@everystack/cli 0.4.91 → 0.4.93

package/CHANGELOG.md

@@ -4,6 +4,57 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.93] - 2026-09-24
+
+### BREAKING CHANGES
+
+- a declared owner needs USAGE on its schema; db:apply refuses without it, db:provision (server 0.4.33) grants it
+
+### Fixed
+
+- name USAGE with CREATE for a missing schema; review follow-ups
+
+## [0.4.92] - 2026-09-24
+
+### Fixed
+
+- grant drift on an owned object runs as its owner
+- an apply fails unless the grants it set really converged
+- settle a built object's grants before checking convergence
+- settle statements are recorded and named; pin settle-as-owner
+
+### Documentation
+
+- a declared owner needs USAGE on its schema to grant there
+
+## [0.4.91] - 2026-09-24
+
+### Fixed
+
+- one apply revokes a grantee dropped from a replaced function
+- a lowercase public grant is PUBLIC in the function grant diff
+
+## [0.4.90] - 2026-09-23
+
+### Added
+
+- db:plan warns when the derived layer is out of sync
+
+### Fixed
+
+- db:apply reports skipped brownfield derived objects by default
+
+## [0.4.89] - 2026-09-22
+
+### Fixed
+
+- outputsDescribeStage matches SST's truncated app-name prefix
+- discoverFunction/discoverCfFunction/discoverBuckets match SST's truncated app-name prefix
+- warn once when cloudfront:ListTagsForResource is denied during distribution discovery
+- db:provision --rotate probes siteUrl on a no-CDN_URL stage
+- update refuses a missing HOST_URL with or without --stage
+- db:reconcile/db:refresh --only respects parens in function identities
+
 ## [0.4.88] - 2026-09-21
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.91",
+  "version": "0.4.93",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -182,7 +182,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.32"
+    "@everystack/server": "0.4.33"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-reconcile.ts

@@ -32,7 +32,7 @@
 import type { QueryRunner } from '../authz-contract';
 import type { SourceObject } from '../derived-source';
 import { introspectDerived } from '../derived-introspect';
-import { planReconcile, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
+import { planReconcile, objectGrantDelta, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
   renderProvenanceUpsert,
@@ -269,8 +269,9 @@ export async function executeReconcile(
     // stable regardless of the create-time wide path above — and that wide path survives the read.
     // The unwrapped path has no transaction to borrow, so it takes a session of its own.
     phase = 'verify';
-    const after = await introspectDerived(atomic ? borrowedSessionRunner(runner) : session);
-    const liveById = new Map(after.objects.map((o) => [o.identity, o]));
+    const reread = () => introspectDerived(atomic ? borrowedSessionRunner(runner) : session);
+    let after = await reread();
+    let liveById = new Map(after.objects.map((o) => [o.identity, o]));
     const srcById = new Map(parsed.objects.map((o) => [o.identity, o]));
 
     // THE ORPHAN CHECK — an outcome assertion, not a plan-shape one. Every identity whose
@@ -309,6 +310,82 @@ export async function executeReconcile(
       );
     }
 
+    // THE GRANT CONVERGENCE CHECK — the same outcome assertion, for authz. Every object whose
+    // grants this batch set (creates, replaces, regrants) must now match its declaration, read
+    // from the real post-DDL catalog with the same diff the plan used.
+    //
+    // A statement that ran is not a statement that worked. PostgreSQL answers a REVOKE that
+    // matches nothing with `WARNING: no privileges could be revoked` and a success tag: issued by
+    // a role that is not the grantor (an operator while ownership is still converging, or a grant
+    // someone with grant option made by hand), it removes nothing. Without this check the apply
+    // reported success while the role kept its privilege — the exact failure a declared-authz
+    // tool exists to prevent. Inside the atomic path the throw rolls the whole batch back.
+    //
+    // SETTLE FIRST. A create's ACL is its attachments PLUS whatever the database adds on its own:
+    // `ALTER DEFAULT PRIVILEGES` grants (db:provision --with-reader sets exactly these), and — for a
+    // superuser builder that creates then hands over — a builder grant folded into the pre-transfer
+    // owner's entry and lost by ALTER … OWNER. The plan cannot see either; only the post-DDL catalog
+    // can. So each created/replaced object's remaining delta runs NOW, in the same batch, and only
+    // then is convergence checked. Without this, those shapes fail every apply, forever: the
+    // rollback restores the plan's `create`, which rebuilds the same ACL. (Main converged them one
+    // apply late, via the next plan's regrant.) Regrants are not re-run: they were computed from
+    // this catalog already, and a repeat of a statement that did not land lands no better.
+    const built = plan.actions.filter((a) => a.action === 'create' || a.action === 'replace').map((a) => a.identity);
+    const settle: string[] = [];
+    for (const identity of built) {
+      const src = srcById.get(identity);
+      const liveObj = liveById.get(identity);
+      if (!src || !liveObj) continue;
+      const delta = objectGrantDelta(src, liveObj);
+      if (!delta || delta.columnScoped || delta.statements.length === 0) continue;
+      // As the owner under set-role, for the reason regrants are: GRANT/REVOKE needs ownership.
+      // The preflight already proved every created object's owner assumable.
+      if (src.owner && liveObj.owner === src.owner && (ownerMode ?? 'set-role') === 'set-role') {
+        settle.push(`SET ROLE ${src.owner}`, ...delta.statements, 'RESET ROLE');
+      } else {
+        settle.push(...delta.statements);
+      }
+    }
+    if (settle.length > 0) {
+      // Recorded BEFORE it runs, so a failed attempt's schema_log row carries the statement that failed.
+      rendered = { ...rendered, statements: [...rendered.statements, ...settle] };
+      phase = 'ddl'; // a GRANT/REVOKE that fails is a DDL failure, not a verify one
+      try {
+        if (atomic) await runner(settle.join(';\n'));
+        else for (const statement of settle) await runner(statement);
+      } catch (err) {
+        throw new Error(
+          `${String((err as any)?.message ?? err)}\n\nThis came from the grant settle pass, which runs after the DDL: `
+          + `the grants the built objects still needed once the catalog was read back (${settle.filter((st) => !/ROLE\b/.test(st)).join('; ')}).`,
+        );
+      }
+      phase = 'verify';
+      after = await reread();
+      liveById = new Map(after.objects.map((o) => [o.identity, o]));
+    }
+
+    const grantTouched = new Set([...built, ...plan.regrants.map((r) => r.identity)]);
+    const unconverged: string[] = [];
+    for (const identity of [...grantTouched].sort()) {
+      const src = srcById.get(identity);
+      const liveObj = liveById.get(identity);
+      if (!src || !liveObj) continue;
+      const delta = objectGrantDelta(src, liveObj);
+      if (delta && !delta.columnScoped && delta.statements.length > 0) {
+        unconverged.push(`${identity}: still needs ${delta.statements.join('; ')}`);
+      }
+    }
+    if (unconverged.length > 0) {
+      throw new Error(
+        `grants did not converge — the statements ran, but the catalog afterwards still differs from the `
+        + `declaration:\n  ${unconverged.join('\n  ')}\n\nA REVOKE that matches nothing only WARNs in PostgreSQL. `
+        + `The usual cause of a REVOKE that did not land is a grant whose grantor is not the role that ran it: `
+        + `the object's live owner differs from its declared owner (converge ownership with \`everystack `
+        + `db:provision\`), or a role holding grant option granted it by hand (revoke it as that role). A GRANT `
+        + `that did not land means the role that ran it holds no grant option on the object. No provenance was written.`,
+      );
+    }
+
     const bookkeeping: string[] = [];
     // ORDER MATTERS: migrate, then record, then remove. This ordering is LOAD-BEARING — it is the
     // fix, not the belt. `renderProvenanceMigrate`'s own guard is the belt (see its docstring).
@@ -426,9 +503,10 @@ export function explainReconcileError(err: unknown, phase: 'ddl' | 'verify' | 'b
       `${msg}\n\nThis failed AFTER the DDL, not in it. `
       + (phase === 'verify'
         ? `The failure came from the verify half: the post-apply catalog re-read, or one of the checks `
-          + `over it — a recorded identity with no source object, an object the catalog cannot see `
-          + `afterwards, or a backend pid that moved. No provenance and no 'applied' schema_log row `
-          + `was written; the bookkeeping write is never reached`
+          + `over it — an object whose DROP left it live, grants that did not converge, a recorded `
+          + `identity with no source object, an object the catalog cannot see afterwards, or a backend `
+          + `pid that moved. No provenance and no 'applied' schema_log row was written; the bookkeeping `
+          + `write is never reached`
         : `The failure came from the bookkeeping write that records what was built — the provenance and `
           + `schema_log statements, or the COMMIT that seals them. The post-apply catalog re-read `
           + `succeeded, so every recorded object was introspectable when it ran`)

package/src/cli/derived-apply.ts

@@ -273,16 +273,19 @@ export function renderEnsureObjectSchemas(objects: SourceObject[]): string[] {
 // Declared-owner preflight — the refusal that beats a raw Postgres error.
 // ---------------------------------------------------------------------------
 
-/** One declared owner and every schema the batch will create an object of theirs in. */
+/** One declared owner, every schema the batch will create an object of theirs in (`schemas`: the
+ *  owner needs CREATE and USAGE there), and every other schema it only GRANTs/REVOKEs in
+ *  (`grantSchemas`: USAGE alone — a GRANT names `schema.object`, and that lookup needs USAGE). */
 export interface OwnerRequirement {
   owner: string;
   schemas: string[];
+  grantSchemas?: string[];
 }
 
 /**
  * The declared owners this batch will actually enact, and where.
  *
- * Scoped to CREATE and REPLACE, because those are the actions that run under `SET ROLE`. A
+ * Scoped to CREATE, REPLACE and owned REGRANTS, because those are what run under `SET ROLE`. A
  * baseline, a prune or an unchanged object never assumes anyone's identity, so demanding its
  * owner be assumable would refuse work the batch was never going to attempt. On a from-scratch
  * build every object is created, so this set is every declared owner anyway.
@@ -296,9 +299,18 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
     if (!obj?.owner) continue;
     (byOwner.get(obj.owner) ?? byOwner.set(obj.owner, new Set()).get(obj.owner)!).add(obj.schema);
   }
-  return [...byOwner.entries()]
-    .map(([owner, schemas]) => ({ owner, schemas: [...schemas].sort() }))
-    .sort((a, b) => a.owner.localeCompare(b.owner));
+  const grantOnly = new Map<string, Set<string>>();
+  for (const r of plan.regrants) {
+    const schema = srcById.get(r.identity)?.schema;
+    if (!r.owner || !schema) continue;
+    (grantOnly.get(r.owner) ?? grantOnly.set(r.owner, new Set()).get(r.owner)!).add(schema);
+  }
+  const owners = new Set([...byOwner.keys(), ...grantOnly.keys()]);
+  return [...owners].sort().map((owner) => {
+    const schemas = [...(byOwner.get(owner) ?? [])].sort();
+    const grantSchemas = [...(grantOnly.get(owner) ?? [])].filter((s) => !schemas.includes(s)).sort();
+    return { owner, schemas, ...(grantSchemas.length ? { grantSchemas } : {}) };
+  });
 }
 
 /**
@@ -310,9 +322,13 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
  * and the privilege only evaluated when it is really there.
  */
 export function ownerPreflightSql(requirements: OwnerRequirement[]): string {
-  const pairs = requirements.flatMap((r) => r.schemas.map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)})`));
+  const rowsFor = (r: OwnerRequirement) => [
+    ...r.schemas.map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, true)`),
+    ...(r.grantSchemas ?? []).map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, false)`),
+  ];
+  const triples = requirements.flatMap(rowsFor);
   return `
-WITH declared(owner_name, schema_name) AS (VALUES ${pairs.join(', ')})
+WITH declared(owner_name, schema_name, needs_create) AS (VALUES ${triples.join(', ')})
 SELECT
   CURRENT_USER AS builder,
   -- Which mechanism the applier may use. A SUPERUSER (RDS: an rds_superuser member) can hand an
@@ -328,12 +344,15 @@ SELECT
   ) AS builder_is_superuser,
   d.owner_name,
   d.schema_name,
+  d.needs_create,
   (r.oid IS NOT NULL) AS role_exists,
   (n.oid IS NOT NULL) AS schema_exists,
   r.rolsuper AS owner_is_superuser,
   CASE WHEN r.oid IS NULL THEN NULL ELSE pg_has_role(CURRENT_USER, r.oid, 'SET') END AS can_set_role,
   CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
-       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
+       ELSE has_schema_privilege(r.oid, n.oid, 'USAGE') END AS owner_can_use
 FROM declared d
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
 LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
@@ -346,11 +365,14 @@ export interface OwnerPreflightRow {
   builder_is_superuser?: unknown;
   owner_name: string;
   schema_name: string;
+  /** False for a schema the owner only GRANTs/REVOKEs in — USAGE is checked, CREATE is not. */
+  needs_create?: unknown;
   role_exists?: unknown;
   schema_exists?: unknown;
   owner_is_superuser?: unknown;
   can_set_role?: unknown;
   owner_can_create?: unknown;
+  owner_can_use?: unknown;
 }
 
 const truthy = (v: unknown): boolean => v === true || v === 't' || v === 'true';
@@ -369,7 +391,7 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
 /**
  * The refusal text, or null when every declared owner is usable.
  *
- * Three ways a declared owner fails, all named at once with the exact statement that fixes each:
+ * Four ways a declared owner fails, all named at once with the exact statement that fixes each:
  *
  *   1. THE ROLE DOES NOT EXIST. The build refuses and does NOT create it. A role is
  *      cluster-scoped and a security principal, and a principal invented by a tool cannot know
@@ -381,6 +403,9 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
  *   3. THE OWNER CANNOT CREATE IN THE SCHEMA. Same mechanism — the CREATE happens AS the owner,
  *      so the owner needs CREATE on the schema the object lives in. A schema that does not exist
  *      yet counts: this build creates it as the BUILDER, and the owner will not hold CREATE on it.
+ *   4. THE OWNER CANNOT USE THE SCHEMA. Every GRANT/REVOKE it runs on its objects (attachments,
+ *      a replace's revokes, regrants, the settle pass) names `schema.object`, and resolving that
+ *      needs USAGE — checked for schemas it creates in AND schemas it only grants in.
  */
 export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null {
   const builder = rows.find((r) => r.builder != null)?.builder;
@@ -388,6 +413,7 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   const missing = new Set<string>();
   const unassumable = new Set<string>();
   const noCreate: Array<{ owner: string; schema: string; exists: boolean }> = [];
+  const noUsage: Array<{ owner: string; schema: string }> = [];
 
   // A superuser builder creates as itself and ALTERs the owner, so it needs neither membership in
   // the owner nor CREATE on the owner's behalf. Refusing on either would be a false refusal that
@@ -403,15 +429,28 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
     // A superuser owner holds CREATE everywhere, including in a schema this build is about to
     // make — there is nothing to refuse.
     if (truthy(row.owner_is_superuser)) continue;
-    if (!truthy(row.schema_exists)) noCreate.push({ owner, schema: String(row.schema_name), exists: false });
-    else if (!truthy(row.owner_can_create)) noCreate.push({ owner, schema: String(row.schema_name), exists: true });
+    const schema = String(row.schema_name);
+    const needsCreate = truthy(row.needs_create);
+    if (!truthy(row.schema_exists)) {
+      // Named whole, in one round: the owner will need both once the builder creates the schema.
+      if (needsCreate) {
+        noCreate.push({ owner, schema, exists: false });
+        noUsage.push({ owner, schema });
+      }
+      continue;
+    }
+    if (needsCreate && !truthy(row.owner_can_create)) noCreate.push({ owner, schema, exists: true });
+    // Every GRANT/REVOKE the owner runs names `schema.object`, and resolving it needs USAGE. An
+    // owned function always has one (its REVOKE ALL … FROM PUBLIC), so this was a mid-batch
+    // `permission denied for schema` before it was a refusal.
+    if (!truthy(row.owner_can_use)) noUsage.push({ owner, schema });
   }
 
-  if (!missing.size && !unassumable.size && !noCreate.length) return null;
+  if (!missing.size && !unassumable.size && !noCreate.length && !noUsage.length) return null;
 
   const lines: string[] = [
-    `declared function owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied.`,
-    `The one-command fix is \`everystack db:provision\`: it ENACTS these grants (and ADOPTS any`,
+    `declared owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied.`,
+    `The one-command fix is \`everystack db:provision\` (USAGE needs @everystack/server >= 0.4.33 on the stage): it ENACTS these grants (and ADOPTS any`,
     `pre-existing objects owned by the master) from the declared model, so you never hand-write them.`,
     `The exact statements, if you must run them by hand:`,
   ];
@@ -424,7 +463,7 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   }
   for (const owner of [...unassumable].sort()) {
     lines.push(
-      `  CANNOT SET ROLE  '${builderName}' cannot assume '${owner}'. The CREATE runs as the owner:`,
+      `  CANNOT SET ROLE  '${builderName}' cannot assume '${owner}'. The CREATE and every GRANT/REVOKE on its objects run as the owner:`,
       `      GRANT ${owner} TO ${builderName} WITH INHERIT FALSE, SET TRUE;`,
     );
   }
@@ -434,6 +473,12 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
       `      GRANT CREATE ON SCHEMA ${schema} TO ${owner};`,
     );
   }
+  for (const { owner, schema } of noUsage) {
+    lines.push(
+      `  NO USAGE ON SCHEMA  '${owner}' cannot use schema "${schema}" — its GRANT/REVOKE on the objects there name the schema:`,
+      `      GRANT USAGE ON SCHEMA ${schema} TO ${owner};`,
+    );
+  }
   return lines.join('\n');
 }
 
@@ -498,8 +543,14 @@ export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[],
   }
 
   // Grant convergence rides the same batch, after every object exists. Idempotent
-  // REVOKE/GRANT — no provenance to record (ACLs are not in any hash).
-  for (const r of plan.regrants) statements.push(...r.statements);
+  // REVOKE/GRANT — no provenance to record (ACLs are not in any hash). An owned object's grants
+  // run AS its owner, for the reason objectSql keeps attachments inside the block: GRANT/REVOKE
+  // needs ownership, and a non-superuser operator does not have it. A superuser builder
+  // (alter-owner) acts as any owner already.
+  for (const r of plan.regrants) {
+    if (r.owner && ownerMode === 'set-role') statements.push(`SET ROLE ${r.owner}`, ...r.statements, 'RESET ROLE');
+    else statements.push(...r.statements);
+  }
 
   // NOTE — a `remove` entry that is also a migration's TARGET is CORRECT, not a contradiction.
   // A legacy-keyed function the source has removed migrates onto its signature identity and is

package/src/cli/derived-plan.ts

@@ -27,7 +27,9 @@
 import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source';
 import type { DerivedCatalog, LiveObject } from './derived-introspect';
 import { triggerDropSql } from './derived-apply';
-import { parseGrantAttachments, diffObjectGrants, revokesPublic } from './derived-grants';
+import {
+  parseGrantAttachments, diffObjectGrants, revokesPublic, type GrantOwnerContext, type ObjectGrantDiff,
+} from './derived-grants';
 import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes';
 
 export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'rebaseline' | 'prune' | 'backfill';
@@ -58,6 +60,11 @@ export interface DriftFinding {
 export interface RegrantFinding {
   identity: string;
   statements: string[];
+  /** The role the statements must run as: GRANT/REVOKE on an object needs its owner, and a
+   *  non-superuser operator is not it. Set only when the declared owner IS the live owner — under
+   *  any other role a REVOKE can match nothing and only WARN. That case runs as the operator, and
+   *  the post-apply convergence check (db-reconcile) fails it rather than letting it read as success. */
+  owner?: string;
 }
 
 /** Declared `dependsOn` vs the live catalog's actual edges (B4: declared, then verified). */
@@ -148,6 +155,40 @@ export interface ReconcileOptions {
 
 const isRelation = (kind: DerivedKind): boolean => kind !== 'function';
 
+const ownerContext = (src: SourceObject, liveObj: LiveObject): GrantOwnerContext => ({
+  ...(src.owner !== undefined ? { declared: src.owner } : {}),
+  ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
+});
+
+/**
+ * The REVOKE/GRANT delta between an object's declared grants and a live ACL — the ONE diff the
+ * drift pass, a replace's revokes and the post-apply convergence check all use, so the check can
+ * never disagree with the plan about what "converged" means. Null when there is nothing to
+ * compare (no ACL read, or a kind with no grants). Column-scoped grants are not compared
+ * (attacl is not introspected) and say so.
+ *
+ * Ownership context is passed for EVERY kind. An owner's implicit privileges are excluded from
+ * the live read for relations too (`a.grantee <> c.relowner`), so a model that both owns an object
+ * and lists that owner in its grants declares a self-grant the read can never confirm —
+ * diffObjectGrants normalizes the owner grantee away. The earlier belief that a relation's grant
+ * set "does not shift with its owner" holds only while relacl is NULL; the first non-owner grant
+ * materializes the ACL and the owner's own rows drop out, exactly as for a function. (A consumer's
+ * ADOPT'd view, owned by a role its model also grants, looped forever — 2026-09-04.)
+ * KNOWN LIMIT: a privilege an owner has deliberately self-revoked is not restored — that is a
+ * failure to ADD access (availability), never to remove it.
+ */
+export function objectGrantDelta(
+  src: SourceObject,
+  liveObj: LiveObject,
+  liveGrants: Record<string, string[]> | undefined = liveObj.grants,
+): (ObjectGrantDiff & { columnScoped: boolean }) | null {
+  if (liveGrants === undefined || src.kind === 'trigger' || src.kind === 'sql') return null;
+  const parsed = parseGrantAttachments(src.attachments);
+  if (parsed.hasColumnGrants) return { statements: [], suppressed: [], columnScoped: true };
+  const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
+  return { ...diffObjectGrants(target, parsed.grants, liveGrants, ownerContext(src, liveObj)), columnScoped: false };
+}
+
 export function planReconcile(
   source: ParsedSources,
   live: DerivedCatalog,
@@ -465,10 +506,6 @@ export function planReconcile(
 
   const regrants: RegrantFinding[] = [];
   const dependencyDrift: DependencyDriftFinding[] = [];
-  const ownerContext = (src: SourceObject, liveObj: LiveObject): { declared?: string; live?: string } => ({
-    ...(src.owner !== undefined ? { declared: src.owner } : {}),
-    ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
-  });
   // Rebaselined objects join the lens: their live catalog rows are as real as a skip's,
   // and running the checks NOW means a migration converges (grants ride the same apply)
   // instead of surfacing on the next plan.
@@ -482,30 +519,21 @@ export function planReconcile(
     // Every object is descriptor-compiled (db/sql retired, B7), and the compiler
     // ALWAYS declares authz — a private relation is declared-empty, not undeclared —
     // so every up-to-date object is grant-checked.
-    if (liveObj?.grants !== undefined) {
-      const parsed = parseGrantAttachments(src.attachments);
-      if (parsed.hasColumnGrants) {
-        extraWarnings.push(
-          `${src.identity}: column-scoped grants are applied at create but not drift-checked (attacl introspection is future work) — hand edits to them are invisible here.`,
-        );
-      } else {
-        const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
-        // Ownership context is passed for EVERY kind. An owner's implicit privileges are excluded
-        // from the live read for relations too (`a.grantee <> c.relowner`), so a model that both
-        // owns an object and lists that owner in its grants declares a self-grant the read can
-        // never confirm — diffObjectGrants normalizes the owner grantee away. The earlier belief
-        // that a relation's grant set "does not shift with its owner" holds only while relacl is
-        // NULL; the first non-owner grant materializes the ACL and the owner's own rows drop out,
-        // exactly as for a function. (A consumer's ADOPT'd view, owned by a role its model also
-        // grants, looped forever — 2026-09-04.)
-        // KNOWN LIMIT: a privilege an owner has deliberately self-revoked is not restored — that
-        // is a failure to ADD access (availability), never to remove it, and unnormalized code did
-        // not converge on it either.
-        const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, ownerContext(src, liveObj));
-        if (statements.length > 0) regrants.push({ identity: src.identity, statements });
-        // Never silent: a withheld revoke is reported every run until the owner is declared.
-        for (const note of suppressed) extraWarnings.push(note);
+    const delta = liveObj ? objectGrantDelta(src, liveObj) : null;
+    if (delta?.columnScoped) {
+      extraWarnings.push(
+        `${src.identity}: column-scoped grants are applied at create but not drift-checked (attacl introspection is future work) — hand edits to them are invisible here.`,
+      );
+    } else if (delta && liveObj) {
+      if (delta.statements.length > 0) {
+        // Run as the owner only when the declared owner IS the live owner: under any other role a
+        // REVOKE can match nothing and only WARN. The post-apply convergence check catches that
+        // case whichever role runs it.
+        const owner = src.owner !== undefined && liveObj.owner === src.owner ? src.owner : undefined;
+        regrants.push({ identity: src.identity, statements: delta.statements, ...(owner ? { owner } : {}) });
       }
+      // Never silent: a withheld revoke is reported every run until the owner is declared.
+      for (const note of delta.suppressed) extraWarnings.push(note);
     }
 
     // Dependency drift — declared, then verified. Only descriptor-home relations carry a
@@ -653,14 +681,12 @@ export function planReconcile(
     const src = srcById.get(id);
     const liveObj = liveById.get(id);
     if (!src || !liveObj || liveObj.grants === undefined) return [];
-    const parsed = parseGrantAttachments(src.attachments);
-    if (parsed.hasColumnGrants) return [];
-    const target = parsed.target ?? `FUNCTION ${src.identity}`;
     const afterReplace = { ...liveObj.grants };
     if (revokesPublic(src.attachments)) delete afterReplace.PUBLIC;
-    const { statements, suppressed } = diffObjectGrants(target, parsed.grants, afterReplace, ownerContext(src, liveObj));
-    for (const note of suppressed) extraWarnings.push(note);
-    return statements.filter((st) => /^REVOKE\b/i.test(st));
+    const delta = objectGrantDelta(src, liveObj, afterReplace);
+    if (!delta || delta.columnScoped) return [];
+    for (const note of delta.suppressed) extraWarnings.push(note);
+    return delta.statements.filter((st) => /^REVOKE\b/i.test(st));
   };
 
   const actions: ReconcileAction[] = [