@everystack/cli 0.4.104 → 0.4.106

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.106] - 2026-10-31
+
+### Added
+
+- declare request roles with defineModule({ roles: { request } })
+
+### Fixed
+
+- a granted definer role is not a request role in the lifecycle check
+- lifecycle rule 2 judges schema owners and the deploy history tables
+- lifecycle reach counts mixed-option membership chains
+- move the database when an app role owns public through pg_database_owner
+- refuse an empty request-role list on the reconcile wire
+
+### Documentation
+
+- say why a granted owner counts, and document roles.request
+- state what an older server skips under the role declaration
+
+## [0.4.105] - 2026-10-31
+
+### Fixed
+
+- rule 5 judges who can replace a trigger function, not its security mode
+- judge declared trigger-function owners before the derived layer lands
+- re-run the catalog check after the derived layer lands
+- read the reconcile's builder on its own connection
+- everystack --version prints the version
+- run the post-check on the reconcile's own connection
+- say the tables were applied only when this run applied them
+
 ## [0.4.104] - 2026-10-30
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.104",
+  "version": "0.4.106",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -145,7 +145,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.25"
+    "@everystack/model": "0.4.26"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",
@@ -192,7 +192,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.40"
+    "@everystack/server": "0.4.42"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-apply.ts

@@ -77,7 +77,7 @@ import { readStageStateTwice } from '../stage-read-consistency';
 import { renderApplyReceipt, renderCatchUpFailure } from '../plain-output';
 import { renderFkOrphanAdvisory, ownershipColumns } from '../fk-orphan-advisory';
 import { catchUpDerived, type CatchUpVenue } from '../derived-catchup';
-import { lifecycleApplyRefusal, lifecycleStateOnlyRefusal } from '../lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleRolesOf, lifecycleStateOnlyRefusal, LifecycleFindingsError, unclassifiedGranteesWarning } from '../lifecycle-preflight';
 import { buildReconcileReport } from './db-reconcile';
 import { step, success, fail, info, warn, line as printLine } from '../output';
 
@@ -269,6 +269,8 @@ async function runCatchUp(
       ...(flags.models ? { models: flags.models } : {}),
       onStart: () => step('Catching the functions, views and triggers up to the checkout...'),
       onRefusal,
+      // A lifecycle refusal says the tables were applied only when this run applied some.
+      stateApplied: applied > 0,
     });
     if (outcome.run) {
       if (verbose) {
@@ -289,6 +291,8 @@ async function runCatchUp(
     return { ok: true, statements: outcome.statements };
   } catch (err: any) {
     const cause = String(err?.message ?? err);
+    // A lifecycle finding's report already says what committed and what did not, one line each.
+    if (err instanceof LifecycleFindingsError) return { ok: false, lines: cause.split('\n') };
     return {
       ok: false,
       // The cause is printed ONCE, at every verbosity: its headline on the report line, and
@@ -515,7 +519,9 @@ async function applyPlanViaStage(
   const { region } = config;
   const fn = opsFunction(config);
   const declared = await loadDeclaredDerived(flags.models);
-  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [])
+  const unclassified = unclassifiedGranteesWarning(declared?.models ?? [], lifecycleRolesOf(declared));
+  if (unclassified) warn(unclassified);
+  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [], lifecycleRolesOf(declared))
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -952,7 +958,9 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   const declaredDb = (): ReturnType<typeof loadDeclaredDerived> =>
     declaredDbPromise ??= loadDeclaredDerived(flags.models);
   // Read-only, before the rollback point: a refused apply must not first take a snapshot, backup or dump.
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [])
+  const unclassified = unclassifiedGranteesWarning((await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
+  if (unclassified) warn(unclassified);
+  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()))
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(runner, (await declaredDb())?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -1109,7 +1117,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
       { verb: 'db:apply', actor: process.env.USER ?? 'unknown' },
       async () => {
         // Re-checked under the lease, where the writes happen.
-        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? []);
+        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
         if (leasedRefusal) {
           fail(leasedRefusal);
           process.exit(1);

package/src/cli/commands/db-branch.ts

@@ -41,6 +41,7 @@ import { resolveDbSource, type DbSource } from '../db-source';
 import { resolveModelsPath } from '../models-path';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import { loadModels } from './db-generate';
+import { lifecycleRolesOf } from '../lifecycle-preflight';
 import { step, success, fail, info, warn } from '../output';
 
 function requireUrl(flags: Record<string, string>, verb: string): string {
@@ -134,6 +135,7 @@ export async function dbTemplateRefreshCommand(flags: Record<string, string>): P
     const result = await executeTemplateRefresh(url, models, {
       declared: declaredDb?.objects,
       sequences: declaredDb?.sequences,
+      lifecycleRoles: lifecycleRolesOf(declaredDb),
       actor: process.env.USER ?? null,
       gitRef: currentGitRef(),
       seed: seedCommand === null ? null : (templateUrl) => {

package/src/cli/commands/db-build.ts

@@ -26,6 +26,7 @@
 
 import type { ModelDescriptor } from '@everystack/model';
 import { buildIntoDatabase } from '../db-build';
+import { LifecycleFindingsError, lifecycleRolesOf } from '../lifecycle-preflight';
 import { createUrlRunner } from '../db-source';
 import { resolveModelsPath } from '../models-path';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
@@ -123,11 +124,13 @@ export async function dbBuildCommand(flags: Record<string, string>): Promise<voi
       declared: declaredDb?.objects,
       sequences: declaredDb?.sequences,
       extensions: declaredDb?.extensions,
+      lifecycleRoles: lifecycleRolesOf(declaredDb),
       actor: process.env.USER ?? null,
       gitRef: currentGitRef(),
     });
   } catch (err: any) {
-    fail(`Build failed: ${err.message}`);
+    // A lifecycle finding says itself what was and was not written.
+    fail(err instanceof LifecycleFindingsError ? err.message : `Build failed: ${err.message}`);
     process.exit(1);
   }
 

package/src/cli/commands/db-check.ts

@@ -44,6 +44,7 @@ import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '..
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
 import type { SourceObject } from '../derived-source';
+import { lifecycleRolesOf, unclassifiedGranteesWarning, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
 import { findReadAuthzGaps, findNakedGrants } from '../authz-lint';
 import { findSelectGrantGaps } from '../select-grant-advisory';
 import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline';
@@ -125,6 +126,8 @@ export interface StaticCheckInput {
    * Absent (undefined) = the caller did not read it (older callers): no map finding at all.
    */
   modelMapSource?: string | null;
+  /** The modules' role declaration (lifecycleRolesOf). Its unclassified grantees are a warning. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
 }
 
 export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
@@ -285,6 +288,11 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // A grantee the role declaration leaves unclassified counts as a request role in the lifecycle
+  // catalog check. Visible, never fatal: classifying it is the operator's call.
+  const unclassified = unclassifiedGranteesWarning(input.models, input.lifecycleRoles ?? {});
+  if (unclassified) findings.push({ level: 'warn', area: 'authz', message: unclassified });
+
   if (input.artifactSource === null && input.artifactOrigin === 'flag') {
     findings.push({
       level: 'fail',
@@ -369,7 +377,7 @@ export interface EphemeralComposeResult {
 export async function executeEphemeralCompose(
   adminUrl: string,
   models: ModelDescriptor[],
-  opts: { actor?: string | null; gitRef?: string | null; declared?: SourceObject[]; sequences?: SequenceDescriptor[]; extensions?: string[] } = {},
+  opts: { actor?: string | null; gitRef?: string | null; declared?: SourceObject[]; sequences?: SequenceDescriptor[]; extensions?: string[]; lifecycleRoles?: LifecycleRoleDeclaration } = {},
 ): Promise<EphemeralComposeResult> {
   const database = `escheck_${process.pid}_${Date.now()}`;
   await createDatabase(adminUrl, database);
@@ -378,6 +386,7 @@ export async function executeEphemeralCompose(
       declared: opts.declared,
       sequences: opts.sequences,
       extensions: opts.extensions,
+      lifecycleRoles: opts.lifecycleRoles,
       actor: opts.actor ?? 'db:check',
       gitRef: opts.gitRef ?? null,
     });
@@ -478,6 +487,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
     moduleModels: declaredDb?.models ?? null,
     baselineSource,
     modelMapPath: mapPath, modelMapSource,
+    lifecycleRoles: lifecycleRolesOf(declaredDb),
   });
   // Per-finding detail is the --verbose report. The quiet default answers the one question a
   // human asked — is anything pending? — and names the verb that shows it.
@@ -504,6 +514,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
         declared: declaredDb?.objects,
         sequences: declaredDb?.sequences,
         extensions,
+        lifecycleRoles: lifecycleRolesOf(declaredDb),
       });
       if (verbose) for (const line of ephemeral.report) info(`  ${line}`);
     } catch (err: any) {

package/src/cli/commands/db-plan.ts

@@ -63,7 +63,7 @@ import { resolveModelsPath } from '../models-path';
 import { resolveConfig, opsFunction } from '../config';
 import { resolveOperatorUrlViaStage } from '../direct-venue';
 import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
-import { lifecycleApplyRefusal } from '../lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleRolesOf, unclassifiedGranteesWarning } from '../lifecycle-preflight';
 import { loadModels } from './db-generate';
 import { loadDeclaredDerived, type DeclaredDerived } from '../declared-derived';
 import { introspectDerived } from '../derived-introspect';
@@ -238,8 +238,14 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
   }
 
   try {
-    const lifecycleNote = await lifecycleApplyRefusal(runner, models);
-    if (lifecycleNote) warn(lifecycleNote);
+    // The modules' role declaration, as db:apply reads it. A barrel that does not compose leaves it
+    // undeclared here (the check as before); the paths that need the derived layer report the error.
+    const lifecycleRoles = lifecycleRolesOf(await loadDeclaredDerived(flags.models).catch(() => null));
+    const lifecycleNote = await lifecycleApplyRefusal(runner, models, lifecycleRoles);
+    const unclassified = unclassifiedGranteesWarning(models, lifecycleRoles);
+    if (unclassified) warn(unclassified);
+    // db:plan only reads, so it mints the plan anyway; db:apply runs the same check and refuses.
+    if (lifecycleNote) warn(`db:apply will refuse this plan until each lifecycle finding below is fixed.\n${lifecycleNote}`);
     let snapshot: SchemaSnapshot;
     let contract: AuthzContract;
     if (dbSource.kind === 'url') {

package/src/cli/commands/db-reconcile.ts

@@ -32,7 +32,7 @@
 import type { QueryRunner } from '../authz-contract';
 import type { SourceObject } from '../derived-source';
 import { introspectDerived } from '../derived-introspect';
-import { catalogInputsFromModels, lifecycleReconcileRefusal } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleReconcileRefusal, lifecycleRolesOf } from '../lifecycle-preflight';
 import { planReconcile, objectGrantDelta, TRIGGER_ENABLED_STATE, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
@@ -84,6 +84,12 @@ export interface ExecuteOptions extends ReconcileOptions {
    * the check. `unknown` because the ops Lambda passes it straight off the wire.
    */
   applicationRoles?: unknown;
+  /**
+   * The modules' declared request roles and declared owners (LifecycleRoleDeclaration), beside
+   * applicationRoles. Optional: absent, the catalog check runs as before. `unknown` for the wire.
+   */
+  requestRoles?: unknown;
+  declaredOwners?: unknown;
   /**
    * The caller already ran lifecycleApplyRefusal with the full models, on this runner, in this
    * process (executeSync does, first thing), so the reconcile does not run the catalog check again.
@@ -159,7 +165,9 @@ export async function executeReconcile(
   // --rebaseline, --only, --overwrite-drift or none) refuses on it below; a plan-only run reports
   // it as a finding. See lifecycleCatalogRefusal for what it defends and from whom.
   const lifecycleGate = (): Promise<string | null> => (options.lifecyclePreflighted ? Promise.resolve(null)
-    : lifecycleReconcileRefusal(runner, parsed.objects, { applicationRoles: options.applicationRoles }));
+    : lifecycleReconcileRefusal(runner, parsed.objects, {
+      applicationRoles: options.applicationRoles, requestRoles: options.requestRoles, declaredOwners: options.declaredOwners,
+    }));
 
   if (!options.apply) {
     const lifecycleFindings = await lifecycleGate();
@@ -768,6 +776,7 @@ export async function dbReconcileCommand(flags: Record<string, string>): Promise
     // The lifecycle catalog check's roles, from the barrel's models. The tables come from the
     // declared transition triggers inside the reconcile, the same derivation the ops Lambda runs.
     applicationRoles: declared?.models ? catalogInputsFromModels(declared.models).applicationRoles : undefined,
+    ...lifecycleRolesOf(declared),
     renamedTables: declared?.renamedTables,
     baseline: flags.baseline === 'true',
     rebaseline: flags.rebaseline === 'true',

package/src/cli/commands/db-sync.ts

@@ -31,7 +31,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type QueryRunner } from '../authz-contract';
-import { catalogInputsFromModels, lifecycleApplyRefusal } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecycleRolesOf, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import { generateMigrationSql, unmodeledTables } from '../migration-generate';
@@ -86,6 +86,8 @@ export interface SyncOptions {
   governedRoles?: string[];
   /** Pending table renames — trigger provenance migrates instead of drop+create. */
   renamedTables?: Record<string, string>;
+  /** The modules' role declaration (lifecycleRolesOf): what the lifecycle gates read beside the models. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
   /** Injectable clock for tests. */
   now?: () => number;
 }
@@ -183,6 +185,8 @@ async function syncOnce(
     // The catalog check runs again here, after the state apply: a table this sync just created can
     // carry a finding (a default privilege, its owner) the check before the state apply could not see.
     applicationRoles: catalogInputsFromModels(models).applicationRoles,
+    requestRoles: options.lifecycleRoles?.requestRoles,
+    declaredOwners: options.lifecycleRoles?.declaredOwners,
   });
 
   const declaredFingerprint = fingerprintModels(models, { sequences: options.sequences }).hash;
@@ -240,8 +244,12 @@ export async function executeSync(
   hooks: SyncHooks = {},
 ): Promise<SyncRun> {
   // State runs before compute, so without this a lifecycle table would land with no transition trigger.
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, models);
+  const lifecycleRefusal = await lifecycleApplyRefusal(runner, models, options.lifecycleRoles);
   if (lifecycleRefusal) throw new Error(lifecycleRefusal);
+  // Before anything is written, so before both places a pass creates derived objects (the
+  // functions the state batch calls, then the reconcile).
+  const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
+  if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
   const first = await syncOnce(runner, session, models, options, hooks, 1);
   // The trigger is the STATE bar, not the combined verdict. The cause above is state-layer
   // only, so a compute refusal or an unadopted object cannot be settled by looking again —
@@ -447,6 +455,7 @@ export async function dbSyncCommand(flags: Record<string, string>): Promise<void
         sequences: declaredDb?.sequences,
         extensions: declaredDb?.extensions,
         renamedTables: declaredDb?.renamedTables,
+        lifecycleRoles: lifecycleRolesOf(declaredDb),
         allowDrops: flags['allow-drops'] === 'true',
         overwriteDrift: flags['overwrite-drift'] === 'true',
         baseline: flags.baseline === 'true',

package/src/cli/db-build.ts

@@ -18,7 +18,7 @@ import { compileDeclaredState } from './declared-diff';
 import { createUrlRunner } from './db-source';
 import { executeSync, buildSyncReport } from './commands/db-sync';
 import { executeReconcile } from './commands/db-reconcile';
-import { lifecycleApplyRefusal } from './lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal, type LifecycleRoleDeclaration } from './lifecycle-preflight';
 
 const SAFE_NAME = /^[a-z_][a-z0-9_$]*$/;
 
@@ -101,6 +101,8 @@ export interface BuildOptions {
   extensions?: string[];
   actor?: string | null;
   gitRef?: string | null;
+  /** The modules' role declaration (lifecycleRolesOf): what the lifecycle gates read beside the models. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
 }
 
 /**
@@ -181,13 +183,18 @@ export async function buildIntoDatabase(
     // declared state: 20 such pairs, `type "…_row" does not exist`, from-scratch only. Their
     // explicit `dependsOn` could not have helped — this pass dropped the view from the wave, so
     // no edge could order it back in.
+    // Before the first derived write: the owners the reconcile will give the declared trigger
+    // functions on lifecycle tables. This pass runs before executeSync, which judges them again
+    // first thing, before its own state apply.
+    const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
+    if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
     const declaredFunctions = (options.declared ?? [])
       .filter((o) => o.kind === 'function' && !o.signatureDeps?.length);
     if (declaredFunctions.length > 0) {
       // The lifecycle catalog check, with the full models, before any lifecycle-owned function
       // lands: this pass declares functions only, so it carries no transition trigger for the
       // reconcile to read the lifecycle tables from. executeSync runs the same check again below.
-      const lifecycleRefusal = await lifecycleApplyRefusal(runner, models);
+      const lifecycleRefusal = await lifecycleApplyRefusal(runner, models, options.lifecycleRoles);
       if (lifecycleRefusal) throw new Error(lifecycleRefusal);
       await runner('SET check_function_bodies = off');
       try {
@@ -211,9 +218,14 @@ export async function buildIntoDatabase(
     const run = await executeSync(runner, session, models, {
       declared: options.declared,
       sequences: options.sequences,
+      lifecycleRoles: options.lifecycleRoles,
       actor: options.actor ?? 'db-build',
       gitRef: options.gitRef ?? null,
     });
+    // Verification: the live catalog check again, over what the derived layer just made live. A
+    // throw, so no caller (db:check's compose ring, the dev template, a test database) can miss it.
+    const post = await lifecyclePostApplyRefusal(session, models, options.lifecycleRoles);
+    if (post) throw new LifecycleFindingsError(post);
     return {
       converged: run.converged,
       fingerprintMatch: run.fingerprintMatch,

package/src/cli/declared-derived.ts

@@ -12,7 +12,7 @@ import path from 'node:path';
 import fs from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
-import { linkModels, ModelLinkError, moduleGovernedRoles } from '@everystack/model';
+import { linkModels, ModelLinkError, moduleGovernedRoles, moduleRequestRoles } from '@everystack/model';
 import { compileDerived } from './derived-compile';
 import { lifecycleDerived } from './lifecycle-derived';
 import { compileTableRenames, compileTableMoves } from './schema-compile';
@@ -35,6 +35,13 @@ export interface DeclaredDerived {
   /** Roles the modules declare as governed beyond the ones the models name. A live grantee
    *  outside the governed set is exempted from reconciliation and ENUMERATED instead. */
   governedRoles: string[];
+  /**
+   * The roles a request can become (`roles: { request }`, the union across modules). Undefined
+   * when no module declares them: the lifecycle catalog check then runs exactly as before.
+   */
+  requestRoles?: string[];
+  /** Every `owner` a declared derived object names, across modules, sorted. */
+  declaredOwners: string[];
   /**
    * Postgres extensions the modules declare — the bootstrap the state layer needs before
    * anything that uses their types. Only the from-scratch compiler consumed these; the DIFF
@@ -194,6 +201,9 @@ export function composeDeclaredDerived(modules: Module[], modelsPath: string): D
       renamedTables: { ...compileTableRenames(models, {}), ...compileTableMoves(models, {}) },
       models,
       governedRoles: moduleGovernedRoles(modules),
+      requestRoles: moduleRequestRoles(modules),
+      declaredOwners: [...new Set(modules.flatMap((m) => m.derived)
+        .flatMap((d) => ('owner' in d && typeof d.owner === 'string' ? [d.owner] : [])))].sort(),
       extensions: [...new Set(modules.flatMap((m) => m.extensions ?? []))].sort(),
     };
   } catch (err) {

package/src/cli/derived-apply.ts

@@ -181,6 +181,16 @@ function objectSql(obj: SourceObject, ownerMode: OwnerApplyMode = 'set-role', re
   return [`SET ROLE ${obj.owner}`, ...statements, 'RESET ROLE'];
 }
 
+/**
+ * The role that owns an object once the reconcile has created it: its declared owner (objectSql
+ * enacts it), else `builder`, the role the reconcile runs as, which creates it as itself. The
+ * lifecycle pre-exposure gate reads owners through this too, so the role it judges is the role the
+ * reconcile makes.
+ */
+export function reconcileOwner(obj: Pick<SourceObject, 'owner'>, builder: string): string {
+  return obj.owner || builder;
+}
+
 const ALTER_OWNER: Record<string, string> = {
   function: 'ALTER FUNCTION',
   view: 'ALTER VIEW',
@@ -228,7 +238,8 @@ export function triggerFunctionOf(trigger: SourceObject, source: readonly Source
 function withTransientExecute(obj: SourceObject, statements: string[], source: readonly SourceObject[], grantee?: string): string[] {
   if (!grantee || obj.kind !== 'trigger') return statements;
   const fn = triggerFunctionOf(obj, source);
-  if (!fn?.owner) return statements;
+  // The builder owns a function it creates for itself, and an owner holds EXECUTE.
+  if (!fn || reconcileOwner(fn, grantee) === grantee) return statements;
   const declared = parseGrantAttachments(fn.attachments).grants[grantee] ?? [];
   if (declared.includes('EXECUTE') || declared.includes('ALL')) return statements;
   const target = dropTarget('function', fn.identity);

package/src/cli/derived-catchup.ts

@@ -33,9 +33,9 @@ import { loadDeclaredDerived, type DeclaredDerived } from './declared-derived';
 import { modelContractPreflight } from './model-wire-lane';
 import { MODEL_WIRE_CONTRACT, type ReconcileWirePayload } from '../wire';
 import { resolveConfig, opsFunction } from './config';
-import { invokeAction } from './aws';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from './aws';
 import { currentGitRef } from './state-apply';
-import { catalogInputsFromModels } from './lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal, lifecycleRolesOf } from './lifecycle-preflight';
 
 /** Where the catch-up runs. The two lanes db:apply itself already has. */
 export type CatchUpVenue =
@@ -77,6 +77,12 @@ export interface CatchUpOptions {
    * wrongly handed an exit loses the sentence its operator was owed.
    */
   onRefusal: 'exit' | 'throw';
+  /**
+   * Whether THIS run committed table or column changes before the catch-up: a lifecycle refusal
+   * then says so. False for db:apply with no --plan, and for a plan that was already applied.
+   * Required for the same reason as `onRefusal`: only the caller knows what it wrote.
+   */
+  stateApplied: boolean;
 }
 
 export interface CatchUpOutcome {
@@ -112,15 +118,27 @@ export async function catchUpDerived(
     // The lifecycle catalog check's roles; the reconcile, here or in the ops Lambda, refuses
     // lifecycle-owned objects without them.
     applicationRoles: declared?.models ? catalogInputsFromModels(declared.models).applicationRoles : undefined,
+    // What the modules declare about the roles; optional on the wire (absent = the check as before).
+    ...lifecycleRolesOf(declared),
     actor: process.env.USER ?? null,
     gitRef: currentGitRef(),
   };
 
+  // Before the first derived write, judge the owners the reconcile will give the declared trigger
+  // functions on lifecycle tables.
+  const config = venue.kind === 'stage' ? await resolveConfig(venue.stage) : undefined;
+  const reader: QueryRunner = (q) => (venue.kind === 'direct' ? venue.runner : lambdaQueryRunner(config!.region, opsFunction(config!)))(q);
+  // The builder is read on the reconcile's own connection: on a stage, db:session runs on the
+  // operator connection, while db:query may run on a reader.
+  const operator: SessionRunner = (statements, opts) =>
+    (venue.kind === 'direct' ? venue.session : lambdaSessionRunner(config!.region, opsFunction(config!)))(statements, opts);
+  const gate = await lifecycleDeclaredOwnerRefusal(reader, operator, objects, declared?.models ?? [], { stateApplied: opts.stateApplied, roles: lifecycleRolesOf(declared) });
+  if (gate) throw new LifecycleFindingsError(gate);
+
   let run: ReconcileRun;
   if (venue.kind === 'direct') {
     run = await executeReconcile(venue.runner, venue.session, options);
   } else {
-    const config = await resolveConfig(venue.stage);
     // The ops Lambda CREATES AND REPLACES database objects from these descriptors, so verify the
     // deployed stage understands their shape before sending them — the same handshake
     // db:reconcile --apply --stage runs, for the same payload.
@@ -130,14 +148,14 @@ export async function catchUpDerived(
     // before the process ends. A catch-up that is the whole command has written nothing, and
     // asks to exit: print the skew, say nothing was sent, exit.
     await modelContractPreflight({
-      region: config.region,
-      fn: opsFunction(config),
+      region: config!.region,
+      fn: opsFunction(config!),
       directCommand: `everystack db:apply --stage ${venue.stage} --direct`,
       onRefusal: opts.onRefusal,
     })('db:apply');
     const result: any = await invokeAction(
-      config.region,
-      opsFunction(config),
+      config!.region,
+      opsFunction(config!),
       'db:reconcile',
       { ...options, modelContract: MODEL_WIRE_CONTRACT } satisfies ReconcileWirePayload,
     );
@@ -154,5 +172,10 @@ export async function catchUpDerived(
   // not land, so db:apply must say so and exit the same way.
   if (run.refusal) throw new CatchUpError(run.refusal);
 
+  // Verification: the live catalog check again, over what the reconcile just made live. On the
+  // operator session, where the commit is: db:query may read a replica that has not caught up.
+  const post = await lifecyclePostApplyRefusal(operator, declared?.models ?? [], lifecycleRolesOf(declared));
+  if (post) throw new LifecycleFindingsError(post);
+
   return { declared: objects.length, run, statements: run.applied ? (run.statements ?? []) : [] };
 }

package/src/cli/index.ts

@@ -44,6 +44,8 @@ import { auditLighthouseCommand } from './commands/lighthouse';
 import { auditCommand } from './commands/audit';
 import { uiAuditCommand } from './commands/ui-audit';
 import { runbookCommand } from './commands/runbook';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
 import { fail } from './output';
 import { parseFlags } from './parse-flags';
 
@@ -56,6 +58,13 @@ async function main() {
     process.exit(0);
   }
 
+  if (command === '--version' || command === '-v') {
+    // tsx polyfills __dirname in ESM (see runbook.ts cliVersion).
+    const pkg = JSON.parse(readFileSync(path.join(eval('__dirname') as string, '..', '..', 'package.json'), 'utf8'));
+    console.log(pkg.version);
+    process.exit(0);
+  }
+
   const flags = parseFlags(args.slice(1));
 
   // `everystack <command> --help` shows help instead of running the command
@@ -405,6 +414,7 @@ Auth:
 
 Options:
   --help, -h    Show this help message
+  --version, -v Print the @everystack/cli version
 `);
 }
 

package/src/cli/lifecycle-preflight.ts

@@ -3,6 +3,8 @@ import { createHash } from 'node:crypto';
 import { DESTROY_LOG_MARKER_BODIES, DESTROY_LOG_MARKER_LANGUAGES, DESTROY_LOG_MARKER_SEARCH_PATH, LIFECYCLE_OWNER_ROLE, type ModelDescriptor } from '@everystack/model';
 import type { QueryRunner } from './authz-contract';
 import { compileTableContract } from './authz-compile';
+import { reconcileOwner, triggerFunctionOf } from './derived-apply';
+import { isSessionError, type SessionRunner } from './session';
 import { parseQualified, type SourceObject } from './derived-source';
 import { lifecycleDerived, lifecycleManifestOf, lifecycleRole } from './lifecycle-derived';
 
@@ -31,13 +33,50 @@ export function lifecycleLogRowRefusal(log: { present?: unknown; current?: unkno
  * The log's shape first (its refusals are unchanged), then the live catalog facts the soft delete
  * rests on (lifecycleCatalogRefusal). Pure SELECTs: the --stage lane runs them over db:query.
  */
-export async function lifecycleApplyRefusal(runner: QueryRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
+export async function lifecycleApplyRefusal(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+): Promise<string | null> {
   if (!models.some(model => model.lifecycle === true)) return null;
   const [log] = await runner(LIFECYCLE_LOG_SQL);
   // Before the plan: a modeled table's keys are the plan's to converge (the models declare each
   // one, or refuse to compile), so rule 6 reports only keys from tables the models do not have.
   const modeledTables = [...new Set(models.map(model => `${model.schema}.${model.table}`))];
-  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models), modeledTables });
+  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models, roles), modeledTables });
+}
+
+/**
+ * What the modules declare about the roles, beside the models (DeclaredDerived). The catalog check
+ * reads it to tell a definer role the models grant to apart from a role a request can become.
+ *
+ *   requestRoles    `roles: { request }`, the union across modules. Undefined = not declared, and
+ *                   the check runs exactly as before: every grantee counts as a request role.
+ *   declaredOwners  every `owner` a declared derived object names.
+ */
+export interface LifecycleRoleDeclaration {
+  requestRoles?: string[];
+  declaredOwners?: string[];
+}
+
+/** The role declaration from a loaded declared layer; empty (not declared) when there is none. */
+export function lifecycleRolesOf(declared: { requestRoles?: string[]; declaredOwners?: string[] } | null | undefined): LifecycleRoleDeclaration {
+  return declared?.requestRoles === undefined ? {} : { requestRoles: declared.requestRoles, declaredOwners: declared.declaredOwners ?? [] };
+}
+
+/**
+ * The grantees the declaration does not classify: each counts as a request role, so the lifecycle
+ * check treats it as application-side. A warning, never a refusal. Null when the request roles are
+ * not declared (nothing is classified), when no model is a lifecycle model, or when none is left.
+ */
+export function unclassifiedGranteesWarning(models: readonly ModelDescriptor[], roles: LifecycleRoleDeclaration): string | null {
+  if (roles.requestRoles === undefined || !models.some(model => model.lifecycle === true)) return null;
+  const classified = new Set([...roles.requestRoles, ...(roles.declaredOwners ?? [])]);
+  const unclassified = catalogInputsFromModels(models).applicationRoles.filter(role => !classified.has(role));
+  if (unclassified.length === 0) return null;
+  return `the models grant privileges to ${unclassified.join(', ')}, which ${unclassified.length === 1 ? 'is' : 'are'} neither a declared request role `
+    + `(roles: { request }) nor a declared owner, so the lifecycle check counts ${unclassified.length === 1 ? 'it' : 'them'} as a role a request can become. `
+    + 'Add each to roles.request, or name it as the owner of the derived objects it owns.';
 }
 
 const literal = (s: string): string => `'${s.replace(/'/g, "''")}'`;
@@ -83,6 +122,13 @@ export interface LifecycleCatalogInputs {
    * rule 6 leaves to the plan. Absent after the state apply: every key is checked.
    */
   modeledTables?: readonly string[];
+  /**
+   * The declared request roles (LifecycleRoleDeclaration). Absent = not declared: the
+   * application roles are the grantees, exactly as before. Present: see applicationRoleSet.
+   */
+  requestRoles?: readonly string[];
+  /** Every declared derived-object owner. Read only when `requestRoles` is present. */
+  declaredOwners?: readonly string[];
 }
 
 /** A declared dependent: the child's `schema.table`, its foreign-key column (SQL name), the lifecycle parent's `schema.table`. */
@@ -125,8 +171,11 @@ export function nullifyUnrecordedFromDeclared(declared: readonly Parameters<type
 
 const notApplicationRole = (lc: string) => (role: string): boolean => role !== 'PUBLIC' && role !== 'public' && role !== lc;
 
-/** The catalog check's inputs, read from the models. */
-export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[] } {
+/** The catalog check's inputs, read from the models (and the role declaration, when there is one). */
+export function catalogInputsFromModels(
+  models: readonly ModelDescriptor[],
+  declaration: LifecycleRoleDeclaration = {},
+): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[]; requestRoles?: string[]; declaredOwners?: string[] } {
   const roles = new Set<string>();
   for (const model of models) {
     const contract = compileTableContract(model);
@@ -138,6 +187,7 @@ export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { l
     lifecycleTables: [...new Set(models.filter(model => model.lifecycle === true).map(model => `${model.schema}.${model.table}`))].sort(),
     applicationRoles: [...roles].filter(notApplicationRole(LIFECYCLE_OWNER_ROLE)).sort(),
     dependentKeys: models.some(model => model.lifecycle === true) ? dependentKeysFromDeclared(lifecycleDerived(models)) : [],
+    ...(declaration.requestRoles === undefined ? {} : { requestRoles: [...declaration.requestRoles], declaredOwners: [...(declaration.declaredOwners ?? [])] }),
   };
 }
 
@@ -151,9 +201,16 @@ export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { l
 const assumes = (x: string, y: string): string => `(pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') OR CASE
     WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
     ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END)`;
-/** `x` can act as `y`, or hold ADMIN on it: an ADMIN holder can grant `y` to itself WITH SET. */
+/**
+ * `x` can act as `y`, or hold ADMIN on it (an ADMIN holder can grant `y` to itself WITH SET), or
+ * reach it through a chain of grants whose options differ link to link. MEMBER counts any chain:
+ * ADMIN-only on `i`, then `i` a member of `y` (grant `i` to itself WITH SET, SET ROLE `i`, then
+ * `y`); or SET-only on `i`, then `i` an INHERIT-only member of `y` (SET ROLE `i` holds `y`'s
+ * privileges). USAGE, SET and MEMBER WITH ADMIN OPTION are each false for both. Never in `assumes`:
+ * the side set must still leave out the RDS master's ADMIN-only membership.
+ */
 const reaches = (x: string, y: string): string =>
-  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION'))`;
+  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER'))`;
 
 /**
  * The application-side roles, as a CTE `side(oid, rolname)`: non-superusers that are, or can act
@@ -164,6 +221,115 @@ const sideCte = (apps: string[]): string => `side AS (SELECT r.oid, r.rolname::t
     WHERE NOT r.rolsuper AND EXISTS (SELECT 1 FROM pg_catalog.pg_roles a
       WHERE a.rolname = ANY(${textArray(apps)}) AND (a.oid = r.oid OR ${assumes('r.oid', 'a.oid')})))`;
 
+/** How `x` reaches `y`, for a finding: INHERIT, SET, ADMIN or a chain of grants (the first that holds; see assumes and reaches). */
+const reachHow = (x: string, y: string): string => `CASE WHEN pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') THEN 'INHERIT'
+    WHEN (CASE WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
+      ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END) THEN 'SET'
+    WHEN pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') THEN 'ADMIN' ELSE 'a chain of grants' END`;
+
+/**
+ * The live facts the declaration rests on. Per declared request role: does it exist, is it a
+ * superuser, is it BYPASSRLS. Per declared owner that is a grantee or a request role: does it exist,
+ * can it log in, and which request roles reach it (reaches: INHERIT, SET or ADMIN, transitively).
+ */
+const requestRoleSql = (request: string[], owners: string[]): string => `SELECT 'request' AS kind, d.name, o.oid IS NOT NULL AS present,
+    COALESCE(o.rolsuper, false) AS super, COALESCE(o.rolbypassrls, false) AS bypassrls, COALESCE(o.rolcanlogin, false) AS login,
+    ARRAY[]::text[] AS reached_by
+  FROM pg_catalog.unnest(${textArray(request)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  UNION ALL
+  SELECT 'owner', d.name, o.oid IS NOT NULL, COALESCE(o.rolsuper, false), COALESCE(o.rolbypassrls, false), COALESCE(o.rolcanlogin, false),
+    ARRAY(SELECT 'request role ' || r.rolname::text || ' can act as ' || d.name || ' (' || ${reachHow('r.oid', 'o.oid')} || ')'
+      FROM pg_catalog.pg_roles r WHERE r.rolname = ANY(${textArray(request)}) AND r.oid <> o.oid AND ${reaches('r.oid', 'o.oid')} ORDER BY 1)
+  FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  ORDER BY 1, 2`;
+
+/** The application roles every rule reads (sideCte's input), and why each counts where the declaration can say. */
+interface ApplicationRoleSet {
+  apps: string[];
+  /** A role in `apps` → one sentence saying why it is there. Empty when nothing is declared. */
+  why: Map<string, string>;
+  /** Live findings on the declared request roles. */
+  findings: string[];
+  /** The models' grantees (applicationRoles), PUBLIC and the lifecycle role left out. */
+  grantees: ReadonlySet<string>;
+  /** The request roles are declared. */
+  declared: boolean;
+}
+
+/**
+ * THE one place the application-role set is computed. Rules 1, 2 and 5, the pre-exposure gate, the
+ * post-check and the reconcile path all read it.
+ *
+ * Not declared (`requestRoles` absent): the grantees, exactly as before, and no query runs.
+ *
+ * Declared: the request roles and the grantees, minus each declared owner D that holds every guard,
+ * read live: D is not a request role, D is not the lifecycle role (never in the set: PUBLIC and it are
+ * filtered out), D exists and cannot log in, and no request role reaches D. A declared owner that
+ * fails a guard stays, and `why` names the guard. A grantee in neither list stays as well. Each
+ * request role must exist, and be neither a superuser nor BYPASSRLS: either is a finding.
+ */
+async function applicationRoleSet(runner: QueryRunner, inputs: LifecycleCatalogInputs, lc: string): Promise<ApplicationRoleSet> {
+  const grantees = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
+  if (inputs.requestRoles === undefined) return { apps: grantees, why: new Map(), findings: [], grantees: new Set(grantees), declared: false };
+  const request = new Set([...inputs.requestRoles].filter(notApplicationRole(lc)));
+  const owners = new Set(inputs.declaredOwners ?? []);
+  const set = new Set([...request, ...grantees]);
+  const candidates = [...set].filter(role => owners.has(role)).sort();
+  const findings: string[] = [];
+  const why = new Map<string, string>();
+  for (const row of await runner(requestRoleSql([...request].sort(), candidates))) {
+    const name = String(row.name);
+    if (row.kind === 'request') {
+      if (!truthy(row.present)) {
+        findings.push(`request role ${name} does not exist. Fix: create it, or remove it from roles.request.`);
+        continue;
+      }
+      if (truthy(row.super)) findings.push(`request role ${name} is a superuser: a request that becomes it passes every check. Fix: ALTER ROLE ${ident(name)} NOSUPERUSER;`);
+      if (truthy(row.bypassrls)) findings.push(`request role ${name} has BYPASSRLS: a request that becomes it skips every row-level policy. Fix: ALTER ROLE ${ident(name)} NOBYPASSRLS;`);
+      continue;
+    }
+    const failed: string[] = [];
+    if (request.has(name)) failed.push(`declared owner ${name} is a request role`);
+    if (!truthy(row.present)) failed.push(`declared owner ${name} does not exist`);
+    else if (truthy(row.login)) failed.push(`declared owner ${name} can log in`);
+    failed.push(...textList(row.reached_by));
+    if (failed.length === 0) set.delete(name);
+    else why.set(name, `${name} counts as an application role: ${failed.join('; ')}.`);
+  }
+  for (const role of grantees) {
+    if (!request.has(role) && !owners.has(role)) {
+      why.set(role, `${role} counts as an application role because the models grant it privileges, and it is neither a declared request role nor a declared owner.`);
+    }
+  }
+  return { apps: [...set].sort(), why, findings, grantees: new Set(grantees), declared: true };
+}
+
+/**
+ * Why `owner`, itself an application-side role, counts: for a rule-5 finding. The declaration's
+ * reason when it has one. Undeclared, and the owner counts only because the models grant to it (it
+ * acts as no other application role, and no other application role reaches it), the finding says
+ * so and names the declaration that tells a definer role apart. Reached, the REVOKE fix stands alone.
+ */
+function ownerCause(set: ApplicationRoleSet, owner: string, actsAs: readonly string[], appReach: readonly string[]): string | undefined {
+  const known = set.why.get(owner);
+  if (known) return known;
+  if (set.declared) return actsAs.length > 0 ? `${owner} can act as the application role${actsAs.length === 1 ? '' : 's'} ${actsAs.join(', ')}.` : undefined;
+  const granted = set.grantees.has(owner) && actsAs.length === 0 && appReach.length === 0;
+  return granted ? grantedCause(owner) : undefined;
+}
+
+const grantedCause = (owner: string): string => `${owner} counts as an application role because the models grant it privileges. `
+  + 'If it is a definer role that no request role reaches, declare the request roles with roles: { request: [...] } in a module.';
+
+/**
+ * Two columns for the rule-5 queries: the application roles `owner` can act as (acts_as), and the
+ * other application roles that reach `owner` (app_reach). Neither counts `owner` itself.
+ */
+const ownerReachColumns = (apps: string[], owner: string): string => `ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${assumes(owner, 'a.oid')} ORDER BY 1) AS acts_as,
+    ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${reaches('a.oid', owner)} ORDER BY 1) AS app_reach`;
+
 /** Rule 1, attributes. */
 const roleSql = (lc: string): string => `SELECT lc.oid IS NOT NULL AS present,
     COALESCE(lc.rolcanlogin, false) AS login, COALESCE(lc.rolsuper, false) AS super,
@@ -182,11 +348,17 @@ const memberSql = (apps: string[], lc: string): string => `WITH ${sideCte(apps)}
   WHERE s.oid <> lc.oid AND ${reaches('s.oid', 'lc.oid')}
   ORDER BY 1`;
 
+/** The deploy history: who owns one can rewrite what was applied, run and reconciled. */
+const HISTORY_TABLES = ['everystack.schema_log', 'everystack.exec_log', 'everystack.derived_provenance'];
+
 /**
  * Rule 2. The owner of a lifecycle table can disable its triggers; the owner of destroy_log can
- * write the marker; the owner of a marker function can replace it. Each such object is a finding
- * when its owner is the lifecycle role, or when an application-side role is that owner, can act
- * as it, or holds ADMIN on it. The operator owning all of them is the documented setup and passes.
+ * write the marker; the owner of a marker function can replace it; the owner of a schema holding
+ * any of them can drop what is in it (DROP ... CASCADE takes the delete-path trigger along); the
+ * owner of schema_log, exec_log or derived_provenance can forge the deploy history. Each such
+ * object is a finding when its owner is the lifecycle role, or when an application-side role is
+ * that owner, can act as it, or holds ADMIN on it. The operator owning all of them is the
+ * documented setup and passes. A table that does not exist is not judged.
  */
 const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH ${sideCte(apps)},
   owned AS (
@@ -198,8 +370,19 @@ const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH
     WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log')
     UNION ALL
     SELECT 'function', m.sig, p.proowner FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
-    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig))
+    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)
+    UNION ALL
+    SELECT 'table', n.nspname::text || '.' || c.relname::text, c.relowner
+    FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.oid IN (SELECT pg_catalog.to_regclass(t) FROM pg_catalog.unnest(${textArray(HISTORY_TABLES)}) AS t)
+    UNION ALL
+    SELECT 'schema', n.nspname::text, n.nspowner FROM pg_catalog.pg_namespace n
+    WHERE n.nspname = ANY(${textArray([...new Set(tables.map(table => table.slice(0, table.indexOf('.'))))])})
+      OR n.oid IN (SELECT c.relnamespace FROM pg_catalog.pg_class c WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log'))
+      OR n.oid IN (SELECT p.pronamespace FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
+        JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)))
   SELECT o.kind, o.name, pg_catalog.pg_get_userbyid(o.owner)::text AS owner, o.owner = lc.oid AS lifecycle_owned,
+    pg_catalog.current_database()::text AS database,
     ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')} ORDER BY 1) AS via
   FROM owned o LEFT JOIN pg_catalog.pg_roles lc ON lc.rolname = ${literal(lc)}
   WHERE o.owner = lc.oid OR EXISTS (SELECT 1 FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')})
@@ -248,20 +431,49 @@ const markerSql = (lc: string): string => `SELECT s.sig, p.oid IS NOT NULL AS pr
   ORDER BY s.i`;
 
 /**
- * Rule 5. A trigger on a lifecycle table whose function is SECURITY DEFINER and owned by neither
- * the table's owner nor the lifecycle role: it runs as that third role inside every delete.
+ * Rule 5. A trigger on a lifecycle table whose function's owner is an application-side role, or
+ * one an application-side role reaches. The soft delete's stamp and destroy's DELETE run as the
+ * lifecycle role, so an INVOKER trigger function runs as it and a DEFINER one as its owner; either
+ * way whoever can replace the body acts inside every soft delete and destroy. So the security
+ * mode does not matter, and neither the table's owner nor the lifecycle role is exempt.
  */
-const definerTriggerSql = (tables: string[], lc: string): string => `SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
+const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${sideCte(apps)}
+  SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
     pg_catalog.quote_ident(fn.nspname) || '.' || pg_catalog.quote_ident(p.proname) || '(' || pg_catalog.pg_get_function_identity_arguments(p.oid) || ')' AS function,
-    pg_catalog.pg_get_userbyid(p.proowner)::text AS owner, pg_catalog.pg_get_userbyid(c.relowner)::text AS table_owner
+    pg_catalog.pg_get_userbyid(p.proowner)::text AS owner,
+    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via,
+    ${ownerReachColumns(apps, 'p.proowner')}
   FROM pg_catalog.pg_trigger g JOIN pg_catalog.pg_class c ON c.oid = g.tgrelid
   JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace JOIN pg_catalog.pg_proc p ON p.oid = g.tgfoid
   JOIN pg_catalog.pg_namespace fn ON fn.oid = p.pronamespace
   WHERE NOT g.tgisinternal AND (n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)})
-    AND p.prosecdef AND p.proowner <> c.relowner
-    AND p.proowner IS DISTINCT FROM (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = ${literal(lc)})
+    AND EXISTS (SELECT 1 FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')})
   ORDER BY 1, 2`;
 
+/**
+ * One rule-5 finding. `via` holds the application-side roles that are, or reach, `owner`. When the
+ * owner is one of them the fix is a new owner; otherwise it is to revoke the path to the owner.
+ * `would`: the pre-exposure gate, which judges a declared trigger before the reconcile creates it.
+ * `cause`: why the owner counts as an application role (ownerCause), when there is more to say.
+ */
+export function triggerOwnerFinding(
+  row: { trigger: string; table: string; function: string; owner: string; via: readonly string[]; cause?: string },
+  would = false,
+): string {
+  const { owner, via } = row;
+  const sideOwned = via.includes(owner);
+  const who = sideOwned ? `${owner}, an application-side role`
+    : `${owner}, which the application-side role${via.length === 1 ? '' : 's'} ${via.join(', ')} can assume`;
+  const fix = sideOwned
+    ? `declare ${row.function}'s owner in db/models as a role no application role can act as, and apply `
+      + `(the apply re-creates a declared function with its declared owner, so a live ALTER alone is undone); `
+      + `for a function not declared in db/models: ALTER FUNCTION ${row.function} OWNER TO <that role>;`
+    : `${via.map(r => `REVOKE ${ident(owner)} FROM ${ident(r)};`).join(' ')} (or from the role each reaches ${owner} through)`;
+  return `trigger ${row.trigger} on ${row.table} ${would ? 'would run' : 'runs'} ${row.function}, owned by ${who}; `
+    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`
+    + (sideOwned && row.cause ? ` ${row.cause}` : '');
+}
+
 /**
  * Rule 6. Every foreign key into a lifecycle table (a partition's clone excluded), with its columns
  * in key order and its ON DELETE action. Which ones a model declares is decided by the caller.
@@ -282,6 +494,8 @@ const OWNER_HAZARD = {
   table: 'an owner can disable its triggers',
   log: 'an owner can write the marker',
   function: 'an owner can replace the function',
+  schema: 'an owner can DROP ... CASCADE the delete-path trigger',
+  history: 'an owner can forge the deploy history',
 };
 
 /**
@@ -298,18 +512,35 @@ const OWNER_HAZARD = {
  *
  * The one implementation: db:apply, db:sync and db:plan reach it through lifecycleApplyRefusal
  * (inputs from the models); db:reconcile, local and in the ops Lambda, through
- * lifecycleReconcileRefusal (tables from the declared transition triggers).
+ * lifecycleReconcileRefusal (tables from the declared transition triggers); db:apply and db:build
+ * again after the derived layer lands, through lifecyclePostApplyRefusal.
  */
 export async function lifecycleCatalogRefusal(
   runner: QueryRunner,
   inputs: LifecycleCatalogInputs,
   options: { lifecycleRole?: string } = {},
 ): Promise<string | null> {
+  const findings = await lifecycleCatalogFindings(runner, inputs, options);
+  if (findings.length === 0) return null;
+  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
+    + `fix each, then re-run:\n${findingLines(findings)}`;
+}
+
+const findingLines = (findings: readonly string[]): string => findings.map(finding => `  - ${finding}`).join('\n');
+const countFindings = (n: number): string => `${n} lifecycle finding${n === 1 ? '' : 's'}`;
+
+/** lifecycleCatalogRefusal's findings, one string each, without the heading. */
+async function lifecycleCatalogFindings(
+  runner: QueryRunner,
+  inputs: LifecycleCatalogInputs,
+  options: { lifecycleRole?: string } = {},
+): Promise<string[]> {
   const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
   const tables = [...new Set(inputs.lifecycleTables)].sort();
-  if (tables.length === 0) return null;
-  const apps = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
-  const findings: string[] = [];
+  if (tables.length === 0) return [];
+  const set = await applicationRoleSet(runner, inputs, lc);
+  const apps = set.apps;
+  const findings: string[] = [...set.findings];
 
   const [role] = await runner(roleSql(lc));
   if (!truthy(role?.present)) {
@@ -328,17 +559,23 @@ export async function lifecycleCatalogRefusal(
   }
 
   for (const row of await runner(ownerSql(tables, apps, lc))) {
-    const kind = row.kind === 'function' ? 'function' : 'table';
-    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log : OWNER_HAZARD[kind];
+    const kind: 'function' | 'schema' | 'table' = row.kind === 'function' || row.kind === 'schema' ? row.kind : 'table';
+    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log
+      : HISTORY_TABLES.includes(String(row.name)) ? OWNER_HAZARD.history : OWNER_HAZARD[kind];
     const via = textList(row.via);
     const who = truthy(row.lifecycle_owned) ? `${row.owner}, the lifecycle role`
       : via.includes(String(row.owner)) ? `${row.owner}, an application-side role`
         : `${row.owner}, which the application-side role${via.length === 1 ? '' : 's'} ${via.join(', ')} can assume`;
-    const name = kind === 'function' ? String(row.name) : quoteLabel(String(row.name));
+    const name = kind === 'function' ? String(row.name) : kind === 'schema' ? ident(String(row.name)) : quoteLabel(String(row.name));
+    // pg_database_owner (public's owner on PostgreSQL 15 and later) has one implicit member, the owner
+    // of the database, and REVOKE cannot remove it: the database itself has to move.
     const fix = truthy(row.lifecycle_owned) || via.includes(String(row.owner))
       ? `ALTER ${kind.toUpperCase()} ${name} OWNER TO <your operator role>;`
-      : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
-    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}`);
+      : row.owner === 'pg_database_owner'
+        ? `ALTER DATABASE ${ident(String(row.database))} OWNER TO <your operator role>; (the owner of the database is pg_database_owner's only member)`
+        : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
+    const cause = via.includes(String(row.owner)) ? set.why.get(String(row.owner)) : undefined;
+    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}${cause ? ` ${cause}` : ''}`);
   }
 
   for (const row of await runner(aclSql(tables))) {
@@ -371,10 +608,11 @@ export async function lifecycleCatalogRefusal(
     }
   }
 
-  for (const row of await runner(definerTriggerSql(tables, lc))) {
-    findings.push(`trigger ${row.trigger} on ${row.table} runs ${row.function}, SECURITY DEFINER and owned by ${row.owner}, `
-      + `neither the table's owner (${row.table_owner}) nor ${lc}; it runs as ${row.owner} inside every delete. `
-      + `Fix: ALTER FUNCTION ${row.function} SECURITY INVOKER; or ALTER FUNCTION ${row.function} OWNER TO ${ident(String(row.table_owner))};`);
+  for (const row of await runner(triggerOwnerSql(tables, apps))) {
+    const owner = String(row.owner);
+    const via = textList(row.via);
+    findings.push(triggerOwnerFinding({ trigger: String(row.trigger), table: String(row.table), function: String(row.function),
+      owner, via, cause: ownerCause(set, owner, textList(row.acts_as), textList(row.app_reach)) }));
   }
 
   const declared = new Set(inputs.dependentKeys.map(key => JSON.stringify([key.child, key.column, key.parent])));
@@ -403,9 +641,96 @@ export async function lifecycleCatalogRefusal(
         + 'if the models declare this key nullify, upgrade the CLI (@everystack/cli) and re-run.' : ''));
   }
 
+  return findings;
+}
+
+/**
+ * A lifecycle finding raised around the derived layer: by the pre-exposure gate (nothing derived
+ * was written) or by the post-check (the objects are live). Its message is the whole report, one
+ * line of head and one line per finding, so a caller prints it as is.
+ */
+export class LifecycleFindingsError extends Error {}
+
+/**
+ * The pre-exposure gate: rule 5 over the DECLARED owners, before the reconcile creates anything.
+ * Each declared trigger on a lifecycle table whose function is declared is judged by the owner the
+ * reconcile will give that function (reconcileOwner: the declared owner, else the role the
+ * reconcile runs as). A declared owner that does not exist live is a finding. A trigger whose
+ * function is not declared is left to the post-check, which reads the live owner.
+ *
+ * `session` reads the builder: it runs on the connection the reconcile writes on. On a stage that
+ * is db:session, the operator connection; db:query (`runner`) may run on a reader
+ * (QUERY_DATABASE_URL), whose CURRENT_USER is not the role that will own the function. `runner`
+ * reads only pg_roles, which is the same on any connection.
+ *
+ * `stateApplied`: the table and column changes have committed, so the refusal says so.
+ */
+export async function lifecycleDeclaredOwnerRefusal(
+  runner: QueryRunner,
+  session: SessionRunner,
+  declared: readonly SourceObject[],
+  models: readonly ModelDescriptor[],
+  options: { stateApplied: boolean; roles?: LifecycleRoleDeclaration },
+): Promise<string | null> {
+  const inputs = catalogInputsFromModels(models, options.roles);
+  const tables = new Set(inputs.lifecycleTables);
+  const triggers = declared.flatMap((object) => {
+    if (object.kind !== 'trigger' || !object.table) return [];
+    const { schema, name } = parseQualified(object.table);
+    const fn = tables.has(`${schema}.${name}`) ? triggerFunctionOf(object, declared) : undefined;
+    return fn ? [{ trigger: object.name, table: `${schema}.${name}`, fn }] : [];
+  });
+  if (triggers.length === 0) return null;
+  const [slot] = await session(['SELECT CURRENT_USER::text AS builder']);
+  if (isSessionError(slot) || slot?.[0]?.builder == null) throw new Error('could not read the role the reconcile runs as (CURRENT_USER)');
+  const builder = String(slot[0].builder);
+  const judged = triggers.map(t => ({ ...t, owner: reconcileOwner(t.fn, builder) }));
+  const owners = [...new Set(judged.map(t => t.owner))].sort();
+  const set = await applicationRoleSet(runner, inputs, LIFECYCLE_OWNER_ROLE);
+  const rows = await runner(`WITH ${sideCte(set.apps)}
+    SELECT d.name AS owner, o.oid IS NOT NULL AS present,
+      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via,
+      ${ownerReachColumns(set.apps, 'o.oid')}
+    FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name`);
+  const byOwner = new Map(rows.map(row => [String(row.owner),
+    { present: truthy(row.present), via: textList(row.via), actsAs: textList(row.acts_as), appReach: textList(row.app_reach) }]));
+  const findings = [...set.findings, ...judged.flatMap((t) => {
+    const owner = byOwner.get(t.owner);
+    if (!owner?.present) {
+      return [`trigger ${t.trigger} on ${t.table} would run ${t.fn.identity}, owned by ${t.owner}, which does not exist. `
+        + `Fix: create ${t.owner} as a role no application role can act as, or declare an existing such role as ${t.fn.identity}'s owner in db/models.`];
+    }
+    if (owner.via.length === 0) return [];
+    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via,
+      cause: ownerCause(set, t.owner, owner.actsAs, owner.appReach) }, true)];
+  })];
+  if (findings.length === 0) return null;
+  return `${options.stateApplied ? 'tables and columns applied; ' : ''}derived layer NOT applied: ${countFindings(findings.length)}; `
+    + `fix each, then re-run:\n${findingLines(findings)}`;
+}
+
+/**
+ * The post-check: the live catalog check again, after the derived layer landed. The reconcile
+ * commits what it created, so the report never says refused or rolled back: the objects are live,
+ * and the next apply's preflight refuses until each finding is fixed.
+ *
+ * It reads on `session`, the reconcile's own connection: on a stage, db:session (the operator
+ * connection). db:query may read a replica the reconcile's commit has not reached yet, and pass.
+ */
+export async function lifecyclePostApplyRefusal(
+  session: SessionRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+): Promise<string | null> {
+  if (!models.some(model => model.lifecycle === true)) return null;
+  const read: QueryRunner = async (q) => {
+    const [slot] = await session([q]);
+    if (isSessionError(slot)) throw new Error(slot.message);
+    return slot ?? [];
+  };
+  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models, roles));
   if (findings.length === 0) return null;
-  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
-    + `fix each, then re-run:\n${findings.map(finding => `  - ${finding}`).join('\n')}`;
+  return `${countFindings(findings.length)} after reconcile; the objects are live; the next apply refuses until fixed:\n${findingLines(findings)}`;
 }
 
 /** An older CLI sends no applicationRoles, so the catalog check cannot run: fail closed. */
@@ -417,6 +742,20 @@ export const LIFECYCLE_MANIFEST_ABSENT_REFUSAL = (functions: readonly string[]):
   + `function${functions.length === 1 ? '' : 's'} ${functions.join(', ')} carr${functions.length === 1 ? 'ies' : 'y'} no manifest, so the declared dependents `
   + 'cannot be read and the lifecycle catalog check cannot run. Compile the declared layer from the models with this CLI and re-run.';
 
+/**
+ * The role declaration is optional on the wire: absent, the check runs as before (every grantee
+ * counts). Present but not a list of role names, the check cannot tell what was declared: fail closed.
+ */
+export const LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL = (field: 'request roles' | 'declared owners'): string => `this db:reconcile payload `
+  + `carries ${field} that are not a list of role names, so the lifecycle catalog check cannot run. `
+  + 'Compile the declared layer from the models with this CLI and re-run.';
+
+/** An empty list treats no role as a request role, so no request role could reach a declared owner. */
+export const LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL = 'this db:reconcile payload declares an empty list of request roles, so every declared owner '
+  + 'would pass the request-role guard. defineModule refuses that list; compile the declared layer from the models with this CLI and re-run.';
+
+const isRoleList = (value: unknown): value is string[] => Array.isArray(value) && value.every(role => typeof role === 'string');
+
 /** Generated by an older CLI (0.4.101's per-row restrict pair); a payload may still carry one it is replacing. */
 const RETIRED_LIFECYCLE_ROLES = ['restrict'] as const;
 
@@ -451,13 +790,15 @@ export function lifecycleTablesFromDeclared(declared: readonly SourceObject[]):
 /**
  * db:reconcile's lifecycle gate, local and in the ops Lambda alike: the destroy_log shape, the
  * declared layer's own consistency, the application roles' presence (fail closed), then the
- * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles` is `unknown`
- * because the ops Lambda reads it off the wire.
+ * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles`, `requestRoles`
+ * and `declaredOwners` are `unknown` because the ops Lambda reads them off the wire. The last two are
+ * optional: an older CLI sends neither, and the check runs as before. An older server ignores them:
+ * it refuses more, and it skips the live checks on the request roles (see ReconcileWirePayload).
  */
 export async function lifecycleReconcileRefusal(
   runner: QueryRunner,
   declared: readonly SourceObject[],
-  options: { applicationRoles?: unknown; lifecycleRole?: string } = {},
+  options: { applicationRoles?: unknown; requestRoles?: unknown; declaredOwners?: unknown; lifecycleRole?: string } = {},
 ): Promise<string | null> {
   if (!declared.some(object => object.owner === LIFECYCLE_OWNER_ROLE)) return null;
   const [log] = await runner(LIFECYCLE_LOG_SQL);
@@ -467,11 +808,16 @@ export async function lifecycleReconcileRefusal(
   if ('refusal' in derived) return derived.refusal;
   const roles = options.applicationRoles;
   if (!Array.isArray(roles) || roles.some(role => typeof role !== 'string')) return LIFECYCLE_ROLES_ABSENT_REFUSAL;
+  const { requestRoles, declaredOwners } = options;
+  if (requestRoles != null && !isRoleList(requestRoles)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('request roles');
+  if (declaredOwners != null && !isRoleList(declaredOwners)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('declared owners');
+  if (Array.isArray(requestRoles) && requestRoles.length === 0) return LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL;
   const unreadable = declared.filter(object => object.owner === LIFECYCLE_OWNER_ROLE && object.name.endsWith('_lifecycle_transition')
     && !lifecycleManifestOf(object)).map(object => object.identity).sort();
   if (unreadable.length > 0) return LIFECYCLE_MANIFEST_ABSENT_REFUSAL(unreadable);
   return lifecycleCatalogRefusal(runner, { lifecycleTables: derived.tables, applicationRoles: roles, dependentKeys: dependentKeysFromDeclared(declared),
-    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared) },
+    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared),
+    ...(requestRoles == null ? {} : { requestRoles, declaredOwners: isRoleList(declaredOwners) ? declaredOwners : [] }) },
     { lifecycleRole: options.lifecycleRole });
 }