@everystack/cli 0.4.55 → 0.4.57

package/src/cli/derived-compile.ts

@@ -194,9 +194,20 @@ function renderFunction(fn: FunctionDescriptor): { sql: string; attachments: Att
     .join(', ');
   const returns = typeof fn.returns === 'string' ? fn.returns : `SETOF ${refName(fn.returns.setof)}`;
   const volatility = fn.volatility === 'volatile' ? '' : ` ${fn.volatility.toUpperCase()}`;
-  const security = fn.security === 'definer'
-    ? ` SECURITY DEFINER SET search_path = ${(fn.searchPath ?? []).join(', ')}`
+  const definer = fn.security === 'definer' ? ' SECURITY DEFINER' : '';
+  // The pin is INDEPENDENT of the security mode, in both directions.
+  //
+  // `'unpinned'` emits no `SET search_path` at all — that is the whole point of the sentinel:
+  // a brownfield definer function that genuinely has none is now declarable, instead of the
+  // pull inventing `pg_catalog` and the build applying the invention for real.
+  //
+  // And a pin on an INVOKER function is emitted too. It used to be silently dropped, so a model
+  // could declare one, the build would not apply it, and the differ (which never read proconfig)
+  // would not notice — a declared property with no effect and no complaint.
+  const pin = Array.isArray(fn.searchPath) && fn.searchPath.length > 0
+    ? ` SET search_path = ${fn.searchPath.join(', ')}`
     : '';
+  const security = `${definer}${pin}`;
   const tag = dollarTag(fn.body);
   const signature = functionSignature(target, fn);
   return {
@@ -321,10 +332,12 @@ function make(kind: SourceObject['kind'], rawName: string, sql: string, attachme
     kind, schema, name,
     identity: extra.identity ?? `${schema}.${name}`,
     sql, attachments,
-    hash: hashSourceContent(sql, attachments),
+    hash: hashSourceContent(sql, attachments, extra.owner),
     // bodyHash excludes PLAIN grants (column-scoped grants stay in — attacl isn't drift-checked, so
     // a column-grant change must still rebuild). Equal across an authz-only plain-grant change.
-    bodyHash: hashSourceContent(sql, attachments.filter((a) => !isPlainGrantAttachment(a))),
+    // The OWNER stays in: changing who a SECURITY DEFINER function (or a non-invoker view)
+    // executes as is a rebuild, not an authz delta, so it must not be routed to a bare GRANT diff.
+    bodyHash: hashSourceContent(sql, attachments.filter((a) => !isPlainGrantAttachment(a)), extra.owner),
     file: DECLARED, seq,
     ...extra,
   });
@@ -369,18 +382,23 @@ export function compileDerived(models: readonly ModelDescriptor[], derived: read
     switch (d.kind) {
       case 'view': {
         const { sql, attachments } = renderView(d);
-        nodes.push({ identity, deps: depIdentities(d.dependsOn), build: make('view', d.name, sql, attachments, { declaredDeps: declaredIdentities(d.dependsOn) }) });
+        // A15: the owner rides on the object, so it enters the content hash (a view that
+        // changes owner IS a different object) and the applier can create it under SET ROLE.
+        nodes.push({ identity, deps: depIdentities(d.dependsOn), build: make('view', d.name, sql, attachments, { declaredDeps: declaredIdentities(d.dependsOn), ...(d.owner ? { owner: d.owner } : {}) }) });
         break;
       }
       case 'materialized view': {
         const { sql, attachments } = renderMaterializedView(d);
-        nodes.push({ identity, deps: depIdentities(d.dependsOn), build: make('materialized view', d.name, sql, attachments, { declaredDeps: declaredIdentities(d.dependsOn) }) });
+        nodes.push({ identity, deps: depIdentities(d.dependsOn), build: make('materialized view', d.name, sql, attachments, { declaredDeps: declaredIdentities(d.dependsOn), ...(d.owner ? { owner: d.owner } : {}) }) });
         break;
       }
       case 'function': {
         const { sql, attachments } = renderFunction(d);
         const setofDep = typeof d.returns === 'string' ? [] : depIdentities([d.returns.setof]);
-        nodes.push({ identity, deps: [...depIdentities(d.dependsOn), ...setofDep], build: make('function', d.name, sql, attachments, { identity }) });
+        // The pin rides STRUCTURALLY as well as inside `sql`, so the differ can compare it
+        // against the live catalog directly instead of only against a recorded hash. It is not
+        // in the hash (it is already inside `sql`), so carrying it moves nobody's fingerprint.
+        nodes.push({ identity, deps: [...depIdentities(d.dependsOn), ...setofDep], build: make('function', d.name, sql, attachments, { identity, ...(d.owner ? { owner: d.owner } : {}), ...(d.searchPath !== undefined ? { searchPath: d.searchPath } : {}) }) });
         break;
       }
       case 'sql': {

package/src/cli/derived-grants.ts

@@ -99,20 +99,113 @@ export function parseGrantAttachments(attachments: readonly Attachment[]): Parse
  * The idempotent REVOKE/GRANT delta between the declared contract and the live ACLs —
  * the table path's reconcileGrants, per derived object. Empty when they match.
  */
+export interface ObjectGrantDiff {
+  statements: string[];
+  /** REVOKEs withheld because ownership made the two sides incomparable, with the reason. */
+  suppressed: string[];
+}
+
+/**
+ * Ownership context for a FUNCTION's grant diff. Absent for relations.
+ *
+ * Owner-implicit EXECUTE is excluded from both grant reads (`grantee <> proowner`), which is
+ * correct in isolation — an owner's privileges are not grants. But it means the SET of
+ * non-owner grants is computed RELATIVE TO THE OWNER, so two sides with different owners
+ * produce two different sets for the same function, and the differ reconciles a difference
+ * that is purely ownership.
+ *
+ * Measured by a consumer, 2026-08-10: their local `resolve_user_slug` is owned by
+ * `outbound_migrator` (owner-implicit, so the pull rendered NO privilege), while on stage the
+ * same function is owned by `slug_resolver` and `outbound_migrator` holds an EXPLICIT grant.
+ * The differ planned `REVOKE EXECUTE ON api.resolve_user_slug FROM outbound_migrator` — a real
+ * access removal minted from an ownership difference. They did not apply it.
+ */
+export interface GrantOwnerContext {
+  /** The owner the DECLARED grant set was computed against, when the models declare one. */
+  declared?: string;
+  /** The owner the LIVE grant set was computed against (`pg_get_userbyid(proowner)`). */
+  live?: string;
+}
+
+/**
+ * The idempotent REVOKE/GRANT delta between the declared contract and the live ACLs —
+ * the table path's reconcileGrants, per derived object. Empty when they match.
+ *
+ * When `owners` is supplied (functions) and the two sides cannot be shown to have been
+ * computed against the SAME owner, REVOKEs are WITHHELD and reported. GRANTs still flow: a
+ * redundant GRANT is noise, a wrong REVOKE removes access that was really there. Failing to
+ * revoke is the recoverable error and it is never silent.
+ *
+ * This withholds some legitimate revokes on a project that has not declared `owner` yet —
+ * deliberately. Declaring the owner restores full capability, and until then the tooling says
+ * plainly what it is not doing rather than guessing.
+ */
 export function diffObjectGrants(
   target: string,
   declared: Record<string, string[]>,
   live: Record<string, string[]>,
-): string[] {
+  owners?: GrantOwnerContext,
+): ObjectGrantDiff {
   const out: string[] = [];
+  const suppressed: string[] = [];
+  // WHICH GRANTEE, not which object. An owner-implicit privilege can only make a grantee
+  // appear or disappear if THAT GRANTEE is an owner on one of the two sides — the owner's own
+  // rows are what each read excludes. So suppression is per-grantee, and every other revoke
+  // still flows.
+  //
+  // This matters concretely: PUBLIC is a pseudo-role that can never own an object, so a
+  // `REVOKE ... FROM PUBLIC` is NEVER explained by ownership. An earlier, object-scoped
+  // version of this guard swallowed exactly that revoke — a hand-run `GRANT EXECUTE TO PUBLIC`
+  // on a managed function stopped being cleaned up, turning a privilege-escalation cleanup
+  // into a silent no-op. Caught by __tests__/integration/derived-drift.test.ts against a real
+  // database.
+  //
+  // The declared owner is only known once the models declare one (`defineFunction owner`).
+  // Until then the pull-time owner is unrecorded, so a grantee that WAS the pull-time owner
+  // cannot be identified — that case is closed by db:pull emitting `owner`, not here. What we
+  // can always identify is the LIVE owner, and that is the half that produces the asymmetry
+  // in the direction that removes access.
+  const ownerish = new Set([owners?.declared, owners?.live].filter((o): o is string => !!o));
+  const suppressibleGrantee = (grantee: string): boolean =>
+    owners?.live !== undefined && grantee !== 'PUBLIC' && ownerish.has(grantee);
+  // NORMALIZATION, and it is a different move from the suppression above.
+  //
+  // The LIVE owner holds every privilege implicitly, and the live read excludes exactly those
+  // rows. So when the two sides share a basis — the models declare the live owner, or declare no
+  // owner at all — a declared grant TO that owner is already true and unreadable. Minting it
+  // produces a GRANT the next read still cannot see: a statement that runs on every reconcile,
+  // forever, and never converges. Measured as 31 of them on one consumer's function set.
+  //
+  // Both directions drop, because both are vacuous: an owner's implicit privileges cannot be
+  // granted (they are already held) and cannot be revoked (they follow ownership, not the ACL).
+  // This is not a withheld statement, so it is not reported as one.
+  //
+  // It applies ONLY when the bases agree. A declared owner that differs from the live one means
+  // ownership itself is converging, the two grant sets were computed against different owners,
+  // and that case stays with the suppression rule above.
+  const sameBasis = owners?.declared === undefined || owners.declared === owners.live;
+  const ownerImplicit = (grantee: string): boolean =>
+    owners?.live !== undefined && grantee !== 'PUBLIC' && grantee === owners.live && sameBasis;
   const grantees = new Set([...Object.keys(declared), ...Object.keys(live)]);
   for (const grantee of [...grantees].sort()) {
+    if (ownerImplicit(grantee)) continue;
     const want = new Set(declared[grantee] ?? []);
     const have = new Set(live[grantee] ?? []);
     const toRevoke = [...have].filter((p) => !want.has(p)).sort();
     const toGrant = [...want].filter((p) => !have.has(p)).sort();
-    if (toRevoke.length) out.push(`REVOKE ${toRevoke.join(', ')} ON ${target} FROM ${grantee}`);
+    if (toRevoke.length) {
+      if (!suppressibleGrantee(grantee)) {
+        out.push(`REVOKE ${toRevoke.join(', ')} ON ${target} FROM ${grantee}`);
+      } else {
+        const why = grantee === owners!.live
+          ? `'${grantee}' is the function's live OWNER, whose implicit privileges are excluded from both grant reads — so this difference is ownership, not a grant`
+          : `'${grantee}' is the function's declared owner (live owner: ${owners!.live}), and an owner's implicit privileges are excluded from both grant reads`;
+        suppressed.push(
+          `${target}: withheld REVOKE ${toRevoke.join(', ')} FROM ${grantee} — ${why}. An owner's implicit privileges are excluded from both reads, so the two grant sets are not comparable and this revoke may remove access that is really there. Declare the function's owner to restore revokes.`,
+        );
+      }
+    }
     if (toGrant.length) out.push(`GRANT ${toGrant.join(', ')} ON ${target} TO ${grantee}`);
   }
-  return out;
+  return { statements: out, suppressed };
 }

package/src/cli/derived-introspect.ts

@@ -37,6 +37,33 @@ export interface LiveObject {
   comment?: string;
   /** sha256 over normalized definition + indexes + comment. */
   defHash: string;
+  /**
+   * Functions, views and matviews: the owning role.
+   *
+   * Read because the grant differ CANNOT be correct without it. Owner-implicit privileges are
+   * excluded from the ACL read (`a.grantee <> p.proowner` / `<> c.relowner`), which is right —
+   * but it means the SET of non-owner grants shifts when the owner changes, so the same object
+   * under two owners yields two different privilege sets and the differ mints statements to
+   * reconcile a difference that is purely ownership.
+   *
+   * A15 — and for views it is a privilege boundary in its own right. A `security_invoker =
+   * false` view executes with its OWNER's rights, exactly as a SECURITY DEFINER function does.
+   * Undeclared, the owner is whoever ran the build: an `admin`-owned sealed-slice view rebuilds
+   * as builder-owned, `admin` can no longer read through it, and every gate stays green.
+   */
+  owner?: string;
+  /**
+   * Is `owner` a SUPERUSER (or an rds_superuser member — RDS has no true superuser)? Half of
+   * the discriminator db:pull uses to decide whether the observed owner is a CHOSEN principal
+   * or the ambient build credential. Absent means not measured.
+   */
+  ownerIsSuperuser?: boolean;
+  /**
+   * Is `owner` the role this introspection is CONNECTED AS? The other half of the
+   * discriminator. A normalized non-superuser migrator owns everything it creates by default,
+   * so "superuser" alone would miss it. Absent means not measured.
+   */
+  ownerIsConnectedRole?: boolean;
   /** Matview only: whether it holds data. */
   populated?: boolean;
   /** Matview only: pg_total_relation_size — the rebuild-cost signal. */
@@ -128,7 +155,22 @@ SELECT
   EXISTS (
     SELECT 1 FROM unnest(COALESCE(c.reloptions, '{}'::text[])) o
     WHERE o IN ('security_invoker=true', 'security_invoker=on')
-  ) AS security_invoker
+  ) AS security_invoker,
+  -- A15. The same three fields the function read carries, for the same reason: a
+  -- security_invoker = false view executes with its OWNER's rights, so its owner is a
+  -- privilege boundary exactly as a SECURITY DEFINER function's is. The two discriminators
+  -- let db:pull tell a CHOSEN owner from the ambient build credential.
+  pg_get_userbyid(c.relowner) AS owner,
+  COALESCE(
+    (SELECT r.rolsuper
+       OR EXISTS (
+         SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+         WHERE m.member = c.relowner AND g.rolname = 'rds_superuser'
+       )
+     FROM pg_roles r WHERE r.oid = c.relowner),
+    false
+  ) AS owner_is_superuser,
+  (pg_get_userbyid(c.relowner) IN (CURRENT_USER, SESSION_USER)) AS owner_is_connected_role
 FROM pg_class c
 JOIN pg_namespace n ON n.oid = c.relnamespace
 WHERE c.relkind IN ('v', 'm')
@@ -171,6 +213,25 @@ SELECT
   l.lanname AS language,
   p.prosecdef AS secdef,
   p.provolatile AS volatility,
+  pg_get_userbyid(p.proowner) AS owner,
+  -- The AMBIENT-BUILD-CREDENTIAL discriminator, two clauses and no more. db:pull renders
+  -- the owner only when the observed owner is neither of these — rendering the ambient
+  -- credential would BLESS an accident, turning "whoever happened to run the migration" into
+  -- fingerprinted, reproducible design. When it IS ambient the renderer emits a FIXME instead:
+  -- the defect stays visible without being ratified.
+  --
+  -- Superuser, matching security-catalog's rule (RDS has no true superuser, so rds_superuser
+  -- membership counts).
+  (
+    SELECT r.rolsuper OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_is_superuser,
+  -- ...or the role we are connected as. A normalized, deliberately non-superuser migrator owns
+  -- every object it creates, so the superuser clause alone would miss the commonest case.
+  (pg_get_userbyid(p.proowner) IN (CURRENT_USER, SESSION_USER)) AS owner_is_connected_role,
   (SELECT split_part(cfg, '=', 2) FROM unnest(COALESCE(p.proconfig, '{}'::text[])) cfg
     WHERE cfg LIKE 'search_path=%' LIMIT 1) AS search_path,
   p.prosrc AS src
@@ -458,6 +519,12 @@ export interface RelationRow {
   rows: unknown;
   /** security_invoker reloption (views). Optional — pre-B5 fixtures omit it. */
   security_invoker?: unknown;
+  /** `pg_get_userbyid(relowner)` — see LiveObject.owner. Optional: pre-A15 fixtures omit it. */
+  owner?: unknown;
+  /** See LiveObject.ownerIsSuperuser. Optional: absent means not measured. */
+  owner_is_superuser?: unknown;
+  /** See LiveObject.ownerIsConnectedRole. Optional: absent means not measured. */
+  owner_is_connected_role?: unknown;
 }
 
 export interface FunctionRow {
@@ -475,6 +542,12 @@ export interface FunctionRow {
   secdef?: unknown;
   volatility?: unknown;
   search_path?: unknown;
+  /** `pg_get_userbyid(proowner)` — see LiveObject.owner. Optional: pre-owner fixtures omit it. */
+  owner?: unknown;
+  /** See LiveObject.ownerIsSuperuser. Optional: absent means not measured. */
+  owner_is_superuser?: unknown;
+  /** See LiveObject.ownerIsConnectedRole. Optional: absent means not measured. */
+  owner_is_connected_role?: unknown;
   src?: unknown;
 }
 
@@ -544,6 +617,19 @@ export interface DerivedRows {
   grants?: GrantAclRow[];
 }
 
+/** Coerce a Postgres boolean as any driver spells it. `undefined` means NOT MEASURED —
+ *  never conflated with a measured `false`. NULL is not-measured too: the only way these
+ *  sub-selects go NULL is the role vanishing between reads, and guessing there would be
+ *  exactly the fabrication this feature exists to stop. */
+function pgBool(v: unknown): boolean | undefined {
+  if (v === undefined || v === null) return undefined;
+  if (typeof v === 'boolean') return v;
+  const s = String(v).toLowerCase();
+  if (s === 't' || s === 'true') return true;
+  if (s === 'f' || s === 'false') return false;
+  return undefined;
+}
+
 /** Coerce a Postgres text[] (a JS array, or the `{a,b}` text form some drivers return) to string[]. */
 function pgTextArray(v: unknown): string[] {
   if (Array.isArray(v)) return v.map(String);
@@ -597,6 +683,12 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
       definition, indexes,
       ...(comment !== undefined ? { comment } : {}),
       defHash: computeDefHash(definition, indexes, comment),
+      // A15 — same three fields, same meaning, as the function branch below. Absent (not
+      // measured) and false (measured, not ambient) stay DIFFERENT, so a pre-A15 fixture
+      // keeps behaving exactly as it did.
+      ...(row.owner != null ? { owner: String(row.owner) } : {}),
+      ...(pgBool(row.owner_is_superuser) !== undefined ? { ownerIsSuperuser: pgBool(row.owner_is_superuser) } : {}),
+      ...(pgBool(row.owner_is_connected_role) !== undefined ? { ownerIsConnectedRole: pgBool(row.owner_is_connected_role) } : {}),
       ...grantsFor('r', identity),
     };
     if (kind === 'materialized view') {
@@ -625,6 +717,11 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
       definition, indexes: [],
       ...(comment !== undefined ? { comment } : {}),
       defHash: computeDefHash(definition, [], comment),
+      ...(row.owner != null ? { owner: String(row.owner) } : {}),
+      // Absent (not measured) and false (measured, not ambient) are DIFFERENT — a pre-owner
+      // fixture must keep behaving exactly as it did, so undefined never becomes false here.
+      ...(pgBool(row.owner_is_superuser) !== undefined ? { ownerIsSuperuser: pgBool(row.owner_is_superuser) } : {}),
+      ...(pgBool(row.owner_is_connected_role) !== undefined ? { ownerIsConnectedRole: pgBool(row.owner_is_connected_role) } : {}),
       ...grantsFor('f', identity),
       ...(row.src !== undefined ? {
         fn: {

package/src/cli/derived-lint.ts

@@ -233,6 +233,62 @@ export function findPublicExecutableSecdef(derived: readonly DerivedDescriptor[]
   return warnings;
 }
 
+// ---------------------------------------------------------------------------
+// Advisory: SECURITY DEFINER with no pin (db:check warn) — A3's linter half
+// ---------------------------------------------------------------------------
+
+export interface UnpinnedDefinerFinding extends DerivedAuthzGap {
+  /** The schemas the DECLARATION can justify, `pg_catalog` first. A floor to review — never applied. */
+  suggested: string[];
+}
+
+/**
+ * Every SECURITY DEFINER function that declares `searchPath: 'unpinned'`, with a SUGGESTED pin.
+ *
+ * This is the half of A3 that keeps the honesty from becoming permission. `db:pull` no longer
+ * invents `['pg_catalog']` for a function whose live `proconfig` is empty — inventing it was an
+ * outage that passed every gate, and fabrication corrodes fingerprint, plan and apply, all of
+ * which rest on the model telling the truth. So the parser records what is there and the
+ * OPINION lives here: an unpinned definer function is a real latent vulnerability, and it gets
+ * named on every run until someone decides about it.
+ *
+ * SUGGEST, never apply. The suggestion is derived from the DECLARED structure — the function's
+ * own schema plus the schemas of its `dependsOn` — and not from reading the body. Body-derived
+ * pins are inventing with extra steps: dynamic SQL, operators and casts defeat the parse, and a
+ * pin that is wrong in the tool's favour is the same failure mode with better intentions. The
+ * suggestion is a floor. The author reviews it and lands it themselves.
+ *
+ * WARN, not fail. On an adopted database this is a faithful report of what is already true, and
+ * failing CI on a faithful pull would make `db:pull` unusable on exactly the schemas it exists
+ * for. Same call, and the same reasoning, as findPublicExecutableSecdef above.
+ */
+export function findUnpinnedDefiners(derived: readonly DerivedDescriptor[]): UnpinnedDefinerFinding[] {
+  const findings: UnpinnedDefinerFinding[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'function' || d.security !== 'definer' || d.searchPath !== 'unpinned') continue;
+    const identity = identityOf(d);
+    const schemas = new Set<string>([parseQualified(d.name).schema]);
+    for (const ref of d.dependsOn ?? []) {
+      schemas.add(isModelRef(ref) ? (ref.schema ?? 'public') : parseQualified(ref.name).schema);
+    }
+    // pg_catalog FIRST and always: it is what stops a caller shadowing a built-in the body
+    // calls unqualified, which is the whole attack this pin defends against.
+    const suggested = ['pg_catalog', ...[...schemas].filter((s) => s !== 'pg_catalog').sort()];
+    findings.push({
+      identity,
+      suggested,
+      message:
+        `${identity} is SECURITY DEFINER with NO search_path — declared 'unpinned', which is the truth about the `
+        + `database, not an approval. It runs with its owner's rights, and a caller controls the search_path, so an `
+        + `unqualified name in the body can be resolved to an object the caller planted. SUGGESTED pin from what the `
+        + `declaration references: searchPath: [${suggested.map((s) => `'${s}'`).join(', ')}]. That is a FLOOR derived `
+        + `from dependsOn, not from reading the body — dynamic SQL, operators and casts are invisible to it, so review `
+        + `it, extend it, and land it yourself. Nothing here is ever applied for you.`,
+    });
+  }
+  return findings;
+}
+
 // ---------------------------------------------------------------------------
 // Gate: matview snapshot over row-scoped sources (db:check warn)
 // ---------------------------------------------------------------------------

package/src/cli/derived-plan.ts

@@ -233,6 +233,30 @@ export function planReconcile(
   const sqlDrops = new Map<string, { dropSql: string; reason: string }>();
   const extraWarnings: string[] = [];
 
+  /**
+   * B2 — the declared `SET search_path` compared against the LIVE one, structurally.
+   *
+   * Every other comparison in this table is a hash against a RECORDED hash, which is why the
+   * pin could differ in silence: `--baseline` records the declared source hash beside the live
+   * def hash without ever comparing the two, so a model claiming `search_path=pg_catalog` about
+   * a database with no pin reads as up to date forever. Measured — `db:reconcile --check`
+   * returned zero actions and zero drift on exactly that state.
+   *
+   * This is the one comparison that reads both sides at once. Null when they agree, or when
+   * either side was not measured (a parser-era object with no declared pin, a pre-B5 catalog
+   * read with no structured fields) — absent evidence is not evidence.
+   */
+  const pinMismatch = (src: SourceObject, liveObj: LiveObject): string | null => {
+    if (src.kind !== 'function' || src.searchPath === undefined || !liveObj.fn) return null;
+    const tokens = (v: string | undefined): string[] =>
+      (v ?? '').split(',').map((s) => s.trim().replace(/^"|"$/g, '')).filter(Boolean);
+    const declared = src.searchPath === 'unpinned' ? [] : src.searchPath.map((s) => s.trim());
+    const livePin = tokens(liveObj.fn.searchPath);
+    if (declared.length === livePin.length && declared.every((s, i) => s === livePin[i])) return null;
+    const say = (p: string[]): string => (p.length ? `search_path = ${p.join(', ')}` : 'no search_path');
+    return `declared ${say(declared)}, live has ${say(livePin)} — replaced from source`;
+  };
+
   for (const src of source.objects) {
     // --only restricts the primary decisions to the named identities; the rest are left
     // untouched (they are not skips — they were never in scope, so they get no plan entry).
@@ -271,9 +295,16 @@ export function planReconcile(
       // (live deparse), so the reconciler can't verify live == source. --baseline trusts it,
       // --rebuild guarantees it by rebuilding from source (relations through the dependency graph
       // below; functions replace in place), and the default flags it for a decision.
+      const pin = pinMismatch(src, liveObj);
       if (options.rebuild) {
         if (isRelation(src.kind)) rebuild.set(src.identity, 'rebuilt from source (first contact, --rebuild)');
         else fnReplace.set(src.identity, 'replaced from source (first contact, --rebuild)');
+      } else if (pin) {
+        // --baseline asserts "live IS the source, trust me". Here we can PROVE it is not, so
+        // recording the assertion would bless the difference permanently — nothing downstream
+        // ever compares these two again. Converge instead, on every path: an object whose pin
+        // is measurably wrong is not unverifiable, it is verifiably different.
+        fnReplace.set(src.identity, `search_path differs from live: ${pin}`);
       } else if (options.baseline) {
         baseline.push(src.identity);
       } else {
@@ -341,6 +372,15 @@ export function planReconcile(
       else fnReplace.set(src.identity, 'source changed');
       continue;
     }
+    // Self-consistent provenance is not proof. A --baseline taken before B2, or a mistaken
+    // --rebaseline, records the declared source hash beside the live def hash without ever
+    // comparing them — so a declared pin the database does not have reads as up to date on
+    // every run. The structural read is what breaks that loop; it self-heals in one apply.
+    const pin = pinMismatch(src, liveObj);
+    if (pin) {
+      fnReplace.set(src.identity, `search_path differs from live: ${pin}`);
+      continue;
+    }
     // Up-to-date (src + live both match provenance). If provenance predates body_hash, record it
     // once — a record-only backfill that ARMS the authz-only fast path for a future grant change.
     // Converges: after this run the row has body_hash, so it skips cleanly next time.
@@ -430,8 +470,15 @@ export function planReconcile(
         );
       } else {
         const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
-        const statements = diffObjectGrants(target, parsed.grants, liveObj.grants);
+        // Functions carry ownership context; relations do not (relacl's NULL means owner-only
+        // and aclexplode(NULL) is empty, so a relation's grant set does not shift with its owner).
+        const owners = src.kind === 'function'
+          ? { ...(src.owner !== undefined ? { declared: src.owner } : {}), ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}) }
+          : undefined;
+        const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, owners);
         if (statements.length > 0) regrants.push({ identity: src.identity, statements });
+        // Never silent: a withheld revoke is reported every run until the owner is declared.
+        for (const note of suppressed) extraWarnings.push(note);
       }
     }