@everystack/cli 0.4.106 → 0.4.107

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.107] - 2026-10-31
+
+### Added
+
+- db:plan names db:provision first when a lifecycle plan needs it
+- db:apply prints a wall time per phase
+- a type change under a declared view or matview mints and applies
+
+### Fixed
+
+- the lifecycle preflight accepts the grants the reviewed plan revokes
+- a re-created view's apply errors name it as a view
+- a grant the plan's REVOKE cannot remove stays a lifecycle finding
+- a destroy_log grant from another role names db:provision's REVOKE
+
 ## [0.4.106] - 2026-10-31
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.106",
+  "version": "0.4.107",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/alter-type-dependents.ts

@@ -13,6 +13,16 @@
  */
 
 import type { QueryRunner } from './authz-contract';
+import type { SessionRunner } from './session';
+import type { SourceObject } from './derived-source';
+import type { StateDependent } from './edge-plan';
+import { introspectDerived } from './derived-introspect';
+import { planReconcile } from './derived-plan';
+import {
+  builderOwnerMode, derivedSearchPath, ownerPreflightRefusal, ownerPreflightSql, ownerRequirements,
+  renderEnsureObjectSchemas, renderReconcileSql, type OwnerApplyMode,
+} from './derived-apply';
+import { quoteIdent, quoteQualified } from './pg-ident';
 
 export interface AlterTypeTarget {
   table: string;
@@ -94,3 +104,192 @@ export function renderAlterTypeRefusal(blocked: readonly BlockedAlterType[]): st
     `Route the type change through db:swap (rebuild + atomic rename), or drop and re-create the dependent derived objects around it (db:reconcile) — deliberately, not as an apply-time surprise.`,
   ].join('\n');
 }
+
+// ---------------------------------------------------------------------------
+// Declared dependents: dropped and re-created inside the state transaction.
+// ---------------------------------------------------------------------------
+
+/**
+ * Every view, matview or rule the targets' type changes force out: the ones that bind a target
+ * column, and, transitively, every view or matview whose rule reads one of those (a view on a
+ * view). PostgreSQL cannot drop the first without the second.
+ */
+export function dependentClosureSql(targets: readonly AlterTypeTarget[]): string {
+  const direct = targets.map((t) => {
+    const rel = quoteLiteral(t.table);
+    return `(d.refobjid = ${rel}::regclass AND d.refobjsubid = (SELECT attnum FROM pg_catalog.pg_attribute
+      WHERE attrelid = ${rel}::regclass AND attname = ${quoteLiteral(t.column)}))`;
+  }).join(' OR ');
+  return `WITH RECURSIVE closure(oid) AS (
+  SELECT r.ev_class FROM pg_catalog.pg_depend d JOIN pg_catalog.pg_rewrite r ON r.oid = d.objid
+   WHERE d.classid = 'pg_catalog.pg_rewrite'::regclass AND d.refclassid = 'pg_catalog.pg_class'::regclass
+     AND r.ev_class <> d.refobjid AND (${direct})
+  UNION
+  SELECT r.ev_class FROM closure c JOIN pg_catalog.pg_depend d ON d.refobjid = c.oid
+     AND d.refclassid = 'pg_catalog.pg_class'::regclass AND d.classid = 'pg_catalog.pg_rewrite'::regclass
+    JOIN pg_catalog.pg_rewrite r ON r.oid = d.objid
+   WHERE r.ev_class <> c.oid
+)
+SELECT DISTINCT cl.oid::bigint AS oid,
+  CASE cl.relkind WHEN 'v' THEN 'view' WHEN 'm' THEN 'materialized view' ELSE 'rule' END AS kind,
+  n.nspname::text || '.' || cl.relname::text AS identity,
+  pg_catalog.pg_total_relation_size(cl.oid)::bigint AS bytes
+FROM closure JOIN pg_catalog.pg_class cl ON cl.oid = closure.oid JOIN pg_catalog.pg_namespace n ON n.oid = cl.relnamespace
+ORDER BY 3`;
+}
+
+/**
+ * What else depends on the closure, which a plain DROP would refuse over (a function returning
+ * the view's row type) or remove silently (a trigger on a view). The closure's own rules and
+ * members are not counted: they are dropped and re-created with it.
+ */
+export function closureBlockersSql(oids: readonly number[]): string {
+  const list = `ARRAY[${oids.map((oid) => String(Math.trunc(oid))).join(', ')}]::oid[]`;
+  return `SELECT DISTINCT pg_catalog.pg_describe_object(d.classid, d.objid, d.objsubid) AS what,
+  pg_catalog.pg_describe_object(d.refclassid, d.refobjid, 0) AS on_what
+FROM pg_catalog.pg_depend d
+WHERE ((d.refclassid = 'pg_catalog.pg_class'::regclass AND d.refobjid = ANY(${list}))
+    OR (d.refclassid = 'pg_catalog.pg_type'::regclass AND d.refobjid IN (SELECT reltype FROM pg_catalog.pg_class WHERE oid = ANY(${list}))))
+  AND ((d.deptype = 'n'
+        AND NOT (d.classid = 'pg_catalog.pg_rewrite'::regclass AND (SELECT ev_class FROM pg_catalog.pg_rewrite WHERE oid = d.objid) = ANY(${list}))
+        AND NOT (d.classid = 'pg_catalog.pg_class'::regclass AND d.objid = ANY(${list})))
+    OR d.classid = 'pg_catalog.pg_trigger'::regclass)
+ORDER BY 1`;
+}
+
+/** `1.2 MB`, for the plan's matview line. */
+export function formatBytes(bytes: number): string {
+  const units = ['B', 'kB', 'MB', 'GB', 'TB'];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) { value /= 1024; unit += 1; }
+  return `${unit === 0 ? value : value.toFixed(1)} ${units[unit]}`;
+}
+
+/** The plan's line for one dependent. */
+export function renderStateDependentLine(d: Pick<StateDependent, 'identity' | 'kind' | 'bytes'>): string {
+  const cost = d.kind === 'materialized view' ? ` (repopulates ${formatBytes(d.bytes ?? 0)})` : '';
+  return `~ ${d.kind} ${d.identity}: dropped before the type change and re-created from the checkout in the same transaction${cost}`;
+}
+
+export type StateDependentsMint = { dependents: StateDependent[] } | { refusal: string };
+
+/**
+ * The declared views and matviews the targets' type changes force out, rendered for the state
+ * transaction, or a refusal naming what the platform cannot re-create:
+ *
+ *   - a dependent the models do not declare (nothing can re-create it from the checkout):
+ *     declare it in the models, which db:pull renders;
+ *   - a declared one whose live definition the reconciler cannot vouch for (drift, or never
+ *     reconciled): db:reconcile has the verb for each;
+ *   - something else depending on the closure (a function over a view's row type, a trigger on a
+ *     view), which a plain DROP would refuse over or silently remove.
+ *
+ * Read-only. Each create is the SQL a derived apply renders for that object.
+ */
+export async function mintStateDependents(
+  runner: QueryRunner,
+  session: SessionRunner,
+  targets: readonly AlterTypeTarget[],
+  declared: readonly SourceObject[],
+): Promise<StateDependentsMint> {
+  if (targets.length === 0) return { dependents: [] };
+  const rows = await runner(dependentClosureSql(targets));
+  if (rows.length === 0) return { dependents: [] };
+  const byIdentity = new Map(declared.map((o) => [o.identity, o]));
+  const where = targets.map((t) => `${t.table}."${t.column}"`).join(', ');
+  const undeclared = rows.filter((r: any) => r.kind === 'rule' || byIdentity.get(String(r.identity))?.kind !== r.kind);
+  if (undeclared.length > 0) {
+    return {
+      refusal: `This plan changes the type of ${where}, and PostgreSQL refuses that while a view or rule binds the column. `
+        + 'db:apply drops and re-creates the declared ones in the same transaction, but these are not declared, so nothing can re-create them:\n'
+        + undeclared.map((r: any) => `  ${r.kind} ${r.identity} is not declared`).join('\n')
+        + '\nFix: declare it in the models (db:pull renders it), then re-run db:plan.',
+    };
+  }
+  const blockers = await runner(closureBlockersSql(rows.map((r: any) => Number(r.oid))));
+  if (blockers.length > 0) {
+    return {
+      refusal: `This plan changes the type of ${where}. db:apply would drop and re-create ${rows.map((r: any) => `${r.kind} ${r.identity}`).join(', ')} around it, `
+        + 'but other objects depend on them, and a plain DROP would refuse over them or remove them:\n'
+        + blockers.map((b: any) => `  ${b.what} depends on ${b.on_what}`).join('\n')
+        + '\nRoute this type change through db:swap, or change the models so nothing else depends on these views first.',
+    };
+  }
+
+  // Creation order is the declared layer's dependency order; the drops run in reverse.
+  const order = new Map(declared.map((o, i) => [o.identity, i]));
+  const closure = rows
+    .map((r: any) => ({ identity: String(r.identity), kind: r.kind as StateDependent['kind'], bytes: Number(r.bytes) }))
+    .sort((a, b) => order.get(a.identity)! - order.get(b.identity)!);
+  const ids = new Set(closure.map((c) => c.identity));
+
+  const live = await introspectDerived(session);
+  const parsed = { objects: [...declared], warnings: [] as string[] };
+  // The reconciler's own verdict first: a hand-edited or never-reconciled view is not ours to
+  // re-create silently, and db:reconcile already has the verb for each.
+  const verdict = planReconcile(parsed, live, { only: [...ids] });
+  const drifted = verdict.drift.filter((d) => ids.has(d.identity)).map((d) => d.identity);
+  const unbaselined = verdict.needsBaseline.filter((id) => ids.has(id));
+  if (drifted.length + unbaselined.length > 0) {
+    return {
+      refusal: `This plan changes the type of ${where}, which db:apply handles by re-creating the declared views and matviews that bind it, `
+        + 'but the reconciler cannot vouch for some of them:\n'
+        + [...drifted.map((id) => `  ${id} differs from its record (hand-edited). Fix: db:reconcile --apply --overwrite-drift, or declare the live definition.`),
+          ...unbaselined.map((id) => `  ${id} was never reconciled. Fix: db:reconcile --baseline once you have verified it matches the models.`)].join('\n')
+        + '\nThen re-run db:plan.',
+    };
+  }
+
+  const liveById = new Map(live.objects.map((o) => [o.identity, o]));
+  // Rendered as the creates a derived apply would run against the catalog as it is after the
+  // drops: the closure absent.
+  const absent = {
+    ...live,
+    objects: live.objects.filter((o) => !ids.has(o.identity)),
+    edges: live.edges.filter((e) => !ids.has(e.dependent) && !ids.has(e.referenced)),
+  };
+  const combined = planReconcile(parsed, absent, { only: [...ids] });
+  const requirements = ownerRequirements(combined, parsed.objects);
+  let ownerMode: OwnerApplyMode = 'set-role';
+  if (requirements.length > 0) {
+    const preflight = await runner(ownerPreflightSql(requirements));
+    const refusal = ownerPreflightRefusal(preflight as any[]);
+    if (refusal) return { refusal: `could not plan the re-create of the views a type change binds: ${refusal}` };
+    ownerMode = builderOwnerMode(preflight as any[]);
+  }
+  const schemas = derivedSearchPath([...declared]);
+  const searchPath = schemas.length === 1 && schemas[0] === 'public' ? null : schemas.map(quoteIdent).join(', ');
+
+  return {
+    dependents: closure.map((c) => {
+      const source = byIdentity.get(c.identity)!;
+      const rendered = renderReconcileSql(planReconcile(parsed, absent, { only: [c.identity] }), parsed.objects, ownerMode);
+      if (rendered.record.length !== 1 || rendered.record[0] !== c.identity) {
+        throw new Error(`could not render the re-create of ${c.identity}: the target changed while minting; re-run db:plan.`);
+      }
+      const drop = `DROP ${c.kind === 'view' ? 'VIEW' : 'MATERIALIZED VIEW'} ${quoteQualified(c.identity)}`;
+      const owner = ownerMode === 'set-role' ? source.owner : undefined;
+      return {
+        identity: c.identity,
+        kind: c.kind,
+        expectedDefHash: liveById.get(c.identity)!.defHash,
+        dropSql: owner ? [`SET ROLE ${owner}`, drop, 'RESET ROLE'].join('\n;\n') : drop,
+        sql: [...renderEnsureObjectSchemas([source]), ...rendered.statements].join('\n;\n'),
+        searchPath,
+        grantContract: {
+          attachments: source.attachments.filter((a) => a.kind === 'grant'),
+          ...(source.owner ? { owner: source.owner } : {}),
+          ownerMode,
+        },
+        provenance: {
+          srcHash: source.hash,
+          ...(source.bodyHash ? { bodyHash: source.bodyHash } : {}),
+          kind: c.kind,
+          ...(source.drop ? { dropSql: source.drop } : {}),
+        },
+        ...(c.kind === 'materialized view' ? { bytes: c.bytes } : {}),
+      };
+    }),
+  };
+}

package/src/cli/apply-execute.ts

@@ -189,6 +189,12 @@ export interface ApplyPlanResult {
   liveFingerprint: string;
   reason?: string;
   logId?: number;
+  /**
+   * Wall time, in ms, of the two phases this function runs, on the statuses that reached the
+   * state transaction: everything before it (the lock, the gates, descent; `verifyMs`), and the
+   * transaction plus the landed-fingerprint read (`stateMs`). Optional on the wire.
+   */
+  phases?: { verifyMs: number; stateMs: number };
   /**
    * The keys the row check found orphans on, if any — data, for the caller's advisory (see
    * fk-orphan-advisory). Present on the paths that got as far as running the check, empty
@@ -465,6 +471,7 @@ export async function executeApplyPlan(
   plan: EdgePlan,
   options: ApplyPlanOptions = {},
 ): Promise<ApplyPlanResult> {
+  const started = Date.now();
   const { hash: live, snapshot: before, contract: beforeAuthz, ledger, ledgerRead } = await liveBaseAndLedger(session);
 
   // The endpoint is FULL (it carries the ungoverned live authz through), so it is compared against
@@ -596,16 +603,23 @@ export async function executeApplyPlan(
   // rewritten — the plan is an artifact under a content hash, and `planHash(plan)` below has to
   // keep naming the file the operator reviewed.
   const { statements: toRun, withheld } = withheldValidations(plan.statements, orphans);
+  if (options.stateOnly && plan.stateDependents?.length) {
+    const reason = `this plan re-creates ${plan.stateDependents.map((d) => `${d.kind} ${d.identity}`).join(', ')} around a column type change, but --state-only skips derived writes. Apply the reviewed plan without --state-only.`;
+    await recordRefusal(runner, plan, live, 'state dependents', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
   if (options.stateOnly && plan.statePrerequisites?.length) {
     const reason = 'this plan needs state prerequisites, but --state-only skips function writes. Apply the reviewed plan without --state-only, or satisfy the prerequisites and re-mint.';
     await recordRefusal(runner, plan, live, 'state prerequisites', reason, options);
     return { status: 'refused', liveFingerprint: live, reason };
   }
 
+  const stateStarted = Date.now();
   let result: StateApplyResult;
   try {
     result = await applyGeneratedStatements(runner, toRun, {
       statePrerequisites: plan.statePrerequisites,
+      stateDependents: plan.stateDependents,
       transaction: options.transaction,
       ...(withheld.length > 0 ? { skippedValidations: withheld } : {}),
       actor: options.actor,
@@ -630,6 +644,7 @@ export async function executeApplyPlan(
   }
 
   const { hash: landed } = await liveBaseFingerprint(session);
+  const phases = { verifyMs: stateStarted - started, stateMs: Date.now() - stateStarted };
   if (result.logId !== undefined) {
     // The log stamps the RAW landed hash — the same flavor as `from` AND as the full `to`, so the
     // schema_log chain reads as one consistent series of live states.
@@ -645,6 +660,7 @@ export async function executeApplyPlan(
     return {
       status: 'validation-pending',
       liveFingerprint: landed,
+      phases,
       // The next move follows the CAUSE: bad rows are a data fix, a check that was cut off by a
       // clock is a lane change. See validationPendingReason.
       reason: validationPendingReason(result.pendingValidations),
@@ -660,6 +676,7 @@ export async function executeApplyPlan(
     return {
       status: 'verify-failed',
       liveFingerprint: landed,
+      phases,
       reason: `applied, but the target landed on ${landed.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
       ...(result.logId !== undefined ? { logId: result.logId } : {}),
       fkOrphans: orphans,
@@ -668,6 +685,7 @@ export async function executeApplyPlan(
   return {
     status: 'applied',
     liveFingerprint: landed,
+    phases,
     ...(result.logId !== undefined ? { logId: result.logId } : {}),
     fkOrphans: orphans,
   };

package/src/cli/commands/db-apply.ts

@@ -238,6 +238,30 @@ export function catchUpRerunCommand(flags: Record<string, string>): string {
   return parts.join(' ');
 }
 
+/** Wall time, in ms, of each db:apply phase that ran. */
+export interface ApplyPhaseTimings {
+  verify?: number;
+  state?: number;
+  derived?: number;
+  postChecks?: number;
+}
+
+/**
+ * One line: the wall time of each phase that ran, in order, or null when none did. Printed beside
+ * the receipt, never inside it, so the receipt's contract is unchanged.
+ */
+export function renderPhaseTimings(phases: ApplyPhaseTimings): string | null {
+  const named: Array<[string, number | undefined]> = [
+    ['descent and fingerprint verify', phases.verify],
+    ['state transaction', phases.state],
+    ['derived catch-up', phases.derived],
+    ['post-checks', phases.postChecks],
+  ];
+  const ran = named.filter((entry): entry is [string, number] => entry[1] !== undefined);
+  if (ran.length === 0) return null;
+  return `phases: ${ran.map(([name, ms]) => `${name} ${(ms / 1000).toFixed(2)}s`).join(', ')}`;
+}
+
 /** What the catch-up did, or what to say about the fact that it did not. */
 type CatchUpReport = { ok: true; statements: string[] } | { ok: false; lines: string[] };
 
@@ -261,10 +285,12 @@ async function runCatchUp(
   applied: number,
   onRefusal: 'exit' | 'throw',
   declared?: Awaited<ReturnType<typeof loadDeclaredDerived>>,
+  phases?: ApplyPhaseTimings,
 ): Promise<CatchUpReport> {
   const verbose = flags.verbose === 'true';
   try {
     const outcome = await catchUpDerived(venue, {
+      ...(phases ? { onPhase: (phase: 'derived' | 'post-checks', ms: number) => { phases[phase === 'derived' ? 'derived' : 'postChecks'] = ms; } } : {}),
       ...(declared !== undefined ? { declared } : {}),
       ...(flags.models ? { models: flags.models } : {}),
       onStart: () => step('Catching the functions, views and triggers up to the checkout...'),
@@ -336,6 +362,7 @@ async function catchUpAfterApply(
   venue: CatchUpVenue,
   flags: Record<string, string>,
   declared?: Awaited<ReturnType<typeof loadDeclaredDerived>>,
+  phases?: ApplyPhaseTimings,
 ): Promise<CatchUpReport> {
   if (!LANDED.has(result.status)) return { ok: true, statements: [] };
   if (flags['state-only'] === 'true') return { ok: true, statements: [] };
@@ -345,7 +372,7 @@ async function catchUpAfterApply(
   const applied = result.status === 'already-applied'
     ? 0
     : classifyGeneratedStatements((plan.statements ?? []).filter((s) => !unapplied.has(s))).executable.length;
-  return runCatchUp(venue, flags, applied, 'throw', declared);
+  return runCatchUp(venue, flags, applied, 'throw', declared, phases);
 }
 
 /**
@@ -521,7 +548,9 @@ async function applyPlanViaStage(
   const declared = await loadDeclaredDerived(flags.models);
   const unclassified = unclassifiedGranteesWarning(declared?.models ?? [], lifecycleRolesOf(declared));
   if (unclassified) warn(unclassified);
-  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [], lifecycleRolesOf(declared))
+  // The plan's own REVOKEs resolve the grant findings they remove: the state transaction runs them
+  // before the catch-up creates any lifecycle function, and the post-check reads the catalog after.
+  const lifecycleRefusal = await lifecycleApplyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? [], lifecycleRolesOf(declared), plan.statements)
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(lambdaQueryRunner(region, fn), declared?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -537,6 +566,10 @@ async function applyPlanViaStage(
   // answered by two containers at two moments. Read the stage twice and refuse a
   // disagreement — the apply never starts. Deliberately OUTSIDE the try below: this
   // refusal must exit as itself, not as "Apply failed".
+  // Wall times as this CLI sees them: the reads, descent and authority before the write; the write
+  // invoke (the ops Lambda's own lock, gates and transaction); then the catch-up's two halves.
+  const phases: ApplyPhaseTimings = {};
+  const verifyStarted = Date.now();
   step('Reading the stage TWICE (state and authz are separate ops-Lambda invokes)...');
   const readSession = lambdaSessionRunner(region, fn);
   const readPair = await readStageStateTwice(readSession).catch((err: any) => {
@@ -628,6 +661,8 @@ async function applyPlanViaStage(
     }
 
     step('Applying in the ops Lambda (credential-free — the operator never holds a database URL)...');
+    const stateStarted = Date.now();
+    phases.verify = stateStarted - verifyStarted;
     const result: any = await invokeAction(region, fn, 'db:apply', {
       plan,
       // q1-contract-version direction A: the server refuses on exact mismatch, so a payload-key or
@@ -643,6 +678,7 @@ async function applyPlanViaStage(
       ...(flags['snapshot-ref'] ? { snapshotRef: flags['snapshot-ref'] } : {}),
       stage: flags.stage,
     });
+    phases.state = Date.now() - stateStarted;
     if (result?.error) {
       fail(`Apply failed: ${result.error}`);
       process.exit(1);
@@ -670,8 +706,10 @@ async function applyPlanViaStage(
   }
 
   // Then the functions, views and triggers — on the same stage, credential-free, always.
-  const catchUp = await catchUpAfterApply(landedResult!, plan, { kind: 'stage', stage: flags.stage }, flags, declared);
+  const catchUp = await catchUpAfterApply(landedResult!, plan, { kind: 'stage', stage: flags.stage }, flags, declared, phases);
   exitOnCatchUpFailure(catchUp);
+  const timings = LANDED.has(landedResult!.status) ? renderPhaseTimings(phases) : null;
+  if (timings) info(timings);
   const declaredGrantees = await declaredGranteesForReceipt(plan, flags);
   const advisoryModels = await modelsForAdvisory(landedResult!, flags);
   reportApplyResult(landedResult!, plan, {
@@ -960,7 +998,8 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   // Read-only, before the rollback point: a refused apply must not first take a snapshot, backup or dump.
   const unclassified = unclassifiedGranteesWarning((await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
   if (unclassified) warn(unclassified);
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()))
+  // As on the stage lane: a finding this plan's own REVOKE removes is not a refusal.
+  const lifecycleRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()), plan.statements)
     ?? (flags['state-only'] === 'true' ? await lifecycleStateOnlyRefusal(runner, (await declaredDb())?.models ?? []) : null);
   if (lifecycleRefusal) {
     fail(lifecycleRefusal);
@@ -1087,6 +1126,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
 
   let landed: ApplyPlanResult | undefined;
   let catchUp: CatchUpReport = { ok: true, statements: [] };
+  const phases: ApplyPhaseTimings = {};
   try {
     // The edge as hashes — internal bookkeeping, not what a reader came for. Verbose only.
   if (flags.verbose === 'true') info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
@@ -1117,7 +1157,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
       { verb: 'db:apply', actor: process.env.USER ?? 'unknown' },
       async () => {
         // Re-checked under the lease, where the writes happen.
-        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()));
+        const leasedRefusal = await lifecycleApplyRefusal(runner, (await declaredDb())?.models ?? [], lifecycleRolesOf(await declaredDb()), plan.statements);
         if (leasedRefusal) {
           fail(leasedRefusal);
           process.exit(1);
@@ -1179,7 +1219,8 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
         // they read, and no second operator can slip in between the two halves. Its failure
         // is carried out as a report, never thrown: the plan landed, and "rolled back" would
         // be a lie.
-        const report = await catchUpAfterApply(result, plan, { kind: 'direct', runner, session }, flags);
+        if (result.phases) Object.assign(phases, { verify: result.phases.verifyMs, state: result.phases.stateMs });
+        const report = await catchUpAfterApply(result, plan, { kind: 'direct', runner, session }, flags, undefined, phases);
         return { result, catchUp: report };
       },
     );
@@ -1199,6 +1240,8 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
   }
 
   exitOnCatchUpFailure(catchUp);
+  const timings = LANDED.has(landed!.status) ? renderPhaseTimings(phases) : null;
+  if (timings) info(timings);
   const declaredGrantees = await declaredGranteesForReceipt(plan, flags);
   const advisoryModels = await modelsForAdvisory(landed!, flags);
   reportApplyResult(landed!, plan, {

package/src/cli/commands/db-plan.ts

@@ -63,7 +63,7 @@ import { resolveModelsPath } from '../models-path';
 import { resolveConfig, opsFunction } from '../config';
 import { resolveOperatorUrlViaStage } from '../direct-venue';
 import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
-import { lifecycleApplyRefusal, lifecycleRolesOf, unclassifiedGranteesWarning } from '../lifecycle-preflight';
+import { lifecycleApplyReport, lifecycleProvisionFirst, lifecycleRolesOf, unclassifiedGranteesWarning } from '../lifecycle-preflight';
 import { loadModels } from './db-generate';
 import { loadDeclaredDerived, type DeclaredDerived } from '../declared-derived';
 import { introspectDerived } from '../derived-introspect';
@@ -71,7 +71,7 @@ import { planReconcile, type ReconcilePlan } from '../derived-plan';
 import { checkFails, buildReconcileReport } from './db-reconcile';
 import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
 import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
-import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents';
+import { alterTypeStatementTargets, mintStateDependents, renderStateDependentLine } from '../alter-type-dependents';
 import { compileTableContract } from '../authz-compile';
 import { reportPipelineLastRun } from './pipeline-run';
 import { renderPlanReport } from '../plain-output';
@@ -241,11 +241,13 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
     // The modules' role declaration, as db:apply reads it. A barrel that does not compose leaves it
     // undeclared here (the check as before); the paths that need the derived layer report the error.
     const lifecycleRoles = lifecycleRolesOf(await loadDeclaredDerived(flags.models).catch(() => null));
-    const lifecycleNote = await lifecycleApplyRefusal(runner, models, lifecycleRoles);
+    // First, before anything else is said: what db:provision must create or fix. Nothing below
+    // can apply until it has run, and the fix is a verb, not SQL.
+    const provisionFirst = await lifecycleProvisionFirst(runner, models,
+      flags.stage ? `everystack db:provision --stage ${flags.stage}` : 'everystack db:provision --database-url <this database>');
+    if (provisionFirst) warn(provisionFirst);
     const unclassified = unclassifiedGranteesWarning(models, lifecycleRoles);
     if (unclassified) warn(unclassified);
-    // db:plan only reads, so it mints the plan anyway; db:apply runs the same check and refuses.
-    if (lifecycleNote) warn(`db:apply will refuse this plan until each lifecycle finding below is fixed.\n${lifecycleNote}`);
     let snapshot: SchemaSnapshot;
     let contract: AuthzContract;
     if (dbSource.kind === 'url') {
@@ -318,22 +320,34 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
       process.exit(1);
     }
 
+    // The lifecycle catalog check db:apply runs, over THIS plan: a finding the plan's own REVOKE
+    // removes is listed as resolved; the rest will block the apply. db:plan only reads, so it
+    // mints the plan anyway. Read after the mint because the plan is half of the answer.
+    const lifecycle = await lifecycleApplyReport(runner, models, lifecycleRoles, plan.statements);
+    if (lifecycle.resolved) info(lifecycle.resolved);
+    if (lifecycle.refusal) warn(`db:apply will refuse this plan until each lifecycle finding below is fixed.\n${lifecycle.refusal}`);
+
     // The edge is pure, but this decision belongs to mint: only this command holds both the
     // checkout's declared functions and the live catalog. Embedding the exact missing CREATEs
     // lets every apply lane enact the reviewed answer without reading source again.
     plan.statePrerequisites = await mintStatePrerequisites(runner, session, plan.statements, declaredDerived?.objects ?? []);
 
-    // The plan lane's contract: what it mints, it can apply. A SET DATA TYPE on a
-    // column a view/matview/rule binds would fail MID-TRANSACTION at apply
-    // ("cannot alter type of a column used by a view or rule") — refuse at mint,
-    // with the dependents named, while there is still a live catalog to ask.
+    // The plan lane's contract: what it mints, it can apply. A SET DATA TYPE on a column a view
+    // or matview binds fails at apply ("cannot alter type of a column used by a view or rule").
+    // The declared ones ride on the plan: the state transaction drops them, changes the type and
+    // re-creates them from this checkout before COMMIT. Anything the platform cannot re-create
+    // refuses here, by name, while there is still a live catalog to ask.
     const alterTargets = alterTypeStatementTargets(plan.statements);
     if (alterTargets.length > 0) {
-      const blockedAlters = await findAlterTypeDependents(runner, alterTargets);
-      if (blockedAlters.length > 0) {
-        fail(`Mint refused: ${renderAlterTypeRefusal(blockedAlters)}`);
+      const dependents = await mintStateDependents(runner, session, alterTargets, declaredDerived?.objects ?? []);
+      if ('refusal' in dependents) {
+        fail(`Mint refused: ${dependents.refusal}`);
         process.exit(1);
       }
+      if (dependents.dependents.length > 0) {
+        plan.stateDependents = dependents.dependents;
+        for (const dependent of dependents.dependents) info(renderStateDependentLine(dependent));
+      }
     }
 
     // The class rides on the ARTIFACT, not only the terminal — a reviewer reading

package/src/cli/commands/db-sync.ts

@@ -31,7 +31,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type QueryRunner } from '../authz-contract';
-import { catalogInputsFromModels, lifecycleApplyRefusal, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecycleRolesOf, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
+import { catalogInputsFromModels, lifecycleApplyReport, lifecycleDeclaredOwnerRefusal, LifecycleFindingsError, lifecycleRolesOf, type LifecycleRoleDeclaration } from '../lifecycle-preflight';
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import { generateMigrationSql, unmodeledTables } from '../migration-generate';
@@ -98,6 +98,8 @@ export interface SyncHooks {
   onStatePlan?: (statements: string[], classified: ClassifiedStatements, pass: number) => void;
   /** Fires after the state layer applied and verified, before the compute reconcile. */
   onStateDone?: (state: StateSyncOutcome) => void;
+  /** Fires before anything executes when the state diff's own REVOKEs resolve lifecycle findings (one line). */
+  onLifecycleResolved?: (line: string) => void;
 }
 
 export interface SyncRun {
@@ -140,6 +142,7 @@ async function syncOnce(
   options: SyncOptions,
   hooks: SyncHooks,
   pass: number,
+  preflight?: (statements: readonly string[]) => Promise<void>,
 ): Promise<SyncRun> {
   const current = await introspectSchema(session);
   const liveAuthz = await introspectContract(session, contractFunctionRow, FUNCTIONS_SQL);
@@ -147,6 +150,8 @@ async function syncOnce(
     allowDrops: options.allowDrops, liveAuthz, sequences: options.sequences,
     governedRoles: options.governedRoles, extensions: options.extensions,
   });
+  // Read-only, before anything is written: it needs the statements this pass will run.
+  await preflight?.(statements);
   const classified = classifyGeneratedStatements(statements);
   hooks.onStatePlan?.(statements, classified, pass);
   // A held drop of a key into a lifecycle table leaves a key the after-state catalog check refuses,
@@ -244,13 +249,18 @@ export async function executeSync(
   hooks: SyncHooks = {},
 ): Promise<SyncRun> {
   // State runs before compute, so without this a lifecycle table would land with no transition trigger.
-  const lifecycleRefusal = await lifecycleApplyRefusal(runner, models, options.lifecycleRoles);
-  if (lifecycleRefusal) throw new Error(lifecycleRefusal);
-  // Before anything is written, so before both places a pass creates derived objects (the
-  // functions the state batch calls, then the reconcile).
-  const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
-  if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
-  const first = await syncOnce(runner, session, models, options, hooks, 1);
+  // It reads the first pass's statements: a finding their own REVOKE removes is resolved, not refused
+  // (the state batch runs before the reconcile creates any lifecycle function, which re-checks).
+  const preflight = async (statements: readonly string[]): Promise<void> => {
+    const lifecycle = await lifecycleApplyReport(runner, models, options.lifecycleRoles, statements);
+    if (lifecycle.refusal) throw new Error(lifecycle.refusal);
+    if (lifecycle.resolved) hooks.onLifecycleResolved?.(lifecycle.resolved);
+    // Before anything is written, so before both places a pass creates derived objects (the
+    // functions the state batch calls, then the reconcile).
+    const ownerRefusal = await lifecycleDeclaredOwnerRefusal(runner, session, options.declared ?? [], models, { stateApplied: false, roles: options.lifecycleRoles });
+    if (ownerRefusal) throw new LifecycleFindingsError(ownerRefusal);
+  };
+  const first = await syncOnce(runner, session, models, options, hooks, 1, preflight);
   // The trigger is the STATE bar, not the combined verdict. The cause above is state-layer
   // only, so a compute refusal or an unadopted object cannot be settled by looking again —
   // retrying on those would make every brownfield sync pay a second full read (and print its
@@ -487,6 +497,7 @@ export async function dbSyncCommand(flags: Record<string, string>): Promise<void
         onStateDone: () => {
           if (declaredDb?.objects.length) step('Reconciling the declared derived layer...');
         },
+        onLifecycleResolved: (line) => info(line),
       },
     );
 

package/src/cli/derived-catchup.ts

@@ -83,6 +83,8 @@ export interface CatchUpOptions {
    * Required for the same reason as `onRefusal`: only the caller knows what it wrote.
    */
   stateApplied: boolean;
+  /** Wall time, in ms, of each phase that ran: the owner gate and reconcile, then the post-check. */
+  onPhase?: (phase: 'derived' | 'post-checks', ms: number) => void;
 }
 
 export interface CatchUpOutcome {
@@ -124,6 +126,7 @@ export async function catchUpDerived(
     gitRef: currentGitRef(),
   };
 
+  const derivedStarted = Date.now();
   // Before the first derived write, judge the owners the reconcile will give the declared trigger
   // functions on lifecycle tables.
   const config = venue.kind === 'stage' ? await resolveConfig(venue.stage) : undefined;
@@ -171,11 +174,14 @@ export async function catchUpDerived(
   // A refusal is not a soft outcome here. db:reconcile prints it and exits 1; the catch-up did
   // not land, so db:apply must say so and exit the same way.
   if (run.refusal) throw new CatchUpError(run.refusal);
+  opts.onPhase?.('derived', Date.now() - derivedStarted);
 
   // Verification: the live catalog check again, over what the reconcile just made live. On the
   // operator session, where the commit is: db:query may read a replica that has not caught up.
+  const postStarted = Date.now();
   const post = await lifecyclePostApplyRefusal(operator, declared?.models ?? [], lifecycleRolesOf(declared));
   if (post) throw new LifecycleFindingsError(post);
+  opts.onPhase?.('post-checks', Date.now() - postStarted);
 
   return { declared: objects.length, run, statements: run.applied ? (run.statements ?? []) : [] };
 }

package/src/cli/edge-plan.ts

@@ -53,8 +53,10 @@ import { compileTableRenames, compileTableMoves, compileRenames } from './schema
  * A v3 reader does not know how to enact or record those prerequisites, so the file formats are
  * not compatible. The existing db:apply version refusal makes the mismatch a re-mint before any
  * write, rather than letting a peer silently omit part of the reviewed artifact.
+ * v7 adds `stateDependents`: declared views and matviews a column type change binds, dropped and
+ * re-created inside the state transaction. A v6 reader would skip them and the ALTER would fail.
  */
-export const PLAN_VERSION = 6;
+export const PLAN_VERSION = 7;
 
 /**
  * The db:apply WIRE CONTRACT between the CLI and the ops Lambda — distinct from PLAN_VERSION,
@@ -119,8 +121,12 @@ export const PLAN_VERSION = 6;
  *
  * v10 applies the reviewed prerequisite search path and restores the transaction's original
  * path before state DDL and grant verification. A v9 stage could bind defaults to other schemas.
+ *
+ * v11 (milestone upgrade-no-hand-sql): the plan gained `stateDependents`, which the server drops
+ * before the state edge and re-creates after it, in the same transaction, with provenance. A v10
+ * stage would skip them, and its ALTER COLUMN TYPE would fail on the view that binds the column.
  */
-export const APPLY_CONTRACT_VERSION = 10;
+export const APPLY_CONTRACT_VERSION = 11;
 
 /** Classification counts (brick 9, decision 11): destructive = drops + narrowings + strips. */
 export interface PlanClassification {
@@ -167,6 +173,30 @@ export type StatePrerequisite = {
   };
 };
 
+/**
+ * A declared view or matview that binds a column this plan changes the type of. PostgreSQL refuses
+ * `ALTER COLUMN ... TYPE` while it exists, so the state transaction drops it (dependents first),
+ * runs the edge, and re-creates it from the reviewed checkout SQL before COMMIT: it is never absent.
+ * Listed in creation (dependency) order; the drops run in reverse.
+ */
+export type StateDependent = {
+  /** `schema.name`. */
+  identity: string;
+  kind: 'view' | 'materialized view';
+  /** The live definition hash read at mint. db:apply refuses, before any write, unless it still holds. */
+  expectedDefHash: string;
+  /** The exact DROP, without CASCADE: anything the mint did not see that depends on it fails the transaction. */
+  dropSql: string;
+  /** The exact schema preparation, CREATE, ownership, grant, comment and index SQL db:apply runs. */
+  sql: string;
+  /** As StatePrerequisite.searchPath. */
+  searchPath: string | null;
+  grantContract: StatePrerequisite['grantContract'];
+  provenance: { srcHash: string; bodyHash?: string; kind: 'view' | 'materialized view'; dropSql?: string };
+  /** Matview only: pg_total_relation_size at mint. The re-create repopulates it, inside the transaction. */
+  bytes?: number;
+};
+
 export interface EdgePlan {
   v: number;
   /** The target's exact live fingerprint at mint time — the lock. */
@@ -234,6 +264,8 @@ export interface EdgePlan {
    * before this field existed have none; an absent field means no prerequisite was recorded.
    */
   statePrerequisites?: readonly StatePrerequisite[];
+  /** Declared views and matviews the state transaction drops and re-creates around a type change. */
+  stateDependents?: readonly StateDependent[];
   executable: number;
   /** Executable statements that LOSE DATA (drops + narrowing type changes) — red, gated at apply. */
   destructive: number;

package/src/cli/lifecycle-preflight.ts

@@ -6,6 +6,8 @@ import { compileTableContract } from './authz-compile';
 import { reconcileOwner, triggerFunctionOf } from './derived-apply';
 import { isSessionError, type SessionRunner } from './session';
 import { parseQualified, type SourceObject } from './derived-source';
+import { quoteQualified } from './pg-ident';
+import { ALWAYS_GOVERNED } from './authz-reconcile';
 import { lifecycleDerived, lifecycleManifestOf, lifecycleRole } from './lifecycle-derived';
 
 export const LIFECYCLE_LOG_REFUSAL = 'everystack.destroy_log is missing; run db:provision before db:apply';
@@ -32,20 +34,96 @@ export function lifecycleLogRowRefusal(log: { present?: unknown; current?: unkno
 /**
  * The log's shape first (its refusals are unchanged), then the live catalog facts the soft delete
  * rests on (lifecycleCatalogRefusal). Pure SELECTs: the --stage lane runs them over db:query.
+ *
+ * `planStatements`: the reviewed plan this check runs before. A finding the plan resolves is not
+ * a refusal (see planRevokedGrants). The plan's state transaction commits before the derived
+ * catch-up creates any lifecycle function, and the post-check reads the catalog again after it.
  */
 export async function lifecycleApplyRefusal(
   runner: QueryRunner,
   models: readonly ModelDescriptor[],
   roles: LifecycleRoleDeclaration = {},
+  planStatements: readonly string[] = [],
 ): Promise<string | null> {
-  if (!models.some(model => model.lifecycle === true)) return null;
+  return (await lifecycleApplyReport(runner, models, roles, planStatements)).refusal;
+}
+
+/** lifecycleApplyRefusal, plus the findings the plan resolves (one line, or null when none). */
+export async function lifecycleApplyReport(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+  planStatements: readonly string[] = [],
+): Promise<{ refusal: string | null; resolved: string | null }> {
+  if (!models.some(model => model.lifecycle === true)) return { refusal: null, resolved: null };
   const [log] = await runner(LIFECYCLE_LOG_SQL);
+  const shape = lifecycleLogRowRefusal(log);
+  if (shape) return { refusal: shape, resolved: null };
   // Before the plan: a modeled table's keys are the plan's to converge (the models declare each
   // one, or refuse to compile), so rule 6 reports only keys from tables the models do not have.
   const modeledTables = [...new Set(models.map(model => `${model.schema}.${model.table}`))];
-  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models, roles), modeledTables });
+  const report = await lifecycleCatalogFindings(runner, { ...catalogInputsFromModels(models, roles), modeledTables },
+    { planRevokes: planRevokedGrants(planStatements) });
+  return { refusal: catalogRefusalText(report), resolved: resolvedLine(report.resolved) };
+}
+
+/**
+ * What `db:provision` must do before a lifecycle plan can apply, as one line naming the command,
+ * or null. The same reads the apply refuses on: everystack.destroy_log missing or out of date
+ * (lifecycleLogRowRefusal), and the lifecycle role missing or holding LOGIN or BYPASSRLS (the
+ * attributes db:provision resets). `command` is the db:provision invocation for this target.
+ */
+export async function lifecycleProvisionFirst(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  command: string,
+  options: { lifecycleRole?: string } = {},
+): Promise<string | null> {
+  if (!models.some(model => model.lifecycle === true)) return null;
+  const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
+  const reasons: string[] = [];
+  const [log] = await runner(LIFECYCLE_LOG_SQL);
+  if (log?.present !== true) reasons.push('everystack.destroy_log is missing');
+  else if (log.current !== true) reasons.push('everystack.destroy_log is out of date');
+  const [role] = await runner(roleSql(lc));
+  if (!truthy(role?.present)) reasons.push(`role ${lc} is missing`);
+  else {
+    const wrong = (['login', 'bypassrls'] as const).filter(key => truthy(role[key])).map(key => key.toUpperCase());
+    if (wrong.length > 0) reasons.push(`role ${lc} has ${wrong.join(', ')}`);
+  }
+  if (reasons.length === 0) return null;
+  return `run db:provision first: ${reasons.join('; ')}. Run: ${command}`;
+}
+
+/**
+ * The grants a reviewed plan revokes, one key per (table, grantee, privilege, column) — the exact
+ * statements the reconciler emits (authz-reconcile.ts reconcileGrants, reconcileColumnGrants):
+ *
+ *   REVOKE REFERENCES, TRIGGER, TRUNCATE ON public.t FROM admin;
+ *   REVOKE REFERENCES (a, b) ON public.t FROM admin;
+ *
+ * Anything else (a sequence, a statement this does not recognise) resolves nothing, so an
+ * unrecognised form can only leave a finding standing, never hide one.
+ */
+export function planRevokedGrants(statements: readonly string[]): ReadonlySet<string> {
+  const keys = new Set<string>();
+  for (const statement of statements) {
+    const column = /^REVOKE ([A-Z]+) \(([^()]+)\) ON (.+) FROM ([^;]+);$/.exec(statement);
+    if (column) {
+      for (const name of column[2].split(', ')) keys.add(revokeKey(column[3], column[4], column[1], name));
+      continue;
+    }
+    const table = /^REVOKE ([A-Z]+(?:, [A-Z]+)*) ON (.+) FROM ([^;]+);$/.exec(statement);
+    if (!table || table[2].startsWith('SEQUENCE ')) continue;
+    for (const privilege of table[1].split(', ')) keys.add(revokeKey(table[2], table[3], privilege));
+  }
+  return keys;
 }
 
+/** `table` as the reconciler emits it (quoteQualified of the contract's `schema.table`). */
+const revokeKey = (table: string, grantee: string, privilege: string, column?: string): string =>
+  JSON.stringify([table, grantee, privilege, column ?? null]);
+
 /**
  * What the modules declare about the roles, beside the models (DeclaredDerived). The catalog check
  * reads it to tell a definer role the models grant to apart from a role a request can become.
@@ -129,6 +207,12 @@ export interface LifecycleCatalogInputs {
   requestRoles?: readonly string[];
   /** Every declared derived-object owner. Read only when `requestRoles` is present. */
   declaredOwners?: readonly string[];
+  /**
+   * The roles a fresh plan governs (ALWAYS_GOVERNED and every grantee of the models): the plan
+   * revokes any REFERENCES, TRIGGER or TRUNCATE such a role holds on a lifecycle table, since a
+   * lifecycle model cannot declare one. Absent (a db:reconcile payload): every rule-3 fix is SQL.
+   */
+  governedRoles?: readonly string[];
 }
 
 /** A declared dependent: the child's `schema.table`, its foreign-key column (SQL name), the lifecycle parent's `schema.table`. */
@@ -175,15 +259,17 @@ const notApplicationRole = (lc: string) => (role: string): boolean => role !== '
 export function catalogInputsFromModels(
   models: readonly ModelDescriptor[],
   declaration: LifecycleRoleDeclaration = {},
-): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[]; requestRoles?: string[]; declaredOwners?: string[] } {
+): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[]; requestRoles?: string[]; declaredOwners?: string[]; governedRoles: string[] } {
   const roles = new Set<string>();
+  const governed = new Set<string>(ALWAYS_GOVERNED);
   for (const model of models) {
     const contract = compileTableContract(model);
-    for (const role of Object.keys(contract.grants)) roles.add(role);
-    for (const role of Object.keys(contract.columnGrants ?? {})) roles.add(role);
+    for (const role of Object.keys(contract.grants)) { roles.add(role); governed.add(role); }
+    for (const role of Object.keys(contract.columnGrants ?? {})) { roles.add(role); governed.add(role); }
     for (const policy of contract.policies) for (const role of policy.roles) roles.add(role);
   }
   return {
+    governedRoles: [...governed].sort(),
     lifecycleTables: [...new Set(models.filter(model => model.lifecycle === true).map(model => `${model.schema}.${model.table}`))].sort(),
     applicationRoles: [...roles].filter(notApplicationRole(LIFECYCLE_OWNER_ROLE)).sort(),
     dependentKeys: models.some(model => model.lifecycle === true) ? dependentKeysFromDeclared(lifecycleDerived(models)) : [],
@@ -392,23 +478,27 @@ const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH
  * Rule 3. TRIGGER, REFERENCES or TRUNCATE on a lifecycle table, or REFERENCES on one of its
  * columns, held by anyone but its owner. On everystack.destroy_log, any privilege but SELECT
  * (table or column) held by anyone but its owner: a writer could forge or remove a marker.
+ * One row per grantor: PostgreSQL revokes only the grants made by the role REVOKE runs as, and
+ * runs a member's (or a superuser's) REVOKE as the owner, so who granted it decides what removes it.
  */
 const aclSql = (tables: string[]): string => `SELECT n.nspname::text || '.' || c.relname::text AS "table", ${granteeName('a.grantee')} AS grantee,
-    a.privilege_type AS privilege, NULL::text AS "column"
+    a.privilege_type AS privilege, NULL::text AS "column", a.grantor = c.relowner AS owner_granted,
+    pg_catalog.pg_get_userbyid(a.grantor)::text AS grantor
   FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
   CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) a
   WHERE c.relkind IN ('r', 'p') AND a.grantee <> c.relowner AND (
     ((n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)}) AND a.privilege_type IN ('TRIGGER', 'REFERENCES', 'TRUNCATE'))
     OR (c.oid = pg_catalog.to_regclass('everystack.destroy_log') AND a.privilege_type <> 'SELECT'))
   UNION ALL
-  SELECT n.nspname::text || '.' || c.relname::text, ${granteeName('a.grantee')}, a.privilege_type, t.attname::text
+  SELECT n.nspname::text || '.' || c.relname::text, ${granteeName('a.grantee')}, a.privilege_type, t.attname::text,
+    a.grantor = c.relowner, pg_catalog.pg_get_userbyid(a.grantor)::text
   FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
   JOIN pg_catalog.pg_attribute t ON t.attrelid = c.oid AND t.attnum > 0 AND NOT t.attisdropped
   CROSS JOIN LATERAL pg_catalog.aclexplode(t.attacl) a
   WHERE c.relkind IN ('r', 'p') AND a.grantee <> c.relowner AND (
     ((n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)}) AND a.privilege_type = 'REFERENCES')
     OR (c.oid = pg_catalog.to_regclass('everystack.destroy_log') AND a.privilege_type <> 'SELECT'))
-  ORDER BY 1, 4 NULLS FIRST, 3, 2`;
+  ORDER BY 1, 4 NULLS FIRST, 3, 2, 6`;
 
 /**
  * Rule 4. Each marker function: SECURITY DEFINER, owned by destroy_log's owner, EXECUTE for the
@@ -520,24 +610,52 @@ export async function lifecycleCatalogRefusal(
   inputs: LifecycleCatalogInputs,
   options: { lifecycleRole?: string } = {},
 ): Promise<string | null> {
-  const findings = await lifecycleCatalogFindings(runner, inputs, options);
+  return catalogRefusalText(await lifecycleCatalogFindings(runner, inputs, options));
+}
+
+const catalogRefusalText = ({ findings, resolved }: CatalogFindings): string | null => {
   if (findings.length === 0) return null;
-  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
+  const also = resolved.length === 0 ? '' : ` (the plan resolves ${resolved.length} more)`;
+  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'})${also}; `
     + `fix each, then re-run:\n${findingLines(findings)}`;
-}
+};
+
+/**
+ * The resolved rule-3 findings as one line: per grantee and privilege, the tables the plan
+ * revokes it on. Null when the plan resolves none.
+ */
+const resolvedLine = (resolved: readonly ResolvedGrant[]): string | null => {
+  if (resolved.length === 0) return null;
+  const byGrant = new Map<string, string[]>();
+  for (const r of resolved) {
+    const grant = `${r.privilege}${r.column ? ` (${r.column})` : ''} from ${r.grantee}`;
+    byGrant.set(grant, [...(byGrant.get(grant) ?? []), r.table]);
+  }
+  const parts = [...byGrant].map(([grant, tables]) => `${grant} on ${[...new Set(tables)].sort().join(', ')}`);
+  return `the plan resolves ${countFindings(resolved.length)}: it revokes ${parts.join('; ')}, before any lifecycle function is created.`;
+};
 
 const findingLines = (findings: readonly string[]): string => findings.map(finding => `  - ${finding}`).join('\n');
 const countFindings = (n: number): string => `${n} lifecycle finding${n === 1 ? '' : 's'}`;
 
-/** lifecycleCatalogRefusal's findings, one string each, without the heading. */
+/** A rule-3 finding the reviewed plan's own REVOKE removes. */
+interface ResolvedGrant { table: string; grantee: string; privilege: string; column: string | null }
+interface CatalogFindings { findings: string[]; resolved: ResolvedGrant[] }
+
+/**
+ * lifecycleCatalogRefusal's findings, one string each, without the heading. `planRevokes`
+ * (planRevokedGrants): a rule-3 grant on a lifecycle table that the plan revokes, exactly that
+ * privilege from that grantee on that table (and column), moves to `resolved`. Nothing else does.
+ */
 async function lifecycleCatalogFindings(
   runner: QueryRunner,
   inputs: LifecycleCatalogInputs,
-  options: { lifecycleRole?: string } = {},
-): Promise<string[]> {
+  options: { lifecycleRole?: string; planRevokes?: ReadonlySet<string> } = {},
+): Promise<CatalogFindings> {
   const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
   const tables = [...new Set(inputs.lifecycleTables)].sort();
-  if (tables.length === 0) return [];
+  const resolved: ResolvedGrant[] = [];
+  if (tables.length === 0) return { findings: [], resolved };
   const set = await applicationRoleSet(runner, inputs, lc);
   const apps = set.apps;
   const findings: string[] = [...set.findings];
@@ -578,11 +696,36 @@ async function lifecycleCatalogFindings(
     findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}${cause ? ` ${cause}` : ''}`);
   }
 
+  const governed = new Set(inputs.governedRoles ?? []);
   for (const row of await runner(aclSql(tables))) {
+    const column = row.column == null ? null : String(row.column);
     const on = row.column == null ? '' : ` (${ident(String(row.column))})`;
+    // Granted by another role WITH GRANT OPTION: the plan's REVOKE (run as the owner) and a fresh
+    // plan both leave it, so it is never resolved. No verb removes it today (item U6).
+    if (!truthy(row.owner_granted)) {
+      const table = quoteLabel(String(row.table));
+      const grantor = ident(String(row.grantor));
+      const who = row.grantee === 'PUBLIC' ? 'PUBLIC' : ident(String(row.grantee));
+      // On destroy_log the revoke comes from db:provision, not from a plan.
+      const revoker = row.table === 'everystack.destroy_log' ? "db:provision's REVOKE" : "the plan's REVOKE";
+      findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}, granted by ${row.grantor} with grant option; `
+        + `${revoker} runs as the owner and cannot remove it. Fix: REVOKE ${row.privilege}${on} ON TABLE ${table} FROM ${who} GRANTED BY ${grantor}; `
+        + `(as ${row.grantor}, a member of it, or a superuser), or REVOKE GRANT OPTION FOR ${row.privilege}${on} ON TABLE ${table} FROM ${grantor} CASCADE;`);
+      continue;
+    }
+    if (options.planRevokes && tables.includes(String(row.table))
+      && options.planRevokes.has(revokeKey(quoteQualified(String(row.table)), String(row.grantee), String(row.privilege), column ?? undefined))) {
+      resolved.push({ table: String(row.table), grantee: String(row.grantee), privilege: String(row.privilege), column });
+      continue;
+    }
     const who = row.grantee === 'PUBLIC' ? 'PUBLIC' : ident(String(row.grantee));
-    findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}. `
-      + `Fix: REVOKE ${row.privilege}${on} ON TABLE ${quoteLabel(String(row.table))} FROM ${who};`);
+    // A verb where one exists: db:provision revokes every grant on destroy_log but its owner's
+    // (ENSURE_DESTROY_LOG_SQL); a fresh plan revokes a governed role's grant on a lifecycle table.
+    // SQL only for a role no plan governs, which the plan leaves alone by design.
+    const fix = row.table === 'everystack.destroy_log' ? 'run db:provision.'
+      : governed.has(String(row.grantee)) ? 'mint a plan (db:plan) and db:apply it; the plan revokes this grant.'
+        : `REVOKE ${row.privilege}${on} ON TABLE ${quoteLabel(String(row.table))} FROM ${who};`;
+    findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}. Fix: ${fix}`);
   }
 
   for (const row of await runner(markerSql(lc))) {
@@ -641,7 +784,7 @@ async function lifecycleCatalogFindings(
         + 'if the models declare this key nullify, upgrade the CLI (@everystack/cli) and re-run.' : ''));
   }
 
-  return findings;
+  return { findings, resolved };
 }
 
 /**
@@ -728,7 +871,7 @@ export async function lifecyclePostApplyRefusal(
     if (isSessionError(slot)) throw new Error(slot.message);
     return slot ?? [];
   };
-  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models, roles));
+  const { findings } = await lifecycleCatalogFindings(read, catalogInputsFromModels(models, roles));
   if (findings.length === 0) return null;
   return `${countFindings(findings.length)} after reconcile; the objects are live; the next apply refuses until fixed:\n${findingLines(findings)}`;
 }

package/src/cli/state-apply.ts

@@ -37,7 +37,7 @@ import { introspectDerived } from './derived-introspect';
 import { objectGrantDelta } from './derived-plan';
 import { isPureComment, statementBody, statementHead } from './sql-statement';
 import { splitFunctionIdentity } from './pg-argtypes';
-import type { StatePrerequisite } from './edge-plan';
+import type { StateDependent, StatePrerequisite } from './edge-plan';
 
 const NOTICE_PREFIX = '-- NOTICE';
 export const STATE_PREREQUISITE_DRIFT_PREFIX = 'state prerequisite drift:';
@@ -366,6 +366,11 @@ export interface StateApplyOptions {
    * back both, rather than leaving a derived object ahead of the state it serves.
    */
   statePrerequisites?: readonly StatePrerequisite[];
+  /**
+   * Reviewed declared views and matviews a type change in this batch binds: dropped (dependents
+   * first) before it and re-created after it, in the same transaction, so they are never absent.
+   */
+  stateDependents?: readonly StateDependent[];
   /**
    * An explicit write transaction over one pinned connection. Prerequisites need this because
    * their DDL, the state edge, and their catalog-derived provenance must commit or roll back
@@ -518,6 +523,7 @@ export async function applyGeneratedStatements(
 ): Promise<StateApplyResult> {
   const classified = classifyGeneratedStatements(statements);
   const prerequisites = options.statePrerequisites ?? [];
+  const dependents = options.stateDependents ?? [];
   // Checks the caller withheld before calling. They are outstanding from the first line of this
   // function: the outcome written before the batch already counts them, and they come back in the
   // result whether or not any check actually ran here.
@@ -583,7 +589,7 @@ export async function applyGeneratedStatements(
   const validationSql = validations.join('\n;\n');
   const started = now();
   try {
-    if (prerequisites.length > 0) {
+    if (prerequisites.length > 0 || dependents.length > 0) {
       if (!options.transaction) {
         throw new Error('state prerequisites require a pinned write transaction; this apply lane cannot prove atomic provenance.');
       }
@@ -591,39 +597,65 @@ export async function applyGeneratedStatements(
         const [settings] = await transactionRunner("SELECT pg_catalog.current_setting('search_path') AS search_path");
         const originalPath = settings?.search_path;
         if (typeof originalPath !== 'string') throw new Error('could not capture prerequisite search_path; no state was applied.');
+        const reread = async () => new Map((await introspectDerived(borrowedSessionRunner(transactionRunner)))
+          .objects.map((object) => [object.identity, object]));
+        // A dependent is re-created from the reviewed SQL, so it must still be the object the mint
+        // read. Checked inside the transaction, before any write.
+        if (dependents.length > 0) {
+          const before = await reread();
+          for (const dependent of dependents) {
+            if (before.get(dependent.identity)?.defHash !== dependent.expectedDefHash) {
+              throw new Error(`${STATE_PREREQUISITE_DRIFT_PREFIX} ${dependent.kind} ${dependent.identity} is not the one this plan was minted against; the target changed since minting. Re-mint with db:plan.`);
+            }
+          }
+        }
         // Defaults and SQL-standard bodies bind names at CREATE time. Use the full declared
         // path recorded at mint, then restore the exact connection setting; the state DDL
-        // that follows pins the canonical path itself.
-        batchSql = ['SET LOCAL check_function_bodies = off', ...prerequisites.flatMap((prerequisite) => [
-          renderStatePrerequisiteGuard(prerequisite),
-          ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(prerequisite.searchPath)]),
-          prerequisite.sql,
-          ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(originalPath)]),
-        ]), ...stateBatch].join('\n;\n');
+        // that follows pins the canonical path itself. Dependents drop before the edge, children
+        // first, and come back after it, parents first, under their declared path.
+        batchSql = [
+          ...(prerequisites.length > 0 ? ['SET LOCAL check_function_bodies = off'] : []),
+          ...prerequisites.flatMap((prerequisite) => [
+            renderStatePrerequisiteGuard(prerequisite),
+            ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(prerequisite.searchPath)]),
+            prerequisite.sql,
+            ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(originalPath)]),
+          ]),
+          ...[...dependents].reverse().map((dependent) => dependent.dropSql),
+          ...stateBatch,
+          ...dependents.flatMap((dependent) => [renderLocalSearchPath(dependent.searchPath ?? originalPath), dependent.sql]),
+          ...(dependents.length > 0 ? [renderLocalSearchPath(originalPath)] : []),
+        ].join('\n;\n');
         await transactionRunner(batchSql);
         // `defHash` is PostgreSQL's canonical deparse, so source text cannot predict it. Read it
         // after the CREATE through the OPEN transaction, then write provenance before COMMIT.
-        const reread = async () => new Map((await introspectDerived(borrowedSessionRunner(transactionRunner)))
-          .objects.map((object) => [object.identity, object]));
+        const created: Array<{ identity: string; kind: 'function' | StateDependent['kind']; grantContract: StatePrerequisite['grantContract'];
+          provenance: { srcHash: string; bodyHash?: string; kind: string; dropSql?: string } }> = [
+          ...prerequisites.map((p) => ({ identity: p.identity, kind: 'function' as const, grantContract: p.grantContract, provenance: p.provenance })),
+          ...dependents.map((d) => ({ identity: d.identity, kind: d.kind, grantContract: d.grantContract, provenance: d.provenance })),
+        ];
         let liveByIdentity = await reread();
-        const grantDelta = (prerequisite: StatePrerequisite) => {
+        // A function is a state prerequisite; a re-created dependent is named as the view it is.
+        const objectLabel = (object: (typeof created)[number]): string =>
+          `${object.kind === 'function' ? 'state prerequisite' : object.kind} ${object.identity}`;
+        const grantDelta = (prerequisite: (typeof created)[number]) => {
           const live = liveByIdentity.get(prerequisite.identity);
           if (!live || live.grants === undefined) {
-            throw new Error(`state prerequisite ${prerequisite.identity} has no readable grant catalog; no provenance was written.`);
+            throw new Error(`${objectLabel(prerequisite)} has no readable grant catalog; no provenance was written.`);
           }
           const contract = prerequisite.grantContract;
           if (contract.owner && live.owner !== contract.owner) {
-            throw new Error(`state prerequisite ${prerequisite.identity} owner did not converge to ${contract.owner}; no provenance was written.`);
+            throw new Error(`${objectLabel(prerequisite)} owner did not converge to ${contract.owner}; no provenance was written.`);
           }
-          const delta = objectGrantDelta({ ...contract, identity: prerequisite.identity, kind: 'function' }, live);
+          const delta = objectGrantDelta({ ...contract, identity: prerequisite.identity, kind: prerequisite.kind }, live);
           if (!delta || delta.columnScoped || delta.suppressed.length > 0) {
-            throw new Error(`state prerequisite ${prerequisite.identity} grants cannot be verified; no provenance was written.`);
+            throw new Error(`${objectLabel(prerequisite)} grants cannot be verified; no provenance was written.`);
           }
           return delta.statements;
         };
         // CREATE inherits default ACLs, and ALTER OWNER can remove a declared builder grant.
         // Settle from the actual catalog using the same grant diff as derived reconcile.
-        const settle = prerequisites.flatMap((prerequisite) => {
+        const settle = created.flatMap((prerequisite) => {
           const statements = grantDelta(prerequisite);
           const { owner, ownerMode } = prerequisite.grantContract;
           return statements.length > 0 && owner && ownerMode === 'set-role'
@@ -636,16 +668,16 @@ export async function applyGeneratedStatements(
           liveByIdentity = await reread();
         }
         // A successful REVOKE can be a warning-only no-op. Only a second catalog read proves it.
-        for (const prerequisite of prerequisites) {
+        for (const prerequisite of created) {
           const remaining = grantDelta(prerequisite);
           if (remaining.length > 0) {
-            throw new Error(`state prerequisite ${prerequisite.identity} grants did not converge: still needs ${remaining.join('; ')}. No provenance was written.`);
+            throw new Error(`${objectLabel(prerequisite)} grants did not converge: still needs ${remaining.join('; ')}. No provenance was written.`);
           }
         }
-        const provenanceSql = prerequisites.map((prerequisite) => {
+        const provenanceSql = created.map((prerequisite) => {
           const liveObject = liveByIdentity.get(prerequisite.identity);
           if (!liveObject) {
-            throw new Error(`state prerequisite ${prerequisite.identity} was created but is not introspectable before commit; provenance was not recorded.`);
+            throw new Error(`${objectLabel(prerequisite)} was created but is not introspectable before commit; provenance was not recorded.`);
           }
           return renderProvenanceUpsert(
             prerequisite.identity,