@everystack/cli 0.4.105 → 0.4.106

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.106] - 2026-10-31
+
+### Added
+
+- declare request roles with defineModule({ roles: { request } })
+
+### Fixed
+
+- a granted definer role is not a request role in the lifecycle check
+- lifecycle rule 2 judges schema owners and the deploy history tables
+- lifecycle reach counts mixed-option membership chains
+- move the database when an app role owns public through pg_database_owner
+- refuse an empty request-role list on the reconcile wire
+
+### Documentation
+
+- say why a granted owner counts, and document roles.request
+- state what an older server skips under the role declaration
+
 ## [0.4.105] - 2026-10-31
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.105",
+  "version": "0.4.106",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -145,7 +145,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.25"
+    "@everystack/model": "0.4.26"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",
@@ -192,7 +192,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.41"
+    "@everystack/server": "0.4.42"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-apply.ts

@@ -77,7 +77,7 @@ import { readStageStateTwice } from '../stage-read-consistency';
 import { renderApplyReceipt, renderCatchUpFailure } from '../plain-output';
 import { renderFkOrphanAdvisory, ownershipColumns } from '../fk-orphan-advisory';
 import { catchUpDerived, type CatchUpVenue } from '../derived-catchup';
-import { lifecycleApplyRefusal, lifecycleStateOnlyRefusal, LifecycleFindingsError } from '../lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleRolesOf, lifecycleStateOnlyRefusal, LifecycleFindingsError, unclassifiedGranteesWarning } from '../lifecycle-preflight';
 import { buildReconcileReport } from './db-reconcile';
 import { step, success, fail, info, warn, line as printLine } from '../output';
 
@@ -519,7 +519,9 @@ async function applyPlanViaStage(
   const { region } = config;
   const fn = opsFunction(config);
   const declared = await loadDeclaredDerived(flags.models);
-  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [])
+  const unclassified = unclassifiedGranteesWarning(declared?.models ?? [], lifecycleRolesOf(declared));
+  if (unclassified) warn(unclassified);
+  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [], lifecycleRolesOf(declared))
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -956,7 +958,9 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   const declaredDb = (): ReturnType<typeof loadDeclaredDerived> =>
     declaredDbPromise ??= loadDeclaredDerived(flags.models);
   // Read-only, before the rollback point: a refused apply must not first take a snapshot, backup or dump.
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [])
+  const unclassified = unclassifiedGranteesWarning((await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
+  if (unclassified) warn(unclassified);
+  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()))
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(runner, (await declaredDb())?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -1113,7 +1117,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
       { verb: 'db:apply', actor: process.env.USER ?? 'unknown' },
       async () => {
         // Re-checked under the lease, where the writes happen.
-        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? []);
+        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
         if (leasedRefusal) {
           fail(leasedRefusal);
           process.exit(1);

package/src/cli/commands/db-branch.ts

@@ -41,6 +41,7 @@ import { resolveDbSource, type DbSource } from '../db-source';
 import { resolveModelsPath } from '../models-path';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import { loadModels } from './db-generate';
+import { lifecycleRolesOf } from '../lifecycle-preflight';
 import { step, success, fail, info, warn } from '../output';
 
 function requireUrl(flags: Record<string, string>, verb: string): string {
@@ -134,6 +135,7 @@ export async function dbTemplateRefreshCommand(flags: Record<string, string>): P
     const result = await executeTemplateRefresh(url, models, {
       declared: declaredDb?.objects,
       sequences: declaredDb?.sequences,
+      lifecycleRoles: lifecycleRolesOf(declaredDb),
       actor: process.env.USER ?? null,
       gitRef: currentGitRef(),
       seed: seedCommand === null ? null : (templateUrl) => {

package/src/cli/commands/db-build.ts

@@ -26,7 +26,7 @@
 
 import type { ModelDescriptor } from '@everystack/model';
 import { buildIntoDatabase } from '../db-build';
-import { LifecycleFindingsError } from '../lifecycle-preflight';
+import { LifecycleFindingsError, lifecycleRolesOf } from '../lifecycle-preflight';
 import { createUrlRunner } from '../db-source';
 import { resolveModelsPath } from '../models-path';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
@@ -124,6 +124,7 @@ export async function dbBuildCommand(flags: Record<string, string>): Promise<voi
       declared: declaredDb?.objects,
       sequences: declaredDb?.sequences,
       extensions: declaredDb?.extensions,
+      lifecycleRoles: lifecycleRolesOf(declaredDb),
       actor: process.env.USER ?? null,
       gitRef: currentGitRef(),
     });

package/src/cli/commands/db-check.ts

@@ -44,6 +44,7 @@ import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '..
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
 import type { SourceObject } from '../derived-source';
+import { lifecycleRolesOf, unclassifiedGranteesWarning, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
 import { findReadAuthzGaps, findNakedGrants } from '../authz-lint';
 import { findSelectGrantGaps } from '../select-grant-advisory';
 import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline';
@@ -125,6 +126,8 @@ export interface StaticCheckInput {
    * Absent (undefined) = the caller did not read it (older callers): no map finding at all.
    */
   modelMapSource?: string | null;
+  /** The modules' role declaration (lifecycleRolesOf). Its unclassified grantees are a warning. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
 }
 
 export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
@@ -285,6 +288,11 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // A grantee the role declaration leaves unclassified counts as a request role in the lifecycle
+  // catalog check. Visible, never fatal: classifying it is the operator's call.
+  const unclassified = unclassifiedGranteesWarning(input.models, input.lifecycleRoles ?? {});
+  if (unclassified) findings.push({ level: 'warn', area: 'authz', message: unclassified });
+
   if (input.artifactSource === null && input.artifactOrigin === 'flag') {
     findings.push({
       level: 'fail',
@@ -369,7 +377,7 @@ export interface EphemeralComposeResult {
 export async function executeEphemeralCompose(
   adminUrl: string,
   models: ModelDescriptor[],
-  opts: { actor?: string | null; gitRef?: string | null; declared?: SourceObject[]; sequences?: SequenceDescriptor[]; extensions?: string[] } = {},
+  opts: { actor?: string | null; gitRef?: string | null; declared?: SourceObject[]; sequences?: SequenceDescriptor[]; extensions?: string[]; lifecycleRoles?: LifecycleRoleDeclaration } = {},
 ): Promise<EphemeralComposeResult> {
   const database = `escheck_${process.pid}_${Date.now()}`;
   await createDatabase(adminUrl, database);
@@ -378,6 +386,7 @@ export async function executeEphemeralCompose(
       declared: opts.declared,
       sequences: opts.sequences,
       extensions: opts.extensions,
+      lifecycleRoles: opts.lifecycleRoles,
       actor: opts.actor ?? 'db:check',
       gitRef: opts.gitRef ?? null,
     });
@@ -478,6 +487,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
     moduleModels: declaredDb?.models ?? null,
     baselineSource,
     modelMapPath: mapPath, modelMapSource,
+    lifecycleRoles: lifecycleRolesOf(declaredDb),
   });
   // Per-finding detail is the --verbose report. The quiet default answers the one question a
   // human asked — is anything pending? — and names the verb that shows it.
@@ -504,6 +514,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
         declared: declaredDb?.objects,
         sequences: declaredDb?.sequences,
         extensions,
+        lifecycleRoles: lifecycleRolesOf(declaredDb),
       });
       if (verbose) for (const line of ephemeral.report) info(`  ${line}`);
     } catch (err: any) {

package/src/cli/commands/db-plan.ts

@@ -63,7 +63,7 @@ import { resolveModelsPath } from '../models-path';
 import { resolveConfig, opsFunction } from '../config';
 import { resolveOperatorUrlViaStage } from '../direct-venue';
 import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
-import { lifecycleApplyRefusal } from '../lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleRolesOf, unclassifiedGranteesWarning } from '../lifecycle-preflight';
 import { loadModels } from './db-generate';
 import { loadDeclaredDerived, type DeclaredDerived } from '../declared-derived';
 import { introspectDerived } from '../derived-introspect';
@@ -238,7 +238,12 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
   }
 
   try {
-    const lifecycleNote = await lifecycleApplyRefusal(runner, models);
+    // The modules' role declaration, as db:apply reads it. A barrel that does not compose leaves it
+    // undeclared here (the check as before); the paths that need the derived layer report the error.
+    const lifecycleRoles = lifecycleRolesOf(await loadDeclaredDerived(flags.models).catch(() => null));
+    const lifecycleNote = await lifecycleApplyRefusal(runner, models, lifecycleRoles);
+    const unclassified = unclassifiedGranteesWarning(models, lifecycleRoles);
+    if (unclassified) warn(unclassified);
     // db:plan only reads, so it mints the plan anyway; db:apply runs the same check and refuses.
     if (lifecycleNote) warn(`db:apply will refuse this plan until each lifecycle finding below is fixed.\n${lifecycleNote}`);
     let snapshot: SchemaSnapshot;

package/src/cli/commands/db-reconcile.ts

@@ -32,7 +32,7 @@
 import type { QueryRunner } from '../authz-contract';
 import type { SourceObject } from '../derived-source';
 import { introspectDerived } from '../derived-introspect';
-import { catalogInputsFromModels, lifecycleReconcileRefusal } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleReconcileRefusal, lifecycleRolesOf } from '../lifecycle-preflight';
 import { planReconcile, objectGrantDelta, TRIGGER_ENABLED_STATE, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
@@ -84,6 +84,12 @@ export interface ExecuteOptions extends ReconcileOptions {
    * the check. `unknown` because the ops Lambda passes it straight off the wire.
    */
   applicationRoles?: unknown;
+  /**
+   * The modules' declared request roles and declared owners (LifecycleRoleDeclaration), beside
+   * applicationRoles. Optional: absent, the catalog check runs as before. `unknown` for the wire.
+   */
+  requestRoles?: unknown;
+  declaredOwners?: unknown;
   /**
    * The caller already ran lifecycleApplyRefusal with the full models, on this runner, in this
    * process (executeSync does, first thing), so the reconcile does not run the catalog check again.
@@ -159,7 +165,9 @@ export async function executeReconcile(
   // --rebaseline, --only, --overwrite-drift or none) refuses on it below; a plan-only run reports
   // it as a finding. See lifecycleCatalogRefusal for what it defends and from whom.
   const lifecycleGate = (): Promise<string | null> => (options.lifecyclePreflighted ? Promise.resolve(null)
-    : lifecycleReconcileRefusal(runner, parsed.objects, { applicationRoles: options.applicationRoles }));
+    : lifecycleReconcileRefusal(runner, parsed.objects, {
+      applicationRoles: options.applicationRoles, requestRoles: options.requestRoles, declaredOwners: options.declaredOwners,
+    }));
 
   if (!options.apply) {
     const lifecycleFindings = await lifecycleGate();
@@ -768,6 +776,7 @@ export async function dbReconcileCommand(flags: Record<string, string>): Promise
     // The lifecycle catalog check's roles, from the barrel's models. The tables come from the
     // declared transition triggers inside the reconcile, the same derivation the ops Lambda runs.
     applicationRoles: declared?.models ? catalogInputsFromModels(declared.models).applicationRoles : undefined,
+    ...lifecycleRolesOf(declared),
     renamedTables: declared?.renamedTables,
     baseline: flags.baseline === 'true',
     rebaseline: flags.rebaseline === 'true',

package/src/cli/commands/db-sync.ts

@@ -31,7 +31,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type QueryRunner } from '../authz-contract';
-import { catalogInputsFromModels, lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecycleRolesOf, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import { generateMigrationSql, unmodeledTables } from '../migration-generate';
@@ -86,6 +86,8 @@ export interface SyncOptions {
   governedRoles?: string[];
   /** Pending table renames — trigger provenance migrates instead of drop+create. */
   renamedTables?: Record<string, string>;
+  /** The modules' role declaration (lifecycleRolesOf): what the lifecycle gates read beside the models. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
   /** Injectable clock for tests. */
   now?: () => number;
 }
@@ -183,6 +185,8 @@ async function syncOnce(
     // The catalog check runs again here, after the state apply: a table this sync just created can
     // carry a finding (a default privilege, its owner) the check before the state apply could not see.
     applicationRoles: catalogInputsFromModels(models).applicationRoles,
+    requestRoles: options.lifecycleRoles?.requestRoles,
+    declaredOwners: options.lifecycleRoles?.declaredOwners,
   });
 
   const declaredFingerprint = fingerprintModels(models, { sequences: options.sequences }).hash;
@@ -240,11 +244,11 @@ export async function executeSync(
   hooks: SyncHooks = {},
 ): Promise<SyncRun> {
   // State runs before compute, so without this a lifecycle table would land with no transition trigger.
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, models);
+  const lifecycleRefusal = await lifecycleApplyRefusal(runner, models, options.lifecycleRoles);
   if (lifecycleRefusal) throw new Error(lifecycleRefusal);
   // Before anything is written, so before both places a pass creates derived objects (the
   // functions the state batch calls, then the reconcile).
-  const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false });
+  const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
   if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
   const first = await syncOnce(runner, session, models, options, hooks, 1);
   // The trigger is the STATE bar, not the combined verdict. The cause above is state-layer
@@ -451,6 +455,7 @@ export async function dbSyncCommand(flags: Record<string, string>): Promise<void
         sequences: declaredDb?.sequences,
         extensions: declaredDb?.extensions,
         renamedTables: declaredDb?.renamedTables,
+        lifecycleRoles: lifecycleRolesOf(declaredDb),
         allowDrops: flags['allow-drops'] === 'true',
         overwriteDrift: flags['overwrite-drift'] === 'true',
         baseline: flags.baseline === 'true',

package/src/cli/db-build.ts

@@ -18,7 +18,7 @@ import { compileDeclaredState } from './declared-diff';
 import { createUrlRunner } from './db-source';
 import { executeSync, buildSyncReport } from './commands/db-sync';
 import { executeReconcile } from './commands/db-reconcile';
-import { lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal } from './lifecycle-preflight';
+import { lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal, type LifecycleRoleDeclaration } from './lifecycle-preflight';
 
 const SAFE_NAME = /^[a-z_][a-z0-9_$]*$/;
 
@@ -101,6 +101,8 @@ export interface BuildOptions {
   extensions?: string[];
   actor?: string | null;
   gitRef?: string | null;
+  /** The modules' role declaration (lifecycleRolesOf): what the lifecycle gates read beside the models. */
+  lifecycleRoles?: LifecycleRoleDeclaration;
 }
 
 /**
@@ -184,7 +186,7 @@ export async function buildIntoDatabase(
     // Before the first derived write: the owners the reconcile will give the declared trigger
     // functions on lifecycle tables. This pass runs before executeSync, which judges them again
     // first thing, before its own state apply.
-    const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false });
+    const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
     if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
     const declaredFunctions = (options.declared ?? [])
       .filter((o) => o.kind === 'function' && !o.signatureDeps?.length);
@@ -192,7 +194,7 @@ export async function buildIntoDatabase(
       // The lifecycle catalog check, with the full models, before any lifecycle-owned function
       // lands: this pass declares functions only, so it carries no transition trigger for the
       // reconcile to read the lifecycle tables from. executeSync runs the same check again below.
-      const lifecycleRefusal = await lifecycleApplyRefusal(runner, models);
+      const lifecycleRefusal = await lifecycleApplyRefusal(runner, models, options.lifecycleRoles);
       if (lifecycleRefusal) throw new Error(lifecycleRefusal);
       await runner('SET check_function_bodies = off');
       try {
@@ -216,12 +218,13 @@ export async function buildIntoDatabase(
     const run = await executeSync(runner, session, models, {
       declared: options.declared,
       sequences: options.sequences,
+      lifecycleRoles: options.lifecycleRoles,
       actor: options.actor ?? 'db-build',
       gitRef: options.gitRef ?? null,
     });
     // Verification: the live catalog check again, over what the derived layer just made live. A
     // throw, so no caller (db:check's compose ring, the dev template, a test database) can miss it.
-    const post = await lifecyclePostApplyRefusal(session, models);
+    const post = await lifecyclePostApplyRefusal(session, models, options.lifecycleRoles);
     if (post) throw new LifecycleFindingsError(post);
     return {
       converged: run.converged,

package/src/cli/declared-derived.ts

@@ -12,7 +12,7 @@ import path from 'node:path';
 import fs from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
-import { linkModels, ModelLinkError, moduleGovernedRoles } from '@everystack/model';
+import { linkModels, ModelLinkError, moduleGovernedRoles, moduleRequestRoles } from '@everystack/model';
 import { compileDerived } from './derived-compile';
 import { lifecycleDerived } from './lifecycle-derived';
 import { compileTableRenames, compileTableMoves } from './schema-compile';
@@ -35,6 +35,13 @@ export interface DeclaredDerived {
   /** Roles the modules declare as governed beyond the ones the models name. A live grantee
    *  outside the governed set is exempted from reconciliation and ENUMERATED instead. */
   governedRoles: string[];
+  /**
+   * The roles a request can become (`roles: { request }`, the union across modules). Undefined
+   * when no module declares them: the lifecycle catalog check then runs exactly as before.
+   */
+  requestRoles?: string[];
+  /** Every `owner` a declared derived object names, across modules, sorted. */
+  declaredOwners: string[];
   /**
    * Postgres extensions the modules declare — the bootstrap the state layer needs before
    * anything that uses their types. Only the from-scratch compiler consumed these; the DIFF
@@ -194,6 +201,9 @@ export function composeDeclaredDerived(modules: Module[], modelsPath: string): D
       renamedTables: { ...compileTableRenames(models, {}), ...compileTableMoves(models, {}) },
       models,
       governedRoles: moduleGovernedRoles(modules),
+      requestRoles: moduleRequestRoles(modules),
+      declaredOwners: [...new Set(modules.flatMap((m) => m.derived)
+        .flatMap((d) => ('owner' in d && typeof d.owner === 'string' ? [d.owner] : [])))].sort(),
       extensions: [...new Set(modules.flatMap((m) => m.extensions ?? []))].sort(),
     };
   } catch (err) {

package/src/cli/derived-catchup.ts

@@ -35,7 +35,7 @@ import { MODEL_WIRE_CONTRACT, type ReconcileWirePayload } from '../wire';
 import { resolveConfig, opsFunction } from './config';
 import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from './aws';
 import { currentGitRef } from './state-apply';
-import { catalogInputsFromModels, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal } from './lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecyclePostApplyRefusal, lifecycleRolesOf } from './lifecycle-preflight';
 
 /** Where the catch-up runs. The two lanes db:apply itself already has. */
 export type CatchUpVenue =
@@ -118,6 +118,8 @@ export async function catchUpDerived(
     // The lifecycle catalog check's roles; the reconcile, here or in the ops Lambda, refuses
     // lifecycle-owned objects without them.
     applicationRoles: declared?.models ? catalogInputsFromModels(declared.models).applicationRoles : undefined,
+    // What the modules declare about the roles; optional on the wire (absent = the check as before).
+    ...lifecycleRolesOf(declared),
     actor: process.env.USER ?? null,
     gitRef: currentGitRef(),
   };
@@ -130,7 +132,7 @@ export async function catchUpDerived(
   // operator connection, while db:query may run on a reader.
   const operator: SessionRunner = (statements, opts) =>
     (venue.kind === 'direct' ? venue.session : lambdaSessionRunner(config!.region, opsFunction(config!)))(statements, opts);
-  const gate = await lifecycleDeclaredOwnerRefusal(reader, operator, objects, declared?.models ?? [], { stateApplied: opts.stateApplied });
+  const gate = await lifecycleDeclaredOwnerRefusal(reader, operator, objects, declared?.models ?? [], { stateApplied: opts.stateApplied, roles: lifecycleRolesOf(declared) });
   if (gate) throw new LifecycleFindingsError(gate);
 
   let run: ReconcileRun;
@@ -172,7 +174,7 @@ export async function catchUpDerived(
 
   // Verification: the live catalog check again, over what the reconcile just made live. On the
   // operator session, where the commit is: db:query may read a replica that has not caught up.
-  const post = await lifecyclePostApplyRefusal(operator, declared?.models ?? []);
+  const post = await lifecyclePostApplyRefusal(operator, declared?.models ?? [], lifecycleRolesOf(declared));
   if (post) throw new LifecycleFindingsError(post);
 
   return { declared: objects.length, run, statements: run.applied ? (run.statements ?? []) : [] };

package/src/cli/lifecycle-preflight.ts

@@ -33,13 +33,50 @@ export function lifecycleLogRowRefusal(log: { present?: unknown; current?: unkno
  * The log's shape first (its refusals are unchanged), then the live catalog facts the soft delete
  * rests on (lifecycleCatalogRefusal). Pure SELECTs: the --stage lane runs them over db:query.
  */
-export async function lifecycleApplyRefusal(runner: QueryRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
+export async function lifecycleApplyRefusal(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+): Promise<string | null> {
   if (!models.some(model => model.lifecycle === true)) return null;
   const [log] = await runner(LIFECYCLE_LOG_SQL);
   // Before the plan: a modeled table's keys are the plan's to converge (the models declare each
   // one, or refuse to compile), so rule 6 reports only keys from tables the models do not have.
   const modeledTables = [...new Set(models.map(model => `${model.schema}.${model.table}`))];
-  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models), modeledTables });
+  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models, roles), modeledTables });
+}
+
+/**
+ * What the modules declare about the roles, beside the models (DeclaredDerived). The catalog check
+ * reads it to tell a definer role the models grant to apart from a role a request can become.
+ *
+ *   requestRoles    `roles: { request }`, the union across modules. Undefined = not declared, and
+ *                   the check runs exactly as before: every grantee counts as a request role.
+ *   declaredOwners  every `owner` a declared derived object names.
+ */
+export interface LifecycleRoleDeclaration {
+  requestRoles?: string[];
+  declaredOwners?: string[];
+}
+
+/** The role declaration from a loaded declared layer; empty (not declared) when there is none. */
+export function lifecycleRolesOf(declared: { requestRoles?: string[]; declaredOwners?: string[] } | null | undefined): LifecycleRoleDeclaration {
+  return declared?.requestRoles === undefined ? {} : { requestRoles: declared.requestRoles, declaredOwners: declared.declaredOwners ?? [] };
+}
+
+/**
+ * The grantees the declaration does not classify: each counts as a request role, so the lifecycle
+ * check treats it as application-side. A warning, never a refusal. Null when the request roles are
+ * not declared (nothing is classified), when no model is a lifecycle model, or when none is left.
+ */
+export function unclassifiedGranteesWarning(models: readonly ModelDescriptor[], roles: LifecycleRoleDeclaration): string | null {
+  if (roles.requestRoles === undefined || !models.some(model => model.lifecycle === true)) return null;
+  const classified = new Set([...roles.requestRoles, ...(roles.declaredOwners ?? [])]);
+  const unclassified = catalogInputsFromModels(models).applicationRoles.filter(role => !classified.has(role));
+  if (unclassified.length === 0) return null;
+  return `the models grant privileges to ${unclassified.join(', ')}, which ${unclassified.length === 1 ? 'is' : 'are'} neither a declared request role `
+    + `(roles: { request }) nor a declared owner, so the lifecycle check counts ${unclassified.length === 1 ? 'it' : 'them'} as a role a request can become. `
+    + 'Add each to roles.request, or name it as the owner of the derived objects it owns.';
 }
 
 const literal = (s: string): string => `'${s.replace(/'/g, "''")}'`;
@@ -85,6 +122,13 @@ export interface LifecycleCatalogInputs {
    * rule 6 leaves to the plan. Absent after the state apply: every key is checked.
    */
   modeledTables?: readonly string[];
+  /**
+   * The declared request roles (LifecycleRoleDeclaration). Absent = not declared: the
+   * application roles are the grantees, exactly as before. Present: see applicationRoleSet.
+   */
+  requestRoles?: readonly string[];
+  /** Every declared derived-object owner. Read only when `requestRoles` is present. */
+  declaredOwners?: readonly string[];
 }
 
 /** A declared dependent: the child's `schema.table`, its foreign-key column (SQL name), the lifecycle parent's `schema.table`. */
@@ -127,8 +171,11 @@ export function nullifyUnrecordedFromDeclared(declared: readonly Parameters<type
 
 const notApplicationRole = (lc: string) => (role: string): boolean => role !== 'PUBLIC' && role !== 'public' && role !== lc;
 
-/** The catalog check's inputs, read from the models. */
-export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[] } {
+/** The catalog check's inputs, read from the models (and the role declaration, when there is one). */
+export function catalogInputsFromModels(
+  models: readonly ModelDescriptor[],
+  declaration: LifecycleRoleDeclaration = {},
+): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[]; requestRoles?: string[]; declaredOwners?: string[] } {
   const roles = new Set<string>();
   for (const model of models) {
     const contract = compileTableContract(model);
@@ -140,6 +187,7 @@ export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { l
     lifecycleTables: [...new Set(models.filter(model => model.lifecycle === true).map(model => `${model.schema}.${model.table}`))].sort(),
     applicationRoles: [...roles].filter(notApplicationRole(LIFECYCLE_OWNER_ROLE)).sort(),
     dependentKeys: models.some(model => model.lifecycle === true) ? dependentKeysFromDeclared(lifecycleDerived(models)) : [],
+    ...(declaration.requestRoles === undefined ? {} : { requestRoles: [...declaration.requestRoles], declaredOwners: [...(declaration.declaredOwners ?? [])] }),
   };
 }
 
@@ -153,9 +201,16 @@ export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { l
 const assumes = (x: string, y: string): string => `(pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') OR CASE
     WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
     ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END)`;
-/** `x` can act as `y`, or hold ADMIN on it: an ADMIN holder can grant `y` to itself WITH SET. */
+/**
+ * `x` can act as `y`, or hold ADMIN on it (an ADMIN holder can grant `y` to itself WITH SET), or
+ * reach it through a chain of grants whose options differ link to link. MEMBER counts any chain:
+ * ADMIN-only on `i`, then `i` a member of `y` (grant `i` to itself WITH SET, SET ROLE `i`, then
+ * `y`); or SET-only on `i`, then `i` an INHERIT-only member of `y` (SET ROLE `i` holds `y`'s
+ * privileges). USAGE, SET and MEMBER WITH ADMIN OPTION are each false for both. Never in `assumes`:
+ * the side set must still leave out the RDS master's ADMIN-only membership.
+ */
 const reaches = (x: string, y: string): string =>
-  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION'))`;
+  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER'))`;
 
 /**
  * The application-side roles, as a CTE `side(oid, rolname)`: non-superusers that are, or can act
@@ -166,6 +221,115 @@ const sideCte = (apps: string[]): string => `side AS (SELECT r.oid, r.rolname::t
     WHERE NOT r.rolsuper AND EXISTS (SELECT 1 FROM pg_catalog.pg_roles a
       WHERE a.rolname = ANY(${textArray(apps)}) AND (a.oid = r.oid OR ${assumes('r.oid', 'a.oid')})))`;
 
+/** How `x` reaches `y`, for a finding: INHERIT, SET, ADMIN or a chain of grants (the first that holds; see assumes and reaches). */
+const reachHow = (x: string, y: string): string => `CASE WHEN pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') THEN 'INHERIT'
+    WHEN (CASE WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
+      ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END) THEN 'SET'
+    WHEN pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') THEN 'ADMIN' ELSE 'a chain of grants' END`;
+
+/**
+ * The live facts the declaration rests on. Per declared request role: does it exist, is it a
+ * superuser, is it BYPASSRLS. Per declared owner that is a grantee or a request role: does it exist,
+ * can it log in, and which request roles reach it (reaches: INHERIT, SET or ADMIN, transitively).
+ */
+const requestRoleSql = (request: string[], owners: string[]): string => `SELECT 'request' AS kind, d.name, o.oid IS NOT NULL AS present,
+    COALESCE(o.rolsuper, false) AS super, COALESCE(o.rolbypassrls, false) AS bypassrls, COALESCE(o.rolcanlogin, false) AS login,
+    ARRAY[]::text[] AS reached_by
+  FROM pg_catalog.unnest(${textArray(request)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  UNION ALL
+  SELECT 'owner', d.name, o.oid IS NOT NULL, COALESCE(o.rolsuper, false), COALESCE(o.rolbypassrls, false), COALESCE(o.rolcanlogin, false),
+    ARRAY(SELECT 'request role ' || r.rolname::text || ' can act as ' || d.name || ' (' || ${reachHow('r.oid', 'o.oid')} || ')'
+      FROM pg_catalog.pg_roles r WHERE r.rolname = ANY(${textArray(request)}) AND r.oid <> o.oid AND ${reaches('r.oid', 'o.oid')} ORDER BY 1)
+  FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  ORDER BY 1, 2`;
+
+/** The application roles every rule reads (sideCte's input), and why each counts where the declaration can say. */
+interface ApplicationRoleSet {
+  apps: string[];
+  /** A role in `apps` → one sentence saying why it is there. Empty when nothing is declared. */
+  why: Map<string, string>;
+  /** Live findings on the declared request roles. */
+  findings: string[];
+  /** The models' grantees (applicationRoles), PUBLIC and the lifecycle role left out. */
+  grantees: ReadonlySet<string>;
+  /** The request roles are declared. */
+  declared: boolean;
+}
+
+/**
+ * THE one place the application-role set is computed. Rules 1, 2 and 5, the pre-exposure gate, the
+ * post-check and the reconcile path all read it.
+ *
+ * Not declared (`requestRoles` absent): the grantees, exactly as before, and no query runs.
+ *
+ * Declared: the request roles and the grantees, minus each declared owner D that holds every guard,
+ * read live: D is not a request role, D is not the lifecycle role (never in the set: PUBLIC and it are
+ * filtered out), D exists and cannot log in, and no request role reaches D. A declared owner that
+ * fails a guard stays, and `why` names the guard. A grantee in neither list stays as well. Each
+ * request role must exist, and be neither a superuser nor BYPASSRLS: either is a finding.
+ */
+async function applicationRoleSet(runner: QueryRunner, inputs: LifecycleCatalogInputs, lc: string): Promise<ApplicationRoleSet> {
+  const grantees = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
+  if (inputs.requestRoles === undefined) return { apps: grantees, why: new Map(), findings: [], grantees: new Set(grantees), declared: false };
+  const request = new Set([...inputs.requestRoles].filter(notApplicationRole(lc)));
+  const owners = new Set(inputs.declaredOwners ?? []);
+  const set = new Set([...request, ...grantees]);
+  const candidates = [...set].filter(role => owners.has(role)).sort();
+  const findings: string[] = [];
+  const why = new Map<string, string>();
+  for (const row of await runner(requestRoleSql([...request].sort(), candidates))) {
+    const name = String(row.name);
+    if (row.kind === 'request') {
+      if (!truthy(row.present)) {
+        findings.push(`request role ${name} does not exist. Fix: create it, or remove it from roles.request.`);
+        continue;
+      }
+      if (truthy(row.super)) findings.push(`request role ${name} is a superuser: a request that becomes it passes every check. Fix: ALTER ROLE ${ident(name)} NOSUPERUSER;`);
+      if (truthy(row.bypassrls)) findings.push(`request role ${name} has BYPASSRLS: a request that becomes it skips every row-level policy. Fix: ALTER ROLE ${ident(name)} NOBYPASSRLS;`);
+      continue;
+    }
+    const failed: string[] = [];
+    if (request.has(name)) failed.push(`declared owner ${name} is a request role`);
+    if (!truthy(row.present)) failed.push(`declared owner ${name} does not exist`);
+    else if (truthy(row.login)) failed.push(`declared owner ${name} can log in`);
+    failed.push(...textList(row.reached_by));
+    if (failed.length === 0) set.delete(name);
+    else why.set(name, `${name} counts as an application role: ${failed.join('; ')}.`);
+  }
+  for (const role of grantees) {
+    if (!request.has(role) && !owners.has(role)) {
+      why.set(role, `${role} counts as an application role because the models grant it privileges, and it is neither a declared request role nor a declared owner.`);
+    }
+  }
+  return { apps: [...set].sort(), why, findings, grantees: new Set(grantees), declared: true };
+}
+
+/**
+ * Why `owner`, itself an application-side role, counts: for a rule-5 finding. The declaration's
+ * reason when it has one. Undeclared, and the owner counts only because the models grant to it (it
+ * acts as no other application role, and no other application role reaches it), the finding says
+ * so and names the declaration that tells a definer role apart. Reached, the REVOKE fix stands alone.
+ */
+function ownerCause(set: ApplicationRoleSet, owner: string, actsAs: readonly string[], appReach: readonly string[]): string | undefined {
+  const known = set.why.get(owner);
+  if (known) return known;
+  if (set.declared) return actsAs.length > 0 ? `${owner} can act as the application role${actsAs.length === 1 ? '' : 's'} ${actsAs.join(', ')}.` : undefined;
+  const granted = set.grantees.has(owner) && actsAs.length === 0 && appReach.length === 0;
+  return granted ? grantedCause(owner) : undefined;
+}
+
+const grantedCause = (owner: string): string => `${owner} counts as an application role because the models grant it privileges. `
+  + 'If it is a definer role that no request role reaches, declare the request roles with roles: { request: [...] } in a module.';
+
+/**
+ * Two columns for the rule-5 queries: the application roles `owner` can act as (acts_as), and the
+ * other application roles that reach `owner` (app_reach). Neither counts `owner` itself.
+ */
+const ownerReachColumns = (apps: string[], owner: string): string => `ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${assumes(owner, 'a.oid')} ORDER BY 1) AS acts_as,
+    ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${reaches('a.oid', owner)} ORDER BY 1) AS app_reach`;
+
 /** Rule 1, attributes. */
 const roleSql = (lc: string): string => `SELECT lc.oid IS NOT NULL AS present,
     COALESCE(lc.rolcanlogin, false) AS login, COALESCE(lc.rolsuper, false) AS super,
@@ -184,11 +348,17 @@ const memberSql = (apps: string[], lc: string): string => `WITH ${sideCte(apps)}
   WHERE s.oid <> lc.oid AND ${reaches('s.oid', 'lc.oid')}
   ORDER BY 1`;
 
+/** The deploy history: who owns one can rewrite what was applied, run and reconciled. */
+const HISTORY_TABLES = ['everystack.schema_log', 'everystack.exec_log', 'everystack.derived_provenance'];
+
 /**
  * Rule 2. The owner of a lifecycle table can disable its triggers; the owner of destroy_log can
- * write the marker; the owner of a marker function can replace it. Each such object is a finding
- * when its owner is the lifecycle role, or when an application-side role is that owner, can act
- * as it, or holds ADMIN on it. The operator owning all of them is the documented setup and passes.
+ * write the marker; the owner of a marker function can replace it; the owner of a schema holding
+ * any of them can drop what is in it (DROP ... CASCADE takes the delete-path trigger along); the
+ * owner of schema_log, exec_log or derived_provenance can forge the deploy history. Each such
+ * object is a finding when its owner is the lifecycle role, or when an application-side role is
+ * that owner, can act as it, or holds ADMIN on it. The operator owning all of them is the
+ * documented setup and passes. A table that does not exist is not judged.
  */
 const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH ${sideCte(apps)},
   owned AS (
@@ -200,8 +370,19 @@ const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH
     WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log')
     UNION ALL
     SELECT 'function', m.sig, p.proowner FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
-    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig))
+    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)
+    UNION ALL
+    SELECT 'table', n.nspname::text || '.' || c.relname::text, c.relowner
+    FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.oid IN (SELECT pg_catalog.to_regclass(t) FROM pg_catalog.unnest(${textArray(HISTORY_TABLES)}) AS t)
+    UNION ALL
+    SELECT 'schema', n.nspname::text, n.nspowner FROM pg_catalog.pg_namespace n
+    WHERE n.nspname = ANY(${textArray([...new Set(tables.map(table => table.slice(0, table.indexOf('.'))))])})
+      OR n.oid IN (SELECT c.relnamespace FROM pg_catalog.pg_class c WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log'))
+      OR n.oid IN (SELECT p.pronamespace FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
+        JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)))
   SELECT o.kind, o.name, pg_catalog.pg_get_userbyid(o.owner)::text AS owner, o.owner = lc.oid AS lifecycle_owned,
+    pg_catalog.current_database()::text AS database,
     ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')} ORDER BY 1) AS via
   FROM owned o LEFT JOIN pg_catalog.pg_roles lc ON lc.rolname = ${literal(lc)}
   WHERE o.owner = lc.oid OR EXISTS (SELECT 1 FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')})
@@ -260,7 +441,8 @@ const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${si
   SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
     pg_catalog.quote_ident(fn.nspname) || '.' || pg_catalog.quote_ident(p.proname) || '(' || pg_catalog.pg_get_function_identity_arguments(p.oid) || ')' AS function,
     pg_catalog.pg_get_userbyid(p.proowner)::text AS owner,
-    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via
+    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via,
+    ${ownerReachColumns(apps, 'p.proowner')}
   FROM pg_catalog.pg_trigger g JOIN pg_catalog.pg_class c ON c.oid = g.tgrelid
   JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace JOIN pg_catalog.pg_proc p ON p.oid = g.tgfoid
   JOIN pg_catalog.pg_namespace fn ON fn.oid = p.pronamespace
@@ -272,8 +454,12 @@ const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${si
  * One rule-5 finding. `via` holds the application-side roles that are, or reach, `owner`. When the
  * owner is one of them the fix is a new owner; otherwise it is to revoke the path to the owner.
  * `would`: the pre-exposure gate, which judges a declared trigger before the reconcile creates it.
+ * `cause`: why the owner counts as an application role (ownerCause), when there is more to say.
  */
-export function triggerOwnerFinding(row: { trigger: string; table: string; function: string; owner: string; via: readonly string[] }, would = false): string {
+export function triggerOwnerFinding(
+  row: { trigger: string; table: string; function: string; owner: string; via: readonly string[]; cause?: string },
+  would = false,
+): string {
   const { owner, via } = row;
   const sideOwned = via.includes(owner);
   const who = sideOwned ? `${owner}, an application-side role`
@@ -284,7 +470,8 @@ export function triggerOwnerFinding(row: { trigger: string; table: string; funct
       + `for a function not declared in db/models: ALTER FUNCTION ${row.function} OWNER TO <that role>;`
     : `${via.map(r => `REVOKE ${ident(owner)} FROM ${ident(r)};`).join(' ')} (or from the role each reaches ${owner} through)`;
   return `trigger ${row.trigger} on ${row.table} ${would ? 'would run' : 'runs'} ${row.function}, owned by ${who}; `
-    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`;
+    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`
+    + (sideOwned && row.cause ? ` ${row.cause}` : '');
 }
 
 /**
@@ -307,6 +494,8 @@ const OWNER_HAZARD = {
   table: 'an owner can disable its triggers',
   log: 'an owner can write the marker',
   function: 'an owner can replace the function',
+  schema: 'an owner can DROP ... CASCADE the delete-path trigger',
+  history: 'an owner can forge the deploy history',
 };
 
 /**
@@ -349,8 +538,9 @@ async function lifecycleCatalogFindings(
   const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
   const tables = [...new Set(inputs.lifecycleTables)].sort();
   if (tables.length === 0) return [];
-  const apps = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
-  const findings: string[] = [];
+  const set = await applicationRoleSet(runner, inputs, lc);
+  const apps = set.apps;
+  const findings: string[] = [...set.findings];
 
   const [role] = await runner(roleSql(lc));
   if (!truthy(role?.present)) {
@@ -369,17 +559,23 @@ async function lifecycleCatalogFindings(
   }
 
   for (const row of await runner(ownerSql(tables, apps, lc))) {
-    const kind = row.kind === 'function' ? 'function' : 'table';
-    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log : OWNER_HAZARD[kind];
+    const kind: 'function' | 'schema' | 'table' = row.kind === 'function' || row.kind === 'schema' ? row.kind : 'table';
+    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log
+      : HISTORY_TABLES.includes(String(row.name)) ? OWNER_HAZARD.history : OWNER_HAZARD[kind];
     const via = textList(row.via);
     const who = truthy(row.lifecycle_owned) ? `${row.owner}, the lifecycle role`
       : via.includes(String(row.owner)) ? `${row.owner}, an application-side role`
         : `${row.owner}, which the application-side role${via.length === 1 ? '' : 's'} ${via.join(', ')} can assume`;
-    const name = kind === 'function' ? String(row.name) : quoteLabel(String(row.name));
+    const name = kind === 'function' ? String(row.name) : kind === 'schema' ? ident(String(row.name)) : quoteLabel(String(row.name));
+    // pg_database_owner (public's owner on PostgreSQL 15 and later) has one implicit member, the owner
+    // of the database, and REVOKE cannot remove it: the database itself has to move.
     const fix = truthy(row.lifecycle_owned) || via.includes(String(row.owner))
       ? `ALTER ${kind.toUpperCase()} ${name} OWNER TO <your operator role>;`
-      : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
-    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}`);
+      : row.owner === 'pg_database_owner'
+        ? `ALTER DATABASE ${ident(String(row.database))} OWNER TO <your operator role>; (the owner of the database is pg_database_owner's only member)`
+        : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
+    const cause = via.includes(String(row.owner)) ? set.why.get(String(row.owner)) : undefined;
+    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}${cause ? ` ${cause}` : ''}`);
   }
 
   for (const row of await runner(aclSql(tables))) {
@@ -413,8 +609,10 @@ async function lifecycleCatalogFindings(
   }
 
   for (const row of await runner(triggerOwnerSql(tables, apps))) {
+    const owner = String(row.owner);
+    const via = textList(row.via);
     findings.push(triggerOwnerFinding({ trigger: String(row.trigger), table: String(row.table), function: String(row.function),
-      owner: String(row.owner), via: textList(row.via) }));
+      owner, via, cause: ownerCause(set, owner, textList(row.acts_as), textList(row.app_reach)) }));
   }
 
   const declared = new Set(inputs.dependentKeys.map(key => JSON.stringify([key.child, key.column, key.parent])));
@@ -472,10 +670,10 @@ export async function lifecycleDeclaredOwnerRefusal(
   session: SessionRunner,
   declared: readonly SourceObject[],
   models: readonly ModelDescriptor[],
-  options: { stateApplied: boolean },
+  options: { stateApplied: boolean; roles?: LifecycleRoleDeclaration },
 ): Promise<string | null> {
-  const { lifecycleTables, applicationRoles } = catalogInputsFromModels(models);
-  const tables = new Set(lifecycleTables);
+  const inputs = catalogInputsFromModels(models, options.roles);
+  const tables = new Set(inputs.lifecycleTables);
   const triggers = declared.flatMap((object) => {
     if (object.kind !== 'trigger' || !object.table) return [];
     const { schema, name } = parseQualified(object.table);
@@ -488,20 +686,24 @@ export async function lifecycleDeclaredOwnerRefusal(
   const builder = String(slot[0].builder);
   const judged = triggers.map(t => ({ ...t, owner: reconcileOwner(t.fn, builder) }));
   const owners = [...new Set(judged.map(t => t.owner))].sort();
-  const rows = await runner(`WITH ${sideCte(applicationRoles)}
+  const set = await applicationRoleSet(runner, inputs, LIFECYCLE_OWNER_ROLE);
+  const rows = await runner(`WITH ${sideCte(set.apps)}
     SELECT d.name AS owner, o.oid IS NOT NULL AS present,
-      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via
+      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via,
+      ${ownerReachColumns(set.apps, 'o.oid')}
     FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name`);
-  const byOwner = new Map(rows.map(row => [String(row.owner), { present: truthy(row.present), via: textList(row.via) }]));
-  const findings = judged.flatMap((t) => {
+  const byOwner = new Map(rows.map(row => [String(row.owner),
+    { present: truthy(row.present), via: textList(row.via), actsAs: textList(row.acts_as), appReach: textList(row.app_reach) }]));
+  const findings = [...set.findings, ...judged.flatMap((t) => {
     const owner = byOwner.get(t.owner);
     if (!owner?.present) {
       return [`trigger ${t.trigger} on ${t.table} would run ${t.fn.identity}, owned by ${t.owner}, which does not exist. `
         + `Fix: create ${t.owner} as a role no application role can act as, or declare an existing such role as ${t.fn.identity}'s owner in db/models.`];
     }
     if (owner.via.length === 0) return [];
-    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via }, true)];
-  });
+    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via,
+      cause: ownerCause(set, t.owner, owner.actsAs, owner.appReach) }, true)];
+  })];
   if (findings.length === 0) return null;
   return `${options.stateApplied ? 'tables and columns applied; ' : ''}derived layer NOT applied: ${countFindings(findings.length)}; `
     + `fix each, then re-run:\n${findingLines(findings)}`;
@@ -515,14 +717,18 @@ export async function lifecycleDeclaredOwnerRefusal(
  * It reads on `session`, the reconcile's own connection: on a stage, db:session (the operator
  * connection). db:query may read a replica the reconcile's commit has not reached yet, and pass.
  */
-export async function lifecyclePostApplyRefusal(session: SessionRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
+export async function lifecyclePostApplyRefusal(
+  session: SessionRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+): Promise<string | null> {
   if (!models.some(model => model.lifecycle === true)) return null;
   const read: QueryRunner = async (q) => {
     const [slot] = await session([q]);
     if (isSessionError(slot)) throw new Error(slot.message);
     return slot ?? [];
   };
-  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models));
+  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models, roles));
   if (findings.length === 0) return null;
   return `${countFindings(findings.length)} after reconcile; the objects are live; the next apply refuses until fixed:\n${findingLines(findings)}`;
 }
@@ -536,6 +742,20 @@ export const LIFECYCLE_MANIFEST_ABSENT_REFUSAL = (functions: readonly string[]):
   + `function${functions.length === 1 ? '' : 's'} ${functions.join(', ')} carr${functions.length === 1 ? 'ies' : 'y'} no manifest, so the declared dependents `
   + 'cannot be read and the lifecycle catalog check cannot run. Compile the declared layer from the models with this CLI and re-run.';
 
+/**
+ * The role declaration is optional on the wire: absent, the check runs as before (every grantee
+ * counts). Present but not a list of role names, the check cannot tell what was declared: fail closed.
+ */
+export const LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL = (field: 'request roles' | 'declared owners'): string => `this db:reconcile payload `
+  + `carries ${field} that are not a list of role names, so the lifecycle catalog check cannot run. `
+  + 'Compile the declared layer from the models with this CLI and re-run.';
+
+/** An empty list treats no role as a request role, so no request role could reach a declared owner. */
+export const LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL = 'this db:reconcile payload declares an empty list of request roles, so every declared owner '
+  + 'would pass the request-role guard. defineModule refuses that list; compile the declared layer from the models with this CLI and re-run.';
+
+const isRoleList = (value: unknown): value is string[] => Array.isArray(value) && value.every(role => typeof role === 'string');
+
 /** Generated by an older CLI (0.4.101's per-row restrict pair); a payload may still carry one it is replacing. */
 const RETIRED_LIFECYCLE_ROLES = ['restrict'] as const;
 
@@ -570,13 +790,15 @@ export function lifecycleTablesFromDeclared(declared: readonly SourceObject[]):
 /**
  * db:reconcile's lifecycle gate, local and in the ops Lambda alike: the destroy_log shape, the
  * declared layer's own consistency, the application roles' presence (fail closed), then the
- * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles` is `unknown`
- * because the ops Lambda reads it off the wire.
+ * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles`, `requestRoles`
+ * and `declaredOwners` are `unknown` because the ops Lambda reads them off the wire. The last two are
+ * optional: an older CLI sends neither, and the check runs as before. An older server ignores them:
+ * it refuses more, and it skips the live checks on the request roles (see ReconcileWirePayload).
  */
 export async function lifecycleReconcileRefusal(
   runner: QueryRunner,
   declared: readonly SourceObject[],
-  options: { applicationRoles?: unknown; lifecycleRole?: string } = {},
+  options: { applicationRoles?: unknown; requestRoles?: unknown; declaredOwners?: unknown; lifecycleRole?: string } = {},
 ): Promise<string | null> {
   if (!declared.some(object => object.owner === LIFECYCLE_OWNER_ROLE)) return null;
   const [log] = await runner(LIFECYCLE_LOG_SQL);
@@ -586,11 +808,16 @@ export async function lifecycleReconcileRefusal(
   if ('refusal' in derived) return derived.refusal;
   const roles = options.applicationRoles;
   if (!Array.isArray(roles) || roles.some(role => typeof role !== 'string')) return LIFECYCLE_ROLES_ABSENT_REFUSAL;
+  const { requestRoles, declaredOwners } = options;
+  if (requestRoles != null && !isRoleList(requestRoles)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('request roles');
+  if (declaredOwners != null && !isRoleList(declaredOwners)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('declared owners');
+  if (Array.isArray(requestRoles) && requestRoles.length === 0) return LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL;
   const unreadable = declared.filter(object => object.owner === LIFECYCLE_OWNER_ROLE && object.name.endsWith('_lifecycle_transition')
     && !lifecycleManifestOf(object)).map(object => object.identity).sort();
   if (unreadable.length > 0) return LIFECYCLE_MANIFEST_ABSENT_REFUSAL(unreadable);
   return lifecycleCatalogRefusal(runner, { lifecycleTables: derived.tables, applicationRoles: roles, dependentKeys: dependentKeysFromDeclared(declared),
-    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared) },
+    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared),
+    ...(requestRoles == null ? {} : { requestRoles, declaredOwners: isRoleList(declaredOwners) ? declaredOwners : [] }) },
     { lifecycleRole: options.lifecycleRole });
 }