@dbsp/cli 3.0.1 → 4.0.0

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   createDbConnection,
   generateSchemaFileWithDiagnostics,
   redactDbUrl
-} from "./chunk-G6NS4BAV.js";
+} from "./chunk-MFQPE7CY.js";
 import {
   loadSchema,
   loadSchemaFromCwd
@@ -15,7 +15,7 @@ import {
 
 // src/index.ts
 import { createRequire } from "module";
-import { Command as Command12, CommanderError } from "commander";
+import { Command as Command13, CommanderError } from "commander";
 
 // src/commands/apply.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -24,30 +24,31 @@ import { readFile } from "fs/promises";
 import { createInterface } from "readline/promises";
 import {
   appendIntentJournal,
-  appendTransitionAuthorization,
   createPgTransitionLessor as createPgTransitionLessor3,
-  createPgTransitionPack as createPgTransitionPack2,
   escapeDiagnosticText as escapeDiagnosticText3,
-  preparePgExecutionSession,
-  readPgLedgerAddressChain as readPgLedgerAddressChain2,
+  executionIdsForRun,
+  readPgLedgerAddressChain,
   readPgLedgerReservationsForExecution,
   readTransitionJournal,
   TransitionRunIdentityMismatchError,
-  validatePgManagedLedgerCurrency,
   withPgTransitionRunLock
 } from "@dbsp/adapter-pgsql";
-import { lockPgJournalRun } from "@dbsp/adapter-pgsql/internal";
+import {
+  applyPgTransitionRun,
+  comparePgsqlDeclaredAdoptionSchema as comparePgsqlDeclaredAdoptionSchema2,
+  executeGeneratorPlan,
+  lockPgJournalRun,
+  modelForDeclaredAdoption as modelForDeclaredAdoption2
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireExclusiveTransitionLease,
   acquireTransitionLease as acquireTransitionLease3,
-  createApplier,
-  createPackRegistry as createPackRegistry2,
   selectorMatchesResource,
   transitionPlanDigest as transitionPlanDigest2,
-  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest3
+  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest2
 } from "@dbsp/core";
 import { mintDurablyLoadedRun } from "@dbsp/core/internal";
-import { ledgerAddressKey as ledgerAddressKey2, REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
+import { ledgerAddressKey, REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
 import { Command as Command2 } from "commander";
 
 // src/utils/output.ts
@@ -61,907 +62,47 @@ function printCliJson(value) {
   console.log(serializeCliJson(value));
 }
 
-// src/commands/execution-ids.ts
-function executionIdsForRun(journal) {
-  const executionIds = /* @__PURE__ */ new Set([journal.run.runId]);
-  for (const event of journal.events) {
-    const record2 = event.record;
-    if (event.event === "intent" && "executionId" in record2 && typeof record2.executionId === "string")
-      executionIds.add(record2.executionId);
-    if (event.event === "observed" && "intent" in record2 && record2.intent && typeof record2.intent.executionId === "string")
-      executionIds.add(record2.intent.executionId);
-  }
-  if ("generator" in journal.plan)
-    executionIds.add(`dbsp.generator.execution.${journal.run.runId}`);
-  return [...executionIds];
-}
-
-// src/commands/generator-execution.ts
-import { randomUUID } from "crypto";
-import { isDeepStrictEqual } from "util";
-import {
-  assertGeneratedPostconditionSession,
-  compareSchemata,
-  createPgsqlAdapter,
-  decodeGeneratedPostconditionPayload,
-  executePgAdmittedOperation,
-  executePgDeclaredAdoption,
-  executePgPersistedTableReaddress,
-  preflightPgDeclaredAdoption,
-  readPgCatalogueIdentity,
-  readPgLedgerAddressChain,
-  readPgLedgerScopeCurrency,
-  readPgRemovalEffectsClosure,
-  toGeneratedPostconditionBindingAddress,
-  verifyGeneratedCheckPostcondition,
-  verifyGeneratedColumnPostcondition,
-  verifyGeneratedIdentityPostcondition,
-  verifyGeneratedIndexPostcondition,
-  verifyGeneratedTablePostcondition,
-  withGeneratedPostconditionSession
-} from "@dbsp/adapter-pgsql";
-import {
-  canonicalJson,
-  canonicalJsonDigest,
-  outcomeClaimEventId,
-  outcomeClaimId,
-  projectLedgerChain,
-  validateNormalizedManagedStepManifest
-} from "@dbsp/core";
-import { decideDestructiveDecision } from "@dbsp/core/internal";
-import { ledgerAddressKey } from "@dbsp/types";
-function managedSteps(manifest) {
-  return manifest.steps;
-}
-function matchesReviewedReplacementSelector(reviewed, provided) {
-  return provided === reviewed || reviewed.startsWith("table:") && provided === reviewed.slice("table:".length);
-}
-function modelForAdoption(table) {
-  const tables = /* @__PURE__ */ new Map([[table.name, table]]);
-  const relations = /* @__PURE__ */ new Map();
-  return {
-    tables,
-    relations,
-    getTable: (name) => tables.get(name),
-    getRelation: (name) => relations.get(name),
-    getRelationsFrom: () => [],
-    getRelationsTo: () => [],
-    isAmbiguous: () => ({ ambiguous: false, options: [] })
-  };
-}
-async function adoptionShapeMatches(pool, schema, shape) {
-  const live = await createPgsqlAdapter(pool).introspect({ schema });
-  const diff = compareSchemata(modelForAdoption(shape), live);
-  return !diff.changes.some((change) => change.table === shape.name);
-}
-var SYSTEM_LEDGER_SCHEMAS = /* @__PURE__ */ new Set([
-  "pg_toast",
-  "pg_catalog",
-  "information_schema"
-]);
-var SystemSchemaLedgerHomeError = class extends Error {
-  address;
-  constructor(address) {
-    super(
-      `SystemSchemaLedgerHomeError: ledger home is unavailable for system schema ${address.schema}: ${ledgerAddressKey(address)}`
-    );
-    this.name = "SystemSchemaLedgerHomeError";
-    this.address = address;
-  }
-};
-function home(address) {
-  if (address.scope !== "database" && address.schema && SYSTEM_LEDGER_SCHEMAS.has(address.schema))
-    throw new SystemSchemaLedgerHomeError(address);
-  return address.scope === "database" ? { scope: "database" } : address.schema ? { scope: "schema", schema: address.schema } : (() => {
-    throw new Error(
-      `schema-scoped generated address ${address.name} has no schema ledger`
-    );
-  })();
-}
-function acceptance(planDigest, approval) {
-  return approval.approvals.some(
-    (grant) => grant.class === `destructive-plan-accepted:${planDigest}`
-  ) === true ? "destructive-plan-accepted" : "absent";
-}
-function withheldDestructiveAuthority(evidence) {
-  if (evidence.declaration !== "requires-removal" && evidence.declaration !== "requires-lossy-change" && evidence.declaration !== "replacement-requested-by-plan")
-    return "destructive declaration authority";
-  if (evidence.ownership !== "managed-by-me")
-    return "destructive ownership authority";
-  if (evidence.catalogueIdentity !== "matches-recorded")
-    return "destructive catalogue identity authority";
-  if (evidence.operatorAcceptance !== "destructive-plan-accepted")
-    return "destructive operator acceptance authority";
-  if (evidence.containment !== void 0 && evidence.containment !== "all-contained-or-managed")
-    return "destructive containment authority";
-  if (evidence.ledgerLineage !== "matches-database")
-    return "destructive ledger lineage authority";
-  return void 0;
-}
-function withheldDestructiveAuthorityFromReason(reason) {
-  if (reason.includes("operator acceptance"))
-    return "destructive operator acceptance authority";
-  if (reason.includes("ledger lineage"))
-    return "destructive ledger lineage authority";
-  return void 0;
-}
-async function databaseId(pool) {
-  const result = await pool.query("SELECT current_database() AS database_id");
-  const database = result.rows[0]?.database_id;
-  if (typeof database !== "string" || database.length === 0)
-    throw new Error(
-      "schema-differ generator could not read current database identity"
-    );
-  return database;
-}
-async function managed(executor, address) {
-  const chain = await readPgLedgerAddressChain(
-    executor,
-    home(address),
-    address
-  );
-  const projection = projectLedgerChain(chain);
-  return projection.kind === "projected-ledger-chain" && projection.stableState === "managed";
-}
-async function alreadyAppliedCreation(executor, address) {
-  const live = await readPgCatalogueIdentity(executor, address);
-  if (!live?.catalogueIdentity) return false;
-  const chain = await readPgLedgerAddressChain(
-    executor,
-    home(address),
-    address
-  );
-  const projection = projectLedgerChain(chain);
-  const recorded = chain.terminalMember?.catalogueIdentity;
-  return projection.kind === "projected-ledger-chain" && projection.stableState === "managed" && recorded !== void 0 && isDeepStrictEqual(recorded, live.catalogueIdentity);
-}
-function observed(address) {
-  return {
-    value: { kind: address.kind, name: address.name },
-    digest: `generator:${address.kind}:${address.name}`
-  };
-}
-function generatedPayload(value) {
-  const encoded = canonicalJson(value);
-  const normalized = JSON.parse(encoded);
-  return {
-    value: normalized,
-    digest: canonicalJsonDigest(normalized),
-    payloadKind: "generated-structural-observation"
-  };
-}
-async function identityObserved(executor, postcondition, address, kind) {
-  const verified = await verifyGeneratedIdentityPostcondition({
-    session: executor,
-    postcondition,
-    address,
-    kind
-  });
-  const value = JSON.parse(
-    canonicalJson({
-      kind: "identity-observed",
-      observedKind: verified.kind,
-      address: {
-        scope: address.scope,
-        ...address.schema === void 0 ? {} : { schema: address.schema },
-        name: address.name
-      },
-      identity: verified.identity,
-      structuralSemantics: "unverified"
-    })
-  );
-  return {
-    catalogueIdentity: verified.catalogueIdentity,
-    observed: {
-      value,
-      digest: canonicalJsonDigest(value),
-      payloadKind: "generated-identity-observation"
-    }
-  };
-}
-function generatedPostcondition(step, address) {
-  const declaration = step.expectedDeclaration;
-  if (!declaration?.value || typeof declaration.value !== "object" || Array.isArray(declaration.value))
-    throw new Error(
-      `generated ${address.kind} step ${step.stepKey} has no decodable generated declaration`
-    );
-  return decodeGeneratedPostconditionPayload(declaration, step.stepKey);
-}
-async function readGeneratedV3Postcondition(executor, postcondition, address) {
-  const bindingAddress = toGeneratedPostconditionBindingAddress(address);
-  switch (postcondition.declaration.kind) {
-    case "column": {
-      const verified = await verifyGeneratedColumnPostcondition({
-        session: executor,
-        postcondition,
-        address: bindingAddress
-      });
-      return {
-        catalogueIdentity: verified.catalogueIdentity,
-        observed: generatedPayload({
-          kind: "column",
-          type: verified.projection.type,
-          nullable: verified.projection.nullable,
-          ...verified.projection.default === void 0 ? {} : { default: verified.projection.default },
-          ...verified.projection.collation === void 0 ? {} : { collation: verified.projection.collation },
-          ...verified.projection.identity === void 0 ? {} : { identity: verified.projection.identity }
-        })
-      };
-    }
-    case "check": {
-      const verified = await verifyGeneratedCheckPostcondition({
-        session: executor,
-        postcondition,
-        address: bindingAddress
-      });
-      return {
-        catalogueIdentity: verified.catalogueIdentity,
-        observed: generatedPayload({
-          kind: verified.kind,
-          type: "c",
-          expression: verified.projection.expression,
-          validated: verified.projection.validated,
-          noInherit: verified.projection.noInherit,
-          enforced: verified.projection.enforced,
-          isLocal: verified.projection.isLocal,
-          inheritanceCount: verified.projection.inheritanceCount,
-          parentId: verified.projection.parentId
-        })
-      };
-    }
-    case "constraint": {
-      return identityObserved(
-        executor,
-        postcondition,
-        bindingAddress,
-        "constraint"
-      );
-    }
-    case "index": {
-      const verified = await verifyGeneratedIndexPostcondition({
-        session: executor,
-        postcondition,
-        address: bindingAddress
-      });
-      return {
-        catalogueIdentity: verified.catalogueIdentity,
-        observed: generatedPayload({
-          kind: verified.kind,
-          projection: verified.projection
-        })
-      };
-    }
-    case "table": {
-      const verified = await verifyGeneratedTablePostcondition({
-        session: executor,
-        postcondition,
-        address: bindingAddress
-      });
-      return {
-        catalogueIdentity: verified.catalogueIdentity,
-        observed: generatedPayload({
-          kind: verified.kind,
-          columns: verified.projection.columns.map((column) => ({
-            name: column.name,
-            type: column.type,
-            nullable: column.nullable,
-            ...column.default === void 0 ? {} : { default: column.default },
-            ...column.collation === void 0 ? {} : { collation: column.collation },
-            ...column.identity === void 0 ? {} : { identity: column.identity }
-          }))
-        })
-      };
-    }
-    case "enum": {
-      return identityObserved(executor, postcondition, bindingAddress, "enum");
-    }
-    case "sequence": {
-      return identityObserved(
-        executor,
-        postcondition,
-        bindingAddress,
-        "sequence"
-      );
-    }
-    case "extension": {
-      return identityObserved(
-        executor,
-        postcondition,
-        bindingAddress,
-        "extension"
-      );
-    }
-    case "absent": {
-      const live = await readPgCatalogueIdentity(executor, address);
-      if (live)
-        throw new Error(
-          `generated ${address.kind} absence postcondition differs: ${address.name} is still present`
-        );
-      return { observed: generatedPayload({ kind: "absent" }) };
-    }
-    default:
-      throw new Error("generated v3 postcondition has no declarable read-back");
-  }
-}
-async function readGeneratedPostcondition(executor, step, address) {
-  executor = assertGeneratedPostconditionSession(executor);
-  const decodedPostcondition = generatedPostcondition(step, address);
-  if (decodedPostcondition.postconditionVersion === 3)
-    return (await readGeneratedV3Postcondition(
-      executor,
-      decodedPostcondition,
-      address
-    )).observed;
-  throw new Error(
-    "generated postcondition decoder returned no supported version"
-  );
-}
-function containedBy(root, candidate) {
-  for (let parent = candidate.parent; parent; parent = parent.parent) {
-    if (parent.engine === root.engine && parent.database === root.database && parent.schema === root.schema && parent.kind === root.kind && parent.name === root.name)
-      return true;
-  }
-  return false;
-}
-async function destructiveEvidence(input) {
-  const { executor, address } = input;
-  let ownership = "uncomputable";
-  let catalogueIdentity = "catalogue-unavailable";
-  let ledgerLineage = "unreadable";
-  try {
-    const chain = await readPgLedgerAddressChain(
-      executor,
-      home(address),
-      address
-    );
-    const projection = projectLedgerChain(chain);
-    ownership = projection.kind === "projected-ledger-chain" ? projection.stableState === "managed" ? "managed-by-me" : projection.stableState === "unknown" ? "unknown" : "blocked" : "uncomputable";
-    const live = await readPgCatalogueIdentity(executor, address);
-    const recorded = chain.terminalMember?.catalogueIdentity;
-    catalogueIdentity = !live ? "object-absent" : recorded === void 0 ? "differs" : isDeepStrictEqual(live.catalogueIdentity, recorded) ? "matches-recorded" : "differs";
-    const currency = await readPgLedgerScopeCurrency(executor, home(address));
-    ledgerLineage = currency.kind === "current" ? "matches-database" : "differs";
-  } catch {
-  }
-  let containment;
-  let containmentOutcome;
-  if (input.classification === "removal") {
-    containment = await readPgRemovalEffectsClosure({
-      executor,
-      root: address,
-      isManaged: (candidate) => managed(executor, candidate)
-    });
-    containmentOutcome = containment.kind;
-  }
-  return {
-    evidence: {
-      declaration: input.classification === "removal" ? input.selection?.kind === "replacement" ? "replacement-requested-by-plan" : "requires-removal" : "requires-lossy-change",
-      ...input.selection?.kind === "replacement" ? { replacementAddress: address } : {},
-      ownership,
-      catalogueIdentity,
-      operatorAcceptance: acceptance(input.planDigest, input.approval),
-      ...containmentOutcome === void 0 ? {} : { containment: containmentOutcome },
-      ...containment?.kind === "reaches-unmanaged" ? { containmentUnmanaged: containment.unmanaged } : {},
-      ...containment?.kind === "undecidable" ? { containmentReason: containment.reason } : {},
-      ledgerLineage
-    },
-    ...containment === void 0 ? {} : { containment }
-  };
-}
-async function removalContainment(executor, address) {
-  return readPgRemovalEffectsClosure({
-    executor,
-    root: address,
-    isManaged: (candidate) => managed(executor, candidate)
-  });
-}
-async function executeGeneratorPlan(input) {
-  const validation = input.manifest ? { ok: true, manifest: input.manifest } : validateNormalizedManagedStepManifest(
-    input.plan?.steps ?? []
-  );
-  if (!validation.ok)
-    return { outcome: "execution-failed", detail: validation.detail };
-  const manifest = validation.manifest;
-  const approval = input.approval ?? {
-    approvals: (input.accepts ?? []).map((value) => ({ class: value }))
-  };
-  const completedStepKeys = [];
-  let destructiveRefusal;
-  let destructiveClosureReplanRequired = false;
-  const partial = (detail) => completedStepKeys.length === 0 ? { outcome: "execution-failed", detail } : {
-    outcome: "partially-applied",
-    detail,
-    completedStepKeys,
-    notStartedStepKeys: managedSteps(manifest).filter((step) => !completedStepKeys.includes(step.stepKey)).map((step) => step.stepKey)
-  };
-  try {
-    const database = await databaseId(input.pool);
-    const executionId = `dbsp.generator.execution.${randomUUID()}`;
-    await input.recordAttempt(executionId);
-    const steps = managedSteps(manifest);
-    for (const step of steps) {
-      if (step.lifecycle?.kind === "adoption-refused")
-        return {
-          outcome: "adoption-refused",
-          detail: `declared adoption for ${step.address?.name ?? step.stepKey} refuses live shape mismatch`
-        };
-      const lifecycle = step.lifecycle;
-      if (lifecycle?.kind !== "adoption") continue;
-      const address = step.address;
-      if (!address || !step.expectedDeclaration || !step.expectedCatalogueIdentity)
-        return {
-          outcome: "execution-failed",
-          detail: `adoption step ${step.stepKey} has incomplete normalized material`
-        };
-      const preflight = await preflightPgDeclaredAdoption({
-        executor: input.pool,
-        home: home(address),
-        address,
-        declaration: step.expectedDeclaration,
-        expectedCatalogueIdentity: step.expectedCatalogueIdentity,
-        shapeMatches: () => adoptionShapeMatches(input.pool, input.schema, lifecycle.shape)
-      });
-      if (preflight.outcome !== "ready" && preflight.outcome !== "no-op")
-        return preflight.outcome === "adoption-refused" ? { outcome: "adoption-refused", detail: preflight.detail } : { outcome: "execution-failed", detail: preflight.detail };
-    }
-    const replacementSelectors = steps.filter((step) => step.selection?.kind === "replacement").map((step) => step.selection?.selector).filter((selector) => selector !== void 0);
-    if (replacementSelectors.length > 0 && !input.replaces?.length)
-      return {
-        outcome: "destructive-authority-refused",
-        detail: "replacement requires a named --replace selector from the reviewed plan",
-        refusal: { withheldAuthority: "destructive declaration authority" }
-      };
-    for (const selector of input.replaces ?? [])
-      if (!replacementSelectors.some(
-        (reviewed) => matchesReviewedReplacementSelector(reviewed, selector)
-      ))
-        return {
-          outcome: "destructive-authority-refused",
-          detail: `replacement ${selector} was not requested by the reviewed plan`,
-          refusal: { withheldAuthority: "destructive declaration authority" }
-        };
-    if (replacementSelectors.some(
-      (reviewed) => !input.replaces?.some(
-        (provided) => matchesReviewedReplacementSelector(reviewed, provided)
-      )
-    ))
-      return {
-        outcome: "selection-incomplete",
-        detail: "replacement selection does not cover every reviewed replacement"
-      };
-    for (const step of steps) {
-      if (step.lifecycle?.kind === "adoption-refused") continue;
-      if (step.lifecycle?.kind === "adoption") {
-        const lifecycle = step.lifecycle;
-        const address2 = step.address;
-        if (!address2 || !step.expectedDeclaration || !step.expectedCatalogueIdentity)
-          return {
-            outcome: "execution-failed",
-            detail: `adoption step ${step.stepKey} has incomplete normalized material`
-          };
-        const adopted = await executePgDeclaredAdoption({
-          executor: input.pool,
-          run: input.run,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          approval,
-          executionId,
-          step,
-          home: home(address2),
-          address: address2,
-          declaration: step.expectedDeclaration,
-          expectedCatalogueIdentity: step.expectedCatalogueIdentity,
-          shapeMatches: () => adoptionShapeMatches(input.pool, input.schema, lifecycle.shape),
-          ...input.observer === void 0 ? {} : { observer: input.observer }
-        });
-        if (adopted.outcome === "completed" || adopted.outcome === "no-op") {
-          completedStepKeys.push(step.stepKey);
-          continue;
-        }
-        if (adopted.outcome === "adoption-refused")
-          return { outcome: "adoption-refused", detail: adopted.detail };
-        if (adopted.outcome === "recovery-required") return adopted;
-        if (adopted.outcome === "transport-ambiguous") return adopted;
-        return { outcome: "execution-failed", detail: adopted.detail };
-      }
-      if (step.lifecycle?.kind === "readdress") {
-        const result = await executePgPersistedTableReaddress({
-          executor: input.pool,
-          run: input.run,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          approval,
-          executionId,
-          step,
-          database,
-          targetSchema: input.schema,
-          ...input.observer === void 0 ? {} : { observer: input.observer }
-        });
-        if (result.outcome === "completed" || result.outcome === "no-op") {
-          completedStepKeys.push(step.stepKey);
-          continue;
-        }
-        return result;
-      }
-      if (step.statementBundle.statements.length === 0) {
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const address = step.address ?? step.closure?.root;
-      if (!address)
-        return {
-          outcome: "execution-failed",
-          detail: `managed step ${step.stepKey} has no address`
-        };
-      const plannedClaimKey = step.plannedClaimKeys[0];
-      if (!plannedClaimKey)
-        return {
-          outcome: "execution-failed",
-          detail: `managed step ${step.stepKey} has no planned claim key`
-        };
-      if (step.classification === "non-destructive" && step.requiresVacancy && await alreadyAppliedCreation(input.pool, address)) {
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const claimKind = step.claimKind;
-      const rootClaimId = outcomeClaimId(executionId, plannedClaimKey, address);
-      const claim = {
-        claimId: rootClaimId,
-        claimSpecies: "sql-bearing",
-        executionId,
-        plannedClaimKey,
-        claimGroupId: rootClaimId,
-        rootClaimId,
-        address,
-        claimKind,
-        statementBundle: step.statementBundle,
-        requiresVacancy: step.requiresVacancy
-      };
-      const baseReservation = {
-        address,
-        claimKind,
-        executionId,
-        rootClaimId: claim.claimId,
-        homeLedger: home(address)
-      };
-      if (step.classification === "non-destructive") {
-        const result = await executePgAdmittedOperation(input.pool, {
-          run: input.run,
-          approval,
-          manifest,
-          recomputedPlanDigest: input.planDigest,
-          operation: {
-            kind: "single-outcome",
-            request: {
-              plan: claim,
-              reservations: [baseReservation],
-              resolution: {
-                eventId: outcomeClaimEventId(claim.claimId, "observed"),
-                eventKind: "observed"
-              },
-              // Transactional DDL is visible only on the admitted session until
-              // its terminal ledger fact commits with it.
-              readBack: async (session) => readGeneratedPostcondition(session, step, address),
-              recordCatalogueIdentity: true,
-              ...input.observer === void 0 ? {} : { observer: input.observer },
-              vacancy: async (executor) => await readPgCatalogueIdentity(executor, address) ? {
-                kind: "occupied",
-                reason: `creation claim ${claim.claimId} refuses occupied live address ${address.name}`
-              } : { kind: "vacant" }
-            }
-          }
-        });
-        if (result.kind === "outcome-recovery-required")
-          return {
-            outcome: "recovery-required",
-            claimId: result.claimId,
-            detail: `claim ${result.claimId} remains open and requires recovery: ${result.reason}`
-          };
-        if (result.kind === "outcome-transport-ambiguous")
-          return { outcome: "transport-ambiguous", detail: result.reason };
-        if ("reason" in result) return partial(result.reason);
-        completedStepKeys.push(step.stepKey);
-        continue;
-      }
-      const containment = step.classification === "removal" ? await removalContainment(input.pool, address) : void 0;
-      const closureMembers = /* @__PURE__ */ new Map();
-      for (const member of step.closure?.members ?? []) {
-        closureMembers.set(ledgerAddressKey(member.address), {
-          address: member.address,
-          plannedClaimKey: member.plannedClaimKey
-        });
-      }
-      if (containment?.kind === "all-contained-or-managed") {
-        for (const effect of containment.effects) {
-          if (effect.internalOwned) continue;
-          if (!containedBy(address, effect.address)) continue;
-          if (!await managed(input.pool, effect.address)) continue;
-          const key = ledgerAddressKey(effect.address);
-          if (closureMembers.has(key)) continue;
-          closureMembers.set(key, {
-            address: effect.address,
-            plannedClaimKey: `closure:${effect.address.kind}:${effect.address.name}`
-          });
-        }
-      }
-      const containedClaims = [];
-      for (const member of closureMembers.values()) {
-        const effect = member.address;
-        const childClaimId = outcomeClaimId(
-          executionId,
-          plannedClaimKey,
-          effect,
-          member.plannedClaimKey
-        );
-        const childReservation = {
-          ...baseReservation,
-          address: effect,
-          rootClaimId: claim.claimId
-        };
-        containedClaims.push({
-          plan: {
-            ...claim,
-            claimId: childClaimId,
-            claimSpecies: "cascade-covered",
-            address: effect,
-            plannedClaimKey: member.plannedClaimKey,
-            // Each member contributes only its terminal absence fact; SQL is
-            // exclusively carried by the destructive root manifest claim.
-            statementBundle: { statements: [] }
-          },
-          reservation: childReservation
-        });
-      }
-      const admitRequest = {
-        plan: claim,
-        reservations: [baseReservation],
-        members: containedClaims.map(({ plan, reservation }) => ({
-          plan,
-          reservations: [reservation]
-        })),
-        destructiveDecision: async (executor) => {
-          const lockedAuthority = await destructiveEvidence({
-            executor,
-            address,
-            classification: step.classification,
-            selection: step.selection,
-            planDigest: input.planDigest,
-            approval
-          });
-          if (step.classification === "removal" && (containment?.kind !== "all-contained-or-managed" || lockedAuthority.containment?.kind !== "all-contained-or-managed" || containment.closureDigest !== lockedAuthority.containment.closureDigest)) {
-            destructiveClosureReplanRequired = true;
-            const decision2 = decideDestructiveDecision(
-              { kind: "removal", address },
-              { ...lockedAuthority.evidence, containment: "undecidable" }
-            );
-            if (decision2.kind === "destructive-decision-refused")
-              destructiveRefusal = {
-                withheldAuthority: withheldDestructiveAuthority({
-                  ...lockedAuthority.evidence,
-                  containment: "undecidable"
-                }) ?? "destructive containment authority"
-              };
-            return decision2;
-          }
-          const decision = decideDestructiveDecision(
-            {
-              kind: step.classification === "removal" ? "removal" : "data-destructive",
-              address,
-              ...step.classification === "removal" && lockedAuthority.containment?.kind === "all-contained-or-managed" ? { closureDigest: lockedAuthority.containment.closureDigest } : {}
-            },
-            lockedAuthority.evidence
-          );
-          if (decision.kind === "destructive-decision-refused")
-            destructiveRefusal = {
-              withheldAuthority: withheldDestructiveAuthority(lockedAuthority.evidence) ?? "destructive authority"
-            };
-          return decision;
-        },
-        ...input.observer === void 0 ? {} : { observer: input.observer }
-      };
-      const executed = await executePgAdmittedOperation(input.pool, {
-        run: input.run,
-        approval,
-        manifest,
-        recomputedPlanDigest: input.planDigest,
-        operation: {
-          kind: "destructive-outcome",
-          request: admitRequest,
-          readBackAndResolve: async (session) => {
-            const declarationReadBack = step.classification === "data-destructive" && step.expectedDeclaration !== void 0 ? await withGeneratedPostconditionSession(
-              {
-                connect: async () => ({
-                  query: session.query.bind(session),
-                  release: () => void 0
-                })
-              },
-              (proof) => {
-                const postcondition = generatedPostcondition(
-                  step,
-                  address
-                );
-                if (postcondition.postconditionVersion !== 3)
-                  throw new Error(
-                    "generated postcondition decoder returned no supported version"
-                  );
-                return readGeneratedV3Postcondition(
-                  proof,
-                  postcondition,
-                  address
-                );
-              }
-            ) : void 0;
-            const live = step.classification === "removal" ? await readPgCatalogueIdentity(session, address) : void 0;
-            const terminalCatalogueIdentity = step.classification === "removal" ? live?.catalogueIdentity : declarationReadBack?.catalogueIdentity;
-            const survivors = step.classification === "removal" && live ? [address] : [];
-            const childLives = await Promise.all(
-              containedClaims.map(async (child) => ({
-                child,
-                live: await readPgCatalogueIdentity(
-                  session,
-                  child.plan.address
-                )
-              }))
-            );
-            for (const { child, live: childLive } of childLives)
-              if (childLive) survivors.push(child.plan.address);
-            if (survivors.length > 0) {
-              const survivorNames = survivors.map(
-                (survivor) => `${survivor.kind} ${survivor.schema ?? "<database>"}.${survivor.name}`
-              );
-              const survivorValue = { survivors: survivorNames };
-              const survivorObservation = {
-                value: survivorValue,
-                digest: canonicalJsonDigest(survivorValue)
-              };
-              return {
-                rootClaimId: claim.claimId,
-                members: [
-                  {
-                    target: home(address),
-                    member: {
-                      eventId: outcomeClaimEventId(
-                        claim.claimId,
-                        "indeterminate"
-                      ),
-                      executionId,
-                      plannedClaimKey: claim.plannedClaimKey,
-                      claimGroupId: claim.claimGroupId,
-                      rootClaimId: claim.rootClaimId,
-                      address,
-                      eventKind: "indeterminate",
-                      observed: survivorObservation
-                    }
-                  },
-                  ...containedClaims.map((child) => ({
-                    target: home(child.plan.address),
-                    member: {
-                      eventId: outcomeClaimEventId(
-                        child.plan.claimId,
-                        "indeterminate"
-                      ),
-                      executionId,
-                      plannedClaimKey: child.plan.plannedClaimKey,
-                      claimGroupId: claim.claimId,
-                      rootClaimId: claim.claimId,
-                      address: child.plan.address,
-                      eventKind: "indeterminate",
-                      observed: survivorObservation
-                    }
-                  }))
-                ],
-                reservations: [
-                  baseReservation,
-                  ...containedClaims.map(({ reservation }) => reservation)
-                ]
-              };
-            }
-            const terminals = [
-              {
-                target: home(address),
-                member: {
-                  eventId: outcomeClaimEventId(
-                    claim.claimId,
-                    step.classification === "removal" ? "absent" : "observed"
-                  ),
-                  executionId,
-                  plannedClaimKey: claim.plannedClaimKey,
-                  claimGroupId: claim.claimGroupId,
-                  rootClaimId: claim.rootClaimId,
-                  address,
-                  eventKind: step.classification === "removal" ? "absent" : "observed",
-                  // The append protocol reads this address's terminal on its
-                  // pinned transaction session after the post-DDL read-back.
-                  ...terminalCatalogueIdentity === void 0 ? {} : { catalogueIdentity: terminalCatalogueIdentity },
-                  ...step.classification === "removal" ? {} : {
-                    observed: declarationReadBack?.observed ?? observed(address)
-                  }
-                }
-              }
-            ];
-            for (const child of containedClaims) {
-              terminals.push({
-                target: home(child.plan.address),
-                member: {
-                  eventId: outcomeClaimEventId(child.plan.claimId, "absent"),
-                  executionId,
-                  plannedClaimKey: child.plan.plannedClaimKey,
-                  claimGroupId: claim.claimId,
-                  rootClaimId: claim.claimId,
-                  address: child.plan.address,
-                  eventKind: "absent",
-                  predecessor: child.plan.claimId
-                }
-              });
-            }
-            return {
-              rootClaimId: claim.claimId,
-              members: terminals,
-              reservations: [
-                baseReservation,
-                ...containedClaims.map(({ reservation }) => reservation)
-              ]
-            };
-          }
-        }
-      });
-      if (executed.kind === "outcome-recovery-required")
-        return {
-          outcome: "recovery-required",
-          claimId: executed.claimId,
-          detail: `claim ${executed.claimId} remains open and requires recovery: ${executed.reason}`
-        };
-      if (executed.kind === "outcome-transport-ambiguous")
-        return { outcome: "transport-ambiguous", detail: executed.reason };
-      if (executed.kind === "outcome-protocol-pending")
-        return partial(
-          `destructive claim ${claim.claimId} remains pending after executing: ${executed.reason}`
-        );
-      if (executed.kind !== "executed-destructive-outcome")
-        return {
-          outcome: "destructive-authority-refused",
-          detail: destructiveClosureReplanRequired ? `${executed.reason}; destructive closure changed under lock; replan required` : executed.reason,
-          ...destructiveRefusal === void 0 && withheldDestructiveAuthorityFromReason(executed.reason) === void 0 ? {} : {
-            refusal: destructiveRefusal ?? {
-              withheldAuthority: withheldDestructiveAuthorityFromReason(executed.reason) ?? "destructive authority"
-            }
-          }
-        };
-      completedStepKeys.push(step.stepKey);
-    }
-    return { outcome: "completed" };
-  } catch (error) {
-    return partial(error instanceof Error ? error.message : String(error));
-  }
-}
-
 // src/commands/generator-plan.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
 import {
   assertDeclarableChangeKind,
   classifyGeneratedMutation,
   comparePgsqlDatabaseSchema,
-  createPgsqlAdapter as createPgsqlAdapter2,
+  createPgPhysicalModel,
+  createPgsqlAdapter,
   createPgsqlGeneratedManagedStep,
   createPgTransitionLessor,
   createPgTransitionRunPersister,
   generatedPostconditionForChange,
   generateMigrationSQL,
-  readPgCatalogueIdentity as readPgCatalogueIdentity2,
+  ReferencedKeyRemovalError,
+  readPgCatalogueIdentity,
   renderPgTableReaddressStatements
 } from "@dbsp/adapter-pgsql";
+import {
+  collectReferencedKeyRemovalConflicts,
+  comparePgsqlDeclaredAdoptionSchema,
+  createPgsqlDeclaredAdoptionStep,
+  generateMigrationSQL as generateMigrationSQLForPhysicalDiff,
+  modelForDeclaredAdoption,
+  pgsqlDeclaredAdoptionDeclaration
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireTransitionLease,
-  canonicalJson as canonicalJson2,
-  canonicalJsonDigest as canonicalJsonDigest2,
+  canonicalJsonDigest,
   transitionPlanDigest,
-  validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest2
+  validateNormalizedManagedStepManifest
 } from "@dbsp/core";
-function adoptionDeclaration(table) {
-  const value = JSON.parse(
-    canonicalJson2({ kind: "table", name: table.name, shape: table })
-  );
-  return { value, digest: canonicalJsonDigest2(value) };
+function decodeGeneratorPlanMaterial(material) {
+  if (material === null || typeof material !== "object" || Array.isArray(material) || !("kind" in material) || material.kind !== "schema-differ-generator")
+    throw new Error("persisted generator material has an invalid kind");
+  const dbCasing = "dbCasing" in material ? material.dbCasing : void 0;
+  if (dbCasing !== void 0 && dbCasing !== "snake_case" && dbCasing !== "camelCase")
+    throw new Error("persisted generator material has an invalid dbCasing");
+  return {
+    ...material,
+    dbCasing: dbCasing ?? "preserve"
+  };
 }
 function replacementStatements(table, schema) {
   const quote = (value) => `"${value.replaceAll('"', '""')}"`;
@@ -985,7 +126,7 @@ function replacementStatements(table, schema) {
   };
   return {
     retireStatements: [`DROP TABLE ${quote(schema)}.${quote(table.name)}`],
-    createStatements: generateMigrationSQL(createDiff, {
+    createStatements: generateMigrationSQLForPhysicalDiff(createDiff, {
       includeDestructive: true,
       schemaName: schema
     })
@@ -1104,6 +245,65 @@ function changeTargetsDeclaredTable(change, table) {
     "alter_sequence"
   ])).has(change.kind);
 }
+function getGeneratorPhase(kind) {
+  switch (kind) {
+    case "drop_foreign_key":
+    case "drop_check_constraint":
+      return 0;
+    case "drop_index":
+      return 1;
+    case "drop_column":
+      return 2;
+    case "drop_primary_key":
+      return 3;
+    case "drop_table":
+    case "drop_enum":
+    case "drop_extension":
+    case "drop_sequence":
+      return 4;
+    case "create_enum":
+    case "create_extension":
+    case "create_sequence":
+      return 5;
+    case "create_table":
+    case "readdress_table":
+      return 6;
+    case "add_column":
+      return 7;
+    case "alter_sequence":
+    case "alter_column_type":
+    case "alter_column_nullable":
+    case "alter_column_default":
+    case "alter_column_collation":
+    case "alter_column_identity":
+    case "alter_column_auto_increment":
+      return 8;
+    case "alter_column_unique":
+    case "add_primary_key":
+      return 9;
+    case "create_index":
+      return 10;
+    case "add_foreign_key":
+      return 11;
+    case "alter_foreign_key":
+      return 12;
+    case "add_check_constraint":
+      return 13;
+    case "alter_enum_add_value":
+      return 14;
+    case "add_comment":
+    case "drop_comment":
+      return 15;
+    case "validate_constraint":
+      return 16;
+    case "enable_rls":
+    case "disable_rls":
+      return 17;
+    case "create_policy":
+    case "drop_policy":
+      return 18;
+  }
+}
 function requiredAdoptionIdentity(identities, table) {
   const identity = identities.get(table);
   if (!identity)
@@ -1111,7 +311,7 @@ function requiredAdoptionIdentity(identities, table) {
   return identity;
 }
 function asDurableGeneratorPlan(material, steps) {
-  const validation = validateNormalizedManagedStepManifest2(steps);
+  const validation = validateNormalizedManagedStepManifest(steps);
   if (!validation.ok)
     throw new Error(
       `generator planning refuses invalid managed-step manifest: ${validation.detail}`
@@ -1146,7 +346,7 @@ function render(plan, planDigest) {
     ]
   ].join("\n");
 }
-async function databaseId2(pool) {
+async function databaseId(pool) {
   const result = await pool.query("SELECT current_database() AS database_id");
   const value = result.rows[0]?.database_id;
   if (typeof value !== "string" || value.length === 0)
@@ -1157,19 +357,39 @@ async function databaseId2(pool) {
 }
 async function runGeneratorPlan(input) {
   const loaded = await loadSchema(input.schemaFile);
+  for (const sequence of loaded.model.sequences?.values() ?? []) {
+    if (sequence.adopt === true)
+      throw new Error(
+        `generator planning refuses sequence adoption for ${sequence.name}: sequence adoption is available through convergePg / dbsp migrate`
+      );
+  }
+  const schema = input.schema ?? "public";
+  const dbCasing = loaded.dbCasing ?? "preserve";
+  const physical = createPgPhysicalModel({
+    mode: "logical",
+    model: loaded.model,
+    schema,
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
+  const physicalTable = (name) => physical.inventory.get({ kind: "table", schema, name });
+  for (const table of loaded.model.tables.values()) {
+    if (table.replace !== true) continue;
+    const physicalName = physicalTable(table.name);
+    if (physicalName !== table.name)
+      throw new Error(
+        `generator planning refuses replacement ${table.name}: dbCasing addresses physical table ${physicalName}; replacement requires preserve casing`
+      );
+  }
   const { pool } = await createDbConnection(input.db);
   try {
-    const schema = input.schema ?? "public";
     const diff = await comparePgsqlDatabaseSchema(
-      createPgsqlAdapter2(pool),
-      loaded.model,
+      createPgsqlAdapter(pool),
+      physical,
       {
-        schema,
         // `apply --schema` owns one schema. Extensions are database-scoped,
         // so an extension not declared by this schema must not become a
         // schema-plan removal merely because it is installed in the database.
-        ignoreUnmanagedExtensions: true,
-        ...loaded.dbCasing ? { dbCasing: loaded.dbCasing } : {}
+        ignoreUnmanagedExtensions: true
       }
     );
     const declaredLifecycleWork = [...loaded.model.tables.values()].some(
@@ -1198,39 +418,57 @@ async function runGeneratorPlan(input) {
         planDigest: null
       };
     }
-    const adoptionMismatches = new Set(
-      [...loaded.model.tables.values()].filter(
-        (table) => table.adopt === true && diff.changes.some(
-          (change) => changeTargetsDeclaredTable(change, table.name)
-        )
-      ).map((table) => table.name)
-    );
-    const database = await databaseId2(pool);
+    const adoptionPhysicalNames = /* @__PURE__ */ new Map();
+    const adoptionMismatches = /* @__PURE__ */ new Set();
+    for (const table of loaded.model.tables.values()) {
+      if (table.adopt !== true) continue;
+      const physicalName = physicalTable(table.name);
+      adoptionPhysicalNames.set(table.name, physicalName);
+      const compared = await comparePgsqlDeclaredAdoptionSchema({
+        executor: pool,
+        model: modelForDeclaredAdoption(table),
+        schema,
+        dbCasing
+      });
+      if (compared.changes.length > 0) adoptionMismatches.add(physicalName);
+    }
+    const database = await databaseId(pool);
     const adoptionIdentities = /* @__PURE__ */ new Map();
     for (const table of loaded.model.tables.values()) {
-      if (table.adopt !== true || adoptionMismatches.has(table.name)) continue;
-      const live = await readPgCatalogueIdentity2(pool, {
+      const physicalName = adoptionPhysicalNames.get(table.name);
+      if (table.adopt !== true || physicalName === void 0 || adoptionMismatches.has(physicalName))
+        continue;
+      const live = await readPgCatalogueIdentity(pool, {
         engine: "postgresql",
         database,
         schema: input.schema ?? "public",
         kind: "table",
-        name: table.name
+        name: physicalName
       });
       if (!live?.catalogueIdentity)
         throw new Error(
-          `declared adoption for ${table.name} refuses absent live identity`
+          `declared adoption for ${physicalName} refuses absent live identity`
         );
-      adoptionIdentities.set(table.name, live.catalogueIdentity);
+      adoptionIdentities.set(physicalName, live.catalogueIdentity);
     }
     const executableDiff = {
       ...diff,
       changes: diff.changes.filter(
         (change) => ![...loaded.model.tables.values()].some(
-          (table) => (table.adopt === true || table.replace === true) && changeTargetsDeclaredTable(change, table.name)
+          (table) => (table.adopt === true || table.replace === true) && changeTargetsDeclaredTable(
+            change,
+            table.adopt === true ? adoptionPhysicalNames.get(table.name) ?? table.name : table.name
+          )
         )
       )
     };
-    const ordinaryChanges = executableDiff.changes.map((change) => ({
+    const phaseOrderedChanges = [...executableDiff.changes].sort(
+      (left, right) => getGeneratorPhase(left.kind) - getGeneratorPhase(right.kind)
+    );
+    const referencedKeyConflicts = collectReferencedKeyRemovalConflicts(phaseOrderedChanges);
+    if (referencedKeyConflicts.length > 0)
+      throw new ReferencedKeyRemovalError(referencedKeyConflicts);
+    const ordinaryChanges = phaseOrderedChanges.map((change) => ({
       kind: change.kind,
       table: change.table,
       ...change.column ? { column: change.column } : {},
@@ -1241,45 +479,54 @@ async function runGeneratorPlan(input) {
         schema,
         change.meta.readdress
       ) : generateMigrationSQL(
-        { ...executableDiff, changes: [change] },
-        { includeDestructive: true, schemaName: schema }
+        { ...executableDiff, physical: diff.physical, changes: [change] },
+        { includeDestructive: true }
       ),
       ...change.kind === "readdress_table" && change.meta?.readdress ? { readdress: change.meta.readdress } : {}
     }));
     const material = {
       kind: "schema-differ-generator",
       planningSchema: schema,
+      ...dbCasing === "preserve" ? {} : { dbCasing },
       changes: [
         ...ordinaryChanges,
-        ...[...loaded.model.tables.values()].filter((table) => adoptionMismatches.has(table.name)).map((table) => ({
-          kind: "adoption_refused",
-          table: table.name,
-          classification: "non-destructive",
-          details: `Refuse adoption of table "${table.name}": live shape does not match declaration`,
-          statements: []
-        })),
-        // `comparePgsqlDatabaseSchema` has just compared each side through
-        // the established live canonicalisation path. An adopted table is
-        // admitted only when that comparison has no remaining change for it.
-        ...[...loaded.model.tables.values()].filter(
-          (table) => table.adopt === true && !diff.changes.some(
-            (change) => changeTargetsDeclaredTable(change, table.name)
-          )
-        ).map((table) => ({
-          kind: "adopt_table",
-          table: table.name,
-          classification: "non-destructive",
-          details: `Adopt existing table "${table.name}" after live shape match`,
-          statements: [],
-          adoption: {
-            declaration: adoptionDeclaration(table),
-            shape: table,
-            catalogueIdentity: requiredAdoptionIdentity(
-              adoptionIdentities,
-              table.name
-            )
-          }
-        })),
+        ...[...loaded.model.tables.values()].flatMap((table) => {
+          const physicalName = adoptionPhysicalNames.get(table.name);
+          if (physicalName === void 0 || !adoptionMismatches.has(physicalName))
+            return [];
+          return [
+            {
+              kind: "adoption_refused",
+              table: physicalName,
+              classification: "non-destructive",
+              details: `Refuse adoption of table "${physicalName}": live shape does not match declaration`,
+              statements: []
+            }
+          ];
+        }),
+        // Adoption is admitted only by its declaration-scoped comparison.
+        ...[...loaded.model.tables.values()].flatMap((table) => {
+          const physicalName = adoptionPhysicalNames.get(table.name);
+          if (table.adopt !== true || physicalName === void 0 || adoptionMismatches.has(physicalName))
+            return [];
+          return [
+            {
+              kind: "adopt_table",
+              table: physicalName,
+              classification: "non-destructive",
+              details: `Adopt existing table "${physicalName}" after live shape match`,
+              statements: [],
+              adoption: {
+                declaration: pgsqlDeclaredAdoptionDeclaration(table),
+                shape: table,
+                catalogueIdentity: requiredAdoptionIdentity(
+                  adoptionIdentities,
+                  physicalName
+                )
+              }
+            }
+          ];
+        }),
         ...[...loaded.model.tables.values()].filter((table) => table.replace === true).map((table) => ({
           kind: "replace_table",
           table: table.name,
@@ -1291,7 +538,7 @@ async function runGeneratorPlan(input) {
       ]
     };
     const ordinaryStepSources = [];
-    for (const [changeIndex, change] of executableDiff.changes.entries()) {
+    for (const [changeIndex, change] of phaseOrderedChanges.entries()) {
       const generated = ordinaryChanges[changeIndex];
       if (!generated)
         throw new Error(
@@ -1408,18 +655,27 @@ async function runGeneratorPlan(input) {
         continue;
       }
       if (change.kind === "adopt_table" && change.adoption) {
-        lifecycleSteps.push(
-          lifecycleStep({
-            ...base,
-            stepKey: `generator:${base.order}:adoption`,
-            classification: "non-destructive",
-            selection: { kind: "adoption", selector: `table:${change.table}` },
-            expectedDeclaration: change.adoption.declaration,
-            expectedCatalogueIdentity: change.adoption.catalogueIdentity,
-            claimKind: "adopt-intent",
-            lifecycle: { kind: "adoption", shape: change.adoption.shape }
-          })
-        );
+        const adoptionStep = createPgsqlDeclaredAdoptionStep({
+          address: {
+            scope: "schema",
+            engine: "postgresql",
+            database,
+            schema,
+            kind: "table",
+            name: change.table
+          },
+          table: change.adoption.shape,
+          stepKey: `generator:${base.order}:adoption`,
+          order: base.order,
+          catalogueIdentity: change.adoption.catalogueIdentity
+        });
+        lifecycleSteps.push({
+          ...adoptionStep,
+          selection: {
+            kind: "adoption",
+            selector: `table:${change.table}`
+          }
+        });
         continue;
       }
       lifecycleSteps.push(
@@ -1456,13 +712,13 @@ async function runGeneratorPlan(input) {
       plan
     );
     const run = {
-      runId: `dbsp-generator-${randomUUID2()}`,
+      runId: `dbsp-generator-${randomUUID()}`,
       planDigest,
-      targetContextDigest: canonicalJsonDigest2({
-        database: await databaseId2(pool),
+      targetContextDigest: canonicalJsonDigest({
+        database: await databaseId(pool),
         schema
       }),
-      databaseId: await databaseId2(pool),
+      databaseId: await databaseId(pool),
       coreVersion: "schema-differ-generator-v1",
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       replayability: material.changes.some(
@@ -1501,20 +757,25 @@ async function runGeneratorPlan(input) {
 import {
   acquirePgTransitionClient,
   createPgExecutionContract,
-  createPgsqlAdapter as createPgsqlAdapter3,
+  createPgPhysicalModel as createPgPhysicalModel2,
+  createPgsqlAdapter as createPgsqlAdapter2,
   createPgTransitionLessor as createPgTransitionLessor2,
   createPgTransitionPack,
   createPgTransitionRunPersister as createPgTransitionRunPersister2,
   ensureTransitionJournal,
   escapeDiagnosticText,
-  getNamingPluginForDbCasing,
   PgExecutionContractDerivationError,
   pgTargetIdentityMismatch,
   readPgExecutionTargetFromClient,
   readPgObservationContextFromLessor
 } from "@dbsp/adapter-pgsql";
+import {
+  PgTransitionRunPersistenceIndeterminateError,
+  planPgTransitionRun
+} from "@dbsp/adapter-pgsql/internal";
 import {
   acquireTransitionLease as acquireTransitionLease2,
+  assertCanonicalizableJson,
   bindDeclarationSet,
   bindExecutionContract,
   createComparator,
@@ -1525,6 +786,7 @@ import {
   validateDeclarationModel
 } from "@dbsp/core";
 import { Command } from "commander";
+var planPhysicalPgTransitionRun = planPgTransitionRun;
 var PlanPersistenceIndeterminateError = class extends Error {
   runId;
   result;
@@ -1574,6 +836,15 @@ var PlanOperationAndCleanupError = class extends AggregateError {
   cleanupError;
 };
 var noCleanupFailure = { kind: "not-failed" };
+function validateSourceDeclarationValues(model) {
+  for (const [tableKey, table] of model.tables)
+    for (const [index, column] of table.columns.entries())
+      if (column.default !== void 0)
+        assertCanonicalizableJson(
+          column.default,
+          `schema.tables[${JSON.stringify(tableKey)}].columns[${index}].default`
+        );
+}
 function equivalenceContext(context) {
   return {
     engine: context.engine,
@@ -1654,20 +925,20 @@ var defaultPlanDeps = {
   async loadCurrent(pool, schema, expectedTargetIdentity) {
     const lease = await acquirePgTransitionClient(pool);
     try {
-      const observed2 = await readPgExecutionTargetFromClient(
+      const observed = await readPgExecutionTargetFromClient(
         lease.client,
         [schema ?? "public"]
       );
       const mismatch = pgTargetIdentityMismatch(
         expectedTargetIdentity,
-        observed2.identity
+        observed.identity
       );
       if (mismatch) {
         throw new Error(
           `PostgreSQL introspection target identity does not match the captured target: ${mismatch}`
         );
       }
-      return await createPgsqlAdapter3(lease.client, {
+      return await createPgsqlAdapter2(lease.client, {
         borrowedClient: true
       }).introspect(schema === void 0 ? {} : { schema });
     } finally {
@@ -1682,18 +953,14 @@ var defaultPlanDeps = {
       expectedTargetIdentity
     );
   },
-  createPlanner(loaded) {
-    const registry2 = createPackRegistry([
-      createPgTransitionPack({
-        ...loaded.dbCasing ? { dbCasing: loaded.dbCasing } : {}
-      })
-    ]);
-    const comparator = createComparator(registry2);
-    const prover = createProver(registry2);
+  createPlanner() {
+    const registry = createPackRegistry([createPgTransitionPack()]);
+    const comparator = createComparator(registry);
+    const prover = createProver(registry);
     return {
       compare: (desired, current, context) => comparator.compare(desired, current, equivalenceContext(context)),
       prove: (compare, pool, context) => prover.prove(compare, createPgTransitionLessor2(pool), context),
-      render: (plan, context) => renderProvenPlanSql(registry2, plan, context)
+      render: (plan, context) => renderProvenPlanSql(registry, plan, context)
     };
   },
   async persist(pool, run, plan) {
@@ -1728,9 +995,9 @@ function executionContractBlockedAssessment(error) {
     ]
   };
 }
-function renderProvenPlanSql(registry2, plan, context) {
+function renderProvenPlanSql(registry, plan, context) {
   const statements = plan.steps.map((step) => {
-    const resolution = registry2.resolveOperation(step.operation);
+    const resolution = registry.resolveOperation(step.operation);
     if (!resolution.ok || !resolution.semantics.renderPlanSql) {
       throw new Error(
         `no SQL renderer is registered for proven operation ${step.operation.operationKind.name}`
@@ -1750,126 +1017,170 @@ async function runPlan(options, overrides) {
     throw new Error(`unsupported plan format ${format}; expected sql or json`);
   }
   const loaded = await deps.loadSchema(options.schemaFile);
-  validateDeclarationModel(loaded.model);
+  validateSourceDeclarationValues(loaded.model);
+  const physical = createPgPhysicalModel2({
+    mode: "logical",
+    model: loaded.model,
+    schema: options.schema ?? "public",
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
+  validateDeclarationModel(physical.model);
   const connection = await deps.createDbConnection(options.db);
   const { pool } = connection;
   let result;
+  let renderedSql;
   let operationError;
-  let failed = false;
-  try {
-    const targetIdentity = await deps.captureTargetIdentity(
-      pool,
-      options.schema
-    );
-    await deps.ensureTransitionJournal(pool);
-    const current = await deps.loadCurrent(
-      pool,
-      options.schema,
-      targetIdentity
-    );
-    const context = await deps.readContext(
-      pool,
-      options.schema,
-      targetIdentity
-    );
-    const planner = deps.createPlanner(loaded);
-    const compare = planner.compare(loaded.model, current, context);
-    const prove = await planner.prove(compare, pool, context);
-    if (prove.kind === "proven") {
-      let executionContract;
-      try {
-        executionContract = await deps.buildExecutionContract(
-          pool,
-          options.schema,
-          prove.plan,
-          targetIdentity
-        );
-      } catch (error) {
-        if (!(error instanceof PgExecutionContractDerivationError)) throw error;
+  let failed = false;
+  try {
+    if (overrides === void 0) {
+      const lifecycle = await planPhysicalPgTransitionRun(
+        physical,
+        async (client, schema) => createPgsqlAdapter2(client, {
+          borrowedClient: true
+        }).introspect(schema === void 0 ? {} : { schema }),
+        pool,
+        {
+          persist: options.dryRun !== true,
+          beforePersist: async (plan, proofContext) => {
+            renderedSql = deps.createPlanner().render(plan, proofContext);
+          }
+        }
+      );
+      if (lifecycle.kind === "proven") {
+        if (renderedSql === void 0)
+          throw new Error("internal error: durable plan SQL was not rendered");
         result = {
-          compareKind: compare.kind,
-          proveKind: "blocked",
-          assessment: executionContractBlockedAssessment(error),
+          compareKind: lifecycle.compare.kind,
+          proveKind: "proven",
+          assessment: lifecycle.assessment,
+          persisted: options.dryRun !== true,
+          runId: options.dryRun === true ? null : lifecycle.run.runId,
+          planDigest: lifecycle.run.planDigest,
+          plan: lifecycle.plan,
+          sql: renderedSql
+        };
+      } else {
+        result = {
+          compareKind: lifecycle.compare.kind,
+          proveKind: lifecycle.kind,
+          assessment: lifecycle.assessment,
           persisted: false,
           runId: null,
           planDigest: null
         };
       }
-      if (executionContract !== void 0) {
-        const contractedPlan = bindExecutionContract(
-          prove.plan,
-          executionContract
-        );
-        const durablePlan = bindDeclarationSet(
-          contractedPlan,
-          declarationSetFromModel(
-            loaded.model,
-            {
+    } else {
+      const targetIdentity = await deps.captureTargetIdentity(
+        pool,
+        physical.schema
+      );
+      await deps.ensureTransitionJournal(pool);
+      const current = await deps.loadCurrent(
+        pool,
+        physical.schema,
+        targetIdentity
+      );
+      const context = await deps.readContext(
+        pool,
+        physical.schema,
+        targetIdentity
+      );
+      const planner = deps.createPlanner();
+      const compare = planner.compare(physical.model, current, context);
+      const prove = await planner.prove(compare, pool, context);
+      if (prove.kind === "proven") {
+        let executionContract;
+        try {
+          executionContract = await deps.buildExecutionContract(
+            pool,
+            physical.schema,
+            prove.plan,
+            targetIdentity
+          );
+        } catch (error) {
+          if (!(error instanceof PgExecutionContractDerivationError))
+            throw error;
+          result = {
+            compareKind: compare.kind,
+            proveKind: "blocked",
+            assessment: executionContractBlockedAssessment(error),
+            persisted: false,
+            runId: null,
+            planDigest: null
+          };
+        }
+        if (executionContract !== void 0) {
+          const contractedPlan = bindExecutionContract(
+            prove.plan,
+            executionContract
+          );
+          const durablePlan = bindDeclarationSet(
+            contractedPlan,
+            declarationSetFromModel(physical.model, {
               engine: context.engine,
               database: context.databaseId,
-              schema: options.schema ?? "public"
-            },
-            getNamingPluginForDbCasing(loaded.dbCasing ?? "preserve")
-          )
-        );
-        const run = createTransitionRunMetadata(durablePlan);
-        const proofContext = prove.plan.observations.find(
-          (observation) => observation.role === "evidence"
-        )?.context;
-        if (!proofContext) {
-          throw new Error(
-            "internal error: minted proven plan has no evidence observation context"
+              schema: physical.schema
+            })
           );
-        }
-        const sql = planner.render(durablePlan, proofContext);
-        if (!options.dryRun) {
-          try {
-            await deps.persist(pool, run, durablePlan);
-          } catch (error) {
-            throw new PlanPersistenceIndeterminateError(
-              {
-                compareKind: compare.kind,
-                proveKind: prove.kind,
-                assessment: prove.assessment,
-                persisted: "indeterminate",
-                runId: run.runId,
-                planDigest: run.planDigest
-              },
-              error
+          const run = createTransitionRunMetadata(durablePlan);
+          const proofContext = prove.plan.observations.find(
+            (observation) => observation.role === "evidence"
+          )?.context;
+          if (!proofContext) {
+            throw new Error(
+              "internal error: minted proven plan has no evidence observation context"
             );
           }
+          const sql = planner.render(durablePlan, proofContext);
+          if (!options.dryRun) {
+            try {
+              await deps.persist(pool, run, durablePlan);
+            } catch (error) {
+              throw new PlanPersistenceIndeterminateError(
+                {
+                  compareKind: compare.kind,
+                  proveKind: prove.kind,
+                  assessment: prove.assessment,
+                  persisted: "indeterminate",
+                  runId: run.runId,
+                  planDigest: run.planDigest
+                },
+                error
+              );
+            }
+          }
+          result = {
+            compareKind: compare.kind,
+            proveKind: prove.kind,
+            assessment: prove.assessment,
+            persisted: !options.dryRun,
+            runId: options.dryRun ? null : run.runId,
+            planDigest: run.planDigest,
+            plan: durablePlan,
+            sql
+          };
         }
+      }
+      if (prove.kind === "no-drift") {
+        result = {
+          compareKind: compare.kind,
+          proveKind: prove.kind,
+          assessment: prove.assessment,
+          persisted: false,
+          runId: null,
+          planDigest: null
+        };
+      } else if (prove.kind !== "proven") {
         result = {
           compareKind: compare.kind,
           proveKind: prove.kind,
           assessment: prove.assessment,
-          persisted: !options.dryRun,
-          runId: options.dryRun ? null : run.runId,
-          planDigest: run.planDigest,
-          plan: durablePlan,
-          sql
+          persisted: false,
+          runId: null,
+          planDigest: null
         };
       }
     }
-    if (prove.kind === "no-drift") {
-      result = {
-        compareKind: compare.kind,
-        proveKind: prove.kind,
-        assessment: prove.assessment,
-        persisted: false,
-        runId: null,
-        planDigest: null
-      };
-    } else if (prove.kind !== "proven") {
-      result = {
-        compareKind: compare.kind,
-        proveKind: prove.kind,
-        assessment: prove.assessment,
-        persisted: false,
-        runId: null,
-        planDigest: null
-      };
-    }
   } catch (error) {
     failed = true;
     operationError = error;
@@ -1881,6 +1192,20 @@ async function runPlan(options, overrides) {
     cleanup = { kind: "failed", error };
   }
   if (failed) {
+    if (operationError instanceof PgTransitionRunPersistenceIndeterminateError) {
+      throw new PlanPersistenceIndeterminateError(
+        {
+          compareKind: operationError.compare.kind,
+          proveKind: "proven",
+          assessment: operationError.assessment,
+          persisted: "indeterminate",
+          runId: operationError.run.runId,
+          planDigest: operationError.run.planDigest
+        },
+        operationError.persistenceError,
+        cleanup
+      );
+    }
     if (operationError instanceof PlanPersistenceIndeterminateError) {
       throw new PlanPersistenceIndeterminateError(
         operationError.result,
@@ -2059,7 +1384,7 @@ function generatorPlanLedgerAddresses(steps) {
   const addresses = /* @__PURE__ */ new Map();
   for (const step of steps) {
     if (step.address !== void 0) {
-      addresses.set(ledgerAddressKey2(step.address), step.address);
+      addresses.set(ledgerAddressKey(step.address), step.address);
       continue;
     }
     const closure = step.closure;
@@ -2070,7 +1395,7 @@ function generatorPlanLedgerAddresses(steps) {
       ...closure.members.map((member) => member.address)
     ];
     for (const address of candidates)
-      addresses.set(ledgerAddressKey2(address), address);
+      addresses.set(ledgerAddressKey(address), address);
   }
   return [...addresses.values()];
 }
@@ -2080,21 +1405,21 @@ async function generatorRunHasLedgerEvidence(session, journal, steps) {
   const addresses = generatorPlanLedgerAddresses(steps);
   const homes = /* @__PURE__ */ new Map();
   for (const address of addresses) {
-    const home2 = ledgerHomeForGeneratorAddress(address);
-    homes.set(`${home2.scope}:${home2.schema ?? ""}`, home2);
+    const home = ledgerHomeForGeneratorAddress(address);
+    homes.set(`${home.scope}:${home.schema ?? ""}`, home);
   }
-  for (const home2 of homes.values()) {
+  for (const home of homes.values()) {
     for (const executionId of executionIds) {
       const reservations = await readPgLedgerReservationsForExecution(
         session,
-        home2,
+        home,
         executionId
       );
       if (reservations.length > 0) return true;
     }
   }
   for (const address of addresses) {
-    const chain = await readPgLedgerAddressChain2(
+    const chain = await readPgLedgerAddressChain(
       session,
       ledgerHomeForGeneratorAddress(address),
       address
@@ -2160,19 +1485,19 @@ async function withPoolCleanupReported(result, close) {
 function compareCodeUnits(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
-function canonicalJson3(value) {
+function canonicalJson(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number") {
     if (typeof value === "number" && !Number.isFinite(value))
       throw new Error("policy values must be finite JSON values");
     return JSON.stringify(value);
   }
-  if (Array.isArray(value)) return `[${value.map(canonicalJson3).join(",")}]`;
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value !== "object")
     throw new Error(
       "policy values must be JSON values (undefined is not allowed)"
     );
   const record2 = value;
-  return `{${Object.keys(record2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson3(record2[key])}`).join(",")}}`;
+  return `{${Object.keys(record2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
 }
 function nonEmptyString(value, path) {
   if (typeof value !== "string" || value.length === 0 || value.trim() !== value)
@@ -2232,7 +1557,7 @@ function validateResourceAddress(value, path) {
       `${path}.catalogueIdentity.value`
     );
     try {
-      canonicalJson3(identityValue);
+      canonicalJson(identityValue);
     } catch (error) {
       throw new Error(
         `${path}.catalogueIdentity.value must be a canonicalizable JSON object: ${errorDetail(error)}`
@@ -2298,15 +1623,15 @@ function validateAssumptionAcceptance(value, path = "acceptance") {
   }
   return candidate;
 }
-function normaliseAcceptance(acceptance2) {
-  const validated = validateAssumptionAcceptance(acceptance2);
+function normaliseAcceptance(acceptance) {
+  const validated = validateAssumptionAcceptance(acceptance);
   const withinScope = validated.withinScope ? [
     ...new Map(
-      validated.withinScope.map((item) => [canonicalJson3(item), item])
+      validated.withinScope.map((item) => [canonicalJson(item), item])
     )
-  ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => JSON.parse(canonicalJson3(item))) : void 0;
+  ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => JSON.parse(canonicalJson(item))) : void 0;
   return JSON.parse(
-    canonicalJson3({
+    canonicalJson({
       class: validated.class,
       ...validated.fromTrustRoot ? { fromTrustRoot: validated.fromTrustRoot } : {},
       ...withinScope === void 0 ? {} : { withinScope }
@@ -2318,7 +1643,7 @@ function canonicalApplyPolicy(acceptances) {
     ...new Map(
       acceptances.map((item) => {
         const normalized = normaliseAcceptance(item);
-        return [canonicalJson3(normalized), normalized];
+        return [canonicalJson(normalized), normalized];
       })
     )
   ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => item);
@@ -2328,7 +1653,7 @@ function authorizationDigest(runId, planDigest, policy, grants, actor, authorize
   if (Number.isNaN(authorizedInstant.getTime()))
     throw new Error("authorization timestamp must be a valid instant");
   return createHash("sha256").update(
-    canonicalJson3({
+    canonicalJson({
       runId,
       planDigest,
       policy: canonicalApplyPolicy(policy),
@@ -2341,7 +1666,7 @@ function authorizationDigest(runId, planDigest, policy, grants, actor, authorize
 }
 function hasReusableAuthorization(authorizations, runId, planDigest, policy, grants) {
   return authorizations?.some(
-    (item) => canonicalJson3(item.policy) === canonicalJson3(policy) && canonicalJson3(item.grants) === canonicalJson3(grants) && item.digest === authorizationDigest(
+    (item) => canonicalJson(item.policy) === canonicalJson(policy) && canonicalJson(item.grants) === canonicalJson(grants) && item.digest === authorizationDigest(
       runId,
       planDigest,
       policy,
@@ -2351,6 +1676,13 @@ function hasReusableAuthorization(authorizations, runId, planDigest, policy, gra
     )
   ) ?? false;
 }
+function acceptanceMatches(assumption, acceptance) {
+  return acceptance.class === assumption.class && (!acceptance.fromTrustRoot || canonicalJson(acceptance.fromTrustRoot) === canonicalJson(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance.withinScope || acceptance.withinScope.length === 0 : !acceptance.withinScope || acceptance.withinScope.length === 0 || assumption.scope.every(
+    (resource) => acceptance.withinScope?.some(
+      (selector) => selectorMatchesResource(selector, resource)
+    )
+  ));
+}
 async function effectiveApplyPolicy(options) {
   let fromFile = [];
   if (options.acceptPolicy) {
@@ -2375,9 +1707,6 @@ async function effectiveApplyPolicy(options) {
     )
   };
 }
-function registry() {
-  return createPackRegistry2([createPgTransitionPack2({})]);
-}
 var APPLY_OUTCOME_CONTRACT = [
   ["completed", 0, "all planned steps completed"],
   ["operation-failed-not-applied", 10, "operation failed before application"],
@@ -2676,13 +2005,6 @@ detail: ${escapeDiagnosticText3(execution.detail)}`;
       ].join("\n");
   }
 }
-function acceptanceMatches(assumption, acceptance2) {
-  return acceptance2.class === assumption.class && (!acceptance2.fromTrustRoot || canonicalJson3(acceptance2.fromTrustRoot) === canonicalJson3(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance2.withinScope || acceptance2.withinScope.length === 0 : !acceptance2.withinScope || acceptance2.withinScope.length === 0 || assumption.scope.every(
-    (resource) => acceptance2.withinScope?.some(
-      (selector) => selectorMatchesResource(selector, resource)
-    )
-  ));
-}
 function recordedPlanRefusal() {
   return { ...REFUSAL_VOCABULARY2["ERR-10"], state: "recorded-plan" };
 }
@@ -2884,7 +2206,15 @@ async function runApplyInternal(runId, options, pool) {
             throw new Error(
               "persisted run no longer contains a generator plan"
             );
-          const recordedSchema = current.plan.generator.planningSchema;
+          let material;
+          try {
+            material = decodeGeneratorPlanMaterial(current.plan.generator);
+          } catch (error) {
+            throw new RecordedPlanDigestMismatchError(
+              `persisted generator material is invalid: ${errorDetail(error)}`
+            );
+          }
+          const recordedSchema = material.planningSchema;
           if (!recordedSchema)
             throw new Error(
               "persisted generator run has no recorded planning schema and is non-resumable"
@@ -2899,7 +2229,7 @@ async function runApplyInternal(runId, options, pool) {
           }
           if (actualDigest !== current.run.planDigest || actualDigest !== expectedPlanDigest)
             throw new RecordedPlanDigestMismatchError();
-          const manifest = validateNormalizedManagedStepManifest3(
+          const manifest = validateNormalizedManagedStepManifest2(
             current.plan.steps
           );
           if (!manifest.ok)
@@ -2947,6 +2277,18 @@ async function runApplyInternal(runId, options, pool) {
                 await journalLease.release();
               }
             },
+            verifyDeclaredAdoptionShape: async (executor, step) => {
+              if (step.lifecycle?.kind !== "adoption") return false;
+              const compared = await comparePgsqlDeclaredAdoptionSchema2({
+                // Outcome protocol provides its claimed pg session here. It is
+                // intentionally not the outer pool held by runApply.
+                executor,
+                model: modelForDeclaredAdoption2(step.lifecycle.shape),
+                schema: recordedSchema,
+                dbCasing: material.dbCasing
+              });
+              return compared.changes.length === 0;
+            },
             ...options.replace === void 0 ? {} : { replaces: options.replace },
             runId
           });
@@ -2974,88 +2316,61 @@ async function runApplyInternal(runId, options, pool) {
         );
       }
     } else {
-      const locked = await withPgTransitionRunLock(
+      const applied = await applyPgTransitionRun(
         owned,
         runId,
-        async (target) => {
-          const loadCurrent = async (id) => {
-            return loadOnTarget(target, id);
-          };
-          const applier = createApplier(registry(), {
-            // A durable apply only verifies the existing immutable row. The applier
-            // calls this before execution; a changed record remains a refusal.
-            persist: async () => void 0
-          });
-          return applier.applyDurable({
-            runId,
-            expectedPlanDigest,
-            loadCurrent,
-            prepareExecutionSession: async (session, contract, plan) => {
-              const currency = await validatePgManagedLedgerCurrency(
-                session,
-                plan
-              );
-              if (currency)
-                return {
-                  ok: false,
-                  kind: "refused",
-                  detail: currency
-                };
-              return preparePgExecutionSession(session, contract, plan);
-            },
-            policy,
-            target,
-            authorize: async (run, plan, session) => {
-              const current = await loadOnTarget(target, run.runId);
-              const grants = plan.assumptions.map((assumption) => ({
-                assumptionId: assumption.id,
-                grant: policy.accepts.findIndex(
-                  (grant) => acceptanceMatches(assumption, grant)
-                )
-              }));
-              if (hasReusableAuthorization(
-                current.authorizations,
+        policy,
+        expectedPlanDigest,
+        {
+          authorize: async ({ current, run, plan }) => {
+            const grants = plan.assumptions.map((assumption) => ({
+              assumptionId: assumption.id,
+              grant: policy.accepts.findIndex(
+                (grant) => acceptanceMatches(assumption, grant)
+              )
+            }));
+            const reusable = current.authorizations?.find(
+              (authorization) => hasReusableAuthorization(
+                [authorization],
                 run.runId,
                 transitionPlanDigest2(plan),
                 policy.accepts,
                 grants
-              ))
-                return;
-              const actor = process.env.USER ?? process.env.LOGNAME ?? "unknown-local-actor";
-              const authorizedAt = (/* @__PURE__ */ new Date()).toISOString();
-              const digest = authorizationDigest(
+              )
+            );
+            if (reusable) return reusable;
+            const actor = process.env.USER ?? process.env.LOGNAME ?? "unknown-local-actor";
+            const authorizedAt = (/* @__PURE__ */ new Date()).toISOString();
+            return {
+              runId: run.runId,
+              policy: policy.accepts,
+              grants,
+              digest: authorizationDigest(
                 run.runId,
                 transitionPlanDigest2(plan),
                 policy.accepts,
                 grants,
                 actor,
                 authorizedAt
-              );
-              const record2 = {
-                runId: run.runId,
-                policy: policy.accepts,
-                grants,
-                digest,
-                actor,
-                authorizedAt
-              };
-              await appendTransitionAuthorization(session, record2);
-            }
-          });
+              ),
+              actor,
+              authorizedAt
+            };
+          }
         }
       );
-      if (locked.kind === "busy") result = { outcome: "run-busy", runId };
+      if (applied.kind === "busy") result = { outcome: "run-busy", runId };
       else {
-        const outcome = outcomeForApplyResult(locked.value);
+        const outcome = outcomeForApplyResult(applied.result);
         const preAppendRefusal = applyPreAppendRefusal(
           outcome,
           persisted.plan,
-          locked.value
+          applied.result
         );
         result = {
           outcome,
           runId,
-          result: locked.value,
+          result: applied.result,
           ...preAppendRefusal === void 0 ? {} : { refusal: preAppendRefusal }
         };
       }
@@ -3250,13 +2565,19 @@ var generateCommand = new Command3("generate").description("Generate code from s
         case "ddl": {
           const dbCasing = mapCasingToDbCasing(options.casing) ?? schema.dbCasing ?? "snake_case";
           const casingLabel = formatGenerateCasingLabel(dbCasing);
-          const { createPgsqlCompileOnlyAdapter } = await import("@dbsp/adapter-pgsql");
+          const { createPgPhysicalModel: createPgPhysicalModel6, createPgsqlCompileOnlyAdapter } = await import("@dbsp/adapter-pgsql");
           const adapter = createPgsqlCompileOnlyAdapter({
             dbCasing,
             ...options.schemaName ? { schemaName: options.schemaName } : {}
           });
           {
-            const ddlStatements = adapter.generateDDL(schema.model, {
+            const physical = createPgPhysicalModel6({
+              mode: "logical",
+              model: schema.model,
+              schema: options.schemaName ?? "public",
+              dbCasing
+            });
+            const ddlStatements = adapter.generateDDL(physical, {
               ...options.drop !== void 0 && {
                 includeDropStatements: options.drop
               },
@@ -3321,16 +2642,16 @@ function formatGenerateCasingLabel(dbCasing) {
 }
 
 // src/commands/inspect.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual } from "util";
 import {
   createPgTransitionLessor as createPgTransitionLessor4,
   DBSP_LEDGER_EVENT_TABLE,
   escapeDiagnosticText as escapeDiagnosticText4,
-  readPgCatalogueIdentity as readPgCatalogueIdentity3,
-  readPgLedgerAddressChain as readPgLedgerAddressChain3,
+  readPgCatalogueIdentity as readPgCatalogueIdentity2,
+  readPgLedgerAddressChain as readPgLedgerAddressChain2,
   readPgLedgerMarker
 } from "@dbsp/adapter-pgsql";
-import { acquireTransitionLease as acquireTransitionLease4, projectLedgerChain as projectLedgerChain2 } from "@dbsp/core";
+import { acquireTransitionLease as acquireTransitionLease4, projectLedgerChain } from "@dbsp/core";
 import {
   canonicalResourceParent
 } from "@dbsp/types";
@@ -3376,7 +2697,7 @@ function inspectLiveDrift(projection, live) {
       kind: "catalogue-drift",
       detail: "ledger records a present catalogue identity but the object is absent"
     };
-  return isDeepStrictEqual2(terminal.catalogueIdentity, live.catalogueIdentity) ? { kind: "matches-ledger" } : {
+  return isDeepStrictEqual(terminal.catalogueIdentity, live.catalogueIdentity) ? { kind: "matches-ledger" } : {
     kind: "catalogue-drift",
     detail: "live catalogue identity differs from the ledger terminal"
   };
@@ -3499,8 +2820,8 @@ async function runInspect(selector, options) {
       );
       let projection;
       try {
-        projection = projectLedgerChain2(
-          await readPgLedgerAddressChain3(lease.session, ledger, address)
+        projection = projectLedgerChain(
+          await readPgLedgerAddressChain2(lease.session, ledger, address)
         );
       } catch (error) {
         return {
@@ -3519,7 +2840,7 @@ async function runInspect(selector, options) {
         };
       }
       try {
-        const live = await readPgCatalogueIdentity3(lease.session, address);
+        const live = await readPgCatalogueIdentity2(lease.session, address);
         const refusal = inspectRefusal(projection);
         const openReaddress = projection?.kind === "projected-ledger-chain" && projection.openClaim?.kind === "readdress-intent" && projection.openClaim.event.pairId ? {
           pairId: projection.openClaim.event.pairId,
@@ -3600,69 +2921,409 @@ function reportWarnings(warnings) {
     console.log(`   \u26A0\uFE0F  ${warning}`);
   }
 }
-var introspectCommand = new Command5("introspect").description("Generate schema.ts from database introspection").requiredOption("-d, --db <url>", "Database connection URL (required)").option("-o, --out <file>", "Output schema file", "./dbsp.schema.ts").option("--schema-name <name>", "Database schema name", "public").option(
-  "--exclude <patterns>",
-  "Tables to exclude (comma-separated glob patterns)",
-  "_migrations,_prisma*,pg_*"
-).option("--include <patterns>", "Tables to include (comma-separated)").option("--no-db-type-comments", "Omit original DB type comments").option(
-  "--db-casing <casing>",
-  "Database column casing (snake_case \u2192 camelCase in generated code)",
-  "snake_case"
-).action(
-  async (options) => {
-    const redactedUrl = redactDbUrl(options.db);
-    console.log(`\u{1F50D} Introspecting database: ${redactedUrl}`);
-    console.log(`   Schema: ${options.schemaName}`);
-    if (options.exclude) {
-      console.log(`   Excluding: ${options.exclude}`);
-    }
-    console.log("");
-    try {
-      const { pool } = await createDbConnection(options.db);
+var introspectCommand = new Command5("introspect").description("Generate schema.ts from database introspection").requiredOption("-d, --db <url>", "Database connection URL (required)").option("-o, --out <file>", "Output schema file", "./dbsp.schema.ts").option("--schema-name <name>", "Database schema name", "public").option(
+  "--exclude <patterns>",
+  "Tables to exclude (comma-separated glob patterns)",
+  "_migrations,_prisma*,pg_*"
+).option("--include <patterns>", "Tables to include (comma-separated)").option("--no-db-type-comments", "Omit original DB type comments").option(
+  "--db-casing <casing>",
+  "Database column casing (snake_case \u2192 camelCase in generated code)",
+  "snake_case"
+).action(
+  async (options) => {
+    const redactedUrl = redactDbUrl(options.db);
+    console.log(`\u{1F50D} Introspecting database: ${redactedUrl}`);
+    console.log(`   Schema: ${options.schemaName}`);
+    if (options.exclude) {
+      console.log(`   Excluding: ${options.exclude}`);
+    }
+    console.log("");
+    try {
+      const { pool } = await createDbConnection(options.db);
+      try {
+        const { introspect } = await import("@dbsp/adapter-pgsql");
+        const excludePatterns = options.exclude ? options.exclude.split(",").map((s) => s.trim()) : void 0;
+        const includePatterns = options.include ? options.include.split(",").map((s) => s.trim()) : void 0;
+        const model = await introspect(pool, {
+          schema: options.schemaName,
+          ...excludePatterns ? { exclude: excludePatterns } : {},
+          ...includePatterns ? { include: includePatterns } : {}
+        });
+        const tableCount = model.tables.size;
+        const relationCount = model.relations.size;
+        const hierarchyCount = model.hierarchies?.length ?? 0;
+        console.log(
+          `\u{1F4CA} Found ${tableCount} tables, ${relationCount} relations, ${hierarchyCount} hierarchies`
+        );
+        const codegenOptions = {
+          sourceUrl: options.db,
+          includeDbTypeComments: options.dbTypeComments,
+          introspectedAt: model.introspectedAt,
+          dbCasing: options.dbCasing
+        };
+        const generated = generateSchemaFileWithDiagnostics(
+          model,
+          codegenOptions
+        );
+        const warnings = uniqueWarnings(generated.warnings);
+        if (warnings.length > 0) {
+          reportWarnings(warnings);
+        }
+        console.log("");
+        const outPath = resolve2(process.cwd(), options.out);
+        mkdirSync2(dirname2(outPath), { recursive: true });
+        writeFileSync2(outPath, generated.code, "utf-8");
+        console.log(`\u2705 Generated schema: ${outPath}`);
+        console.log(`   Tables: ${tableCount}`);
+        console.log(`   Relations: ${relationCount}`);
+      } finally {
+        await pool.end();
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`\u274C ${message}`);
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/migrate.ts
+import {
+  convergePg,
+  createPgPhysicalModel as createPgPhysicalModel3,
+  escapeDiagnosticText as escapeDiagnosticText5,
+  PgConvergeRefusalError
+} from "@dbsp/adapter-pgsql";
+import { Command as Command6 } from "commander";
+var MIGRATE_OUTCOME_CONTRACT = [
+  ["no-drift", 0, "database matches declaration"],
+  ["applied", 0, "admitted additions or adoptions applied"],
+  ["partially-applied", 11, "some target effects may be durable"],
+  ["busy", 21, "ledger lock or claims are busy; retry later"],
+  ["database-read-only", 34, "target cannot accept managed writes"],
+  ["load-failed", 27, "schema file could not be loaded"],
+  ["migrate-failed", 29, "migration, connection, or planning failure"],
+  ["adoption-refused", 62, "declared adoption no longer matches live object"],
+  [
+    "recovery-required",
+    64,
+    "admitted claim remains open; reconcile before retrying"
+  ],
+  [
+    "transport-ambiguous",
+    65,
+    "admitted operation has ambiguous transport outcome"
+  ],
+  [
+    "invalid-options",
+    70,
+    "an --external-index or --format value is malformed, or convergePg refused its options"
+  ],
+  ["ledger-absent", 71, "convergence ledger is not initialized"],
+  ["incompatible-ledger", 72, "ledger version is unsupported"],
+  ["unsupported-server", 73, "PostgreSQL server is unsupported"],
+  ["unsupported-change", 74, "requested schema change is not admitted"],
+  ["unmanaged-object", 75, "live object is not ledger-managed"],
+  ["unmanaged-parent", 76, "parent live object is not ledger-managed"],
+  ["concurrent-drift", 77, "live schema changed during admission"],
+  ["execution-refused", 78, "admitted execution step was refused"],
+  ["cleanup-failed", 79, "pool failed to close after convergence"]
+];
+var migrateExitCodes = new Map(
+  MIGRATE_OUTCOME_CONTRACT.map(([outcome, exitCode]) => [outcome, exitCode])
+);
+function exitCodeForMigrateOutcome(outcome) {
+  return migrateExitCodes.get(outcome);
+}
+var refusalOutcomes = {
+  "invalid-options": "invalid-options",
+  "unsupported-change": "unsupported-change",
+  "unmanaged-object": "unmanaged-object",
+  "unmanaged-parent": "unmanaged-parent",
+  "concurrent-drift": "concurrent-drift",
+  "ledger-absent": "ledger-absent",
+  "incompatible-ledger": "incompatible-ledger",
+  "unsupported-server": "unsupported-server",
+  busy: "busy",
+  "recovery-required": "recovery-required",
+  "database-read-only": "database-read-only",
+  "execution-refused": "execution-refused",
+  "adoption-refused": "adoption-refused",
+  // dbsp migrate never supplies application steps, but preserve the closed converge map.
+  "application-step-changed": "migrate-failed",
+  "application-step-failed": "migrate-failed",
+  // dbsp migrate never supplies initialize, but preserve the closed converge map.
+  "initialization-refused": "migrate-failed"
+};
+var defaultMigrateDeps = {
+  loadSchema,
+  createDbConnection,
+  converge: convergePg
+};
+function resolvedDeps2(overrides) {
+  return { ...defaultMigrateDeps, ...overrides };
+}
+function describeThrown2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function parseExternalIndexes(entries) {
+  if (entries === void 0 || entries.length === 0) return void 0;
+  return entries.map((entry) => {
+    const separator = entry.indexOf(":");
+    if (separator <= 0 || separator === entry.length - 1)
+      throw new Error(
+        `invalid --external-index ${entry}; expected <table>:<index>`
+      );
+    return {
+      table: entry.slice(0, separator),
+      name: entry.slice(separator + 1)
+    };
+  });
+}
+function resultForConverge(result, schema, schemaFile) {
+  switch (result.kind) {
+    case "no-drift":
+    case "applied":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        applied: result.applied
+      };
+    case "partially-applied":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        completedStepKeys: result.completedStepKeys,
+        notStartedStepKeys: result.notStartedStepKeys,
+        detail: result.detail
+      };
+    case "transport-ambiguous":
+      return {
+        outcome: result.kind,
+        exitCode: exitCodeForMigrateOutcome(result.kind),
+        schema,
+        schemaFile,
+        detail: result.detail
+      };
+  }
+  const unhandled = result;
+  return unhandled;
+}
+function refusalResult(error, schema, schemaFile) {
+  const outcome = refusalOutcomes[error.refusal];
+  return {
+    outcome,
+    exitCode: exitCodeForMigrateOutcome(outcome),
+    schema,
+    schemaFile,
+    changes: error.changes,
+    ...error.detail === void 0 ? {} : { detail: error.detail },
+    ...error.runIds === void 0 ? {} : { runIds: error.runIds },
+    ...error.busyRunIds === void 0 ? {} : { busyRunIds: error.busyRunIds },
+    ...error.executionIds === void 0 ? {} : { executionIds: error.executionIds }
+  };
+}
+function failureResult(outcome, error, schema, schemaFile) {
+  return {
+    outcome,
+    exitCode: exitCodeForMigrateOutcome(outcome),
+    schema,
+    schemaFile,
+    error: describeThrown2(error)
+  };
+}
+async function runMigrate(schemaPath, options, overrides) {
+  const schema = options.schema ?? "public";
+  const deps = resolvedDeps2(overrides);
+  if (options.format !== void 0 && options.format !== "text" && options.format !== "json")
+    return failureResult(
+      "invalid-options",
+      new Error(
+        `unsupported migrate format ${options.format}; expected text or json`
+      ),
+      schema,
+      schemaPath
+    );
+  let externalIndexes;
+  try {
+    externalIndexes = parseExternalIndexes(options.externalIndex);
+  } catch (error) {
+    return failureResult("invalid-options", error, schema, schemaPath);
+  }
+  let loaded;
+  try {
+    loaded = await deps.loadSchema(schemaPath);
+  } catch (error) {
+    return failureResult("load-failed", error, schema, schemaPath);
+  }
+  let physical;
+  try {
+    physical = createPgPhysicalModel3({
+      mode: "logical",
+      model: loaded.model,
+      schema,
+      ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+    });
+  } catch (error) {
+    return failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  let pool;
+  try {
+    ({ pool } = await deps.createDbConnection(options.db));
+  } catch (error) {
+    return failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  let result;
+  let convergeResult;
+  try {
+    convergeResult = await deps.converge(pool, physical, {
+      ...externalIndexes === void 0 ? {} : { externalIndexes }
+    });
+    result = resultForConverge(convergeResult, schema, schemaPath);
+  } catch (error) {
+    result = error instanceof PgConvergeRefusalError ? refusalResult(error, schema, schemaPath) : failureResult("migrate-failed", error, schema, schemaPath);
+  }
+  try {
+    await pool.end();
+  } catch (error) {
+    const cleanupError = describeThrown2(error);
+    if (result.exitCode === 0 && convergeResult !== void 0) {
+      return {
+        outcome: "cleanup-failed",
+        exitCode: exitCodeForMigrateOutcome("cleanup-failed"),
+        schema,
+        schemaFile: schemaPath,
+        cleanupError,
+        result: convergeResult
+      };
+    }
+    return { ...result, cleanupError };
+  }
+  return result;
+}
+function redactDiagnostic(value, db) {
+  const sensitive = /* @__PURE__ */ new Set([db]);
+  try {
+    const url = new URL(db);
+    const password = url.password;
+    if (password) {
+      sensitive.add(password);
       try {
-        const { introspect } = await import("@dbsp/adapter-pgsql");
-        const excludePatterns = options.exclude ? options.exclude.split(",").map((s) => s.trim()) : void 0;
-        const includePatterns = options.include ? options.include.split(",").map((s) => s.trim()) : void 0;
-        const model = await introspect(pool, {
-          schema: options.schemaName,
-          ...excludePatterns ? { exclude: excludePatterns } : {},
-          ...includePatterns ? { include: includePatterns } : {}
-        });
-        const tableCount = model.tables.size;
-        const relationCount = model.relations.size;
-        const hierarchyCount = model.hierarchies?.length ?? 0;
-        console.log(
-          `\u{1F4CA} Found ${tableCount} tables, ${relationCount} relations, ${hierarchyCount} hierarchies`
-        );
-        const codegenOptions = {
-          sourceUrl: options.db,
-          includeDbTypeComments: options.dbTypeComments,
-          introspectedAt: model.introspectedAt,
-          dbCasing: options.dbCasing
-        };
-        const generated = generateSchemaFileWithDiagnostics(
-          model,
-          codegenOptions
-        );
-        const warnings = uniqueWarnings(generated.warnings);
-        if (warnings.length > 0) {
-          reportWarnings(warnings);
-        }
-        console.log("");
-        const outPath = resolve2(process.cwd(), options.out);
-        mkdirSync2(dirname2(outPath), { recursive: true });
-        writeFileSync2(outPath, generated.code, "utf-8");
-        console.log(`\u2705 Generated schema: ${outPath}`);
-        console.log(`   Tables: ${tableCount}`);
-        console.log(`   Relations: ${relationCount}`);
-      } finally {
-        await pool.end();
+        sensitive.add(decodeURIComponent(password));
+      } catch {
       }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.error(`\u274C ${message}`);
-      process.exit(1);
     }
+    for (const password2 of url.searchParams.getAll("password"))
+      sensitive.add(password2);
+    for (const pair of url.search.slice(1).split("&")) {
+      const separator = pair.indexOf("=");
+      const name = separator === -1 ? pair : pair.slice(0, separator);
+      if (name !== "password") continue;
+      if (separator !== -1) sensitive.add(pair.slice(separator + 1));
+    }
+  } catch {
+    const match = /:\/\/[^/:]+:([^@]+)@/.exec(db);
+    if (match?.[1]) sensitive.add(match[1]);
+  }
+  return [...sensitive].filter((entry) => entry.length > 0).sort((left, right) => right.length - left.length).reduce((text, entry) => text.replaceAll(entry, "<redacted>"), value);
+}
+function redactedConvergeResult(result, db) {
+  return result.kind === "partially-applied" || result.kind === "transport-ambiguous" ? { ...result, detail: redactDiagnostic(result.detail, db) } : result;
+}
+function redactedResult(result, db) {
+  return {
+    ...result,
+    ...result.detail === void 0 ? {} : { detail: redactDiagnostic(result.detail, db) },
+    ...result.error === void 0 ? {} : { error: redactDiagnostic(result.error, db) },
+    ...result.cleanupError === void 0 ? {} : { cleanupError: redactDiagnostic(result.cleanupError, db) },
+    ...result.result === void 0 ? {} : { result: redactedConvergeResult(result.result, db) }
+  };
+}
+function formatMigrateJson(result, db) {
+  const safe = redactedResult(result, db);
+  const { schemaFile: _schemaFile, ...document } = safe;
+  return document;
+}
+function formatMigrateHuman(result, db) {
+  const safe = redactedResult(result, db);
+  const diagnostic = (value) => escapeDiagnosticText5(value);
+  const lines = [`${diagnostic(safe.outcome)}: ${diagnostic(safe.schema)}`];
+  if (safe.applied?.length)
+    for (const applied of safe.applied) lines.push(diagnostic(applied));
+  if (safe.outcome === "partially-applied") {
+    const stepKeys = (entries) => entries?.length ? entries.map(diagnostic).join(", ") : "none";
+    lines.push(`completed: ${stepKeys(safe.completedStepKeys)}`);
+    lines.push(`not started: ${stepKeys(safe.notStartedStepKeys)}`);
+  }
+  if (safe.detail !== void 0) lines.push(diagnostic(safe.detail));
+  if (safe.changes?.length)
+    for (const change of safe.changes)
+      lines.push(diagnostic(JSON.stringify(change)));
+  if (safe.outcome === "recovery-required") {
+    if (safe.runIds?.length) {
+      lines.push("dbsp reconcile --db <database> <run-id>");
+      for (const runId of safe.runIds)
+        lines.push(`run id: ${diagnostic(runId)}`);
+    }
+    if (safe.busyRunIds?.length) {
+      for (const busyRunId of safe.busyRunIds)
+        lines.push(`busy run id: ${diagnostic(busyRunId)}`);
+      lines.push("these runs are still executing; retry later");
+    }
+    if (safe.executionIds?.length) {
+      for (const executionId of safe.executionIds)
+        lines.push(`execution id: ${diagnostic(executionId)}`);
+      lines.push(
+        "no dbsp command resolves a claim by execution id; the owner named in the detail above must resolve these claims"
+      );
+    }
+  }
+  if (safe.outcome === "ledger-absent")
+    lines.push(
+      "dbsp preflight --reinitialize --db <database> --schema-file <schema-file> --scope <schema> --out <adoption-file>",
+      `schema file: ${diagnostic(safe.schemaFile)}`,
+      `schema: ${diagnostic(safe.schema)}`
+    );
+  if (safe.outcome === "cleanup-failed" && safe.result !== void 0) {
+    lines.push(`convergence: ${diagnostic(safe.result.kind)}`);
+    if ("applied" in safe.result && safe.result.applied.length)
+      for (const applied of safe.result.applied)
+        lines.push(diagnostic(applied));
+  }
+  if (safe.error !== void 0) lines.push(diagnostic(safe.error));
+  if (safe.cleanupError !== void 0)
+    lines.push(`Connection cleanup failed: ${diagnostic(safe.cleanupError)}`);
+  return lines.join("\n");
+}
+var migrateCommand = new Command6("migrate").description(
+  "Converge without confirmation: applies only additions and declared adoptions admitted by convergePg; refused changes send no DDL, but execution can still be refused or partially applied. Use dbsp plan plus dbsp apply for reviewed changes."
+).argument("<schema-file>", "Schema DSL file").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema <name>", "Database schema name", "public").option(
+  "--external-index <model-table:index>",
+  "Physical index to leave alone; the table is the model name (before dbCasing maps it), then the index by its exact PostgreSQL name; the table part cannot contain :; repeatable.",
+  (value, previous = []) => {
+    previous.push(value);
+    return previous;
+  }
+).option("--format <format>", "Output format: text or json", "text").addHelpText(
+  "after",
+  `
+Outcome contract:
+${MIGRATE_OUTCOME_CONTRACT.map(([outcome, exitCode, description]) => `  ${outcome} (${exitCode}): ${description}`).join("\n")}
+Command-line syntax errors (an unknown option, a missing --db or schema file) exit 1 with { status, error } under --format json, as for every dbsp command.`
+).exitOverride().configureOutput({ writeErr: () => {
+} }).action(
+  async (schemaFile, options) => {
+    const result = await runMigrate(schemaFile, options);
+    if (options.format === "json")
+      printCliJson(formatMigrateJson(result, options.db));
+    else if (result.exitCode === 0)
+      console.log(formatMigrateHuman(result, options.db));
+    else console.error(formatMigrateHuman(result, options.db));
+    process.exitCode = result.exitCode;
   }
 );
 
@@ -3671,12 +3332,12 @@ import { createHash as createHash2 } from "crypto";
 import { mkdtemp, open, rename, rm } from "fs/promises";
 import { dirname as dirname3, join } from "path";
 import {
-  escapeDiagnosticText as escapeDiagnosticText5,
-  getNamingPluginForDbCasing as getNamingPluginForDbCasing2,
+  createPgPhysicalModel as createPgPhysicalModel4,
+  escapeDiagnosticText as escapeDiagnosticText6,
   runPgReinitializePreflight
 } from "@dbsp/adapter-pgsql";
 import { declarationSetFromModel as declarationSetFromModel2 } from "@dbsp/core";
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 var defaultDeps = { createDbConnection, loadSchema };
 var nodeAdoptionFileSystem = {
   mkdtemp,
@@ -3726,13 +3387,9 @@ async function databaseName(pool) {
     throw new Error("current database could not be read");
   return name;
 }
-function declarationsForScopes(model, database, scopes, naming) {
+function declarationsForScopes(model, database, scopes) {
   const declarations = scopes.flatMap(
-    (schema) => declarationSetFromModel2(
-      model,
-      { engine: "postgresql", database, schema },
-      naming
-    ).declarations
+    (schema) => declarationSetFromModel2(model, { engine: "postgresql", database, schema }).declarations
   );
   const seen = /* @__PURE__ */ new Set();
   const uniqueDeclarations = declarations.filter((declaration) => {
@@ -3767,19 +3424,25 @@ async function runPreflight(options, deps = defaultDeps) {
     throw new Error("dbsp preflight requires --reinitialize");
   if (!options.out)
     throw new Error("dbsp preflight --reinitialize requires --out <file>");
-  if (options.scopes.length === 0)
+  const physicalSchema = options.scopes[0];
+  if (physicalSchema === void 0)
     throw new Error(
       "dbsp preflight requires at least one explicit --scope <schema>"
     );
   const loaded = await deps.loadSchema(options.schemaFile);
+  const physical = createPgPhysicalModel4({
+    mode: "logical",
+    model: loaded.model,
+    schema: physicalSchema,
+    ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+  });
   const connection = await deps.createDbConnection(options.db);
   try {
     const database = await databaseName(connection.pool);
     const declarations = declarationsForScopes(
-      loaded.model,
+      physical.model,
       database,
-      options.scopes,
-      getNamingPluginForDbCasing2(loaded.dbCasing ?? "preserve")
+      options.scopes
     );
     return await runPgReinitializePreflight({
       pool: connection.pool,
@@ -3794,18 +3457,18 @@ async function runPreflight(options, deps = defaultDeps) {
 function formatScope(scope) {
   const name = scope.ledger.scope === "database" ? "dbsp_meta" : scope.ledger.schema ?? "unknown";
   if (scope.outcome === "failed")
-    return `${escapeDiagnosticText5(name)}: failed (${escapeDiagnosticText5(scope.reason.step)}: ${escapeDiagnosticText5(scope.reason.message)})`;
-  return scope.refusal ? `${escapeDiagnosticText5(name)}: ${escapeDiagnosticText5(scope.outcome)} (${escapeDiagnosticText5(scope.refusal.code)}: ${escapeDiagnosticText5(scope.refusal.detail)})` : `${escapeDiagnosticText5(name)}: ${escapeDiagnosticText5(scope.outcome)}`;
+    return `${escapeDiagnosticText6(name)}: failed (${escapeDiagnosticText6(scope.reason.step)}: ${escapeDiagnosticText6(scope.reason.message)})`;
+  return scope.refusal ? `${escapeDiagnosticText6(name)}: ${escapeDiagnosticText6(scope.outcome)} (${escapeDiagnosticText6(scope.refusal.code)}: ${escapeDiagnosticText6(scope.refusal.detail)})` : `${escapeDiagnosticText6(name)}: ${escapeDiagnosticText6(scope.outcome)}`;
 }
 function formatReinitializeSplit(scopes) {
   const names = (predicate) => scopes.filter(predicate).map(
-    (scope) => escapeDiagnosticText5(
+    (scope) => escapeDiagnosticText6(
       scope.ledger.scope === "database" ? "dbsp_meta" : scope.ledger.schema ?? "unknown"
     )
   ).join(",") || "none";
   return `reinitialize-split: changed=${names((scope) => scope.outcome === "current")}; failed=${names((scope) => scope.outcome === "failed")}; not-attempted=${names((scope) => scope.outcome === "not-attempted")}`;
 }
-var preflightCommand = new Command6("preflight").description(
+var preflightCommand = new Command7("preflight").description(
   "Run the separately privileged managed-ledger reinitialize cutover"
 ).requiredOption("-d, --db <url>", "Database connection URL (required)").requiredOption(
   "--reinitialize",
@@ -3830,7 +3493,7 @@ var preflightCommand = new Command6("preflight").description(
     );
   } catch (error) {
     console.error(
-      escapeDiagnosticText5(
+      escapeDiagnosticText6(
         error instanceof Error ? error.message : String(error)
       )
     );
@@ -3839,33 +3502,12 @@ var preflightCommand = new Command6("preflight").description(
 });
 
 // src/commands/reconcile.ts
-import { createHash as createHash3 } from "crypto";
 import {
-  assertCreateUniqueIndexConcurrentlyRecoveryNotInvalid,
-  assertPgDatabaseWritable,
-  escapeDiagnosticText as escapeDiagnosticText6,
-  isPgDatabaseReadOnlyError,
-  readPgLedgerAddressChain as readPgLedgerAddressChain4,
-  readPgLedgerReservationsForExecution as readPgLedgerReservationsForExecution2,
-  readPgLedgerScopeCurrency as readPgLedgerScopeCurrency2,
-  readTransitionJournal as readTransitionJournal2,
-  readVerifiedPgLedgerReservationsForPair,
-  recoverPgReaddressPair,
-  withPgTransitionRunLock as withPgTransitionRunLock2
+  escapeDiagnosticText as escapeDiagnosticText7,
+  PgReconcileTransitionRunError,
+  reconcilePgTransitionRun
 } from "@dbsp/adapter-pgsql";
-import { recoverPgOutcomeClaim } from "@dbsp/adapter-pgsql/internal";
-import {
-  acquireExclusiveTransitionLease as acquireExclusiveTransitionLease2,
-  assumptionAccepted,
-  canonicalJson as canonicalJson4,
-  canonicalJsonDigest as canonicalJsonDigest3,
-  outcomeClaimId as outcomeClaimId2,
-  projectLedgerChain as projectLedgerChain3,
-  resourceScopeCovers,
-  transitionPlanDigest as transitionPlanDigest3
-} from "@dbsp/core";
-import { sameLedgerAddress } from "@dbsp/types";
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 function pgSqlState(error) {
   if (typeof error !== "object" || error === null || !("code" in error))
     return void 0;
@@ -3892,170 +3534,120 @@ function classifyReconcileFailure(error, stage) {
   return "catalogue";
 }
 function isUnresolvedRecoveryOutcome(report) {
-  return report.outcome === "pending" || report.outcome === "blocked" || report.outcome === "malformed-chain" || report.outcome === "protocol-refused" || report.outcome === "transport-ambiguous" || report.outcome === "no-open-claim" || report.outcome === "indeterminate-appended" || report.outcome === "indeterminate-pair";
-}
-function ledgerHome(address) {
-  if (address.scope === "database") return { scope: "database" };
-  if (!address.schema)
-    throw new Error(
-      `schema-scoped managed claim ${address.name} has no schema`
-    );
-  return { scope: "schema", schema: address.schema };
-}
-function recoveryPayload(identity) {
-  const value = JSON.parse(
-    canonicalJson4({
-      ...identity === void 0 ? {} : { catalogueIdentity: identity }
-    })
-  );
-  return {
-    value,
-    digest: canonicalJsonDigest3(value)
-  };
-}
-function recoveryReport(address, result) {
-  if (result.kind === "outcome-recovery-appended") {
-    const indeterminate = result.classification.resolution.eventKind === "indeterminate";
-    return {
-      address,
-      outcome: indeterminate ? "indeterminate-appended" : result.append.kind === "already-appended-outcome-resolution" ? "already-appended" : "appended",
-      reason: result.classification.resolution.reason
-    };
+  return [
+    "pending",
+    "blocked",
+    "malformed-chain",
+    "protocol-refused",
+    "transport-ambiguous",
+    "no-open-claim",
+    "indeterminate-appended",
+    "indeterminate-pair"
+  ].includes(report.outcome);
+}
+function ledgerCurrencyDetail(issue) {
+  return issue.currency.kind === "not-current" && issue.currency.reason === "lineage" ? "ledger lineage mismatch; run dbsp preflight --reinitialize" : `ledger marker ${issue.currency.marker.kind}; run dbsp preflight --reinitialize`;
+}
+function refusalForSelectedIssue(issue) {
+  if (issue === void 0) return void 0;
+  if (issue.kind === "ledger-not-current") {
+    const address = issue.affectedAddresses[0];
+    return address === void 0 ? void 0 : preAppendRefusalFor("ERR-03", { address, state: "unknown" });
   }
-  if (result.kind === "outcome-recovery-no-open-claim")
-    return { address, outcome: "no-open-claim" };
-  if (result.kind === "outcome-recovery-pending")
-    return {
-      address,
-      outcome: "pending",
-      reason: result.reason,
-      ...result.reasonCode === "catalogue-unavailable" ? { failureCause: "catalogue" } : {},
-      ...result.reasonCode === "catalogue-unavailable" ? {
-        refusal: preAppendRefusalFor("ERR-09", {
-          address,
-          state: "unknown"
-        })
-      } : {}
-    };
-  if (result.kind === "outcome-recovery-blocked")
-    return { address, outcome: "blocked", reason: result.reason };
-  if (result.kind === "outcome-recovery-malformed-chain")
-    return {
-      address,
-      outcome: "malformed-chain",
-      reason: result.reason,
-      failureCause: "malformed-journal",
-      refusal: preAppendRefusalFor("ERR-08", { address, state: "unknown" })
-    };
-  if (result.kind === "outcome-transport-ambiguous")
-    return {
-      address,
-      outcome: "transport-ambiguous",
-      reason: result.reason,
-      failureCause: "transport"
-    };
-  return { address, outcome: "protocol-refused", reason: result.reason };
+  if (issue.kind === "database-read-only") {
+    const address = issue.affectedAddresses[0];
+    return address === void 0 ? void 0 : preAppendRefusalFor("ERR-07", { address, state: "unknown" });
+  }
+  return preAppendRefusalFor(
+    issue.kind === "catalogue-unavailable" ? "ERR-09" : "ERR-08",
+    { address: issue.address, state: "unknown" }
+  );
 }
-function readdressRecoveryReport(reservations, result) {
-  const first = reservations[0];
-  if (!first) throw new Error("re-address recovery has no reservation");
-  if (result.kind === "readdress-recovery-refused-pair")
-    return {
-      address: first.address,
-      outcome: "refused-pair",
-      pairId: result.pairId
-    };
-  if (result.kind === "readdress-recovery-indeterminate-pair")
-    return {
-      address: first.address,
-      outcome: "indeterminate-pair",
-      reason: result.reason,
-      pairId: result.pairId
-    };
-  if (result.kind === "readdress-recovery-transport-ambiguous-pair")
-    return {
-      address: first.address,
-      outcome: "transport-ambiguous",
-      reason: result.reason,
-      failureCause: "transport",
-      pairId: result.pairId
-    };
-  return {
-    address: first.address,
-    outcome: "pending",
-    reason: result.reason,
-    pairId: result.pairId
-  };
+function mapRecovery(reports, issue) {
+  if (reports === void 0) return void 0;
+  const markerDetail = issue?.kind === "ledger-not-current" ? ledgerCurrencyDetail(issue) : void 0;
+  return reports.map((report) => ({
+    ...report,
+    ...markerDetail === void 0 ? {} : { reason: markerDetail },
+    ...issue?.kind === "ledger-not-current" ? {
+      refusal: preAppendRefusalFor("ERR-03", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : report.failureCause === "catalogue" ? {
+      refusal: preAppendRefusalFor("ERR-09", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : report.failureCause === "malformed-journal" ? {
+      refusal: preAppendRefusalFor("ERR-08", {
+        address: report.address,
+        state: "unknown"
+      })
+    } : {}
+  }));
 }
 function unresolvedRecoveryDetail(reports) {
   const unresolved = reports.filter(isUnresolvedRecoveryOutcome);
   if (unresolved.length === 0) return void 0;
   return unresolved.map(
-    (report) => `${escapeDiagnosticText6(report.address.name)}: ${escapeDiagnosticText6(report.reason ?? report.outcome)}`
+    (report) => `${escapeDiagnosticText7(report.address.name)}: ${escapeDiagnosticText7(report.reason ?? report.outcome)}`
   ).join("; ");
 }
 function formatReconcileHuman(result) {
-  const line = `${escapeDiagnosticText6(result.outcome)}: ${escapeDiagnosticText6(result.runId)}`;
+  const line = `${escapeDiagnosticText7(result.outcome)}: ${escapeDiagnosticText7(result.runId)}`;
   const base = result.refusal ? formatPreAppendRefusalHuman(line, result.refusal) : line;
   if (result.outcome === "reconcile-completed" || !result.recovery) return base;
   const unresolved = result.recovery.filter(isUnresolvedRecoveryOutcome);
   return unresolved.length === 0 ? base : [
     base,
     ...unresolved.map(
-      (report) => `${escapeDiagnosticText6(report.address.name)}: ${escapeDiagnosticText6(report.outcome)}${report.reason ? `: ${escapeDiagnosticText6(report.reason)}` : ""}`
+      (report) => `${escapeDiagnosticText7(report.address.name)}: ${escapeDiagnosticText7(report.outcome)}${report.reason ? `: ${escapeDiagnosticText7(report.reason)}` : ""}`
     )
   ].join("\n");
 }
-function statementBundleDigest(statements) {
-  return createHash3("sha256").update(
-    JSON.stringify(statements.map(({ ordinal, sql }) => [ordinal, sql]))
-  ).digest("hex");
-}
-function recoveryEvidenceForClaim(input) {
-  if (transitionPlanDigest3(input.journal.plan) !== input.journal.run.planDigest)
-    return void 0;
-  const step = input.journal.plan.steps.find(
-    (candidate) => candidate.managedClaim?.plannedClaimKey === input.plannedClaimKey
-  );
-  const claim = step?.managedClaim;
-  if (!step || !claim || !sameLedgerAddress(claim.address, input.row.address) || outcomeClaimId2(
-    input.row.executionId,
-    input.plannedClaimKey,
-    input.row.address
-  ) !== input.row.rootClaimId)
-    return void 0;
-  const binding = step.guards.find(
-    (guard) => guard.protocol.binding.kind === "external-ddl-exclusion" && resourceScopeCovers(guard.protocol.binding.scope, [input.row.address])
-  )?.protocol.binding;
-  if (binding?.kind !== "external-ddl-exclusion") return void 0;
-  const assumption = input.journal.plan.assumptions.find(
-    (candidate) => candidate.id === binding.assumption && candidate.class === "external-ddl-exclusion" && step.restsOnAssumptions.includes(candidate.id) && resourceScopeCovers(candidate.scope, [input.row.address])
-  );
-  if (!assumption) return void 0;
-  const accepted = input.journal.authorizations?.some((authorization) => {
-    const grant = authorization.grants.find(
-      (candidate) => candidate.assumptionId === assumption.id
-    );
-    if (!grant) return false;
-    const acceptance2 = authorization.policy[grant.grant];
-    return acceptance2 !== void 0 && assumptionAccepted(assumption, { accepts: [acceptance2] });
-  });
-  if (!accepted) return void 0;
-  const bundleDigest = statementBundleDigest(claim.statementBundle.statements);
+function mapAdapterResult(result) {
+  if (result.kind === "busy")
+    return {
+      outcome: "reconcile-run-unavailable",
+      runId: result.runId,
+      addresses: []
+    };
+  if (result.kind === "selection-unavailable")
+    return {
+      outcome: "reconcile-claim-selection-unavailable",
+      runId: result.runId,
+      addresses: result.addresses,
+      ...result.detail === void 0 ? {} : { detail: result.detail }
+    };
+  if (result.kind === "database-read-only") {
+    const refusal = refusalForSelectedIssue(result.selectedIssue);
+    return {
+      outcome: "database-read-only",
+      runId: result.runId,
+      addresses: result.addresses,
+      detail: result.selectedIssue.reason,
+      ...refusal === void 0 ? {} : { refusal }
+    };
+  }
+  const recovery = mapRecovery(result.recovery, result.selectedIssue);
+  const detail = result.selectedIssue?.kind === "ledger-not-current" ? ledgerCurrencyDetail(result.selectedIssue) : recovery === void 0 ? void 0 : unresolvedRecoveryDetail(recovery);
+  if (result.kind === "unresolved") {
+    const refusal = refusalForSelectedIssue(result.selectedIssue);
+    return {
+      outcome: "reconcile-unresolved",
+      runId: result.runId,
+      addresses: result.addresses,
+      ...detail === void 0 ? {} : { detail },
+      ...recovery === void 0 ? {} : { recovery },
+      ...refusal === void 0 ? {} : { refusal }
+    };
+  }
   return {
-    runId: input.journal.run.runId,
-    planDigest: input.journal.run.planDigest,
-    executionId: input.row.executionId,
-    claimId: input.row.rootClaimId,
-    plannedClaimKey: input.plannedClaimKey,
-    admittedBundleDigest: bundleDigest,
-    persistedBundleDigest: bundleDigest,
-    recordedPreState: input.stableStateBeforeClaim,
-    externalDdlExclusion: {
-      planDigest: input.journal.run.planDigest,
-      address: input.row.address,
-      trustRoot: JSON.stringify(assumption.asserter)
-    }
+    outcome: "reconcile-completed",
+    runId: result.runId,
+    addresses: result.addresses,
+    ...recovery === void 0 ? {} : { recovery }
   };
 }
 async function runReconcile(runId, options, pool) {
@@ -4070,303 +3662,28 @@ async function runReconcile(runId, options, pool) {
       failureCause: classifyReconcileFailure(error, "reconcile")
     };
   }
-  let stage = "reconcile";
   try {
-    const locked = await withPgTransitionRunLock2(
-      owned,
-      runId,
-      async (target) => {
-        const lease = await acquireExclusiveTransitionLease2(target);
-        try {
-          stage = "journal";
-          const journal = await readTransitionJournal2(lease.session, runId, {
-            ensure: false
-          });
-          stage = "reconcile";
-          const material = journal.plan.steps.map((step) => {
-            const generatedStep = step;
-            const generated = generatedStep.address;
-            return step.managedClaim ?? (generated === void 0 ? void 0 : {
-              address: generated,
-              ...generatedStep.plannedClaimKeys?.[0] === void 0 ? {} : {
-                plannedClaimKey: generatedStep.plannedClaimKeys[0]
-              }
-            });
-          }).filter(
-            (claim) => claim !== void 0
-          );
-          try {
-            await assertPgDatabaseWritable(lease.session);
-          } catch (error) {
-            if (isPgDatabaseReadOnlyError(error))
-              return {
-                kind: "database-read-only",
-                detail: error.message,
-                addresses: material.map((claim) => claim.address)
-              };
-            throw error;
-          }
-          if (material.length === 0)
-            return {
-              kind: "selection-unavailable",
-              addresses: journal.plan.declarations?.declarations.map(
-                (declaration) => declaration.address
-              ) ?? []
-            };
-          const homes = /* @__PURE__ */ new Map();
-          for (const claim of material) {
-            const home2 = ledgerHome(claim.address);
-            homes.set(`${home2.scope}:${home2.schema ?? ""}`, home2);
-          }
-          for (const home2 of homes.values()) {
-            const currency = await readPgLedgerScopeCurrency2(
-              lease.session,
-              home2
-            );
-            if (currency.kind === "current") continue;
-            const detail = currency.kind === "not-current" && currency.reason === "lineage" ? "ledger lineage mismatch; run dbsp preflight --reinitialize" : `ledger marker ${currency.marker.kind}; run dbsp preflight --reinitialize`;
-            const affected = material.filter((claim) => {
-              const claimHome = ledgerHome(claim.address);
-              return claimHome.scope === home2.scope && claimHome.schema === home2.schema;
-            });
-            return {
-              kind: "unresolved",
-              addresses: affected.map((claim) => claim.address),
-              detail,
-              recovery: affected.map((claim) => ({
-                address: claim.address,
-                outcome: "blocked",
-                reason: detail,
-                refusal: preAppendRefusalFor("ERR-03", {
-                  address: claim.address,
-                  state: "unknown"
-                })
-              }))
-            };
-          }
-          const executionIds = executionIdsForRun(journal);
-          const reservations = (await Promise.all(
-            [...homes.values()].flatMap(
-              (home2) => executionIds.map(
-                (executionId) => readPgLedgerReservationsForExecution2(
-                  lease.session,
-                  home2,
-                  executionId
-                )
-              )
-            )
-          )).flat();
-          if (reservations.length === 0)
-            return {
-              kind: "selection-unavailable",
-              addresses: material.map((x) => x.address)
-            };
-          const readdressPairs = /* @__PURE__ */ new Map();
-          const byRoot = /* @__PURE__ */ new Map();
-          for (const row of reservations) {
-            if (row.claimKind === "readdress-intent" && row.pairId !== void 0) {
-              const pairKey = `${row.executionId}:${row.pairId}`;
-              readdressPairs.set(pairKey, [
-                ...readdressPairs.get(pairKey) ?? [],
-                row
-              ]);
-              continue;
-            }
-            byRoot.set(row.rootClaimId, [
-              ...byRoot.get(row.rootClaimId) ?? [],
-              row
-            ]);
-          }
-          const recovery = [];
-          for (const [_pairKey, pairRows] of readdressPairs) {
-            const pairId = pairRows[0]?.pairId;
-            const executionId = pairRows[0]?.executionId;
-            if (!pairId || !executionId) continue;
-            const readPairInSelectedHomes = readVerifiedPgLedgerReservationsForPair;
-            const closure = await readPairInSelectedHomes(
-              lease.session,
-              pairId,
-              [...homes.values()]
-            );
-            const recovered = await recoverPgReaddressPair(lease.session, {
-              pairId,
-              executionId,
-              reservations: closure
-            });
-            recovery.push(readdressRecoveryReport(closure, recovered));
-          }
-          for (const rows of byRoot.values()) {
-            const rootClaimId = rows[0]?.rootClaimId;
-            if (!rootClaimId) continue;
-            if (rows.some(
-              (row) => !executionIds.includes(row.executionId) || row.rootClaimId !== rootClaimId
-            ))
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `reservation disagreement for root claim ${rootClaimId}`
-              };
-            const rootCandidates = [];
-            for (const row of rows) {
-              stage = "catalogue";
-              const chain = await readPgLedgerAddressChain4(
-                lease.session,
-                ledgerHome(row.address),
-                row.address
-              );
-              stage = "reconcile";
-              const projection = projectLedgerChain3(chain);
-              if (projection.kind !== "projected-ledger-chain" || projection.openClaim === void 0)
-                continue;
-              const open2 = projection.openClaim.event;
-              const openRoot = open2.rootClaimId ?? open2.eventId;
-              if (open2.executionId !== row.executionId || openRoot !== rootClaimId)
-                return {
-                  kind: "selection-unavailable",
-                  addresses: rows.map((item) => item.address),
-                  detail: `open chain member disagrees with reservation root ${rootClaimId}`
-                };
-              if (open2.eventId === rootClaimId)
-                rootCandidates.push({
-                  row,
-                  stableStateBeforeClaim: projection.openClaim.stableStateBeforeClaim,
-                  ...open2.plannedClaimKey === void 0 ? {} : { plannedClaimKey: open2.plannedClaimKey }
-                });
-            }
-            if (rootCandidates.length !== 1)
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `execution ${runId} has ${rootCandidates.length} open root members for ${rootClaimId}`
-              };
-            const selected = rootCandidates[0];
-            if (!selected) continue;
-            if (!selected.plannedClaimKey || !material.some(
-              (claim) => claim.plannedClaimKey === selected.plannedClaimKey
-            ))
-              return {
-                kind: "selection-unavailable",
-                addresses: rows.map((row) => row.address),
-                detail: `open root ${rootClaimId} has no matching persisted managed step`
-              };
-            const step = journal.plan.steps.find(
-              (candidate) => candidate.managedClaim?.plannedClaimKey === selected.plannedClaimKey || "plannedClaimKeys" in candidate && Array.isArray(candidate.plannedClaimKeys) && candidate.plannedClaimKeys.includes(
-                selected.plannedClaimKey
-              )
-            );
-            const operationReadBack = step?.operation?.operationKind.name === "CreateUniqueIndexConcurrently" ? async (executor, _address, identity) => {
-              await assertCreateUniqueIndexConcurrentlyRecoveryNotInvalid(
-                executor,
-                step.operation
-              );
-              return {
-                observed: recoveryPayload(identity),
-                effect: "unverifiable"
-              };
-            } : void 0;
-            const indeterminateEvidence = recoveryEvidenceForClaim({
-              journal,
-              row: selected.row,
-              plannedClaimKey: selected.plannedClaimKey,
-              stableStateBeforeClaim: selected.stableStateBeforeClaim
-            });
-            for (const row of rows) {
-              const isRoot = sameLedgerAddress(
-                row.address,
-                selected.row.address
-              );
-              const recovered = await recoverPgOutcomeClaim(owned, {
-                address: row.address,
-                reservations: [row],
-                resolutionEventId: isRoot ? `${rootClaimId}:reconcile:${runId}` : `${rootClaimId}:reconcile:${runId}:${row.address.kind}:${row.address.name}`,
-                acceptedExternalDdlExclusion: isRoot && indeterminateEvidence !== void 0,
-                resolveIndeterminate: true,
-                readBack: async (_executor, _address, identity) => recoveryPayload(identity),
-                ...isRoot && indeterminateEvidence !== void 0 ? { indeterminateEvidence } : {},
-                ...isRoot && operationReadBack !== void 0 ? { operationReadBack } : {}
-              });
-              recovery.push(recoveryReport(row.address, recovered));
-            }
-          }
-          const unresolved = unresolvedRecoveryDetail(recovery);
-          if (unresolved)
-            return {
-              kind: "unresolved",
-              addresses: reservations.map((item) => item.address),
-              detail: unresolved,
-              recovery
-            };
-          return {
-            kind: "completed",
-            addresses: reservations.map((item) => item.address),
-            recovery
-          };
-        } finally {
-          await lease.release();
-        }
-      }
-    );
-    if (locked.kind === "busy")
-      return { outcome: "reconcile-run-unavailable", runId, addresses: [] };
-    if (locked.value.kind === "selection-unavailable")
-      return {
-        outcome: "reconcile-claim-selection-unavailable",
-        runId,
-        addresses: locked.value.addresses,
-        ...locked.value.detail ? { detail: locked.value.detail } : {}
-      };
-    if (locked.value.kind === "database-read-only") {
-      const address = locked.value.addresses[0];
-      return {
-        outcome: "database-read-only",
-        runId,
-        addresses: locked.value.addresses,
-        detail: locked.value.detail,
-        ...address === void 0 ? {} : {
-          refusal: preAppendRefusalFor("ERR-07", {
-            address,
-            state: "unknown"
-          })
-        }
-      };
-    }
-    if (locked.value.kind === "unresolved") {
-      const address = locked.value.addresses[0];
-      const markerRefusal = address !== void 0 && locked.value.detail?.includes("run dbsp preflight --reinitialize") ? preAppendRefusalFor("ERR-03", { address, state: "unknown" }) : void 0;
-      const recoveryRefusal = locked.value.recovery?.find(
-        (report) => report.refusal !== void 0
-      )?.refusal;
-      const refusal = markerRefusal ?? recoveryRefusal;
-      return {
-        outcome: "reconcile-unresolved",
-        runId,
-        addresses: locked.value.addresses,
-        ...locked.value.detail ? { detail: locked.value.detail } : {},
-        ...locked.value.recovery ? { recovery: locked.value.recovery } : {},
-        ...refusal === void 0 ? {} : { refusal }
-      };
-    }
-    return {
-      outcome: "reconcile-completed",
-      runId,
-      addresses: locked.value.addresses,
-      ...locked.value.recovery ? { recovery: locked.value.recovery } : {}
-    };
+    return mapAdapterResult(await reconcilePgTransitionRun(owned, runId));
   } catch (error) {
+    const typed = error instanceof PgReconcileTransitionRunError ? error : void 0;
+    const cause = typed?.originalCause ?? error;
     return {
       outcome: "reconcile-run-unavailable",
       runId,
       addresses: [],
-      detail: escapeDiagnosticText6(
-        error instanceof Error ? error.message : String(error)
+      detail: escapeDiagnosticText7(
+        cause instanceof Error ? cause.message : String(cause)
       ),
-      failureCause: classifyReconcileFailure(error, stage)
+      failureCause: classifyReconcileFailure(
+        cause,
+        typed?.stage ?? "reconcile"
+      )
     };
   } finally {
     if (pool === void 0) await owned.end();
   }
 }
-var reconcileCommand = new Command7("reconcile").description("Resolve this run\u2019s open managed claims from live evidence only").argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--format <format>", "Output format: text or json", "text").action(async (runId, options) => {
+var reconcileCommand = new Command8("reconcile").description("Resolve this run\u2019s open managed claims from live evidence only").argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--format <format>", "Output format: text or json", "text").action(async (runId, options) => {
   const result = await runReconcile(runId, options);
   if (options.format === "json") printCliJson(result);
   else console.log(formatReconcileHuman(result));
@@ -4375,25 +3692,25 @@ var reconcileCommand = new Command7("reconcile").description("Resolve this run\u
 
 // src/commands/recover.ts
 import {
-  assertPgDatabaseWritable as assertPgDatabaseWritable2,
-  createPgTransitionPack as createPgTransitionPack3,
-  isPgDatabaseReadOnlyError as isPgDatabaseReadOnlyError2,
+  assertPgDatabaseWritable,
+  createPgTransitionPack as createPgTransitionPack2,
+  isPgDatabaseReadOnlyError,
   preparePgRecoveryAdmission,
-  readPgLedgerScopeCurrency as readPgLedgerScopeCurrency3,
+  readPgLedgerScopeCurrency,
   readPgObservationContextFromLessor as readPgObservationContextFromLessor2,
-  readTransitionJournal as readTransitionJournal3,
-  withPgTransitionRunLock as withPgTransitionRunLock3
+  readTransitionJournal as readTransitionJournal2,
+  withPgTransitionRunLock as withPgTransitionRunLock2
 } from "@dbsp/adapter-pgsql";
 import {
   acquireTransitionTargetLease,
-  assumptionAccepted as assumptionAccepted2,
-  createApplier as createApplier2,
-  createPackRegistry as createPackRegistry3,
+  assumptionAccepted,
+  createApplier,
+  createPackRegistry as createPackRegistry2,
   loadVerifiedRecoveryJournal,
-  transitionPlanDigest as transitionPlanDigest4,
+  transitionPlanDigest as transitionPlanDigest3,
   validateTransitionRelationalInvariants
 } from "@dbsp/core";
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 var RECOVER_OUTCOME_CONTRACT = [
   ["completed", 0, "all attempted steps were durably reconciled"],
   ["recovery-resume-required", 40, "remaining work requires a new proof"],
@@ -4482,7 +3799,7 @@ function validateRecoveryAuthorization(journal) {
       if (journal.plan.assumptions.every((assumption) => {
         const grant = grants.get(assumption.id);
         const acceptedGrant = grant === void 0 ? void 0 : accepts[grant];
-        return grant !== void 0 && grant >= 0 && grant < accepts.length && acceptedGrant !== void 0 && assumptionAccepted2(assumption, {
+        return grant !== void 0 && grant >= 0 && grant < accepts.length && acceptedGrant !== void 0 && assumptionAccepted(assumption, {
           accepts: [acceptedGrant]
         });
       }))
@@ -4493,7 +3810,7 @@ function validateRecoveryAuthorization(journal) {
   return { ok: false, outcome: "recovery-authorization-invalid" };
 }
 function recoveryPolicyForJournal(loaded, runId) {
-  if (loaded.run.runId !== runId || loaded.run.planDigest !== transitionPlanDigest4(loaded.plan) || !validateTransitionRelationalInvariants({ kind: "plan", plan: loaded.plan }).ok)
+  if (loaded.run.runId !== runId || loaded.run.planDigest !== transitionPlanDigest3(loaded.plan) || !validateTransitionRelationalInvariants({ kind: "plan", plan: loaded.plan }).ok)
     return { ok: false, outcome: "recovery-plan-invalid" };
   return validateRecoveryAuthorization(loaded);
 }
@@ -4521,12 +3838,12 @@ function outcomeForRecoveryResult(result) {
 async function load(target, runId) {
   const lease = await acquireTransitionTargetLease(target);
   try {
-    return await readTransitionJournal3(lease.session, runId, { ensure: false });
+    return await readTransitionJournal2(lease.session, runId, { ensure: false });
   } finally {
     await lease.release();
   }
 }
-function ledgerHome2(address) {
+function ledgerHome(address) {
   if (address.scope === "database") return { scope: "database" };
   if (!address.schema)
     throw new Error(
@@ -4544,24 +3861,24 @@ function recoveryAddresses(journal) {
     return address === void 0 ? [] : [address];
   });
 }
-function formatLedgerHome(home2) {
-  return home2.scope === "database" ? "database" : `schema ${home2.schema}`;
+function formatLedgerHome(home) {
+  return home.scope === "database" ? "database" : `schema ${home.schema}`;
 }
 async function recoverMarkerRefusal(target, journal) {
   const addresses = recoveryAddresses(journal);
   const homes = [];
   for (const address of addresses) {
-    const home2 = ledgerHome2(address);
-    if (homes.some((candidate) => sameLedgerHome(candidate.home, home2)))
+    const home = ledgerHome(address);
+    if (homes.some((candidate) => sameLedgerHome(candidate.home, home)))
       continue;
-    homes.push({ address, home: home2 });
+    homes.push({ address, home });
   }
   const lease = await acquireTransitionTargetLease(target);
   try {
-    for (const { address, home: home2 } of homes) {
-      const currency = await readPgLedgerScopeCurrency3(lease.session, home2);
+    for (const { address, home } of homes) {
+      const currency = await readPgLedgerScopeCurrency(lease.session, home);
       if (currency.kind === "current") continue;
-      const detail = currency.kind === "not-current" && currency.reason === "lineage" ? `ledger lineage mismatch in ${formatLedgerHome(home2)}; run dbsp preflight --reinitialize` : `ledger marker ${currency.marker.kind} in ${formatLedgerHome(home2)}; run dbsp preflight --reinitialize`;
+      const detail = currency.kind === "not-current" && currency.reason === "lineage" ? `ledger lineage mismatch in ${formatLedgerHome(home)}; run dbsp preflight --reinitialize` : `ledger marker ${currency.marker.kind} in ${formatLedgerHome(home)}; run dbsp preflight --reinitialize`;
       return {
         detail,
         refusal: preAppendRefusalFor("ERR-03", {
@@ -4581,7 +3898,7 @@ async function runRecover(runId, options, pool) {
   const owned = pool === void 0 ? (await createDbConnection(options.db)).pool : pool;
   let result;
   try {
-    const locked = await withPgTransitionRunLock3(
+    const locked = await withPgTransitionRunLock2(
       owned,
       runId,
       async (target) => {
@@ -4604,9 +3921,9 @@ async function runRecover(runId, options, pool) {
         }
         const writabilityLease = await acquireTransitionTargetLease(target);
         try {
-          await assertPgDatabaseWritable2(writabilityLease.session);
+          await assertPgDatabaseWritable(writabilityLease.session);
         } catch (error) {
-          if (isPgDatabaseReadOnlyError2(error))
+          if (isPgDatabaseReadOnlyError(error))
             return {
               outcome: "database-read-only",
               detail: error.message
@@ -4627,8 +3944,8 @@ async function runRecover(runId, options, pool) {
         const authorization = loaded.journal.events.length === 0 ? void 0 : recoveryPolicyForJournal(loaded.journal, runId);
         if (authorization && !authorization.ok)
           return { outcome: authorization.outcome };
-        const result2 = await createApplier2(
-          createPackRegistry3([createPgTransitionPack3({})]),
+        const result2 = await createApplier(
+          createPackRegistry2([createPgTransitionPack2({})]),
           { persist: async () => void 0 }
         ).resume(
           loaded.journal,
@@ -4662,7 +3979,7 @@ async function runRecover(runId, options, pool) {
   }
   return result;
 }
-var recoverCommand = new Command8("recover").description(
+var recoverCommand = new Command9("recover").description(
   "Observe and classify an attempted durable run; performs no planned target DDL and does not re-authorize assumptions"
 ).argument("<run-id>", "Durable run identifier").requiredOption("-d, --db <url>", "Database connection URL (required)").requiredOption(
   "--plan-digest <sha>",
@@ -4698,11 +4015,11 @@ ${RECOVER_OUTCOME_CONTRACT.map(([outcome, code, description]) => `  ${outcome} -
 // src/commands/release.ts
 import {
   createPgTransitionLessor as createPgTransitionLessor5,
-  escapeDiagnosticText as escapeDiagnosticText7,
+  escapeDiagnosticText as escapeDiagnosticText8,
   releasePgManagedAddress
 } from "@dbsp/adapter-pgsql";
 import { acquireTransitionLease as acquireTransitionLease5 } from "@dbsp/core";
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 async function runRelease(selector, options) {
   const { pool } = await createDbConnection(options.db);
   const schema = options.schema ?? "public";
@@ -4737,18 +4054,18 @@ async function runRelease(selector, options) {
 function formatReleaseHuman(result) {
   if (result.outcome === "released") return "released";
   if (result.outcome === "database-read-only")
-    return `database-read-only: ${escapeDiagnosticText7(result.detail)}`;
+    return `database-read-only: ${escapeDiagnosticText8(result.detail)}`;
   if (result.outcome === "release-unavailable")
-    return `release-unavailable: ${escapeDiagnosticText7(result.detail)}`;
+    return `release-unavailable: ${escapeDiagnosticText8(result.detail)}`;
   return [
-    `release-refused: ${escapeDiagnosticText7(result.detail)}`,
-    `address: ${escapeDiagnosticText7(JSON.stringify(result.address))}`,
-    `state: ${escapeDiagnosticText7(result.refusal.state)}`,
-    `withheld authority: ${escapeDiagnosticText7(result.refusal.withheldAuthority)}`,
-    `resolving command: ${escapeDiagnosticText7(result.refusal.resolvingCommand)}`
+    `release-refused: ${escapeDiagnosticText8(result.detail)}`,
+    `address: ${escapeDiagnosticText8(JSON.stringify(result.address))}`,
+    `state: ${escapeDiagnosticText8(result.refusal.state)}`,
+    `withheld authority: ${escapeDiagnosticText8(result.refusal.withheldAuthority)}`,
+    `resolving command: ${escapeDiagnosticText8(result.refusal.resolvingCommand)}`
   ].join("\n");
 }
-var releaseCommand = new Command9("release").description(
+var releaseCommand = new Command10("release").description(
   "End management for one address without touching the database object"
 ).argument("<address>", "Address as name or kind:name").requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema <name>", "Schema ledger containing the address", "public").option("--kind <kind>", "Kind for an unqualified address", "table").option(
   "--parent <kind:name>",
@@ -4766,15 +4083,15 @@ var releaseCommand = new Command9("release").description(
     const detail = error instanceof Error ? error.message : String(error);
     if (options.format === "json")
       printCliJson({ outcome: "release-refused", detail });
-    else console.error(`release-refused: ${escapeDiagnosticText7(detail)}`);
+    else console.error(`release-refused: ${escapeDiagnosticText8(detail)}`);
     process.exitCode = 1;
   }
 });
 
 // src/commands/repl.ts
 import { readFileSync } from "fs";
-import { Command as Command10 } from "commander";
-var replCommand = new Command10("repl").description("Launch interactive REPL for exploring schema and queries").option("-s, --schema <path>", "Path to schema file (default: auto-detect)").option(
+import { Command as Command11 } from "commander";
+var replCommand = new Command11("repl").description("Launch interactive REPL for exploring schema and queries").option("-s, --schema <path>", "Path to schema file (default: auto-detect)").option(
   "-d, --db <url>",
   "PostgreSQL connection URL for execution mode (e.g., postgres://localhost/mydb)"
 ).option("-e, --eval <query>", "Execute a single query and exit (batch mode)").option(
@@ -4896,10 +4213,11 @@ function mapReplCasingOption(casing) {
 // src/commands/verify.ts
 import {
   comparePgsqlDatabaseSchema as comparePgsqlDatabaseSchema2,
-  createPgsqlAdapter as createPgsqlAdapter4,
-  escapeDiagnosticText as escapeDiagnosticText8
+  createPgPhysicalModel as createPgPhysicalModel5,
+  createPgsqlAdapter as createPgsqlAdapter3,
+  escapeDiagnosticText as escapeDiagnosticText9
 } from "@dbsp/adapter-pgsql";
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 
 // src/verifier.ts
 var CHANGE_TO_DRIFT = {
@@ -4929,6 +4247,10 @@ var CHANGE_TO_DRIFT = {
   // Column enhancements
   alter_column_collation: { type: "collation_mismatch", severity: "warning" },
   alter_column_identity: { type: "identity_mismatch", severity: "warning" },
+  alter_column_auto_increment: {
+    type: "auto_increment_mismatch",
+    severity: "error"
+  },
   // Comments
   add_comment: { type: "comment_mismatch", severity: "info" },
   drop_comment: { type: "comment_mismatch", severity: "info" },
@@ -5041,7 +4363,7 @@ function formatVerifyResult(result) {
 }
 
 // src/commands/verify.ts
-var verifyCommand = new Command11("verify").description("Compare schema vs real database (drift detection)").option(
+var verifyCommand = new Command12("verify").description("Compare schema vs real database (drift detection)").option(
   "-s, --schema <path>",
   "Path to schema file (default: dbsp.schema.ts)"
 ).requiredOption("-d, --db <url>", "Database connection URL (required)").option("--schema-name <name>", "Database schema name (default: public)").option("--json", "Output as JSON").action(
@@ -5059,14 +4381,18 @@ var verifyCommand = new Command11("verify").description("Compare schema vs real
     try {
       const loaded = await loadSchema(schemaPath);
       const schemaModel = loaded.model;
+      const physical = createPgPhysicalModel5({
+        mode: "logical",
+        model: schemaModel,
+        schema: options.schemaName ?? "public",
+        ...loaded.dbCasing === void 0 ? {} : { dbCasing: loaded.dbCasing }
+      });
       const { pool } = await createDbConnection(options.db);
       try {
-        const adapter = createPgsqlAdapter4(pool);
-        const diff = await comparePgsqlDatabaseSchema2(adapter, schemaModel, {
-          ...options.schemaName ? { schema: options.schemaName } : {},
-          ...loaded.dbCasing !== void 0 ? { dbCasing: loaded.dbCasing } : {},
+        const adapter = createPgsqlAdapter3(pool);
+        const diff = await comparePgsqlDatabaseSchema2(adapter, physical, {
           onExpressionCanonicalizationWarning: (warning) => console.warn(
-            `\u26A0\uFE0F  [${warning.kind} ${escapeDiagnosticText8(warning.table)}.${escapeDiagnosticText8(warning.name)}] ${warning.message}`
+            `\u26A0\uFE0F  [${warning.kind} ${escapeDiagnosticText9(warning.table)}.${escapeDiagnosticText9(warning.name)}] ${warning.message}`
           )
         });
         const dbModel = await adapter.introspect({
@@ -5103,12 +4429,13 @@ var verifyCommand = new Command11("verify").description("Compare schema vs real
 );
 
 // src/index.ts
-var program = new Command12();
+var program = new Command13();
 var packageJson = createRequire(import.meta.url)("../package.json");
 var jsonFormatCommands = /* @__PURE__ */ new Set([
   "apply",
   "inspect",
   "plan",
+  "migrate",
   "recover",
   "reconcile",
   "release"
@@ -5136,6 +4463,7 @@ program.name("dbsp").description("Schema-first code generation for db-semantic-p
 program.addCommand(generateCommand);
 program.addCommand(introspectCommand);
 program.addCommand(planCommand);
+program.addCommand(migrateCommand);
 program.addCommand(preflightCommand);
 program.addCommand(applyCommand);
 program.addCommand(inspectCommand);