@everystack/cli 0.4.79 → 0.4.80

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.80] - 2026-09-07
+
+### BREAKING CHANGES
+
+- apply-contract v3 — the default-privilege lock is a server-run gate; redeploy the stage before the first staged db:apply after upgrading
+
+### Added
+
+- empty-edge summary names the ungoverned grantees, not 35 tables
+- carryUngovernedAuthz — the full-prediction merge helper (N3 step 1)
+- predictLiveState carryUngoverned — the full endpoint flavor (N3 step 2)
+- the plan `to` is the full endpoint, verified and disclosed (N3 steps 3-5)
+- a plan-created serial sequence is granted in the same plan
+- the plan locks the default-privilege posture it predicted from
+
+### Fixed
+
+- the full endpoint carries default privileges onto plan-created objects
+- bump apply-contract to v2 for the full endpoint; sharpen the empty-edge summary
+- db:check fails on a named artifact path with nothing at it
+
+### Documentation
+
+- the plan `to` flavor; test: condition (a) drop end-to-end (N3 step 6)
+- every db verb has a reference entry, and a test says so
+- the disclosed gap names what actually compiles, and a test pins it
+- the last two rollback-point sentences say what the code does; the retargeting edge is named
+
 ## [0.4.79] - 2026-09-07
 
 ### Removed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.79",
+  "version": "0.4.80",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/apply-execute.ts

@@ -38,7 +38,7 @@ import {
   COLUMN_GRANTS_SQL,
   EFFECTIVE_PRIVILEGES_SQL,
   SCHEMA_ACL_SQL,
-  SEQUENCE_ACLS_SQL,
+  SEQUENCE_ACLS_SQL, DEFAULT_ACL_SQL,
   type QueryRunner,
   type AuthzContract,
 } from './authz-contract';
@@ -56,10 +56,9 @@ import {
 } from './schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog';
 import { fingerprintLive, FINGERPRINT_VERSION } from './schema-fingerprint';
-import { governedLiveFingerprint } from './edge-plan';
 import { applyGeneratedStatements } from './state-apply';
 import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply';
-import { checkPlanPrecondition, planHash, type EdgePlan } from './edge-plan';
+import { checkPlanPrecondition, planHash, defaultAclHash, type EdgePlan } from './edge-plan';
 import type { DescentLedgerRow } from './git-descent';
 
 /**
@@ -255,6 +254,9 @@ export async function liveBaseAndLedger(session: SessionRunner): Promise<LiveBas
     [
       COLUMNS_SQL, CONSTRAINTS_SQL, ENUMS_SQL, INDEXES_SQL, SEQUENCES_SQL, EXTENSIONS_SQL,
       RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, FUNCTIONS_SQL,
+      // The default-privilege posture the plan's `defaultAclHash` is checked against — read in
+      // the SAME session as the lock's state, so the two gates describe one instant.
+      DEFAULT_ACL_SQL,
       { sql: SCHEMA_LOG_WITNESS_SQL, allowFailure: true },
     ],
     INTROSPECTION_SESSION,
@@ -270,8 +272,9 @@ export async function liveBaseAndLedger(session: SessionRunner): Promise<LiveBas
     columnGrants: results[9] as any[], effectivePrivileges: results[10] as any[],
     schemaAcls: results[11] as any[], sequenceAcls: results[12] as any[],
     functions: (results[13] as any[]).map(contractFunctionRow),
+    defaultAcls: results[14] as any[],
   });
-  const ledger = mapLedgerRows(rowsOrEmpty(results[14]));
+  const ledger = mapLedgerRows(rowsOrEmpty(results[15]));
   return { hash: fingerprintLive(snapshot, contract).hash, snapshot, contract, ledger };
 }
 
@@ -284,15 +287,17 @@ export async function executeApplyPlan(
 ): Promise<ApplyPlanResult> {
   const { hash: live, snapshot: before, contract: beforeAuthz, ledger } = await liveBaseAndLedger(session);
 
-  // Two flavors, matched to what each check compares (see EdgePlan): the RAW
-  // hash for live-vs-live (the lock, the backup chain), the GOVERNED hash for
-  // declared-vs-live (already-applied here, verify-after below) — computed with
-  // the exact set the mint stamped on the plan. A plan minted before the field
-  // existed verifies raw, as it was minted.
-  const governed = plan.governedRoles ? new Set(plan.governedRoles) : undefined;
-  const governedLive = governed ? governedLiveFingerprint(before, beforeAuthz, governed) : live;
+  // The endpoint is FULL (it carries the ungoverned live authz through), so it is compared against
+  // the RAW live hash directly — the same flavor as `from`. A plan without that flavor predates
+  // the full endpoint (N3, milestone plan-endpoint-full): its `to` is a governed hash, and
+  // verifying the full live against it would false-fail AFTER the DDL landed. Refuse and re-mint.
+  if (plan.toFlavor !== 'full') {
+    const reason = 'this plan predates the full endpoint — its `to` is a governed fingerprint. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'plan flavor', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
 
-  if (governedLive === plan.toFingerprint) {
+  if (live === plan.toFingerprint) {
     return { status: 'already-applied', liveFingerprint: live };
   }
   const pre = checkPlanPrecondition(plan, live);
@@ -301,6 +306,24 @@ export async function executeApplyPlan(
     return { status: 'refused', liveFingerprint: live, reason: pre.reason };
   }
 
+  // The lock covers object state. The default-privilege posture is not object state — `from`
+  // never hashed it — yet the FULL prediction consumed it for every object this plan creates.
+  // Compare it BEFORE any write: an ALTER DEFAULT PRIVILEGES since minting used to pass the
+  // lock, land the DDL, and fail verify-after post-DDL. A plan without the field predates the
+  // gate and cannot be checked; plans are minutes old, so refusing costs one re-mint.
+  if (plan.defaultAclHash === undefined) {
+    const reason = 'this plan predates the default privileges lock — it carries no defaultAclHash. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'default privileges', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
+  if (defaultAclHash(beforeAuthz) !== plan.defaultAclHash) {
+    const reason =
+      'the default-privilege posture (ALTER DEFAULT PRIVILEGES) moved since minting — the plan predicted its endpoint ' +
+      'from the old one, so the objects it creates would land with grants it did not carry. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'default privileges', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
+
   if (options.checkDescent) {
     const descent = await options.checkDescent({ snapshot: before, contract: beforeAuthz, fingerprint: live, ledger });
     if (!descent.ok) {
@@ -347,19 +370,19 @@ export async function executeApplyPlan(
     ...(options.descentNote ? { descentNote: options.descentNote } : {}),
   });
 
-  const { hash: landed, snapshot: after, contract: afterAuthz } = await liveBaseFingerprint(session);
+  const { hash: landed } = await liveBaseFingerprint(session);
   if (result.logId !== undefined) {
-    // The log stamps the RAW landed hash — the same flavor as `from`, so the
+    // The log stamps the RAW landed hash — the same flavor as `from` AND as the full `to`, so the
     // schema_log chain reads as one consistent series of live states.
     await runner(renderSchemaLogFingerprintUpdate(result.logId, landed));
   }
 
-  const governedLanded = governed ? governedLiveFingerprint(after, afterAuthz, governed) : landed;
-  if (governedLanded !== plan.toFingerprint) {
+  // The full `to` equals the post-apply raw live hash, so verify-after compares them directly.
+  if (landed !== plan.toFingerprint) {
     return {
       status: 'verify-failed',
       liveFingerprint: landed,
-      reason: `applied, but the target landed on ${governedLanded.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
+      reason: `applied, but the target landed on ${landed.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
       ...(result.logId !== undefined ? { logId: result.logId } : {}),
     };
   }

package/src/cli/authz-contract.ts

@@ -357,6 +357,15 @@ export interface AuthzContract {
    * it did not read.
    */
   sequenceGrants?: SequenceGrantContract[];
+  /**
+   * Default privileges (`pg_default_acl`) that fire for objects the current role CREATES —
+   * `{ tables, sequences }`, each schema (`''` = all schemas) → grantee → sorted privileges. The
+   * FULL prediction folds the ungoverned slice onto plan-created objects: Postgres auto-grants
+   * them at creation, so a `to` endpoint without them false-verify-fails a successful CREATE
+   * apply on a brownfield BI stage. Absent means NOT MEASURED (older recorder, hand-built
+   * fixture) — the prediction then models no default ACL, as before.
+   */
+  defaultAcls?: { tables: DefaultAclScope; sequences: DefaultAclScope };
 }
 
 /**
@@ -682,6 +691,59 @@ export function assembleSequenceGrants(rows: readonly SequenceAclRow[]): Sequenc
   return [...bySequence.values()].sort((a, b) => a.sequence.localeCompare(b.sequence));
 }
 
+/**
+ * The default privileges (`ALTER DEFAULT PRIVILEGES`) that fire for TABLES and SEQUENCES the
+ * CURRENT role creates — so the prediction can model what a plan-CREATED object will carry.
+ *
+ * `pg_default_acl` is keyed by (defaclrole, defaclnamespace, defaclobjtype). An object created by
+ * role R in schema S receives the ACL for (R, S) AND for (R, all-schemas). We read the current
+ * role's rows only: everystack applies as one operator, so the creator IS the introspector. A
+ * NULL `defaclnamespace` means "every schema" — reported as an empty schema string so the
+ * resolver can union it with any specific schema. Objtype 'r' is a table, 'S' a sequence.
+ */
+export const DEFAULT_ACL_SQL = `
+SELECT
+  COALESCE(n.nspname, '') AS schema,
+  d.defaclobjtype AS objtype,
+  COALESCE(r.rolname, 'PUBLIC') AS grantee,
+  a.privilege_type AS privilege
+FROM pg_default_acl d
+LEFT JOIN pg_namespace n ON n.oid = d.defaclnamespace
+CROSS JOIN LATERAL aclexplode(d.defaclacl) a
+LEFT JOIN pg_roles r ON r.oid = a.grantee
+WHERE d.defaclrole = (SELECT oid FROM pg_roles WHERE rolname = current_user)
+  AND d.defaclobjtype IN ('r', 'S')
+  AND (n.nspname IS NULL OR (n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'))
+ORDER BY 1, 2, 3, 4;
+`.trim();
+
+export interface DefaultAclRow {
+  schema: unknown;
+  /** 'r' = table, 'S' = sequence. */
+  objtype: unknown;
+  grantee: unknown;
+  privilege: unknown;
+}
+
+/** schema (`''` = all schemas) → grantee → sorted privileges. */
+export type DefaultAclScope = Record<string, Record<string, string[]>>;
+
+/** Fold the per-privilege rows into { tables, sequences }, each schema → grantee → privileges. */
+export function assembleDefaultAcls(rows: readonly DefaultAclRow[]): { tables: DefaultAclScope; sequences: DefaultAclScope } {
+  const tables: DefaultAclScope = {};
+  const sequences: DefaultAclScope = {};
+  for (const row of rows) {
+    if (row.grantee == null || row.privilege == null) continue;
+    const scope = String(row.objtype) === 'S' ? sequences : String(row.objtype) === 'r' ? tables : null;
+    if (!scope) continue;
+    const schema = String(row.schema ?? '');
+    const grantee = String(row.grantee);
+    const byGrantee = scope[schema] ?? (scope[schema] = {});
+    byGrantee[grantee] = [...new Set([...(byGrantee[grantee] ?? []), String(row.privilege)])].sort();
+  }
+  return { tables, sequences };
+}
+
 /** The two privileges a schema ACL can carry, in aclitem letter form. */
 const SCHEMA_PRIV_LETTERS: Record<string, string> = { U: 'USAGE', C: 'CREATE' };
 
@@ -872,6 +934,8 @@ export interface ContractRows {
   schemaAcls?: SchemaAclRow[];
   /** SEQUENCE_ACLS_SQL. Optional — absent means not measured, never "no sequences". */
   sequenceAcls?: SequenceAclRow[];
+  /** DEFAULT_ACL_SQL. Optional — absent means not measured, never "no default privileges". */
+  defaultAcls?: DefaultAclRow[];
   /** Already-mapped function descriptors (from security-catalog's FUNCTIONS_SQL). */
   functions: { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean; ownerIsSuperuser?: boolean }[];
 }
@@ -966,6 +1030,7 @@ export function assembleContract(rows: ContractRows): AuthzContract {
     ...(schemaAcls ? { schemaAcls } : {}),
     // Same absent-means-unmeasured contract as schemaAcls above.
     ...(rows.sequenceAcls ? { sequenceGrants: assembleSequenceGrants(rows.sequenceAcls) } : {}),
+    ...(rows.defaultAcls ? { defaultAcls: assembleDefaultAcls(rows.defaultAcls) } : {}),
   };
 }
 
@@ -978,8 +1043,8 @@ export async function introspectContract(
   // ONE session: the queries describe one moment under one pinned search_path.
   // Policy USING / WITH CHECK expressions deparse relative to that path, so a read spread
   // across connections can report authz drift that does not exist.
-  const [rls, policies, grants, columnGrants, effectivePrivileges, schemaAcls, sequenceAcls, fnRows] = await session(
-    [RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, functionsSql],
+  const [rls, policies, grants, columnGrants, effectivePrivileges, schemaAcls, sequenceAcls, defaultAcls, fnRows] = await session(
+    [RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, DEFAULT_ACL_SQL, functionsSql],
     INTROSPECTION_SESSION,
   );
   return assembleContract({
@@ -990,6 +1055,7 @@ export async function introspectContract(
     effectivePrivileges: effectivePrivileges as EffectivePrivilegeRow[],
     schemaAcls: schemaAcls as SchemaAclRow[],
     sequenceAcls: sequenceAcls as SequenceAclRow[],
+    defaultAcls: defaultAcls as DefaultAclRow[],
     functions: (fnRows as any[]).map(mapFunctionRow),
   });
 }

package/src/cli/authz-reconcile.ts

@@ -89,6 +89,61 @@ export function ungovernedGrants(live: AuthzContract, governed: ReadonlySet<stri
   return out.sort((a, b) => a.grantee.localeCompare(b.grantee) || a.table.localeCompare(b.table));
 }
 
+/**
+ * A declared table's authz AFTER the edge lands — the FULL prediction's per-table building block.
+ *
+ * The reconciler converges the GOVERNED roles onto the declared contract and leaves every other
+ * (foreign) grantee alone. So the post-apply truth for a declared table is: the declared contract
+ * PLUS the live authz of the ungoverned roles. The governed prediction drops that second half; on
+ * a brownfield stage the foreign grants live on, so a `to` endpoint without them can never equal
+ * the post-apply full live hash (milestone plan-endpoint-full).
+ *
+ * Carried ONLY onto objects the declared target still has (condition (a) of the N2 ruling):
+ *  - table-level grants ride whole — the table is present by construction;
+ *  - a column grant rides only for the columns in `presentColumns`; a grant on a column the edge
+ *    DROPS is gone after apply, so carrying it would predict an endpoint the apply cannot reach —
+ *    a false verify-failed after the DDL already landed;
+ *  - a policy rides only when EVERY role it names is ungoverned. A policy touching a governed role
+ *    is the reconciler's to manage, so it is not carried here (if the reconciler leaves it, the
+ *    verify-after fails LOUD rather than being hidden).
+ *
+ * The declared (governed) grants always win over any live grant to the same role: a governed role
+ * whose live grant the models dropped must be REVOKED by the plan, never carried through.
+ */
+export function carryUngovernedAuthz(
+  declared: TableContract,
+  live: TableContract,
+  governed: ReadonlySet<string>,
+  presentColumns: ReadonlySet<string>,
+): TableContract {
+  const foreign = (role: string): boolean => !isGoverned(governed, role);
+
+  const grants: Record<string, string[]> = { ...declared.grants };
+  for (const [role, privileges] of Object.entries(live.grants)) {
+    if (foreign(role)) grants[role] = [...privileges];
+  }
+
+  const columnGrants: Record<string, Record<string, string[]>> = { ...(declared.columnGrants ?? {}) };
+  for (const [role, byPrivilege] of Object.entries(live.columnGrants ?? {})) {
+    if (!foreign(role)) continue;
+    const kept: Record<string, string[]> = {};
+    for (const [privilege, columns] of Object.entries(byPrivilege)) {
+      const present = columns.filter((c) => presentColumns.has(c));
+      if (present.length > 0) kept[privilege] = present;
+    }
+    if (Object.keys(kept).length > 0) columnGrants[role] = kept;
+  }
+
+  const carriedPolicies = live.policies.filter((p) => p.roles.length > 0 && p.roles.every(foreign));
+
+  return {
+    ...declared,
+    grants,
+    ...(Object.keys(columnGrants).length > 0 ? { columnGrants } : {}),
+    policies: [...declared.policies, ...carriedPolicies],
+  };
+}
+
 /**
  * The exemption report, one line per grantee — the shared rendering every surface prints.
  *
@@ -307,7 +362,18 @@ function reconcileSequenceGrants(
 export function emitReconcileSql(
   declared: AuthzContract,
   live: AuthzContract,
-  opts: { governedRoles?: ReadonlySet<string> } = {},
+  opts: {
+    governedRoles?: ReadonlySet<string>;
+    /**
+     * The serial sequences the SAME plan's data phase CREATES (a new serial table, a serial
+     * column added to an existing one) — reconciled as if live with no grants. Without them a
+     * created sequence got no governed grant until the NEXT plan: db:apply verified green and
+     * every INSERT by the governed holder failed `permission denied for sequence` for one plan
+     * cycle (milestone finish-0-4-x F1). They are emitted even when the live side never read
+     * sequences: the plan creates these, so there is no unread live state to misjudge.
+     */
+    createdSequences?: readonly SequenceGrantContract[];
+  } = {},
 ): string[] {
   // Condition C — two phases PER TABLE in one transaction: every access-REMOVING statement
   // (policy DROP, REVOKE, RLS ENABLE/FORCE) before every access-ADDING one (policy CREATE, GRANT,
@@ -325,7 +391,7 @@ export function emitReconcileSql(
   // Absent = the recorder never read sequences; skip the pass entirely rather than diff
   // against a set nobody measured. Grouped once, not re-scanned per table.
   const sequencesByTable = new Map<string, SequenceGrantContract[]>();
-  for (const seq of live.sequenceGrants ?? []) {
+  for (const seq of [...(live.sequenceGrants ?? []), ...(opts.createdSequences ?? [])]) {
     (sequencesByTable.get(seq.table) ?? sequencesByTable.set(seq.table, []).get(seq.table)!).push(seq);
   }
 

package/src/cli/commands/db-check.ts

@@ -80,6 +80,15 @@ export interface StaticCheckInput {
   artifactPath: string;
   /** null = no generated schema artifact on disk. */
   artifactSource: string | null;
+  /**
+   * Where `artifactPath` came from — the same resolution db:generate records. An ABSENT artifact
+   * is only "nothing to match" at the untouched default (an app that never generated one). A path
+   * the operator named with `--schema-out`, or one the journal recorded, is a claim that an
+   * artifact lives there; its absence is the artifact gate vanishing, and must FAIL. Measured:
+   * `db:check --schema-out db/does-not-exist.ts` printed the note and passed with exit 0.
+   * Absent = default (older callers).
+   */
+  artifactOrigin?: 'flag' | 'recorded' | 'default';
   /** Set when a retired db/sql directory still carries .sql files — the tombstone
    *  message (with the migration path); a hard fail, never a shrug. */
   sqlDirRetired?: string | null;
@@ -250,7 +259,19 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
-  if (input.artifactSource === null) {
+  if (input.artifactSource === null && input.artifactOrigin === 'flag') {
+    findings.push({
+      level: 'fail',
+      area: 'artifact',
+      message: `no generated schema at ${input.artifactPath} — the path came from --schema-out, so an artifact is expected there. Fix the path, or run db:generate to write it. A named path with nothing at it is a gate that guards nothing.`,
+    });
+  } else if (input.artifactSource === null && input.artifactOrigin === 'recorded') {
+    findings.push({
+      level: 'fail',
+      area: 'artifact',
+      message: `no generated schema at ${input.artifactPath} — the migration journal records that path as the artifact (db:generate wrote it there). Restore it, run db:generate, or re-record with --schema-out.`,
+    });
+  } else if (input.artifactSource === null) {
     findings.push({
       level: 'note',
       area: 'artifact',
@@ -393,7 +414,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
   } catch { /* no baseline — see above */ }
 
   const findings = runStaticChecks({
-    modelsPath, models, modelsError, modelFileScans, extensions, artifactPath, artifactSource, sqlDirRetired,
+    modelsPath, models, modelsError, modelFileScans, extensions, artifactPath, artifactSource, artifactOrigin: artifactRes.source, sqlDirRetired,
     sequences: declaredDb?.sequences, derived: declaredDb?.derived, derivedError,
     moduleModels: declaredDb?.models ?? null,
     baselineSource,

package/src/cli/commands/db-plan.ts

@@ -49,7 +49,7 @@ import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } fr
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { readStageStateTwice } from '../stage-read-consistency';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
-import { mintEdgePlan, planHash, buildPlanSummary } from '../edge-plan';
+import { mintEdgePlan, planHash, buildPlanSummary, explainCarriedBy } from '../edge-plan';
 import { proveDescent, describeDriftOrigin, proveLineageLost, realLineageProbe, type ProveVerdict, type LineageProof } from '../git-descent';
 import { fingerprintLive, divergentSurfaces } from '../schema-fingerprint';
 import { predictLiveState } from '../edge-plan';
@@ -337,16 +337,22 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
       await fs.writeFile(out, body, 'utf8');
     }
 
-    // An EMPTY edge between two different fingerprints reads as a contradiction. `from` is the
-    // target's full fingerprint (the concurrency lock at apply); `to` is the declared endpoint
-    // through the models' governed set. They differ by exactly what the plan leaves alone — name
-    // it, computed at mint from the two canonical forms, never stored on the plan.
-    const carriedBy = plan.statements.length === 0 && plan.fromFingerprint !== plan.toFingerprint
-      ? divergentSurfaces(
-        predictLiveState(models, snapshot, contract, { governedRoles: governedRoleSet(declaredAuthz, declaredGovernedRoles) }).canonical,
-        fingerprintLive(snapshot, contract).canonical,
-      )
-      : undefined;
+    // An EMPTY edge still has a story to tell, and the two cases tell DIFFERENT ones:
+    //  - `from == to`: the full endpoint carried the foreign grants through, so the plan is empty
+    //    AND equal. Name the ungoverned roles (condition (c)) — the operator must still see what
+    //    rides untouched and under which baseline.
+    //  - `from != to`: the FULL prediction failed to reproduce raw live — a real, unexplained
+    //    divergence. The foreign grants are ABSORBED into `to`, so they are NOT the cause; naming
+    //    them would misdirect. Name the divergent surface of the FULL prediction vs live instead.
+    const emptyEdge = plan.statements.length === 0;
+    const carriedBy = !emptyEdge
+      ? undefined
+      : plan.fromFingerprint === plan.toFingerprint
+        ? explainCarriedBy(exemptions, [])
+        : divergentSurfaces(
+          predictLiveState(models, snapshot, contract, { governedRoles: governedRoleSet(declaredAuthz, declaredGovernedRoles), carryUngoverned: true }).canonical,
+          fingerprintLive(snapshot, contract).canonical,
+        );
     for (const line of buildPlanSummary(plan, carriedBy ? { carriedBy } : {})) info(line);
     info(`plan_ref: ${planHash(plan).slice(0, 12)}`);
 

package/src/cli/edge-plan.ts

@@ -27,13 +27,16 @@
 import { createHash } from 'node:crypto';
 import type { ModelDescriptor } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect';
-import type { AuthzContract } from './authz-contract';
+import type { AuthzContract, SequenceGrantContract, DefaultAclScope } from './authz-contract';
+import { ownSequenceName } from './schema-diff';
 import { generateMigrationSql, unmodeledTables } from './migration-generate';
 import { compileTableContract } from './authz-compile';
+import { carryUngovernedAuthz, inheritedSequenceGrants, type GrantExemption } from './authz-reconcile';
+import { BASELINE_FILE } from './authz-baseline';
 import { classifyGeneratedStatements, classifyDestructive, partitionStatements, renderStatementHistogram } from './state-apply';
-import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, FINGERPRINT_VERSION, type Fingerprint } from './schema-fingerprint';
+import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, schemaOf, FINGERPRINT_VERSION, type Fingerprint } from './schema-fingerprint';
 import { compileDeclaredState } from './declared-diff';
-import { compileTableRenames, compileTableMoves } from './schema-compile';
+import { compileTableRenames, compileTableMoves, compileRenames } from './schema-compile';
 
 export const PLAN_VERSION = 2;
 
@@ -48,8 +51,20 @@ export const PLAN_VERSION = 2;
  * runs, or a gate's semantics. Both packages import THIS binding (the server from the cli it
  * bundles), so a version skew is a hard, exact-equality refusal in both directions — never a
  * silently dropped gate.
+ *
+ * v2 (milestone plan-endpoint-full): `plan.toFingerprint` became the FULL endpoint (carries the
+ * ungoverned live authz through) and the server verifies the raw landed hash against it. An
+ * un-redeployed v1 ops Lambda would verify a GOVERNED landed hash against the full `to` and report
+ * verify-failed on a SUCCESSFUL brownfield apply — so the meaning of a gate changed and the peers
+ * must not mix. The handshake now forces a stage redeploy before an apply crosses versions.
+ *
+ * v3 (milestone finish-0-4-x): the payload gained `plan.defaultAclHash` and the server runs a new
+ * gate on it (`default privileges`, pre-dispatch). A v2 ops Lambda would ignore the key and skip
+ * the gate — not a false pass of the apply (it degrades to the post-DDL verify failure), but a
+ * silently dropped gate the operator was told is in force. The BUMP RULE says a gate the server
+ * runs is part of the contract, so the peers refuse until the stage is redeployed.
  */
-export const APPLY_CONTRACT_VERSION = 1;
+export const APPLY_CONTRACT_VERSION = 3;
 
 /** Classification counts (brick 9, decision 11): destructive = drops + narrowings + strips. */
 export interface PlanClassification {
@@ -82,13 +97,29 @@ export interface EdgePlan {
    */
   fpVersion?: number;
   /**
-   * The predicted live fingerprint after apply — exact, unmodeled-aware, and
-   * GOVERNED: hashed through the models' governed-role set (`governedRoles`
-   * below), because it is a declared-vs-live claim. Compare it only against
-   * `governedLiveFingerprint` computed with the same set — never against the
-   * raw `from` flavor.
+   * The predicted live fingerprint after apply — exact and unmodeled-aware. Its FLAVOR is
+   * `toFlavor`: a `full` endpoint (every plan minted since N3) carries the ungoverned live authz
+   * through, so it equals the post-apply RAW live hash and db:apply compares `from`-flavor live
+   * against it directly. A `governed`/absent endpoint predates the full flavor and db:apply
+   * REFUSES it — comparing a full live hash against a governed `to` would false-verify-fail after
+   * the DDL already landed.
    */
   toFingerprint: string;
+  /**
+   * Which flavor `toFingerprint` is (milestone plan-endpoint-full). `full` carries the ungoverned
+   * live grants/policies/sequence ACLs through the prediction and is what db:apply verifies
+   * against. Absent means a pre-N3 plan whose `to` was governed — db:apply refuses it (re-mint).
+   */
+  toFlavor?: 'governed' | 'full';
+  /**
+   * The content address of the default-privilege posture (`pg_default_acl`, tables + sequences,
+   * every schema and grantee) the FULL prediction consumed at mint. `from` never hashed it —
+   * default ACLs are not object state — so an `ALTER DEFAULT PRIVILEGES` between mint and apply
+   * passed the concurrency lock, the DDL landed, and verify-after failed POST-DDL. db:apply
+   * compares this against the live posture BEFORE dispatch and refuses on a difference; absent
+   * means a plan minted before the lock existed, and db:apply refuses that too (re-mint).
+   */
+  defaultAclHash?: string;
   /**
    * The governed-role set `to` was hashed under, sorted — carried on the plan
    * so every apply venue verifies with the exact set the mint used. Absent on
@@ -162,7 +193,7 @@ export function predictLiveFingerprint(
   models: ModelDescriptor[],
   snapshot: SchemaSnapshot,
   contract: AuthzContract,
-  opts: { schema?: string; governedRoles?: ReadonlySet<string> } = {},
+  opts: { schema?: string; governedRoles?: ReadonlySet<string>; carryUngoverned?: boolean } = {},
 ): string {
   return predictLiveState(models, snapshot, contract, opts).hash;
 }
@@ -176,14 +207,20 @@ export function predictLiveState(
   models: ModelDescriptor[],
   snapshot: SchemaSnapshot,
   contract: AuthzContract,
-  opts: { schema?: string; governedRoles?: ReadonlySet<string> } = {},
+  opts: { schema?: string; governedRoles?: ReadonlySet<string>; carryUngoverned?: boolean } = {},
 ): Fingerprint {
-  // The prediction is a DECLARED-vs-live comparison, so it must hash through the
-  // models' governed set — the live side of any comparison against it must use
-  // the same set (see governedLiveFingerprint). Unfiltered, every ride-through
-  // table's foreign grants poison the endpoint and verify-after can never pass
-  // on a brownfield target.
+  // Two FLAVORS (milestone plan-endpoint-full):
+  //  - GOVERNED (default): hash through the models' governed set. A DECLARED-vs-live comparison —
+  //    the descent declares-test and db:check — must ignore the foreign grants the reconciler
+  //    leaves alone, or it reads "drifted" against a state the models can never reach.
+  //  - FULL (`carryUngoverned`): the plan's `to` endpoint. The reconciler converges the governed
+  //    roles and leaves the foreign ones, so the post-apply truth is the declared contract PLUS
+  //    the live ungoverned authz. Carry it through and hash UNFILTERED, so `to` equals the
+  //    post-apply full live hash and an empty plan means the two fingerprints are equal.
+  const carry = opts.carryUngoverned === true;
   const governedRoles = opts.governedRoles ?? governedRolesForModels(models);
+  const foreignGrantee = (role: string): boolean =>
+    !governedRoles.has(role) && !(role.toUpperCase() === 'PUBLIC' && governedRoles.has('PUBLIC'));
   const declared = compileDeclaredState(models, { schema: opts.schema });
   const declaredTables = new Set(declared.snapshot.tables.map((t) => t.table));
   const currentNames = new Set(snapshot.tables.map((t) => t.table));
@@ -214,16 +251,122 @@ export function predictLiveState(
       ...(snapshot.enums ?? []).filter((e) => !declaredEnums.has(e.name)),
     ],
   };
+  // The live counterpart of a declared table: its rename or move source when the edge brings it
+  // in under a new name, else its own name. Grants, policies and owned sequences survive RENAME
+  // TABLE and SET SCHEMA alike (they attach by OID), so the foreign authz carries across both.
+  // A model cannot declare both, so the two maps never collide.
+  const priorNameOf: Record<string, string> = {
+    ...compileTableMoves(models, { schema: opts.schema }),
+    ...compileTableRenames(models, { schema: opts.schema }),
+  };
+  const liveNameFor = (declaredTable: string): string =>
+    !currentNames.has(declaredTable) && currentNames.has(priorNameOf[declaredTable] ?? '')
+      ? priorNameOf[declaredTable]
+      : declaredTable;
+  const liveByTable = new Map(contract.tables.map((t) => [t.table, t]));
+  const declaredColumnsByTable = new Map(
+    declared.snapshot.tables.map((t) => [t.table, new Set(t.columns.map((c) => c.name))]),
+  );
+
+  // The UNGOVERNED default-privilege grants that fire for an object created in `schema` — the
+  // schema-specific rows unioned with the all-schemas ('') rows, foreign grantees only. Postgres
+  // applies these at CREATE, so a plan-created table/sequence lands with them; the reconciler
+  // never touches a foreign role, so they persist. Governed roles are excluded — the reconciler
+  // sets those explicitly and the declared contract already models them.
+  const defaultAclFor = (scope: DefaultAclScope | undefined, schema: string): Record<string, string[]> => {
+    if (!scope) return {};
+    const out: Record<string, string[]> = {};
+    for (const key of ['', schema]) {
+      for (const [grantee, privileges] of Object.entries(scope[key] ?? {})) {
+        if (foreignGrantee(grantee)) out[grantee] = [...new Set([...(out[grantee] ?? []), ...privileges])].sort();
+      }
+    }
+    return out;
+  };
+
+  // FULL flavor: each declared table's authz AFTER apply = declared contract + the live authz of
+  // the ungoverned roles, carried onto the columns the declared target keeps (carryUngovernedAuthz).
+  // A CREATED table (no live counterpart) has nothing to carry — but Postgres applies the schema's
+  // default privileges to it at creation, so fold the ungoverned default ACL in, or the endpoint
+  // omits a grant the apply lands and verify-after false-fails.
+  const declaredAuthz = carry
+    ? declared.contract.tables.map((d) => {
+      const liveTable = liveByTable.get(liveNameFor(d.table));
+      if (liveTable) return carryUngovernedAuthz(d, liveTable, governedRoles, declaredColumnsByTable.get(d.table) ?? new Set());
+      const defaultGrants = defaultAclFor(contract.defaultAcls?.tables, schemaOf(d.table));
+      return Object.keys(defaultGrants).length > 0 ? { ...d, grants: { ...d.grants, ...defaultGrants } } : d;
+    })
+    : declared.contract.tables;
   const mergedAuthz = [
-    ...declared.contract.tables,
+    ...declaredAuthz,
     ...contract.tables.filter((t) => ridesThrough(t.table)),
   ];
+
   // Sequence ACLs (v11): declared tables DERIVE their reconciled (inherited) target, so pass
   // measured ACLs ONLY for rides-through tables — the ones reconciliation never touches, whose
   // live ACLs carry through unchanged. Passing all measured would make a declared table's
   // predicted endpoint read its pre-reconcile ACL and never converge with the plan it mints.
   const ridesThroughSeqGrants = (contract.sequenceGrants ?? []).filter((s) => ridesThrough(s.table));
-  return fingerprintState(mergedSnapshot, mergedAuthz, { governedRoles, sequenceGrants: ridesThroughSeqGrants });
+  let sequenceGrants = ridesThroughSeqGrants;
+  if (carry) {
+    // FULL flavor, the sequence combine: a declared table's sequence lands with its GOVERNED
+    // grants DERIVED (the reconciler converges them onto the A6 inheritance) AND its FOREIGN
+    // grants MEASURED (the reconciler skips ungoverned roles, so their direct grants are
+    // unchanged). Deriving alone drops the foreign grant; passing the live measured grants reads
+    // a stale (pre-reconcile) governed shape. So synthesize one entry per live sequence whose
+    // grants = inherited-governed ∪ that-sequence's-foreign-live-grants, and hash UNFILTERED.
+    const liveSeqByTable = new Map<string, SequenceGrantContract[]>();
+    for (const s of contract.sequenceGrants ?? []) {
+      (liveSeqByTable.get(s.table) ?? liveSeqByTable.set(s.table, []).get(s.table)!).push(s);
+    }
+    const declaredColumnsFor = new Map(declared.snapshot.tables.map((t) => [t.table, t.columns]));
+    const liveColumnsFor = new Map(snapshot.tables.map((t) => [t.table, new Set(t.columns.map((c) => c.name))]));
+    const columnRenames = compileRenames(models, { schema: opts.schema });
+    const declaredSeqGrants: SequenceGrantContract[] = [];
+    for (const d of declaredAuthz) {
+      if (ridesThrough(d.table)) continue;
+      const inherited = inheritedSequenceGrants(d);
+      const liveName = liveNameFor(d.table);
+      for (const s of liveSeqByTable.get(liveName) ?? []) {
+        const foreign: Record<string, string[]> = {};
+        for (const [role, privileges] of Object.entries(s.grants)) {
+          if (foreignGrantee(role)) foreign[role] = privileges;
+        }
+        declaredSeqGrants.push({
+          sequence: s.sequence,
+          table: d.table,
+          grants: { ...inherited, ...foreign },
+          ...(s.identity !== undefined ? { identity: s.identity } : {}),
+        });
+      }
+      // The sequences THIS plan creates — every serial column of a created table, or a serial
+      // column ADDED to a live one. `plannedSerialSequences` grants by the diff's `createTable` /
+      // `addColumn` changes; this side has no diff in hand, so it reads the same facts off the
+      // live snapshot: a column is added when neither its own name nor its `renamedFrom` source
+      // exists live (a rename is a `renameColumn` change and creates nothing). Each lands with the
+      // governed inheritance the same plan grants (finish-0-4-x F1) PLUS the SEQUENCE default ACL
+      // Postgres applied at creation for the foreign roles. Identity columns own no nextval
+      // default and are excluded on both sides, so only serial columns count.
+      const liveColumns = liveColumnsFor.get(liveName);
+      const renamedFromOf = columnRenames[d.table] ?? {};
+      const existsLive = (column: string): boolean =>
+        liveColumns?.has(column) === true || (renamedFromOf[column] !== undefined && liveColumns?.has(renamedFromOf[column]) === true);
+      const seqDefaultGrants = defaultAclFor(contract.defaultAcls?.sequences, schemaOf(d.table));
+      (declaredColumnsFor.get(d.table) ?? [])
+        .filter((c) => ownSequenceName(d.table, c) != null && !existsLive(c.name))
+        .forEach((_, i) => declaredSeqGrants.push({
+          sequence: `${d.table}#created_seq_${i}`,
+          table: d.table,
+          grants: { ...seqDefaultGrants, ...inherited },
+          identity: false,
+        }));
+    }
+    sequenceGrants = [...ridesThroughSeqGrants, ...declaredSeqGrants];
+  }
+  return fingerprintState(mergedSnapshot, mergedAuthz, {
+    governedRoles: carry ? undefined : governedRoles,
+    sequenceGrants,
+  });
 }
 
 /**
@@ -283,19 +426,22 @@ export function mintEdgePlan(
   const breakdown = partitionStatements(classified.executable, { declaredGrantees });
   const destructive = breakdown.drops.length + breakdown.narrowings.length + breakdown.strips.length;
 
-  // The plan's two endpoints are two different FLAVORS, deliberately:
-  //  - `from` is the RAW live hash (everything introspected) — the concurrency
-  //    lock and the backup-stamp chain (backup.fp == plan.from) compare
-  //    live-vs-live and must stay computable with no models in hand.
-  //  - `to` is the GOVERNED hash — a declared-vs-live claim, filtered through
-  //    the models' governed set, which rides ON the plan so every venue
-  //    (direct, ops Lambda) verifies with the set the mint used.
+  // The plan's two endpoints are both FULL live hashes, deliberately:
+  //  - `from` is the RAW live hash (everything introspected) — the concurrency lock and the
+  //    backup-stamp chain (backup.fp == plan.from) compare live-vs-live.
+  //  - `to` is the FULL predicted endpoint: the declared state PLUS the ungoverned live authz the
+  //    reconciler leaves alone (carryUngoverned). So `to` equals the post-apply raw live hash, an
+  //    empty plan means `from == to`, and db:apply verifies the full landed hash against it.
+  // The governed set still rides on the plan — the descent declares-test and db:check use it — but
+  // the endpoint itself is full.
   const governedRoles = governedRolesForModels(models, opts.governedRoles);
   return {
     v: PLAN_VERSION,
     fromFingerprint: fingerprintLive(snapshot, contract).hash,
     fpVersion: FINGERPRINT_VERSION,
-    toFingerprint: predictLiveFingerprint(models, snapshot, contract, { schema: opts.schema, governedRoles }),
+    toFingerprint: predictLiveFingerprint(models, snapshot, contract, { schema: opts.schema, governedRoles, carryUngoverned: true }),
+    toFlavor: 'full',
+    defaultAclHash: defaultAclHash(contract),
     declaredFingerprint: fingerprintModels(models, { schema: opts.schema }).hash,
     governedRoles: [...governedRoles].sort(),
     statements,
@@ -384,6 +530,24 @@ export function tablesLeftWithoutARead(statements: readonly string[], live?: Aut
   return dark.sort();
 }
 
+/**
+ * The content address of a contract's default-privilege posture — what `plan.defaultAclHash`
+ * carries and what db:apply recomputes over the live contract before dispatch. The WHOLE
+ * posture, not just the foreign slice the prediction folds in: a governed default ACL changes
+ * what a created object lands with too, and re-minting is free. A contract that never read
+ * default ACLs (an older recorder, a hand-built fixture) hashes as "not measured" — equal to
+ * itself, never to a measured one.
+ *
+ * `current_user`-relative, like the read it hashes (DEFAULT_ACL_SQL keys on the role that will
+ * create the objects). Mint and apply as DIFFERENT database roles that own different default
+ * ACLs, and the hashes differ with no change in between — a false refusal whose escape is one
+ * re-mint. The stage lanes share one operator role, so this only bites a mint over a local DSN
+ * applied through `--stage`, or two local DSNs — and a plan should be minted where it is applied.
+ */
+export function defaultAclHash(contract: Pick<AuthzContract, 'defaultAcls'>): string {
+  return createHash('sha256').update(stableStringify(contract.defaultAcls ?? null)).digest('hex');
+}
+
 /** The plan's content address — recorded as `plan_ref` on the schema_log row. */
 export function planHash(plan: EdgePlan): string {
   return createHash('sha256').update(stableStringify(plan)).digest('hex');
@@ -420,15 +584,42 @@ const short = (hash: string): string => hash.slice(0, 12);
  * cutover, cli 0.4.77). The caller computes it at mint from the canonical forms; it is never
  * stored on the plan.
  */
+/**
+ * What accounts for an EMPTY edge between two DIFFERENT fingerprints — the `carriedBy` the
+ * summary prints. The `from` half is the full live fingerprint (the concurrency lock), the `to`
+ * half the declared endpoint through the governed set, and on a brownfield adopter they differ by
+ * exactly the roles the models do not govern: the reconciler leaves those grants alone. So when
+ * any ungoverned grantee is present, it IS the difference — name the roles and the baseline that
+ * admitted them (`db/authz-baseline.json`). Naming "35 tables differ" instead sent a consumer
+ * hunting a schema change that was not there (0.4.78 re-plan). Fall back to the raw divergent
+ * surfaces only when NO ungoverned grantee explains it — a live object the vocabulary cannot
+ * declare, say a policy on a governed role. Interim: the full fix carries the ungoverned authz
+ * through so the edge is truly empty (milestone plan-endpoint-full, N3).
+ */
+export function explainCarriedBy(
+  exemptions: readonly GrantExemption[],
+  divergent: readonly string[],
+): string[] {
+  const grantees = [...new Set(exemptions.map((e) => e.grantee))].sort();
+  if (grantees.length > 0) {
+    return [`grants to baseline-adopted role(s) ${grantees.join(', ')} (${BASELINE_FILE})`];
+  }
+  return [...divergent];
+}
+
 export function buildPlanSummary(plan: EdgePlan, opts: { carriedBy?: string[] } = {}): string[] {
   const lines: string[] = [];
   lines.push(`edge: ${short(plan.fromFingerprint)} → ${short(plan.toFingerprint)}`);
   if (plan.statements.length === 0) {
+    const carried = opts.carriedBy?.length ? `; carried by: ${opts.carriedBy.join('; ')}` : '';
     if (plan.fromFingerprint === plan.toFingerprint) {
-      lines.push('empty — the target already declares this state');
+      // Condition (c), milestone plan-endpoint-full: the full endpoint carries the foreign grants
+      // through, so a brownfield adopter reaches from == to — but the operator must still see WHICH
+      // ungoverned roles ride through untouched, or the baseline they were admitted under is invisible.
+      lines.push('empty — the target already declares this state' + carried);
     } else {
       lines.push('empty — no statement to emit. The fingerprints differ by what the plan leaves alone: `from` is the target\'s full fingerprint (the concurrency lock), `to` the declared endpoint through the governed set'
-        + (opts.carriedBy?.length ? `; carried by: ${opts.carriedBy.join('; ')}` : '') + '.');
+        + carried + '.');
     }
     return lines;
   }

package/src/cli/migration-generate.ts

@@ -16,12 +16,13 @@
  */
 
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect';
-import type { AuthzContract } from './authz-contract';
+import type { SchemaSnapshot, ColumnSchema } from './schema-introspect';
+import type { AuthzContract, SequenceGrantContract } from './authz-contract';
 import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile';
 import { compileTableContract } from './authz-compile';
 import { emitReconcileSql, governedRoleSet } from './authz-reconcile';
-import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff';
+import { diffSchema, emitSchemaSql, ownSequenceName, type SchemaChange } from './schema-diff';
+import { schemaOf } from './schema-fingerprint';
 
 export interface GenerateOptions {
   /** The Postgres schema the Models live in. Default: `public`. */
@@ -233,12 +234,22 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
       .filter(([, from]) => pendingMoveSources.has(from))
       .map(([to, from]) => [from, to] as const),
   ]);
+  // The owned sequences ride a RENAME/SET SCHEMA with their table (the sequence keeps its
+  // own name), so their live ACLs are keyed under the new table name too — else the sequence
+  // reconcile finds nothing for a renamed table and its inheritance lags a plan behind.
   const liveAuthzRenamed = opts.liveAuthz && pendingByFrom.size > 0
     ? {
         ...opts.liveAuthz,
         tables: opts.liveAuthz.tables.map((t) =>
           pendingByFrom.has(t.table) ? { ...t, table: pendingByFrom.get(t.table)! } : t,
         ),
+        ...(opts.liveAuthz.sequenceGrants
+          ? {
+              sequenceGrants: opts.liveAuthz.sequenceGrants.map((s) =>
+                pendingByFrom.has(s.table) ? { ...s, table: pendingByFrom.get(s.table)! } : s,
+              ),
+            }
+          : {}),
       }
     : opts.liveAuthz;
   const desiredContracts = models.map((m) => compileTableContract(m, { schema }));
@@ -246,6 +257,7 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
   const authzPhase = liveAuthzRenamed
     ? emitReconcileSql(desiredAuthz, liveAuthzRenamed, {
         governedRoles: governedRoleSet(desiredAuthz, opts.governedRoles ?? []),
+        createdSequences: plannedSerialSequences(changes),
       })
     : [];
 
@@ -295,6 +307,28 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
   return [...extensionPhase, ...schemaPhase, ...usagePhase, ...dataPhase, ...authzPhase];
 }
 
+/**
+ * The serial sequences a diff's data phase CREATES — one per serial column in a `createTable`
+ * or `addColumn` change whose default draws the column's OWN conventional `<table>_<col>_seq`
+ * (the `serial` shorthand is what creates it). A foreign `nextval` draws an existing sequence
+ * and creates none; an identity column has no nextval default; a rename/move creates nothing
+ * (the live sequence rides along under its old name). Returned as live-shaped entries with NO
+ * grants, for `emitReconcileSql`'s `createdSequences` — the reconcile then grants the same
+ * plan's INSERT-holders their inheritance right after the CREATE that makes the sequence.
+ */
+export function plannedSerialSequences(changes: readonly SchemaChange[]): SequenceGrantContract[] {
+  const out: SequenceGrantContract[] = [];
+  const push = (table: string, c: ColumnSchema): void => {
+    const seq = ownSequenceName(table, c);
+    if (seq) out.push({ sequence: `${schemaOf(table)}.${seq}`, table, grants: {}, identity: false });
+  };
+  for (const change of changes) {
+    if (change.kind === 'createTable') for (const c of change.schema.columns) push(change.table, c);
+    else if (change.kind === 'addColumn') push(change.table, change.column);
+  }
+  return out;
+}
+
 /** The marker drizzle migration files put between statements. */
 const BREAKPOINT = '\n--> statement-breakpoint\n';
 

package/src/cli/schema-diff.ts

@@ -208,10 +208,21 @@ export function sequenceCreateSql(seq: SequenceSchema): string {
   return `${s};`;
 }
 
+/**
+ * The bare name of the sequence a column OWNS through the `serial` shorthand — its conventional
+ * `<table>_<col>_seq` — or null: a foreign `nextval` draws an existing sequence and owns none,
+ * and an identity column has no nextval default. This is the one place that spells the
+ * convention; the CREATE/ADD renderer, the created-sequence grant, and the endpoint prediction
+ * all read it here so they cannot disagree about which columns make a sequence.
+ */
+export function ownSequenceName(table: string, col: ColumnSchema): string | null {
+  const seq = nextvalSequence(col.default);
+  return seq != null && seq === `${bareTable(table)}_${col.name}_seq` ? seq : null;
+}
+
 /** True when a column's default draws a sequence that is NOT its own conventional one. */
 function isForeignSequenceDefault(table: string, col: ColumnSchema): boolean {
-  const seq = nextvalSequence(col.default);
-  return seq != null && seq !== `${bareTable(table)}_${col.name}_seq`;
+  return nextvalSequence(col.default) != null && ownSequenceName(table, col) == null;
 }
 
 // ---------------------------------------------------------------------------
@@ -888,8 +899,7 @@ function serialSpelling(col: ColumnSchema, table: string): string | null {
   // ONLY the column's own conventional sequence is a serial declaration — the shorthand
   // creates a sequence, so spelling it for a foreign `nextval` would mint a duplicate
   // and silently detach the column from the sequence it declared.
-  const seq = nextvalSequence(col.default);
-  if (seq == null || seq !== `${bareTable(table)}_${col.name}_seq`) return null;
+  if (ownSequenceName(table, col) == null) return null;
   if (col.type === 'integer') return 'serial';
   if (col.type === 'bigint') return 'bigserial';
   return null;

package/src/cli/schema-fingerprint.ts

@@ -301,8 +301,10 @@ export interface CanonicalizeOptions {
    * The MEASURED serial-sequence ACLs (v11). A table present here is hashed from its live ACLs
    * (so a REVOKE moves the fingerprint); a table absent DERIVES its ACLs from the A6 inheritance
    * rule (the reconciled target). The live path passes every measured table; the declared path
-   * passes nothing; the plan's predicted endpoint passes only rides-through tables. See
-   * {@link canonicalSequenceAuthz}.
+   * passes nothing; the plan's predicted endpoint passes the rides-through tables measured — and
+   * in its FULL flavor (`carryUngoverned`) also one synthesized entry per declared table's
+   * sequence: its live sequences combined with the reconciled governed shape, plus the sequences
+   * the plan creates. See {@link canonicalSequenceAuthz}.
    */
   sequenceGrants?: SequenceGrantContract[];
 }
@@ -568,13 +570,14 @@ WHERE p.prosecdef
   AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'
   AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = p.oid AND d.deptype = 'e')
 UNION ALL
--- A14, the interim before v11. A column's GENERATED … AS IDENTITY is now READ, DECLARED and
--- BUILT, but it is not yet hashed: the fingerprint's coverage is a version contract, and a
--- property entering the hash inside a version makes two operators on different CLI builds
--- disagree about the same database. So it is named here until v11 carries it, batched with the
--- sequence ACLs and the schema posture. The gap is real and narrow: an identity that is silently
--- dropped or flipped ALWAYS to BY DEFAULT leaves every fingerprint gate green. db:generate sees
--- it (the differ compares it), and the round-trip oracle's pg_dump comparison catches it.
+-- A14. A column's GENERATED … AS IDENTITY is READ, DECLARED and BUILT, but it is NOT hashed:
+-- the fingerprint's coverage is a version contract, and a property entering the hash inside a
+-- version makes two operators on different CLI builds disagree about the same database. v11
+-- took the sequence ACLs and deliberately left this and the schema posture out; both stay
+-- named here until a canon bump (a v12 candidate) carries them together. The gap is real and
+-- narrow: an identity that is silently dropped or flipped ALWAYS to BY DEFAULT leaves the MATCH
+-- claim green. It is not silent on the write path — db:generate/db:plan diff it (the differ
+-- compares identity) — and the round-trip oracle's pg_dump comparison catches it.
 SELECT 'identity column',
        n.nspname || '.' || c.relname || '.' || a.attname ||
        ' → ' || CASE a.attidentity WHEN 'a' THEN 'always' ELSE 'by default' END