@everystack/cli 0.4.80 → 0.4.81

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.81] - 2026-09-08
+
+### Added
+
+- every declared write compiles a policy; check narrows, never replaces
+
+### Fixed
+
+- db:pull recovers owner: from the normalized predicate and round-trips
+
 ## [0.4.80] - 2026-09-07
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.80",
+  "version": "0.4.81",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-compile.ts

@@ -322,6 +322,22 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // A "row-scoped" condition is either a direct owner or a transitive via.
   const rowScoped = (a: Ability): boolean => Boolean(a.condition.owner || a.condition.via);
 
+  // The `authenticated` role — named `role: 'authenticated'` OR the role-less default. On a
+  // row-scoped model this role is ALWAYS row-scoped; every other role gets its own policy.
+  const isAuthClass = (a: Ability): boolean => !a.condition.role || a.condition.role === 'authenticated';
+
+  // The model's row scope as a bare condition — owner/via keys ONLY, with the READ's guards
+  // stripped. It is what an authenticated/role-less `manage` desugars to: the four verbs are
+  // scoped to the model's owner, never to whatever a `can('read', { owner, sql })` narrowed the
+  // read with. Non-null exactly when `rowPred` is.
+  const ownerConditionAbility = model.abilities.find((a) => a.condition.owner);
+  const viaConditionAbility = model.abilities.find((a) => a.condition.via);
+  const rowScopeCondition: Ability['condition'] | null = owner && ownerConditionAbility
+    ? { owner: ownerConditionAbility.condition.owner, userField: ownerConditionAbility.condition.userField, ownerExpr: ownerConditionAbility.condition.ownerExpr }
+    : via && viaConditionAbility
+      ? { via: viaConditionAbility.condition.via }
+      : null;
+
   /**
    * A read scoped to a named role — `can('read', { role })`. It compiles to its own
    * `<table>_select_<role>` policy, so its predicate must NOT also be folded into the
@@ -331,19 +347,29 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const isRoleRead = (a: Ability): boolean =>
     a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
-  // `manage` + owner/via desugars into four verb abilities for policy emission.
-  // Role-scoped `manage` (the admin bypass) passes through — it matches `hasAdminManage`
-  // directly. Grants handle `manage` natively via `verbsFor`, so this expansion is
-  // policy-compiler-local: `compileGrants` still reads `model.abilities`.
+  // `manage` desugars into four verb abilities for policy emission. Two cases become
+  // manage-OWN (four row-scoped verbs):
+  //   - `manage` carrying its OWN owner/via (`can('manage', { owner })`); or
+  //   - authenticated/role-less `manage` on a row-scoped MODEL — the role is dropped and the
+  //     model's owner/via added, because the authenticated role on a row-scoped model is
+  //     always row-scoped (the W1 ruling). The literal reading (an ALL policy USING true for
+  //     authenticated beside `_select_own`) would be the round-1 widening: permissive policies
+  //     UNION, so an unconditional policy beside an owner-checked one opens the whole table.
+  // Everything else — another role's `manage` (the admin bypass, an editor's ALL), or an
+  // authenticated `manage` with no row scope — passes through to the ALL-policy path below.
+  // Grants handle `manage` natively via `verbsFor`, so this expansion is policy-compiler-local:
+  // `compileGrants` still reads `model.abilities`.
+  const desugarManage = (c: Ability['condition']): Ability[] => [
+    { action: 'read', condition: c },
+    { action: 'create', condition: c },
+    { action: 'update', condition: c },
+    { action: 'delete', condition: c },
+  ];
   const abilities: readonly Ability[] = model.abilities.flatMap((a) => {
-    if (a.action !== 'manage' || !rowScoped(a)) return [a];
-    const c = a.condition;
-    return [
-      { action: 'read' as const, condition: c },
-      { action: 'create' as const, condition: c },
-      { action: 'update' as const, condition: c },
-      { action: 'delete' as const, condition: c },
-    ];
+    if (a.action !== 'manage') return [a];
+    if (rowScoped(a)) return desugarManage(a.condition);
+    if (isAuthClass(a) && rowScopeCondition) return desugarManage(rowScopeCondition);
+    return [a];
   });
 
   const predFor = (action: Ability['action']): string | null => {
@@ -370,15 +396,6 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     }
     return null;
   };
-  const checkFor = (action: Ability['action']): string | null => {
-    for (const a of abilities) {
-      if (a.action !== action) continue;
-      const p = rawPredicate(a.condition.check, `${table}: can('${action}', { check })`);
-      if (p) return p;
-    }
-    return null;
-  };
-  const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
   // The audience is open when the public read says so. Read off the SAME abilities that make
   // `hasPublicRead` true, so the two can never disagree about which read is being compiled.
@@ -389,10 +406,7 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // full-row owner read — so it is excluded here and handled by its own branch.
   const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnAbility(a));
   const hasColumnOwnerRead = abilities.some((a) => a.action === 'read' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
-  const canCreate = abilities.some((a) => a.action === 'create');
-  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a) && !isColumnAbility(a));
   const hasColumnUpdateOwner = abilities.some((a) => a.action === 'update' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
-  const hasDeleteOwner = abilities.some((a) => a.action === 'delete' && rowScoped(a));
 
   const t = model.table;
   const policies: PolicyContract[] = [];
@@ -410,8 +424,15 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     });
   };
 
-  // admin-bypass — one ALL policy, true/true.
-  if (hasAdminManage) policy(`${t}_admin`, 'ALL', ['admin'], 'true', 'true');
+  // The ALL-policy `manage` roles — every `manage` ability that did NOT desugar to manage-own:
+  // another role's bypass (admin, editor, moderator) and an authenticated `manage` with no row
+  // scope. Each is one ALL policy `<t>_<role>` USING true WITH CHECK true. `admin` is simply the
+  // first instance of this rule, not a special case; the fold to `authenticated` covers the
+  // role-less no-scope `can('manage')`. Deduplicated by policy name.
+  const manageAllRoles = [...new Set(
+    abilities.filter((a) => a.action === 'manage').map((a) => policyRole(a.condition.role ?? 'authenticated')),
+  )];
+  for (const role of manageAllRoles) policy(`${t}_${role}`, 'ALL', [role], 'true', 'true');
 
   if (hasPublicRead) {
     // public read on a soft-delete table — split per role; authenticated owners
@@ -512,26 +533,136 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     );
   }
 
-  // owner-gated writes. INSERT checks ownership (you can only create rows you own);
-  // UPDATE gates + checks; DELETE gates. `rowPred` is the direct-owner or `via:` predicate.
+  // Writes. Every declared write compiles a policy — a grant with no policy behind it is dead
+  // under RLS, which is the whole bug this milestone closes. The rule per verb:
   //
-  // A declared `check` is the WITH CHECK half; without one the read half governs both
-  // (Postgres' own default). The two differ when a row may be written into a shape its
-  // author could not have selected by — the direction that matters is a check WEAKER than
-  // the using, which lets an owner move their own row past whatever the using guarded.
-  const createPred = andPredicates(rowPred, predFor('create'));
-  const updatePred = andPredicates(rowPred, predFor('update'));
-  const deletePred = andPredicates(rowPred, predFor('delete'));
-
-  if (canCreate && createPred) {
-    policy(`${t}_insert_own`, 'INSERT', ['authenticated'], null, checkFor('create') ?? createPred);
-  }
-  if ((hasUpdateOwner || predFor('update')) && updatePred) {
-    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, checkFor('update') ?? updatePred);
+  //   - authenticated (named or role-less), on a ROW-SCOPED model → `_<verb>_own`.
+  //     USING = rowScope AND where; WITH CHECK = rowScope AND (check ?? where). The row-scope
+  //     term is NEVER removable: a `where`/`check` narrows WITHIN own rows. INSERT has no USING;
+  //     DELETE has no WITH CHECK.
+  //   - authenticated, on a model with NO row scope → `_<verb>_authenticated`.
+  //     USING = where ?? true; WITH CHECK = check ?? where ?? true.
+  //   - any OTHER named role → `_<verb>_<role>`, predicate ?? true. NEVER folded into `_own`,
+  //     so one role's `where` can never narrow (or, unscoped, widen) another's rows.
+  //
+  // Permissive policies UNION, so at most ONE authenticated policy is emitted per verb — the
+  // where/check are taken from the first authenticated ability that declares one.
+  // A column-scoped write with no role cannot carry a WITH CHECK. Postgres' WITH CHECK is
+  // ROW-level, never column-level, so the predicate has nowhere honest to go: AND-ing it into
+  // the full-row `_own` policy over-applies it to every update (not just the scoped columns),
+  // and dropping it silently is an evaporating security rule — the exact hole this compiler
+  // throws over for a malformed `sql:`. So it throws here too, rather than swallow it. (A
+  // NAMED-role column write keeps its own policy and is unaffected; a row-level `check:` on a
+  // non-column ability is the supported spelling.)
+  for (const a of model.abilities) {
+    // A role name is emitted UNQUOTED into GRANT/CREATE POLICY, so Postgres folds or splits
+    // anything that is not a bare lowercase identifier: `AUTHENTICATED` folds onto
+    // `authenticated`, `anon, authenticated` becomes two grantees — and a policy meant for a
+    // distinct role silently lands on a real vocabulary role beside its owner-checked one, which
+    // permissive UNION turns into the whole table. Refuse it. (PUBLIC is folded deliberately by
+    // isPseudoPublic and is exempt.)
+    const role = a.condition.role;
+    if (role && !isPseudoPublic(role) && !/^[a-z_][a-z0-9_]*$/.test(role)) {
+      throw new Error(
+        `${table}: can('${a.action}', { role: '${role}' }) — a role name is emitted unquoted, so it must be a bare `
+        + `lowercase identifier ([a-z_][a-z0-9_]*). '${role}' would be case-folded or split by Postgres and the policy `
+        + `would land on a different role. Use the exact lowercase role name.`,
+      );
+    }
+    // A role-less column ability cannot carry a ROW predicate (where/sql/check). Postgres USING
+    // and WITH CHECK are row-level, never column-level, so the predicate has nowhere honest to
+    // go: applied to the whole-row policy it over-applies to every column, dropped it evaporates
+    // — the exact hole this compiler throws over for a malformed `sql:`. (A NAMED-role column
+    // ability keeps its own policy and is unaffected; a row-level predicate on a non-column
+    // ability is the supported spelling.)
+    if (isColumnAbility(a) && !a.condition.role
+      && (a.condition.check != null || a.condition.sql != null || a.condition.where != null)) {
+      throw new Error(
+        `${table}: can('${a.action}', { owner, columns, … }) — a column-scoped ability cannot carry a row predicate `
+        + `(where/sql/check). Postgres USING/WITH CHECK are row-level, not column-level, so the predicate could only be `
+        + `applied to the whole-row policy (over-applying it to every column) or dropped (an evaporating security rule). `
+        + `Move the predicate to a row-level ability — can('${a.action}', { owner, where }) — or enforce it with a trigger.`,
+      );
+    }
   }
-  else if (hasColumnUpdateOwner && updatePred) {
-    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, updatePred);
+
+  const WRITE_VERBS = [
+    { action: 'create' as const, word: 'insert', command: 'INSERT' as PolicyCommand },
+    { action: 'update' as const, word: 'update', command: 'UPDATE' as PolicyCommand },
+    { action: 'delete' as const, word: 'delete', command: 'DELETE' as PolicyCommand },
+  ];
+  const firstPred = (abs: readonly Ability[], half: 'where' | 'check'): string | null => {
+    for (const a of abs) {
+      const raw = half === 'check' ? a.condition.check : (a.condition.sql ?? a.condition.where);
+      const label = `${table}: can('${a.action}'${half === 'check' ? ', { check }' : ''})`;
+      const p = rawPredicate(raw, label);
+      if (p) return p;
+    }
+    return null;
+  };
+  for (const { action, word, command } of WRITE_VERBS) {
+    const verbAbilities = abilities.filter((a) => a.action === action && !isColumnAbility(a));
+    const authAbilities = verbAbilities.filter(isAuthClass);
+
+    if (authAbilities.length) {
+      const where = firstPred(authAbilities, 'where');
+      const check = firstPred(authAbilities, 'check');
+      if (rowPred) {
+        policy(
+          `${t}_${word}_own`, command, ['authenticated'],
+          command === 'INSERT' ? null : andPredicates(rowPred, where),
+          command === 'DELETE' ? null : andPredicates(rowPred, check ?? where),
+        );
+      } else {
+        // No row scope: USING = where ?? true, WITH CHECK = check ?? where ?? true. Route through
+        // andPredicates so a vacuous `where: sql`true`` collapses to plain `true` rather than
+        // leaking a `(true)` term that would churn the reconciler against a live `USING (true)`.
+        policy(
+          `${t}_${word}_authenticated`, command, ['authenticated'],
+          command === 'INSERT' ? null : (andPredicates(where) ?? 'true'),
+          command === 'DELETE' ? null : (andPredicates(check ?? where) ?? 'true'),
+        );
+      }
+    } else if (action === 'update' && hasColumnUpdateOwner && rowPred) {
+      // A column-scoped owner update with no full-row authenticated update: the row gate is the
+      // owner (this policy), the GRANT scopes the columns. The full-row branch above would have
+      // covered it otherwise, so this only fires when there is no non-column owner update.
+      policy(`${t}_update_own`, 'UPDATE', ['authenticated'], rowPred, rowPred);
+    }
+
+    // Other named roles — each its own policy, never folded into `_own`.
+    const seenRoles = new Set<string>();
+    for (const a of verbAbilities) {
+      if (isAuthClass(a)) continue;
+      const role = policyRole(a.condition.role!);
+      if (seenRoles.has(role)) continue;
+      seenRoles.add(role);
+      const name = `${t}_${word}_${role}`;
+      const label = `${table}: can('${action}', { role: '${role}' })`;
+      if (policies.some((p) => p.name === name)) {
+        throw new Error(
+          `${label} collides with the ${name} policy already compiled from this model. `
+          + `Declare one ${action} ability for that role: permissive policies OR together, so separate rules could only widen.`,
+        );
+      }
+      const where = rawPredicate(a.condition.sql ?? a.condition.where, label);
+      const check = rawPredicate(a.condition.check, `${label}, { check }`);
+      // A role that ALSO declares owner:/via: (`can('update', { role: 'editor', owner })`) is
+      // scoped to its own rows exactly as an authenticated owner write is — the row scope AND-s
+      // in, and without it the role would get USING (true): the whole table, not its own rows.
+      // Same rule the role-read (`isRoleRead`) and column-role-update loops already apply.
+      const roleScope = rowScoped(a) ? rowPred : null;
+      policy(
+        name, command, [role],
+        command === 'INSERT' ? null : (andPredicates(roleScope, where) ?? 'true'),
+        command === 'DELETE' ? null : (andPredicates(roleScope, check ?? where) ?? 'true'),
+      );
+    }
   }
+
+  // Column-scoped role UPDATE — a `can('update', { role, columns })` grants those columns and
+  // needs its own policy TO that role. (The owner/column-owner cases are handled above; this is
+  // the named-role column path, kept distinct because `verbAbilities` excludes column abilities.)
   for (const a of abilities.filter((ability) =>
     isColumnAbility(ability) && ability.action === 'update' && Boolean(ability.condition.role),
   )) {
@@ -544,14 +675,16 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         + `Declare one update ability for that role: permissive policies OR together, so separate rules could only widen.`,
       );
     }
-    const using = andPredicates(
-      rowScoped(a) ? rowPred : null,
-      rawPredicate(a.condition.sql ?? a.condition.where, where),
-    ) ?? 'true';
-    policy(name, 'UPDATE', [role], using, rawPredicate(a.condition.check, `${where}, { check }`) ?? using);
-  }
-  if ((hasDeleteOwner || predFor('delete')) && deletePred) {
-    policy(`${t}_delete_own`, 'DELETE', ['authenticated'], deletePred, null);
+    const rowScope = rowScoped(a) ? rowPred : null;
+    const wherePred = rawPredicate(a.condition.sql ?? a.condition.where, where);
+    const checkPred = rawPredicate(a.condition.check, `${where}, { check }`);
+    const using = andPredicates(rowScope, wherePred) ?? 'true';
+    // WITH CHECK NARROWS, symmetric with USING: the row scope is ANDed in, never replaced, and
+    // the write guard defaults to the read guard. The old `rawPredicate(check) ?? using` emitted
+    // the check verbatim, so on a row-scoped column update a `check:` dropped the owner term —
+    // the one path the milestone's headline claim did not yet hold.
+    const check = andPredicates(rowScope, checkPred ?? wherePred) ?? using;
+    policy(name, 'UPDATE', [role], using, check);
   }
 
   policies.sort((a, b) => a.name.localeCompare(b.name));

package/src/cli/authz-derive.ts

@@ -92,14 +92,20 @@ function deriveExtraPrivileges(contract: TableContract): Record<string, string[]
 }
 
 /**
- * The deparsed owner predicate the compiler produces, in both its casts:
- *   (col = (((current_setting('request.jwt.claims'::text, true))::jsonb ->> 'sub'::text)))
+ * The deparsed owner predicate, in BOTH wire spellings — the `::text` casts are optional:
+ *   normalized (what both producers emit since a616a1f3, 2026-08-24, and what a live stage
+ *     returns through `predicate()`'s cross-version normalizer):
+ *       (col = (((current_setting('request.jwt.claims', true))::jsonb ->> 'sub'))::uuid)
+ *   raw old-major deparse (a dump captured before the normalizer, or an older stage):
+ *       (col = (((current_setting('request.jwt.claims'::text, true))::jsonb ->> 'sub'::text)))
  * Recognising it turns a predicate back into `{ owner: 'col' }` — the structured shape —
- * instead of an opaque `sql:` fragment. Anything unrecognised stays verbatim rather than
- * being guessed at.
+ * instead of an opaque `sql:` fragment. Before the casts were made optional the matcher
+ * expected only the raw spelling, so a normalized live predicate — every one, today — fell
+ * through to `sql:` and lost the `owner:` on round-trip. Anything unrecognised still stays
+ * verbatim rather than being guessed at.
  */
 const OWNER_RE =
-  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(*\(current_setting\('request\.jwt\.claims'::text,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'::text\)*(?:::[a-z]+)?\)?$/i;
+  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(*\(current_setting\('request\.jwt\.claims'(?:::text)?,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'(?:::text)?\)*(?:::[a-z]+)?\)?$/i;
 
 /**
  * The OTHER owner shape: the database's own accessor, `(<col> = auth.user_id())`.
@@ -132,6 +138,33 @@ export function parseOwnerPredicate(
   return f ? { column: f[1], claim: 'sub', expr: f[2] } : null;
 }
 
+/**
+ * Decompose a WRITE predicate into its owner conjunct and the remaining guard.
+ *
+ * The compiler builds an owner write as `rowScope AND where` (USING) and `rowScope AND (check ??
+ * where)` (WITH CHECK). To round-trip, the deriver reverses that: the owner term may be the whole
+ * predicate (`owner = claim`) or one top-level AND conjunct (`owner = claim AND state = 'draft'`),
+ * and everything else is the guard the compiler will AND back in beside the owner. Returns the
+ * owner parse (null when there is none) and the guard text (null when the owner is the whole
+ * predicate). Nothing is guessed: a predicate with no recognisable owner conjunct returns
+ * `{ owner: null, guard: <the whole predicate> }`, which the caller carries verbatim as `sql:`.
+ */
+function splitOwnerPredicate(
+  pred: string | null,
+): { owner: ReturnType<typeof parseOwnerPredicate>; guard: string | null } {
+  if (!pred) return { owner: null, guard: null };
+  const direct = parseOwnerPredicate(pred);
+  if (direct) return { owner: direct, guard: null };
+  const conjuncts = splitTopLevel(pred, 'AND');
+  if (conjuncts.length < 2) return { owner: null, guard: pred };
+  const idx = conjuncts.findIndex((c) => parseOwnerPredicate(c));
+  if (idx === -1) return { owner: null, guard: pred };
+  const owner = parseOwnerPredicate(conjuncts[idx]);
+  const rest = conjuncts.filter((_, i) => i !== idx);
+  const guard = rest.length === 0 ? null : rest.length === 1 ? rest[0] : `(${rest.join(' AND ')})`;
+  return { owner, guard };
+}
+
 /**
  * Split a predicate on a top-level operator, respecting parens and string literals.
  *
@@ -562,7 +595,7 @@ export function deriveAbilities(
     }
 
     if (diverges && own) {
-      const parts = [`owner: '${own.owner.column}'`];
+      const parts = [`owner: '${modelFieldKey(own.owner.column)}'`];
       if (own.owner.claim !== 'sub') parts.push(`userField: '${own.owner.claim}'`);
       if (own.owner.expr) parts.push(`ownerExpr: sql\`${own.owner.expr}\``);
       const guard = sqlFragment(own.ownerSql);
@@ -597,7 +630,7 @@ export function deriveAbilities(
     const pol = policiesFor(contract, 'authenticated', 'SELECT')[0];
     const owner = parseOwnerPredicate(pol?.using ?? null);
     if (owner) {
-      const parts = [`owner: '${owner.column}'`];
+      const parts = [`owner: '${modelFieldKey(owner.column)}'`];
       if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
       if (owner.expr) parts.push(`ownerExpr: sql\`${owner.expr}\``);
       abilities.push(`can('read', { ${parts.join(', ')} })`);
@@ -616,22 +649,58 @@ export function deriveAbilities(
       ?? policiesFor(contract, 'authenticated', command)[0];
     const using = pol?.using ?? null;
     const check = pol?.check ?? null;
-    const owner = parseOwnerPredicate(using) ?? parseOwnerPredicate(check);
+    // Decompose both halves into (owner, guard). INSERT carries the owner in WITH CHECK (its
+    // USING is null); UPDATE/DELETE carry it in USING. The owner is recovered from whichever
+    // half has it.
+    const u = splitOwnerPredicate(using);
+    const c = splitOwnerPredicate(check);
+    const owner = u.owner ?? c.owner;
 
     const parts: string[] = [];
     if (owner) {
-      parts.push(`owner: '${owner.column}'`);
+      parts.push(`owner: '${modelFieldKey(owner.column)}'`);
       if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
       if (owner.expr) parts.push(`ownerExpr: sql\`${owner.expr}\``);
-    }
-    // A predicate beyond the owner gate (a state guard, a tenant filter) rides as `sql`.
-    const usingFrag = owner && parseOwnerPredicate(using) ? null : sqlFragment(using);
-    if (usingFrag) parts.push(`sql: ${usingFrag}`);
-    // The WRITE half, only when it genuinely differs. Postgres defaults it to USING, and
-    // emitting it unconditionally would be noise that also defeats the round-trip diff.
-    if (check && check !== using) {
-      const checkFrag = sqlFragment(check);
-      if (checkFrag) parts.push(`check: ${checkFrag}`);
+      // The USING guard beyond the owner gate (a state guard, a tenant filter) rides as `sql`.
+      const usingGuard = sqlFragment(u.guard);
+      if (usingGuard) parts.push(`sql: ${usingGuard}`);
+      // The WRITE half rides as `check` ONLY when its guard differs from the USING guard. The
+      // compiler defaults WITH CHECK to (rowScope AND where), so emitting an equal guard would
+      // double the owner term on recompile — the round-trip regression this closes.
+      // WITH CHECK handling. `check == null` means the live policy has NO explicit WITH CHECK
+      // (Postgres defaults it to USING at runtime) — emit no `check:` and let the compiler
+      // default it the same way. Only an EXPLICIT check that differs from the USING guard needs a
+      // `check:`, and only in the shapes below.
+      if (command !== 'DELETE' && check != null && c.owner == null) {
+        // The live WITH CHECK does not even restate the owner gate that USING carries — it is
+        // WIDER on the owner axis (the extreme is `WITH CHECK (true)`: write a row you do not
+        // own). The model has no spelling for that, and every `check:` the compiler emits ANDs
+        // the owner back in, so the derived ability necessarily TIGHTENS live. Disclose it rather
+        // than round-trip the loss silently; the residual db:plan statement is the real diff.
+        notes.push(`policy "${pol?.name}" (${command}) has a WITH CHECK that does not restate the owner gate in its USING —`);
+        notes.push(`  it is wider than any owner ability can express, so the rendered model TIGHTENS it to the owner. Live WITH CHECK:`);
+        notes.push(`    ${check}`);
+      } else if (command !== 'DELETE' && check != null && c.owner != null && c.guard == null && u.guard != null) {
+        // Explicit owner-only WITH CHECK while USING carries a guard — the write half is
+        // deliberately WIDER than the read half (the moderation shape this file's header names:
+        // "your own draft rows" to target, "your own row" to write into). Left implicit, the
+        // compiler would default WITH CHECK to (owner AND where) and TIGHTEN it, so the pull would
+        // misreport live. `check: sql`true`` forces WITH CHECK back to the owner gate alone.
+        parts.push('check: sql`true`');
+      } else if (c.guard != null && (c.guard ?? '') !== (u.guard ?? '')) {
+        // An explicit WITH CHECK carrying a DIFFERENT guard than USING (owner ∧ a distinct write
+        // guard). Rides as `check:`; the compiler ANDs the owner back in.
+        const checkFrag = sqlFragment(c.guard);
+        if (checkFrag) parts.push(`check: ${checkFrag}`);
+      }
+    } else {
+      // No owner recovered — carry the predicates verbatim, USING and (differing) WITH CHECK.
+      const usingFrag = sqlFragment(using);
+      if (usingFrag) parts.push(`sql: ${usingFrag}`);
+      if (check && check !== using) {
+        const checkFrag = sqlFragment(check);
+        if (checkFrag) parts.push(`check: ${checkFrag}`);
+      }
     }
 
     if (!parts.length && !pol) {