@everystack/cli 0.4.85 → 0.4.87

package/src/cli/commands/db.ts

@@ -1117,7 +1117,10 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     // The reader's read grants ride this same step, for the same reason ADOPT does: they can stall
     // on a lock, and nothing that can stall may sit between the password swap and the secret write.
     const readerRole = result.readerRole as string | undefined;
-    if (!declaredOwners.length && !declaredObjects.length && !readerRole) return;
+    // NO early return on "nothing declared". Convergence also carries the schema "public" posture
+    // check — a property of the DATABASE, not of the Models — and the brownfield app that declares
+    // no owners is exactly the one most likely to carry the pre-PG15 PUBLIC CREATE grant. Gating
+    // this on the declarations made the check unreachable for it.
     const ownerPayload = { ...ownershipPayload, adminRole: result.adminRole, ...(readerRole ? { readerRole, searchPath } : {}) };
     let owned: any = {};
     try {
@@ -1177,6 +1180,24 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
       // then fail on every table. Same non-zero exit as an un-converged owner.
       for (const r of reader.refusals) { warn(`Read-only grants: ${r}`); ownershipIncomplete = true; }
     }
+    // The schema "public" posture. Reported only when there IS a gap: a PG15+ database (or one
+    // already hardened) is the expected state and says nothing, exactly like a converged owner.
+    // Absent entirely on a server that predates this check — also silent, never narrated as clean.
+    const posture = owned.publicSchemaPosture;
+    if (posture?.publicCanCreate) {
+      if (posture.revoked) {
+        // The SQL is spelled out rather than imported from @everystack/server: that package is a
+        // lazily-loaded peer here (the ops-Lambda venue never loads it), so a static import for a
+        // display string would be a new hard dependency for a sentence.
+        success('Schema posture: REVOKE CREATE ON SCHEMA public FROM PUBLIC — the pre-PG15 default, which PG15 removed, is gone. Verified by re-reading the catalog.');
+      } else {
+        // NOT counted as ownershipIncomplete, deliberately. This is an advisory hardening on a live
+        // database, and `--confirm` is a shared gate (an operator passes it for ADOPT). Failing a
+        // provisioning run whose credentials succeeded, over a posture the operator has not been
+        // asked about yet, would break every existing pre-PG15 deploy pipeline on upgrade.
+        for (const r of posture.refusals) warn(`Schema posture: ${r}`);
+      }
+    }
   };
 
   // Additive-only: if the login roles already existed as live logins, provision changed no

package/src/cli/commands/diag.ts

@@ -13,7 +13,7 @@
  *   everystack diag [url] --hydration  # Analyze SSR hydration issues
  */
 
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { getFromS3 } from '../aws';
 import { step, success, fail, info, warn } from '../output';
 import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer';
@@ -53,11 +53,11 @@ export async function diagCommand(
   // Build the URL: positional arg > baseUrl + --path
   let url = positionalUrl;
   if (!url) {
-    if (!config.baseUrl) {
-      fail('No URL provided and no baseUrl in config. Pass a URL or use --stage.');
+    url = probeUrl(config);
+    if (!url) {
+      fail('No URL provided and no site URL for this stage. Pass a URL, set CDN_URL on the API function, or use --stage on a deployed stage.');
       process.exit(1);
     }
-    url = config.baseUrl;
   }
   // Strip trailing slash from base URL before appending path
   url = url.replace(/\/+$/, '');

package/src/cli/commands/lighthouse.ts

@@ -21,7 +21,7 @@ import {
   type ExtractedRun,
   type LhReport,
 } from '../lighthouse';
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { step, info, fail, warn } from '../output';
 
 function runLighthouse(url: string, outPath: string): LhReport {
@@ -69,7 +69,7 @@ export async function auditLighthouseCommand(flags: Record<string, string>): Pro
   if (!host) {
     try {
       const config = await resolveConfig(flags.stage);
-      host = config.baseUrl;
+      host = probeUrl(config);
     } catch (err: any) {
       fail(err.message);
       info('Pass --host <url> to audit a specific URL without resolving a stage.');

package/src/cli/commands/security-probe.ts

@@ -26,7 +26,7 @@ import {
   type CatalogGrant,
   type ProbeResult,
 } from '../security-probe';
-import { resolveConfig, opsFunction } from '../config';
+import { resolveConfig, opsFunction, probeUrl } from '../config';
 import { invokeAction } from '../aws';
 import { step, info, fail, success, warn } from '../output';
 
@@ -188,7 +188,7 @@ export async function securityProbeCommand(flags: Record<string, string>): Promi
     fail(err.message);
     process.exit(1);
   }
-  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  const base = (flags.host || probeUrl(config)).replace(/\/+$/, '');
   if (!base) {
     fail('No router URL to probe. Pass --host or ensure the stage has a deployed URL.');
     process.exit(1);

package/src/cli/commands/update.ts

@@ -5,7 +5,8 @@ import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
-import { resolveConfig, type CliConfig } from '../config';
+import { resolveConfig, probeUrl, type CliConfig } from '../config';
+import { missingHostUrlError } from '../host-url';
 import { uploadToS3, headS3, invokeAction, rollingRestart } from '../aws';
 import { step, success, warn, fail, info } from '../output';
 import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
@@ -128,6 +129,13 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       warn(`Could not load SST secrets: ${err.message}`);
       info('Secrets may be unavailable during export. Provide env vars from the caller if needed.');
     }
+
+    // After the secrets step: a secret may supply HOST_URL.
+    const noHostUrl = await missingHostUrlError(flags.stage, { siteUrl: resolvedConfig?.siteUrl });
+    if (noHostUrl) {
+      fail(noHostUrl);
+      process.exit(1);
+    }
   }
 
   const branch = flags.branch;
@@ -639,13 +647,17 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
 
       // 7. Verify the origin is serving the new release.
       step('Verifying origin serves new release...');
-      const verified = await verifyOriginRelease(config.baseUrl, updateId);
+      const siteUrl = probeUrl(config);
+      const verified = await verifyOriginRelease(siteUrl, updateId);
       if (verified) {
         success(`Origin confirmed: ${updateId.slice(0, 12)}...`);
+      } else if (!siteUrl) {
+        warn('No site URL for this stage, so the origin was not checked.');
+        info('Set CDN_URL on the API function, or check the site by hand for the x-everystack-release header.');
       } else {
         warn('Origin did not confirm the new release within the timeout.');
         info('The release may still be propagating. Check manually:');
-        info(`  curl -sI ${config.baseUrl} | grep x-everystack-release`);
+        info(`  curl -sI ${siteUrl} | grep x-everystack-release`);
       }
 
       // Clean up archive
@@ -822,6 +834,8 @@ export async function verifyOriginRelease(
   baseUrl: string,
   expectedUpdateId: string,
 ): Promise<boolean> {
+  // No site URL: every probe would throw and be swallowed, burning the whole timeout.
+  if (!baseUrl) return false;
   const deadline = Date.now() + VERIFY_TIMEOUT_MS;
   let consecutive = 0;
 

package/src/cli/config.ts

@@ -12,7 +12,10 @@ import path from 'node:path';
 import { step } from './output';
 
 export interface CliConfig {
+  /** CDN_URL / routerUrl as deployed. update pins it into OTA bundles: never derived. */
   baseUrl: string;
+  /** What cache:purge and update's release check probe. Falls back to baseUrl when absent. */
+  siteUrl?: string;
   region: string;
   apiFunctionName: string;
   /** Dedicated operator function (db/console actions). Falls back to apiFunctionName. */
@@ -30,6 +33,14 @@ export interface CliConfig {
   backupsBucket?: string;
 }
 
+/**
+ * The URL commands PROBE (release checks, audits, lighthouse): siteUrl, else baseUrl, else ''.
+ * Never use it to write a URL into anything shipped; that is baseUrl's job (HOST_URL).
+ */
+export function probeUrl(config: Pick<CliConfig, 'baseUrl' | 'siteUrl'>): string {
+  return config.siteUrl || config.baseUrl || '';
+}
+
 /** Operator invoke target — dedicated ops function when deployed, else the API function. */
 export function opsFunction(config: CliConfig): string {
   return config.opsFunctionName ?? config.apiFunctionName;
@@ -81,6 +92,22 @@ async function readLocalOutputs(): Promise<Partial<SstOutputs> | null> {
   }
 }
 
+/**
+ * The local outputs.json, only if its deploy WAS this stage. It is the last deploy on ANY stage,
+ * and databaseInstanceId picks db:apply/db:swap's confirmed rollback snapshot, so another
+ * stage's file must never reach a stage's config. Unknown means no.
+ */
+async function readOutputsFor(stage: string): Promise<Partial<SstOutputs> | null> {
+  const outputs = await readLocalOutputs();
+  if (!outputs) return null;
+  try {
+    const { parseAppName, outputsDescribeStage } = await import('./discover');
+    return outputsDescribeStage(outputs, await parseAppName(), stage) ? outputs : null;
+  } catch {
+    return null;
+  }
+}
+
 export async function resolveConfig(stage?: string): Promise<CliConfig> {
   const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
 
@@ -95,7 +122,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
     // Check cache first
     const cached = await getCachedConfig(stage);
-    if (cached) return enrichConfigFromOutputs(cached, await readLocalOutputs());
+    if (cached) return enrichConfigFromOutputs(cached, await readOutputsFor(stage));
 
     step(`Discovering resources for stage "${stage}"...`);
     const appName = await parseAppName();
@@ -103,7 +130,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
     // Cache for future fast lookups
     await setCachedConfig(stage, config);
-    return enrichConfigFromOutputs(config, await readLocalOutputs());
+    return enrichConfigFromOutputs(config, await readOutputsFor(stage));
   }
 
   // Default: read .sst/outputs.json (unchanged behavior)
@@ -140,6 +167,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
   return {
     baseUrl: outputs.routerUrl,
+    siteUrl: outputs.routerUrl,
     region,
     apiFunctionName: outputs.apiFunctionName,
     opsFunctionName: outputs.opsFunctionName,

package/src/cli/discover-distribution.ts

@@ -7,8 +7,8 @@
  * SST Routers do not put the app/stage in the distribution Comment, so
  * matching runs in order of reliability:
  *   1. DomainName / Aliases match the discovered router URL host
- *   2. Comment contains the {app}-{stage}- prefix (legacy setups)
- *   3. sst:app + sst:stage tags (authoritative, but one API call per candidate)
+ *   2. sst:app + sst:stage tags (authoritative, but one API call per candidate)
+ *   3. Comment contains the {app}-{stage}- prefix (legacy setups; a substring, so a last resort)
  */
 
 export interface DistributionHints {
@@ -26,35 +26,69 @@ interface DistributionSummaryLite {
   Aliases?: { Items?: string[] };
 }
 
-/** Pure matcher for the cheap passes (domain, alias, legacy comment). Exported for tests. */
-export function matchDistribution(
-  items: readonly DistributionSummaryLite[],
-  prefix: string,
-  routerHost?: string,
-): string | undefined {
+/**
+ * A distribution and how it was found. `host` and `tag` are confirmed matches; `comment` is a
+ * substring guess (prefix `app-dev-` also matches the Comment of `my-app`'s dev stage), good
+ * enough for --invalidate but not to name the site a purge probes.
+ */
+export interface DistributionMatch {
+  id: string;
+  /** cloudfront.net domain, no scheme — the host this distribution always answers on. */
+  domain?: string;
+  by: 'host' | 'comment' | 'tag';
+}
+
+function toMatch(dist: DistributionSummaryLite, by: DistributionMatch['by']): DistributionMatch | undefined {
+  return dist.Id ? { id: dist.Id, domain: dist.DomainName, by } : undefined;
+}
+
+function matchByHost(items: readonly DistributionSummaryLite[], routerHost?: string): DistributionMatch | undefined {
   const host = routerHost?.toLowerCase();
-  if (host) {
-    for (const dist of items) {
-      if (dist.DomainName?.toLowerCase() === host) return dist.Id;
-      if (dist.Aliases?.Items?.some((alias) => alias.toLowerCase() === host)) return dist.Id;
-    }
+  if (!host) return undefined;
+  for (const dist of items) {
+    const hit =
+      dist.DomainName?.toLowerCase() === host ||
+      dist.Aliases?.Items?.some((alias) => alias.toLowerCase() === host);
+    if (hit) return toMatch(dist, 'host');
   }
+  return undefined;
+}
+
+function matchByComment(items: readonly DistributionSummaryLite[], prefix: string): DistributionMatch | undefined {
   const needle = prefix.toLowerCase();
   for (const dist of items) {
-    if ((dist.Comment || '').toLowerCase().includes(needle)) return dist.Id;
+    if ((dist.Comment || '').toLowerCase().includes(needle)) return toMatch(dist, 'comment');
   }
   return undefined;
 }
 
+/** Pure matcher for the non-tag passes (domain, alias, legacy comment). Exported for tests. */
+export function matchDistributionBy(
+  items: readonly DistributionSummaryLite[],
+  prefix: string,
+  routerHost?: string,
+): DistributionMatch | undefined {
+  return matchByHost(items, routerHost) ?? matchByComment(items, prefix);
+}
+
+/** The distribution id only. Exported for tests. */
+export function matchDistribution(
+  items: readonly DistributionSummaryLite[],
+  prefix: string,
+  routerHost?: string,
+): string | undefined {
+  return matchDistributionBy(items, prefix, routerHost)?.id;
+}
+
 /**
- * Find the CloudFront distribution for a stage.
+ * Find the CloudFront distribution for a stage, and how it was matched.
  * Best-effort: returns undefined if not found.
  */
-export async function discoverDistribution(
+export async function discoverDistributionMatch(
   region: string,
   prefix: string,
   hints: DistributionHints = {},
-): Promise<string | undefined> {
+): Promise<DistributionMatch | undefined> {
   const { CloudFrontClient, ListDistributionsCommand, ListTagsForResourceCommand } =
     await import('@aws-sdk/client-cloudfront');
   const client = new CloudFrontClient({ region });
@@ -69,10 +103,11 @@ export async function discoverDistribution(
     marker = res.DistributionList?.IsTruncated ? res.DistributionList.NextMarker : undefined;
   } while (marker);
 
-  const cheap = matchDistribution(items, prefix, hints.routerHost);
-  if (cheap) return cheap;
+  const byHost = matchByHost(items, hints.routerHost);
+  if (byHost) return byHost;
 
-  // Tag pass — authoritative but one call per distribution, so it runs last.
+  // Tag pass — authoritative, so it runs before the Comment guess (a Comment substring can name
+  // another app's stage). One call per distribution; SST tags every distribution it makes.
   if (hints.appName && hints.stage) {
     for (const dist of items) {
       if (!dist.ARN) continue;
@@ -82,7 +117,7 @@ export async function discoverDistribution(
           (res.Tags?.Items || []).map((t) => [t.Key, t.Value]),
         );
         if (tags.get('sst:app') === hints.appName && tags.get('sst:stage') === hints.stage) {
-          return dist.Id;
+          return toMatch(dist, 'tag');
         }
       } catch {
         // Tag read denied or transient — keep scanning
@@ -90,5 +125,6 @@ export async function discoverDistribution(
     }
   }
 
-  return undefined;
+  // Legacy setups whose distribution carries the {app}-{stage}- prefix in its Comment.
+  return matchByComment(items, prefix);
 }

package/src/cli/discover.ts

@@ -17,7 +17,16 @@ import { importOptionalAws } from './aws';
 
 /** Mirrors CliConfig from config.ts — defined locally to avoid circular imports. */
 interface DiscoveredConfig {
+  /**
+   * CDN_URL from the API Lambda, or ''. update pins this into shipped OTA bundles (HOST_URL),
+   * so it is NEVER derived from anything else.
+   */
   baseUrl: string;
+  /**
+   * The URL cache:purge and update's release check probe: baseUrl, else the domain of the stage's
+   * tag-confirmed CloudFront distribution, else ''. Probe-only; never shipped.
+   */
+  siteUrl: string;
   region: string;
   apiFunctionName: string;
   opsFunctionName?: string;
@@ -62,6 +71,22 @@ export async function parseAppName(configPath?: string): Promise<string> {
   return match[1];
 }
 
+/**
+ * Does a deploy-written .sst/outputs.json describe this stage? The file is the last deploy on ANY
+ * stage and has no stage field, but its apiFunctionName is `<app>-<stage>-ApiFunction-<hash>`
+ * (the convention discovery matches on). `.sst/stage` is NOT evidence: it is SST's personal-stage
+ * marker and can name a different stage than the last deploy. Unknown means no.
+ */
+export function outputsDescribeStage(
+  outputs: { apiFunctionName?: string } | null | undefined,
+  appName: string,
+  stage: string,
+): boolean {
+  const fn = outputs?.apiFunctionName;
+  if (!fn) return false;
+  return fn.toLowerCase().startsWith(`${appName}-${stage}-ApiFunction-`.toLowerCase());
+}
+
 // ---------------------------------------------------------------------------
 // CloudFront function discovery (→ KVS ARN)
 // ---------------------------------------------------------------------------
@@ -284,20 +309,30 @@ export async function discoverConfig(
 
   // Distribution discovery is best-effort (status CDN section, cache:purge --invalidate)
   let distributionId: string | undefined;
+  let distributionDomain: string | undefined;
   try {
-    const { discoverDistribution } = await import('./discover-distribution');
+    const { discoverDistributionMatch } = await import('./discover-distribution');
     const routerHost = lambdaResult.routerUrl
       ? new URL(lambdaResult.routerUrl).host
       : undefined;
-    distributionId = await discoverDistribution(region, prefix, {
+    const match = await discoverDistributionMatch(region, prefix, {
       routerHost,
       appName,
       stage,
     });
+    distributionId = match?.id;
+    // A Comment-substring match can name another app's stage; only a confirmed one may say
+    // which site a purge probes.
+    if (match && match.by !== 'comment') distributionDomain = match.domain;
   } catch {
     // Non-fatal
   }
 
+  // CDN_URL is optional on the API Lambda. Without it the stage's own distribution supplies the
+  // probe URL — and only that: baseUrl stays as deployed (see DiscoveredConfig).
+  const baseUrl = lambdaResult.routerUrl || '';
+  const siteUrl = baseUrl || (distributionDomain ? `https://${distributionDomain}` : '');
+
   if (!bucketsResult.updatesBucket) {
     throw new Error(
       `Could not find S3 bucket "${prefix}updatesbucket-*". ` +
@@ -320,15 +355,19 @@ export async function discoverConfig(
     try {
       const raw = await fs.readFile(path.resolve('.sst', 'outputs.json'), 'utf8');
       const outputs = JSON.parse(raw);
-      if (!mediaBucket && outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
-      if (!backupsBucket && outputs.backupsBucket) backupsBucket = outputs.backupsBucket;
+      // outputs.json is the last deploy on ANY stage: adopt its buckets only if it was this one.
+      if (outputsDescribeStage(outputs, appName, stage)) {
+        if (!mediaBucket && outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
+        if (!backupsBucket && outputs.backupsBucket) backupsBucket = outputs.backupsBucket;
+      }
     } catch {
       // outputs.json not available — non-fatal
     }
   }
 
   return {
-    baseUrl: lambdaResult.routerUrl || '',
+    baseUrl,
+    siteUrl,
     region,
     apiFunctionName: lambdaResult.functionName,
     opsFunctionName: opsFn,
@@ -348,12 +387,13 @@ export async function discoverConfig(
 // ---------------------------------------------------------------------------
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const CACHE_VERSION = 5; // Bump when CachedOutputs schema changes to invalidate stale caches (5: +backupsBucket)
+const CACHE_VERSION = 6; // Bump when CachedOutputs schema changes to invalidate stale caches (5: +backupsBucket, 6: +siteUrl; getCachedConfig drops v5 files, an empty siteUrl is cached as a fact)
 
 interface CachedOutputs {
   _cachedAt: number;
   _version?: number;
   routerUrl?: string;
+  siteUrl?: string;
   apiFunctionName?: string;
   opsFunctionName?: string;
   imageFunctionName?: string;
@@ -381,6 +421,7 @@ export async function getCachedConfig(stage: string): Promise<DiscoveredConfig |
     }
     return {
       baseUrl: cached.routerUrl || '',
+      siteUrl: cached.siteUrl ?? cached.routerUrl ?? '',
       region: process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1',
       apiFunctionName: cached.apiFunctionName,
       opsFunctionName: cached.opsFunctionName,
@@ -458,6 +499,7 @@ export async function setCachedConfig(stage: string, config: DiscoveredConfig):
     _cachedAt: Date.now(),
     _version: CACHE_VERSION,
     routerUrl: config.baseUrl,
+    siteUrl: config.siteUrl,
     apiFunctionName: config.apiFunctionName,
     opsFunctionName: config.opsFunctionName,
     imageFunctionName: config.imageFunctionName,

package/src/cli/edge-plan.ts

@@ -26,9 +26,9 @@
 
 import { createHash } from 'node:crypto';
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect';
+import type { SchemaSnapshot, TableSchema } from './schema-introspect';
 import type { AuthzContract, SequenceGrantContract, DefaultAclScope } from './authz-contract';
-import { ownSequenceName } from './schema-diff';
+import { ownSequenceName, foreignKeyContentKey } from './schema-diff';
 import { generateMigrationSql, unmodeledTables } from './migration-generate';
 import { compileTableContract } from './authz-compile';
 import { carryUngovernedAuthz, inheritedSequenceGrants, type GrantExemption } from './authz-reconcile';
@@ -73,8 +73,19 @@ export const PLAN_VERSION = 2;
  * stage would skip the preflight and run the VALIDATE inside the edge — a silently dropped gate
  * and a different failure mode, both of which the BUMP RULE covers. Peers refuse until the stage
  * is redeployed.
+ *
+ * v5 (validation-pending stops refusing the whole edge): `ApplyPlanResult` gained `pendingIsSafe`
+ * and `unappliedStatements` — the CLIENT now decides, from `pendingIsSafe`, whether a
+ * `validation-pending` result exits 0 (a withheld or ordinary-orphan cause) or 1 (a cut-off or
+ * unrecognised cause, a real anomaly). A v4 ops Lambda's `executeApplyPlan` never sets
+ * `pendingIsSafe` at all, so a v5 client reading its response would see it absent, treat every
+ * pending result as UNSAFE by the same fail-closed rule that protects the in-version case, and
+ * exit 1 on a perfectly safe withheld key — the exact false CI failure this whole feature exists
+ * to remove, reintroduced silently across a version skew instead of refused cleanly. The BUMP
+ * RULE covers exactly this: a field the CLIENT now depends on to decide something is part of the
+ * contract. Peers refuse until the stage is redeployed.
  */
-export const APPLY_CONTRACT_VERSION = 4;
+export const APPLY_CONTRACT_VERSION = 5;
 
 /** Classification counts (brick 9, decision 11): destructive = drops + narrowings + strips. */
 export interface PlanClassification {
@@ -225,6 +236,36 @@ export function predictLiveFingerprint(
   return predictLiveState(models, snapshot, contract, opts).hash;
 }
 
+/**
+ * One declared table with its `validate: false` foreign keys' VALIDITY taken from live.
+ *
+ * A key the model declared `validate: false` compiles to `notValid: true`, and that is right for
+ * a from-scratch build: nothing validates it, so the built key really is NOT VALID. But the
+ * PREDICTED endpoint is not a build, it is "the live database after this edge" — and the edge
+ * emits nothing at all for such a key when the live one already content-matches (see
+ * `diffConstraints`: a live NOT VALID key needs no statement, and a live FULLY-VALID key is the
+ * accept-either case). Predicting NOT VALID over a key the database has already validated would
+ * make the plan's own verify-after fail on an edge that touched nothing, on every apply, forever.
+ *
+ * So the prediction copies what the key IS. Untouched for every other key: absent live table,
+ * absent live counterpart, or a declaration that never said `validate: false` — those predict
+ * exactly what they always did.
+ */
+function carryFkValidityThrough(declared: TableSchema, live: TableSchema | undefined): TableSchema {
+  if (!live || !declared.foreignKeys.some((fk) => fk.notValid)) return declared;
+  const liveByContent = new Map(live.foreignKeys.map((fk) => [foreignKeyContentKey(fk), fk]));
+  return {
+    ...declared,
+    foreignKeys: declared.foreignKeys.map((fk) => {
+      if (!fk.notValid) return fk;
+      const counterpart = liveByContent.get(foreignKeyContentKey(fk));
+      if (!counterpart || counterpart.notValid) return fk;
+      const { notValid: _dropped, ...rest } = fk;
+      return rest;
+    }),
+  };
+}
+
 /**
  * The predicted endpoint as a full {@link Fingerprint} (hash AND canonical form). The hash is
  * the plan's `to` and the declares-test; the canonical form lets a MISMATCH report name WHICH
@@ -268,16 +309,6 @@ export function predictLiveState(
     !declaredTables.has(table) && !pendingRenameSources.has(table) && !pendingMoveSources.has(table);
   const declaredEnumList = declared.snapshot.enums ?? [];
   const declaredEnums = new Set(declaredEnumList.map((e) => e.name));
-  const mergedSnapshot: SchemaSnapshot = {
-    tables: [
-      ...declared.snapshot.tables,
-      ...snapshot.tables.filter((t) => ridesThrough(t.table)),
-    ],
-    enums: [
-      ...declaredEnumList,
-      ...(snapshot.enums ?? []).filter((e) => !declaredEnums.has(e.name)),
-    ],
-  };
   // The live counterpart of a declared table: its rename or move source when the edge brings it
   // in under a new name, else its own name. Grants, policies and owned sequences survive RENAME
   // TABLE and SET SCHEMA alike (they attach by OID), so the foreign authz carries across both.
@@ -290,6 +321,17 @@ export function predictLiveState(
     !currentNames.has(declaredTable) && currentNames.has(priorNameOf[declaredTable] ?? '')
       ? priorNameOf[declaredTable]
       : declaredTable;
+  const liveSnapshotByTable = new Map(snapshot.tables.map((t) => [t.table, t]));
+  const mergedSnapshot: SchemaSnapshot = {
+    tables: [
+      ...declared.snapshot.tables.map((t) => carryFkValidityThrough(t, liveSnapshotByTable.get(liveNameFor(t.table)))),
+      ...snapshot.tables.filter((t) => ridesThrough(t.table)),
+    ],
+    enums: [
+      ...declaredEnumList,
+      ...(snapshot.enums ?? []).filter((e) => !declaredEnums.has(e.name)),
+    ],
+  };
   const liveByTable = new Map(contract.tables.map((t) => [t.table, t]));
   const declaredColumnsByTable = new Map(
     declared.snapshot.tables.map((t) => [t.table, new Set(t.columns.map((c) => c.name))]),