lease.session,
-                ledgerHome(row.address),
-                row.address
-              );
-              stage = "reconcile";
-              const projection = projectLedgerChain3(chain);
-              if (projection.kind !== "projected-ledger-chain" || projection.openClaim === void 0)
-                continue;
-              const open2 = projection.openClaim.event;
-              const openRoot = open2.rootClaimId ?? open2.eventId;
-              if (open2.executionId !== row.executionId || openRoot !== rootClaimId)
-                return {
-                  kind: "selection-unavailable",
-                  addresses: rows.map((item) => item.address),
-                  detail: `open chain member disagrees with reservation root ${rootClaimId}`
-                };
-              if (open2.eventId === rootClaimId)
-                rootCandidates.push({
-                  row,
-                  stableStateBeforeClaim: projection.openClaim.stableStateBeforeClaim,
-                  ...open2.plannedClaimKey === void 0 ? {} : { plannedClaimKey: open2.plannedClaimKey }
-                });
-            }
-            if (rootCandidates.length !== 1)
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `execution ${runId} has ${rootCandidates.length} open root members for ${rootClaimId}`
-              };
-            const selected = rootCandidates[0];
-            if (!selected) continue;
-            if (!selected.plannedClaimKey || !material.some(
-              (claim) => claim.plannedClaimKey === selected.plannedClaimKey
-            ))
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `open root ${rootClaimId} has no matching persisted managed step`
-              };
-            const step = journal.plan.steps.find(
-              (candidate) => candidate.managedClaim?.plannedClaimKey === selected.plannedClaimKey || "plannedClaimKeys" in candidate && Array.isArray(candidate.plannedClaimKeys) && candidate.plannedClaimKeys.includes(
-                selected.plannedClaimKey
-              )
-            );
-            const operationReadBack = step?.operation?.operationKind.name === "CreateUniqueIndexConcurrently" ? async (executor, _address, identity) => {
-              await assertCreateUniqueIndexConcurrentlyRecoveryNotInvalid(
-                executor,
-                step.operation
-              );
-              return {
-                observed: recoveryPayload(identity),
-                effect: "unverifiable"
-              };
-            } : void 0;
-            const indeterminateEvidence = recoveryEvidenceForClaim({
-              journal,
-              row: selected.row,
-              plannedClaimKey: selected.plannedClaimKey,
-              stableStateBeforeClaim: selected.stableStateBeforeClaim
-            });
-            for (const row of rows) {
-              const isRoot = sameLedgerAddress(
-                row.address,
-                selected.row.address
-              );
-              const recovered = await recoverPgOutcomeClaim(owned, {
-                address: row.address,
-                reservations: [row],
-                resolutionEventId: isRoot ? `${rootClaimId}:reconcile:${runId}` : `${rootClaimId}:reconcile:${runId}:${row.address.kind}:${row.address.name}`,
-                acceptedExternalDdlExclusion: isRoot && indeterminateEvidence !== void 0,
-                resolveIndeterminate: true,
-                readBack: async (_executor, _address, identity) => recoveryPayload(identity),
-                ...isRoot && indeterminateEvidence !== void 0 ? { indeterminateEvidence } : {},
-                ...isRoot && operationReadBack !== void 0 ? { operationReadBack } : {}
-              });
-              recovery.push(recoveryReport(row.address, recovered));
-            }
-          }
-          const unresolved = unresolvedRecoveryDetail(recovery);
-          if (unresolved)
-            return {
-              kind: "unresolved",
-              addresses: reservations.map((item) => item.address),
-              detail: unresolved,
-              recovery
-            };
-          return {
-            kind: "completed",
-            addresses: reservations.map((item) => item.address),
-            recovery
-          };
-        } finally {
-          await lease.release();
-        }
-      }
-    );
-    if (locked.kind === "busy")
-      return { outcome: "reconcile-run-unavailable", runId, addresses: [] };
-    if (locked.value.kind === "selection-unavailable")
-      return {
-        outcome: "reconcile-claim-selection-unavailable",
-        runId,
-        addresses: locked.value.addresses,
-        ...locked.value.detail ? { detail: locked.value.detail } : {}
-      };
-    if (locked.value.kind === "database-read-only") {
-      const address = locked.value.addresses[0];
-      return {
-        outcome: "database-read-only",
-        runId,
-        addresses: locked.value.addresses,
-        detail: locked.value.detail,
-        ...address === void 0 ? {} : {
-          refusal: preAppendRefusalFor("ERR-07", {
-            address,
-            state: "unknown"
-          })
-        }
-      };
-    }
-    if (locked.value.kind === "unresolved") {
-      const address = locked.value.addresses[0];
-      const markerRefusal = address !== void 0 && locked.value.detail?.includes("run dbsp preflight --reinitialize") ? preAppendRefusalFor("ERR-03", { address, state: "unknown" }) : void 0;
-      const recoveryRefusal = locked.value.recovery?.find(
-        (report) => report.refusal !== void 0
-      )?.refusal;
-      const refusal = markerRefusal ?? recoveryRefusal;
-      return {
-        outcome: "reconcile-unresolved",
-        runId,
-        addresses: locked.value.addresses,
-        ...locked.value.detail ? { detail: locked.value.detail } : {},
-        ...locked.value.recovery ? { recovery: locked.value.recovery } : {},
-        ...refusal === void 0 ? {} : { refusal }
-      };
-    }
-    return {
-      outcome: "reconcile-completed",
-      runId,
-      addresses: locked.value.addresses,
-      ...locked.value.recovery ? { recovery: locked.value.recovery } : {}
-    };
+    return mapAdapterResult(await reconcilePgTransitionRun(owned, runId));
   } catch (error) {
+    const typed = error instanceof PgReconcileTransitionRunError ? error : void 0;
+    const cause = typed?.originalCause ?? error;
     return {
       outcome: "reconcile-run-unavailable",
       runId,
       addresses: [],
-      detail: escapeDiagnosticText6(
-        error instanceof Error ? error.message : String(error)
+      detail: escapeDiagnosticText7(
+        cause instanceof Error ? cause.message : String(cause)
       ),
-      failureCause: classifyReconcileFailure(error, stage)
+      failureCause: classifyReconcileFailure(
+        cause,
+        typed?.stage ?? "reconcile"
+      )
     };
   } finally {
     if (pool === void 0) await owned.end();
   }
 }
-var reconcileCommand = new Command7("reconcile").description("Resolve this run\u2019s open managed claims from live evidence only").argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--format <format>", "Output format: text or json", "text").action(async (runId, options) => {
+var reconcileCommand = new Command8("reconcile").description("Resolve this run\u2019s open managed claims from live evidence only").argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--format <format>", "Output format: text or json", "text").action(async (runId, options) => {
   const result = await runReconcile(runId, options);
   if (options.format === "json") printCliJson(result);
   else console.log(formatReconcileHuman(result));
@@ -4190,25 +3692,25 @@ var reconcileCommand = new Command7("reconcile").description("Resolve this run\u
 
 // src/commands/recover.ts
 import {
-  assertPgDatabaseWritable as assertPgDatabaseWritable2,
-  createPgTransitionPack as createPgTransitionPack3,
-  isPgDatabaseReadOnlyError as isPgDatabaseReadOnlyError2,
+  assertPgDatabaseWritable,
+  createPgTransitionPack as createPgTransitionPack2,
+  isPgDatabaseReadOnlyError,
   preparePgRecoveryAdmission,
-  readPgLedgerScopeCurrency as readPgLedgerScopeCurrency3,
+  readPgLedgerScopeCurrency,
   readPgObservationContextFromLessor as readPgObservationContextFromLessor2,
-  readTransitionJournal as readTransitionJournal3,
-  withPgTransitionRunLock as withPgTransitionRunLock3
+  readTransitionJournal as readTransitionJournal2,
+  withPgTransitionRunLock as withPgTransitionRunLock2
 } from "@dbsp/adapter-pgsql";
 import {
   acquireTransitionTargetLease,
-  assumptionAccepted as assumptionAccepted2,
-  createApplier as createApplier2,
-  createPackRegistry as createPackRegistry3,
+  assumptionAccepted,
+  createApplier,
+  createPackRegistry as createPackRegistry2,
   loadVerifiedRecoveryJournal,
-  transitionPlanDigest as transitionPlanDigest4,
+  transitionPlanDigest as transitionPlanDigest3,
   validateTransitionRelationalInvariants
 } from "@dbsp/core";
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 var RECOVER_OUTCOME_CONTRACT = [
   ["completed", 0, "all attempted steps were durably reconciled"],
   ["recovery-resume-required", 40, "remaining work requires a new proof"],
@@ -4297,7 +3799,7 @@ function validateRecoveryAuthorization(journal) {
       if (journal.plan.assumptions.every((assumption) => {
         const grant = grants.get(assumption.id);
         const acceptedGrant = grant === void 0 ? void 0 : accepts[grant];
-        return grant !== void 0 && grant >= 0 && grant < accepts.length && acceptedGrant !== void 0 && assumptionAccepted2(assumption, {
+        return grant !== void 0 && grant >= 0 && grant < accepts.length && acceptedGrant !== void 0 && assumptionAccepted(assumption, {
           accepts: [acceptedGrant]
         });
       }))
@@ -4308,7 +3810,7 @@ function validateRecoveryAuthorization(journal) {
   return { ok: false, outcome: "recovery-authorization-invalid" };
 }
 function recoveryPolicyForJournal(loaded, runId) {
-  if (loaded.run.runId !== runId || loaded.run.planDigest !== transitionPlanDigest4(loaded.plan) || !validateTransitionRelationalInvariants({ kind: "plan", plan: loaded.plan }).ok)
+  if (loaded.run.runId !== runId || loaded.run.planDigest !== transitionPlanDigest3(loaded.plan) || !validateTransitionRelationalInvariants({ kind: "plan", plan: loaded.plan }).ok)
     return { ok: false, outcome: "recovery-plan-invalid" };
   return validateRecoveryAuthorization(loaded);
 }
@@ -4336,12 +3838,12 @@ function outcomeForRecoveryResult(result) {
 async function load(target, runId) {
   const lease = await acquireTransitionTargetLease(target);
   try {
-    return await readTransitionJournal3(lease.session, runId, { ensure: false });
+    return await readTransitionJournal2(lease.session, runId, { ensure: false });
   } finally {
     await lease.release();
   }
 }
-function ledgerHome2(address) {
+function ledgerHome(address) {
   if (address.scope === "database") return { scope: "database" };
   if (!address.schema)
     throw new Error(
@@ -4359,24 +3861,24 @@ function recoveryAddresses(journal) {
     return address === void 0 ? [] : [address];
   });
 }
-function formatLedgerHome(home2) {
-  return home2.scope === "database" ? "database" : `schema ${home2.schema}`;
+function formatLedgerHome(home) {
+  return home.scope === "database" ? "database" : `schema ${home.schema}`;
 }
 async function recoverMarkerRefusal(target, journal) {
   const addresses = recoveryAddresses(journal);
   const homes = [];
   for (const address of addresses) {
-    const home2 = ledgerHome2(address);
-    if (homes.some((candidate) => sameLedgerHome(candidate.home, home2)))
+    const home = ledgerHome(address);
+    if (homes.some((candidate) => sameLedgerHome(candidate.home, home)))
       continue;
-    homes.push({ address, home: home2 });
+    homes.push({ address, home });
   }
   const lease = await acquireTransitionTargetLease(target);
   try {
-    for (const { address, home: home2 } of homes) {
-      const currency = await readPgLedgerScopeCurrency3(lease.session, home2);
+    for (const { address, home } of homes) {
+      const currency = await readPgLedgerScopeCurrency(lease.session, home);
       if (currency.kind === "current") continue;
-      const detail = currency.kind === "not-current" && currency.reason === "lineage" ? `ledger lineage mismatch in ${formatLedgerHome(home2)}; run dbsp preflight --reinitialize` : `ledger marker ${currency.marker.kind} in ${formatLedgerHome(home2)}; run dbsp preflight --reinitialize`;
+      const detail = currency.kind === "not-current" && currency.reason === "lineage" ? `ledger lineage mismatch in ${formatLedgerHome(home)}; run dbsp preflight --reinitialize` : `ledger marker ${currency.marker.kind} in ${formatLedgerHome(home)}; run dbsp preflight --reinitialize`;
       return {
         detail,
         refusal: preAppendRefusalFor("ERR-03", {
@@ -4396,7 +3898,7 @@ async function runRecover(runId, options, pool) {
   const owned = pool === void 0 ? (await createDbConnection(options.db)).pool : pool;
   let result;
   try {
-    const locked = await withPgTransitionRunLock3(
+    const locked = await withPgTransitionRunLock2(
       owned,
       runId,
       async (target) => {
@@ -4419,9 +3921,9 @@ async function runRecover(runId, options, pool) {
         }
         const writabilityLease = await acquireTransitionTargetLease(target);
         try {
-          await assertPgDatabaseWritable2(writabilityLease.session);
+          await assertPgDatabaseWritable(writabilityLease.session);
         } catch (error) {
-          if (isPgDatabaseReadOnlyError2(error))
+          if (isPgDatabaseReadOnlyError(error))
             return {
               outcome: "database-read-only",
               detail: error.message
@@ -4442,8 +3944,8 @@ async function runRecover(runId, options, pool) {
         const authorization = loaded.journal.events.length === 0 ? void 0 : recoveryPolicyForJournal(loaded.journal, runId);
         if (authorization && !authorization.ok)
           return { outcome: authorization.outcome };
-        const result2 = await createApplier2(
-          createPackRegistry3([createPgTransitionPack3({})]),
+        const result2 = await createApplier(
+          createPackRegistry2([createPgTransitionPack2({})]),
           { persist: async () => void 0 }
         ).resume(
           loaded.journal,
@@ -4477,7 +3979,7 @@ async function runRecover(runId, options, pool) {
   }
   return result;
 }
-var recoverCommand = new Command8("recover").description(
+var recoverCommand = new Command9("recover").description(
   "Observe and classify an attempted durable run; performs no planned target DDL and does not re-authorize assumptions"
 ).argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").requiredOption(
   "--plan-digest <sha>",
@@ -4513,11 +4015,11 @@ ${RECOVER_OUTCOME_CONTRACT.map(([outcome, code, description]) => `  ${outcome} -
 // src/commands/release.ts
 import {
   createPgTransitionLessor as createPgTransitionLessor5,
-  escapeDiagnosticText as escapeDiagnosticText7,
+  escapeDiagnosticText as escapeDiagnosticText8,
   releasePgManagedAddress
 } from "@dbsp/adapter-pgsql";
 import { acquireTransitionLease as acquireTransitionLease5 } from "@dbsp/core";
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 async function runRelease(selector, options) {
   const { pool } = await createDbConnection(options.db);
   const schema = options.schema ?? "public";
@@ -4552,18 +4054,18 @@ async function runRelease(selector, options) {
 function formatReleaseHuman(result) {
   if (result.outcome === "released") return "released";
   if (result.outcome === "database-read-only")
-    return `database-read-only: ${escapeDiagnosticText7(result.detail)}`;
+    return `database-read-only: ${escapeDiagnosticText8(result.detail)}`;
   if (result.outcome === "release-unavailable")
-    return `release-unavailable: ${escapeDiagnosticText7(result.detail)}`;
+    return `release-unavailable: ${escapeDiagnosticText8(result.detail)}`;
   return [
-    `release-refused: ${escapeDiagnosticText7(result.detail)}`,
-    `address: ${escapeDiagnosticText7(JSON.stringify(result.address))}`,
-    `state: ${escapeDiagnosticText7(result.refusal.state)}`,
-    `withheld authority: ${escapeDiagnosticText7(result.refusal.withheldAuthority)}`,
-    `resolving command: ${escapeDiagnosticText7(result.refusal.resolvingCommand)}`
+    `release-refused: ${escapeDiagnosticText8(result.detail)}`,
+    `address: ${escapeDiagnosticText8(JSON.stringify(result.address))}`,
+    `state: ${escapeDiagnosticText8(result.refusal.state)}`,
+    `withheld authority: ${escapeDiagnosticText8(result.refusal.withheldAuthority)}`,
+    `resolving command: ${escapeDiagnosticText8(result.refusal.resolvingCommand)}`
   ].join("\n");
 }
-var releaseCommand = new Command9("release").description(
+var releaseCommand = new Command10("release").description(
   "End management for one address without touching the database object"
 ).argument("<address>", "Address as name or kind:name").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema <name>", "Schema ledger containing the address", "public").option("--kind <kind>", "Kind for an unqualified address", "table").option(
   "--parent <kind:name>",
@@ -4581,15 +4083,15 @@ var releaseCommand = new Command9("release").description(
     const detail = error instanceof Error ? error.message : String(error);
     if (options.format === "json")
       printCliJson({ outcome: "release-refused", detail });
-    else console.error(`release-refused: ${escapeDiagnosticText7(detail)}`);
+    else console.error(`release-refused: ${escapeDiagnosticText8(detail)}`);
     process.exitCode = 1;
   }
 });
 
 // src/commands/repl.ts
 import { readFileSync } from "fs";
-import { Command as Command10 } from "commander";
-var replCommand = new Command10("repl").description("Launch interactive REPL for exploring schema and queries").option("-s, --schema <path>", "Path to schema file (default: auto-detect)").option(
+import { Command as Command11 } from "commander";
+var replCommand = new Command11("repl").description("Launch interactive REPL for exploring schema and queries").option("-s, --schema <path>", "Path to schema file (default: auto-detect)").option(
   "-d, --db <url>",
   "PostgreSQL connection URL for execution mode (e.g., postgres://localhost/mydb)"
 ).option("-e, --eval <query>", "Execute a single query and exit (batch mode)").option(
@@ -4711,10 +4213,11 @@ function mapReplCasingOption(casing) {
 // src/commands/verify.ts
 import {
   comparePgsqlDatabaseSchema as comparePgsqlDatabaseSchema2,
-  createPgsqlAdapter as createPgsqlAdapter4,
-  escapeDiagnosticText as escapeDiagnosticText8
+  createPgPhysicalModel as createPgPhysicalModel5,
+  createPgsqlAdapter as createPgsqlAdapter3,
+  escapeDiagnosticText as escapeDiagnosticText9
 } from "@dbsp/adapter-pgsql";
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 
 // src/verifier.ts
 var CHANGE_TO_DRIFT = {
@@ -4744,6 +4247,10 @@ var CHANGE_TO_DRIFT = {
   // Column enhancements
   alter_column_collation: { type: "collation_mismatch", severity: "warning" },
   alter_column_identity: { type: "identity_mismatch", severity: "warning" },
+  alter_column_auto_increment: {
+    type: "auto_increment_mismatch",
+    severity: "error"
+  },
   // Comments
   add_comment: { type: "comment_mismatch", severity: "info" },
   drop_comment: { type: "comment_mismatch", severity: "info" },
@@ -4856,7 +4363,7 @@ function formatVerifyResult(result) {
 }
 
 // src/commands/verify.ts
-var verifyCommand = new Command11("verify").description("Compare schema vs real database (drift detection)").option(
+var verifyCommand = new Command12("verify").description("Compare schema vs real database (drift detection)").option(
   "-s, --schema <path>",
   "Path to schema file (default: dbsp.schema.ts)"
 ).requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema-name <name>", "Database schema name (default: public)").option("--json", "Output as JSON").action(
@@ -4874,14 +4381,18 @@ var verifyCommand = new Command11("verify").description("Compare schema vs real
     try {
       const loaded = await loadSchema(schemaPath);
       const schemaModel = loaded.model;
+      const physical = createPgPhysicalModel5({
+        mode: "logical",
+        model: schemaModel,
+        schema: options.schemaName ?? "public",
+        ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+      });
       const { pool } = await createDbConnection(options.db);
       try {
-        const adapter = createPgsqlAdapter4(pool);
-        const diff = await comparePgsqlDatabaseSchema2(adapter, schemaModel, {
-          ...options.schemaName ? { schema: options.schemaName } : {},
-          ...loaded.dbCasing !== void 0 ? { dbCasing: loaded.dbCasing } : {},
+        const adapter = createPgsqlAdapter3(pool);
+        const diff = await comparePgsqlDatabaseSchema2(adapter, physical, {
           onExpressionCanonicalizationWarning: (warning) => console.warn(
-            `\u26A0\uFE0F  [${warning.kind} ${escapeDiagnosticText8(warning.table)}.${escapeDiagnosticText8(warning.name)}] ${warning.message}`
+            `\u26A0\uFE0F  [${warning.kind} ${escapeDiagnosticText9(warning.table)}.${escapeDiagnosticText9(warning.name)}] ${warning.message}`
           )
         });
         const dbModel = await adapter.introspect({
@@ -4918,12 +4429,13 @@ var verifyCommand = new Command11("verify").description("Compare schema vs real
 );
 
 // src/index.ts
-var program = new Command12();
+var program = new Command13();
 var packageJson = createRequire(import.meta.url)("../package.json");
 var jsonFormatCommands = /* @__PURE__ */ new Set([
   "apply",
   "inspect",
   "plan",
+  "migrate",
   "recover",
   "reconcile",
   "release"
@@ -4951,6 +4463,7 @@ program.name("dbsp").description("Schema-first code generation for db-semantic-p
 program.addCommand(generateCommand);
 program.addCommand(introspectCommand);
 program.addCommand(planCommand);
+program.addCommand(migrateCommand);
 program.addCommand(preflightCommand);
 program.addCommand(applyCommand);
 program.addCommand(inspectCommand);