@everystack/cli 0.4.104 → 0.4.105

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.105] - 2026-10-31
+
+### Fixed
+
+- rule 5 judges who can replace a trigger function, not its security mode
+- judge declared trigger-function owners before the derived layer lands
+- re-run the catalog check after the derived layer lands
+- read the reconcile's builder on its own connection
+- everystack --version prints the version
+- run the post-check on the reconcile's own connection
+- say the tables were applied only when this run applied them
+
 ## [0.4.104] - 2026-10-30
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.104",
+  "version": "0.4.105",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -192,7 +192,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.40"
+    "@everystack/server": "0.4.41"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-apply.ts

@@ -77,7 +77,7 @@ import { readStageStateTwice } from '../stage-read-consistency';
 import { renderApplyReceipt, renderCatchUpFailure } from '../plain-output';
 import { renderFkOrphanAdvisory, ownershipColumns } from '../fk-orphan-advisory';
 import { catchUpDerived, type CatchUpVenue } from '../derived-catchup';
-import { lifecycleApplyRefusal, lifecycleStateOnlyRefusal } from '../lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleStateOnlyRefusal, LifecycleFindingsError } from '../lifecycle-preflight';
 import { buildReconcileReport } from './db-reconcile';
 import { step, success, fail, info, warn, line as printLine } from '../output';
 
@@ -269,6 +269,8 @@ async function runCatchUp(
       ...(flags.models ? { models: flags.models } : {}),
       onStart: () => step('Catching the functions, views and triggers up to the checkout...'),
       onRefusal,
+      // A lifecycle refusal says the tables were applied only when this run applied some.
+      stateApplied: applied > 0,
     });
     if (outcome.run) {
       if (verbose) {
@@ -289,6 +291,8 @@ async function runCatchUp(
     return { ok: true, statements: outcome.statements };
   } catch (err: any) {
     const cause = String(err?.message ?? err);
+    // A lifecycle finding's report already says what committed and what did not, one line each.
+    if (err instanceof LifecycleFindingsError) return { ok: false, lines: cause.split('\n') };
     return {
       ok: false,
       // The cause is printed ONCE, at every verbosity: its headline on the report line, and

package/src/cli/commands/db-build.ts

@@ -26,6 +26,7 @@
 
 import type { ModelDescriptor } from '@everystack/model';
 import { buildIntoDatabase } from '../db-build';
+import { LifecycleFindingsError } from '../lifecycle-preflight';
 import { createUrlRunner } from '../db-source';
 import { resolveModelsPath } from '../models-path';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
@@ -127,7 +128,8 @@ export async function dbBuildCommand(flags: Record<string, string>): Promise<voi
       gitRef: currentGitRef(),
     });
   } catch (err: any) {
-    fail(`Build failed: ${err.message}`);
+    // A lifecycle finding says itself what was and was not written.
+    fail(err instanceof LifecycleFindingsError ? err.message : `Build failed: ${err.message}`);
     process.exit(1);
   }
 

package/src/cli/commands/db-plan.ts

@@ -239,7 +239,8 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
 
   try {
     const lifecycleNote = await lifecycleApplyRefusal(runner, models);
-    if (lifecycleNote) warn(lifecycleNote);
+    // db:plan only reads, so it mints the plan anyway; db:apply runs the same check and refuses.
+    if (lifecycleNote) warn(`db:apply will refuse this plan until each lifecycle finding below is fixed.\n${lifecycleNote}`);
     let snapshot: SchemaSnapshot;
     let contract: AuthzContract;
     if (dbSource.kind === 'url') {

package/src/cli/commands/db-sync.ts

@@ -31,7 +31,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type QueryRunner } from '../authz-contract';
-import { catalogInputsFromModels, lifecycleApplyRefusal } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError } from '../lifecycle-preflight';
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import { generateMigrationSql, unmodeledTables } from '../migration-generate';
@@ -242,6 +242,10 @@ export async function executeSync(
   // State runs before compute, so without this a lifecycle table would land with no transition trigger.
   const lifecycleRefusal = await lifecycleApplyRefusal(runner, models);
   if (lifecycleRefusal) throw new Error(lifecycleRefusal);
+  // Before anything is written, so before both places a pass creates derived objects (the
+  // functions the state batch calls, then the reconcile).
+  const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false });
+  if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
   const first = await syncOnce(runner, session, models, options, hooks, 1);
   // The trigger is the STATE bar, not the combined verdict. The cause above is state-layer
   // only, so a compute refusal or an unadopted object cannot be settled by looking again —

package/src/cli/db-build.ts

@@ -18,7 +18,7 @@ import { compileDeclaredState } from './declared-diff';
 import { createUrlRunner } from './db-source';
 import { executeSync, buildSyncReport } from './commands/db-sync';
 import { executeReconcile } from './commands/db-reconcile';
-import { lifecycleApplyRefusal } from './lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal } from './lifecycle-preflight';
 
 const SAFE_NAME = /^[a-z_][a-z0-9_$]*$/;
 
@@ -181,6 +181,11 @@ export async function buildIntoDatabase(
     // declared state: 20 such pairs, `type "…_row" does not exist`, from-scratch only. Their
     // explicit `dependsOn` could not have helped — this pass dropped the view from the wave, so
     // no edge could order it back in.
+    // Before the first derived write: the owners the reconcile will give the declared trigger
+    // functions on lifecycle tables. This pass runs before executeSync, which judges them again
+    // first thing, before its own state apply.
+    const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false });
+    if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
     const declaredFunctions = (options.declared ?? [])
       .filter((o) => o.kind === 'function' && !o.signatureDeps?.length);
     if (declaredFunctions.length > 0) {
@@ -214,6 +219,10 @@ export async function buildIntoDatabase(
       actor: options.actor ?? 'db-build',
       gitRef: options.gitRef ?? null,
     });
+    // Verification: the live catalog check again, over what the derived layer just made live. A
+    // throw, so no caller (db:check's compose ring, the dev template, a test database) can miss it.
+    const post = await lifecyclePostApplyRefusal(session, models);
+    if (post) throw new LifecycleFindingsError(post);
     return {
       converged: run.converged,
       fingerprintMatch: run.fingerprintMatch,

package/src/cli/derived-apply.ts

@@ -181,6 +181,16 @@ function objectSql(obj: SourceObject, ownerMode: OwnerApplyMode = 'set-role', re
   return [`SET ROLE ${obj.owner}`, ...statements, 'RESET ROLE'];
 }
 
+/**
+ * The role that owns an object once the reconcile has created it: its declared owner (objectSql
+ * enacts it), else `builder`, the role the reconcile runs as, which creates it as itself. The
+ * lifecycle pre-exposure gate reads owners through this too, so the role it judges is the role the
+ * reconcile makes.
+ */
+export function reconcileOwner(obj: Pick<SourceObject, 'owner'>, builder: string): string {
+  return obj.owner || builder;
+}
+
 const ALTER_OWNER: Record<string, string> = {
   function: 'ALTER FUNCTION',
   view: 'ALTER VIEW',
@@ -228,7 +238,8 @@ export function triggerFunctionOf(trigger: SourceObject, source: readonly Source
 function withTransientExecute(obj: SourceObject, statements: string[], source: readonly SourceObject[], grantee?: string): string[] {
   if (!grantee || obj.kind !== 'trigger') return statements;
   const fn = triggerFunctionOf(obj, source);
-  if (!fn?.owner) return statements;
+  // The builder owns a function it creates for itself, and an owner holds EXECUTE.
+  if (!fn || reconcileOwner(fn, grantee) === grantee) return statements;
   const declared = parseGrantAttachments(fn.attachments).grants[grantee] ?? [];
   if (declared.includes('EXECUTE') || declared.includes('ALL')) return statements;
   const target = dropTarget('function', fn.identity);

package/src/cli/derived-catchup.ts

@@ -33,9 +33,9 @@ import { loadDeclaredDerived, type DeclaredDerived } from './declared-derived';
 import { modelContractPreflight } from './model-wire-lane';
 import { MODEL_WIRE_CONTRACT, type ReconcileWirePayload } from '../wire';
 import { resolveConfig, opsFunction } from './config';
-import { invokeAction } from './aws';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from './aws';
 import { currentGitRef } from './state-apply';
-import { catalogInputsFromModels } from './lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal } from './lifecycle-preflight';
 
 /** Where the catch-up runs. The two lanes db:apply itself already has. */
 export type CatchUpVenue =
@@ -77,6 +77,12 @@ export interface CatchUpOptions {
    * wrongly handed an exit loses the sentence its operator was owed.
    */
   onRefusal: 'exit' | 'throw';
+  /**
+   * Whether THIS run committed table or column changes before the catch-up: a lifecycle refusal
+   * then says so. False for db:apply with no --plan, and for a plan that was already applied.
+   * Required for the same reason as `onRefusal`: only the caller knows what it wrote.
+   */
+  stateApplied: boolean;
 }
 
 export interface CatchUpOutcome {
@@ -116,11 +122,21 @@ export async function catchUpDerived(
     gitRef: currentGitRef(),
   };
 
+  // Before the first derived write, judge the owners the reconcile will give the declared trigger
+  // functions on lifecycle tables.
+  const config = venue.kind === 'stage' ? await resolveConfig(venue.stage) : undefined;
+  const reader: QueryRunner = (q) => (venue.kind === 'direct' ? venue.runner : lambdaQueryRunner(config!.region, opsFunction(config!)))(q);
+  // The builder is read on the reconcile's own connection: on a stage, db:session runs on the
+  // operator connection, while db:query may run on a reader.
+  const operator: SessionRunner = (statements, opts) =>
+    (venue.kind === 'direct' ? venue.session : lambdaSessionRunner(config!.region, opsFunction(config!)))(statements, opts);
+  const gate = await lifecycleDeclaredOwnerRefusal(reader, operator, objects, declared?.models ?? [], { stateApplied: opts.stateApplied });
+  if (gate) throw new LifecycleFindingsError(gate);
+
   let run: ReconcileRun;
   if (venue.kind === 'direct') {
     run = await executeReconcile(venue.runner, venue.session, options);
   } else {
-    const config = await resolveConfig(venue.stage);
     // The ops Lambda CREATES AND REPLACES database objects from these descriptors, so verify the
     // deployed stage understands their shape before sending them — the same handshake
     // db:reconcile --apply --stage runs, for the same payload.
@@ -130,14 +146,14 @@ export async function catchUpDerived(
     // before the process ends. A catch-up that is the whole command has written nothing, and
     // asks to exit: print the skew, say nothing was sent, exit.
     await modelContractPreflight({
-      region: config.region,
-      fn: opsFunction(config),
+      region: config!.region,
+      fn: opsFunction(config!),
       directCommand: `everystack db:apply --stage ${venue.stage} --direct`,
       onRefusal: opts.onRefusal,
     })('db:apply');
     const result: any = await invokeAction(
-      config.region,
-      opsFunction(config),
+      config!.region,
+      opsFunction(config!),
       'db:reconcile',
       { ...options, modelContract: MODEL_WIRE_CONTRACT } satisfies ReconcileWirePayload,
     );
@@ -154,5 +170,10 @@ export async function catchUpDerived(
   // not land, so db:apply must say so and exit the same way.
   if (run.refusal) throw new CatchUpError(run.refusal);
 
+  // Verification: the live catalog check again, over what the reconcile just made live. On the
+  // operator session, where the commit is: db:query may read a replica that has not caught up.
+  const post = await lifecyclePostApplyRefusal(operator, declared?.models ?? []);
+  if (post) throw new LifecycleFindingsError(post);
+
   return { declared: objects.length, run, statements: run.applied ? (run.statements ?? []) : [] };
 }

package/src/cli/index.ts

@@ -44,6 +44,8 @@ import { auditLighthouseCommand } from './commands/lighthouse';
 import { auditCommand } from './commands/audit';
 import { uiAuditCommand } from './commands/ui-audit';
 import { runbookCommand } from './commands/runbook';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
 import { fail } from './output';
 import { parseFlags } from './parse-flags';
 
@@ -56,6 +58,13 @@ async function main() {
     process.exit(0);
   }
 
+  if (command === '--version' || command === '-v') {
+    // tsx polyfills __dirname in ESM (see runbook.ts cliVersion).
+    const pkg = JSON.parse(readFileSync(path.join(eval('__dirname') as string, '..', '..', 'package.json'), 'utf8'));
+    console.log(pkg.version);
+    process.exit(0);
+  }
+
   const flags = parseFlags(args.slice(1));
 
   // `everystack <command> --help` shows help instead of running the command
@@ -405,6 +414,7 @@ Auth:
 
 Options:
   --help, -h    Show this help message
+  --version, -v Print the @everystack/cli version
 `);
 }
 

package/src/cli/lifecycle-preflight.ts

@@ -3,6 +3,8 @@ import { createHash } from 'node:crypto';
 import { DESTROY_LOG_MARKER_BODIES, DESTROY_LOG_MARKER_LANGUAGES, DESTROY_LOG_MARKER_SEARCH_PATH, LIFECYCLE_OWNER_ROLE, type ModelDescriptor } from '@everystack/model';
 import type { QueryRunner } from './authz-contract';
 import { compileTableContract } from './authz-compile';
+import { reconcileOwner, triggerFunctionOf } from './derived-apply';
+import { isSessionError, type SessionRunner } from './session';
 import { parseQualified, type SourceObject } from './derived-source';
 import { lifecycleDerived, lifecycleManifestOf, lifecycleRole } from './lifecycle-derived';
 
@@ -248,20 +250,43 @@ const markerSql = (lc: string): string => `SELECT s.sig, p.oid IS NOT NULL AS pr
   ORDER BY s.i`;
 
 /**
- * Rule 5. A trigger on a lifecycle table whose function is SECURITY DEFINER and owned by neither
- * the table's owner nor the lifecycle role: it runs as that third role inside every delete.
+ * Rule 5. A trigger on a lifecycle table whose function's owner is an application-side role, or
+ * one an application-side role reaches. The soft delete's stamp and destroy's DELETE run as the
+ * lifecycle role, so an INVOKER trigger function runs as it and a DEFINER one as its owner; either
+ * way whoever can replace the body acts inside every soft delete and destroy. So the security
+ * mode does not matter, and neither the table's owner nor the lifecycle role is exempt.
  */
-const definerTriggerSql = (tables: string[], lc: string): string => `SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
+const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${sideCte(apps)}
+  SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
     pg_catalog.quote_ident(fn.nspname) || '.' || pg_catalog.quote_ident(p.proname) || '(' || pg_catalog.pg_get_function_identity_arguments(p.oid) || ')' AS function,
-    pg_catalog.pg_get_userbyid(p.proowner)::text AS owner, pg_catalog.pg_get_userbyid(c.relowner)::text AS table_owner
+    pg_catalog.pg_get_userbyid(p.proowner)::text AS owner,
+    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via
   FROM pg_catalog.pg_trigger g JOIN pg_catalog.pg_class c ON c.oid = g.tgrelid
   JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace JOIN pg_catalog.pg_proc p ON p.oid = g.tgfoid
   JOIN pg_catalog.pg_namespace fn ON fn.oid = p.pronamespace
   WHERE NOT g.tgisinternal AND (n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)})
-    AND p.prosecdef AND p.proowner <> c.relowner
-    AND p.proowner IS DISTINCT FROM (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = ${literal(lc)})
+    AND EXISTS (SELECT 1 FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')})
   ORDER BY 1, 2`;
 
+/**
+ * One rule-5 finding. `via` holds the application-side roles that are, or reach, `owner`. When the
+ * owner is one of them the fix is a new owner; otherwise it is to revoke the path to the owner.
+ * `would`: the pre-exposure gate, which judges a declared trigger before the reconcile creates it.
+ */
+export function triggerOwnerFinding(row: { trigger: string; table: string; function: string; owner: string; via: readonly string[] }, would = false): string {
+  const { owner, via } = row;
+  const sideOwned = via.includes(owner);
+  const who = sideOwned ? `${owner}, an application-side role`
+    : `${owner}, which the application-side role${via.length === 1 ? '' : 's'} ${via.join(', ')} can assume`;
+  const fix = sideOwned
+    ? `declare ${row.function}'s owner in db/models as a role no application role can act as, and apply `
+      + `(the apply re-creates a declared function with its declared owner, so a live ALTER alone is undone); `
+      + `for a function not declared in db/models: ALTER FUNCTION ${row.function} OWNER TO <that role>;`
+    : `${via.map(r => `REVOKE ${ident(owner)} FROM ${ident(r)};`).join(' ')} (or from the role each reaches ${owner} through)`;
+  return `trigger ${row.trigger} on ${row.table} ${would ? 'would run' : 'runs'} ${row.function}, owned by ${who}; `
+    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`;
+}
+
 /**
  * Rule 6. Every foreign key into a lifecycle table (a partition's clone excluded), with its columns
  * in key order and its ON DELETE action. Which ones a model declares is decided by the caller.
@@ -298,16 +323,32 @@ const OWNER_HAZARD = {
  *
  * The one implementation: db:apply, db:sync and db:plan reach it through lifecycleApplyRefusal
  * (inputs from the models); db:reconcile, local and in the ops Lambda, through
- * lifecycleReconcileRefusal (tables from the declared transition triggers).
+ * lifecycleReconcileRefusal (tables from the declared transition triggers); db:apply and db:build
+ * again after the derived layer lands, through lifecyclePostApplyRefusal.
  */
 export async function lifecycleCatalogRefusal(
   runner: QueryRunner,
   inputs: LifecycleCatalogInputs,
   options: { lifecycleRole?: string } = {},
 ): Promise<string | null> {
+  const findings = await lifecycleCatalogFindings(runner, inputs, options);
+  if (findings.length === 0) return null;
+  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
+    + `fix each, then re-run:\n${findingLines(findings)}`;
+}
+
+const findingLines = (findings: readonly string[]): string => findings.map(finding => `  - ${finding}`).join('\n');
+const countFindings = (n: number): string => `${n} lifecycle finding${n === 1 ? '' : 's'}`;
+
+/** lifecycleCatalogRefusal's findings, one string each, without the heading. */
+async function lifecycleCatalogFindings(
+  runner: QueryRunner,
+  inputs: LifecycleCatalogInputs,
+  options: { lifecycleRole?: string } = {},
+): Promise<string[]> {
   const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
   const tables = [...new Set(inputs.lifecycleTables)].sort();
-  if (tables.length === 0) return null;
+  if (tables.length === 0) return [];
   const apps = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
   const findings: string[] = [];
 
@@ -371,10 +412,9 @@ export async function lifecycleCatalogRefusal(
     }
   }
 
-  for (const row of await runner(definerTriggerSql(tables, lc))) {
-    findings.push(`trigger ${row.trigger} on ${row.table} runs ${row.function}, SECURITY DEFINER and owned by ${row.owner}, `
-      + `neither the table's owner (${row.table_owner}) nor ${lc}; it runs as ${row.owner} inside every delete. `
-      + `Fix: ALTER FUNCTION ${row.function} SECURITY INVOKER; or ALTER FUNCTION ${row.function} OWNER TO ${ident(String(row.table_owner))};`);
+  for (const row of await runner(triggerOwnerSql(tables, apps))) {
+    findings.push(triggerOwnerFinding({ trigger: String(row.trigger), table: String(row.table), function: String(row.function),
+      owner: String(row.owner), via: textList(row.via) }));
   }
 
   const declared = new Set(inputs.dependentKeys.map(key => JSON.stringify([key.child, key.column, key.parent])));
@@ -403,9 +443,88 @@ export async function lifecycleCatalogRefusal(
         + 'if the models declare this key nullify, upgrade the CLI (@everystack/cli) and re-run.' : ''));
   }
 
+  return findings;
+}
+
+/**
+ * A lifecycle finding raised around the derived layer: by the pre-exposure gate (nothing derived
+ * was written) or by the post-check (the objects are live). Its message is the whole report, one
+ * line of head and one line per finding, so a caller prints it as is.
+ */
+export class LifecycleFindingsError extends Error {}
+
+/**
+ * The pre-exposure gate: rule 5 over the DECLARED owners, before the reconcile creates anything.
+ * Each declared trigger on a lifecycle table whose function is declared is judged by the owner the
+ * reconcile will give that function (reconcileOwner: the declared owner, else the role the
+ * reconcile runs as). A declared owner that does not exist live is a finding. A trigger whose
+ * function is not declared is left to the post-check, which reads the live owner.
+ *
+ * `session` reads the builder: it runs on the connection the reconcile writes on. On a stage that
+ * is db:session, the operator connection; db:query (`runner`) may run on a reader
+ * (QUERY_DATABASE_URL), whose CURRENT_USER is not the role that will own the function. `runner`
+ * reads only pg_roles, which is the same on any connection.
+ *
+ * `stateApplied`: the table and column changes have committed, so the refusal says so.
+ */
+export async function lifecycleDeclaredOwnerRefusal(
+  runner: QueryRunner,
+  session: SessionRunner,
+  declared: readonly SourceObject[],
+  models: readonly ModelDescriptor[],
+  options: { stateApplied: boolean },
+): Promise<string | null> {
+  const { lifecycleTables, applicationRoles } = catalogInputsFromModels(models);
+  const tables = new Set(lifecycleTables);
+  const triggers = declared.flatMap((object) => {
+    if (object.kind !== 'trigger' || !object.table) return [];
+    const { schema, name } = parseQualified(object.table);
+    const fn = tables.has(`${schema}.${name}`) ? triggerFunctionOf(object, declared) : undefined;
+    return fn ? [{ trigger: object.name, table: `${schema}.${name}`, fn }] : [];
+  });
+  if (triggers.length === 0) return null;
+  const [slot] = await session(['SELECT CURRENT_USER::text AS builder']);
+  if (isSessionError(slot) || slot?.[0]?.builder == null) throw new Error('could not read the role the reconcile runs as (CURRENT_USER)');
+  const builder = String(slot[0].builder);
+  const judged = triggers.map(t => ({ ...t, owner: reconcileOwner(t.fn, builder) }));
+  const owners = [...new Set(judged.map(t => t.owner))].sort();
+  const rows = await runner(`WITH ${sideCte(applicationRoles)}
+    SELECT d.name AS owner, o.oid IS NOT NULL AS present,
+      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via
+    FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name`);
+  const byOwner = new Map(rows.map(row => [String(row.owner), { present: truthy(row.present), via: textList(row.via) }]));
+  const findings = judged.flatMap((t) => {
+    const owner = byOwner.get(t.owner);
+    if (!owner?.present) {
+      return [`trigger ${t.trigger} on ${t.table} would run ${t.fn.identity}, owned by ${t.owner}, which does not exist. `
+        + `Fix: create ${t.owner} as a role no application role can act as, or declare an existing such role as ${t.fn.identity}'s owner in db/models.`];
+    }
+    if (owner.via.length === 0) return [];
+    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via }, true)];
+  });
+  if (findings.length === 0) return null;
+  return `${options.stateApplied ? 'tables and columns applied; ' : ''}derived layer NOT applied: ${countFindings(findings.length)}; `
+    + `fix each, then re-run:\n${findingLines(findings)}`;
+}
+
+/**
+ * The post-check: the live catalog check again, after the derived layer landed. The reconcile
+ * commits what it created, so the report never says refused or rolled back: the objects are live,
+ * and the next apply's preflight refuses until each finding is fixed.
+ *
+ * It reads on `session`, the reconcile's own connection: on a stage, db:session (the operator
+ * connection). db:query may read a replica the reconcile's commit has not reached yet, and pass.
+ */
+export async function lifecyclePostApplyRefusal(session: SessionRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
+  if (!models.some(model => model.lifecycle === true)) return null;
+  const read: QueryRunner = async (q) => {
+    const [slot] = await session([q]);
+    if (isSessionError(slot)) throw new Error(slot.message);
+    return slot ?? [];
+  };
+  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models));
   if (findings.length === 0) return null;
-  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
-    + `fix each, then re-run:\n${findings.map(finding => `  - ${finding}`).join('\n')}`;
+  return `${countFindings(findings.length)} after reconcile; the objects are live; the next apply refuses until fixed:\n${findingLines(findings)}`;
 }
 
 /** An older CLI sends no applicationRoles, so the catalog check cannot run: fail closed. */