@everystack/cli 0.4.92 → 0.4.95

package/src/cli/derived-apply.ts

@@ -273,12 +273,13 @@ export function renderEnsureObjectSchemas(objects: SourceObject[]): string[] {
 // Declared-owner preflight — the refusal that beats a raw Postgres error.
 // ---------------------------------------------------------------------------
 
-/** One declared owner and every schema the batch will create an object of theirs in. Empty
- *  `schemas` means the batch only GRANTs/REVOKEs as that owner: it must exist and be assumable,
- *  but it creates nothing, so it needs CREATE nowhere. */
+/** One declared owner, every schema the batch will create an object of theirs in (`schemas`: the
+ *  owner needs CREATE and USAGE there), and every other schema it only GRANTs/REVOKEs in
+ *  (`grantSchemas`: USAGE alone — a GRANT names `schema.object`, and that lookup needs USAGE). */
 export interface OwnerRequirement {
   owner: string;
   schemas: string[];
+  grantSchemas?: string[];
 }
 
 /**
@@ -298,12 +299,18 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
     if (!obj?.owner) continue;
     (byOwner.get(obj.owner) ?? byOwner.set(obj.owner, new Set()).get(obj.owner)!).add(obj.schema);
   }
+  const grantOnly = new Map<string, Set<string>>();
   for (const r of plan.regrants) {
-    if (r.owner && !byOwner.has(r.owner)) byOwner.set(r.owner, new Set());
+    const schema = srcById.get(r.identity)?.schema;
+    if (!r.owner || !schema) continue;
+    (grantOnly.get(r.owner) ?? grantOnly.set(r.owner, new Set()).get(r.owner)!).add(schema);
   }
-  return [...byOwner.entries()]
-    .map(([owner, schemas]) => ({ owner, schemas: [...schemas].sort() }))
-    .sort((a, b) => a.owner.localeCompare(b.owner));
+  const owners = new Set([...byOwner.keys(), ...grantOnly.keys()]);
+  return [...owners].sort().map((owner) => {
+    const schemas = [...(byOwner.get(owner) ?? [])].sort();
+    const grantSchemas = [...(grantOnly.get(owner) ?? [])].filter((s) => !schemas.includes(s)).sort();
+    return { owner, schemas, ...(grantSchemas.length ? { grantSchemas } : {}) };
+  });
 }
 
 /**
@@ -315,11 +322,13 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
  * and the privilege only evaluated when it is really there.
  */
 export function ownerPreflightSql(requirements: OwnerRequirement[]): string {
-  // A grant-only owner still needs its row (does it exist, can we assume it): one with no schema.
-  const pairs = requirements.flatMap((r) => (r.schemas.length ? r.schemas : [null])
-    .map((s) => `(${escapeLiteral(r.owner)}, ${s === null ? 'NULL::text' : escapeLiteral(s)})`));
+  const rowsFor = (r: OwnerRequirement) => [
+    ...r.schemas.map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, true)`),
+    ...(r.grantSchemas ?? []).map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, false)`),
+  ];
+  const triples = requirements.flatMap(rowsFor);
   return `
-WITH declared(owner_name, schema_name) AS (VALUES ${pairs.join(', ')})
+WITH declared(owner_name, schema_name, needs_create) AS (VALUES ${triples.join(', ')})
 SELECT
   CURRENT_USER AS builder,
   -- Which mechanism the applier may use. A SUPERUSER (RDS: an rds_superuser member) can hand an
@@ -335,12 +344,15 @@ SELECT
   ) AS builder_is_superuser,
   d.owner_name,
   d.schema_name,
+  d.needs_create,
   (r.oid IS NOT NULL) AS role_exists,
   (n.oid IS NOT NULL) AS schema_exists,
   r.rolsuper AS owner_is_superuser,
   CASE WHEN r.oid IS NULL THEN NULL ELSE pg_has_role(CURRENT_USER, r.oid, 'SET') END AS can_set_role,
   CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
-       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
+       ELSE has_schema_privilege(r.oid, n.oid, 'USAGE') END AS owner_can_use
 FROM declared d
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
 LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
@@ -352,13 +364,15 @@ export interface OwnerPreflightRow {
   builder?: unknown;
   builder_is_superuser?: unknown;
   owner_name: string;
-  /** Null for a grant-only owner — nothing is created, so there is no schema to check. */
-  schema_name: string | null;
+  schema_name: string;
+  /** False for a schema the owner only GRANTs/REVOKEs in — USAGE is checked, CREATE is not. */
+  needs_create?: unknown;
   role_exists?: unknown;
   schema_exists?: unknown;
   owner_is_superuser?: unknown;
   can_set_role?: unknown;
   owner_can_create?: unknown;
+  owner_can_use?: unknown;
 }
 
 const truthy = (v: unknown): boolean => v === true || v === 't' || v === 'true';
@@ -377,7 +391,7 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
 /**
  * The refusal text, or null when every declared owner is usable.
  *
- * Three ways a declared owner fails, all named at once with the exact statement that fixes each:
+ * Four ways a declared owner fails, all named at once with the exact statement that fixes each:
  *
  *   1. THE ROLE DOES NOT EXIST. The build refuses and does NOT create it. A role is
  *      cluster-scoped and a security principal, and a principal invented by a tool cannot know
@@ -389,6 +403,9 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
  *   3. THE OWNER CANNOT CREATE IN THE SCHEMA. Same mechanism — the CREATE happens AS the owner,
  *      so the owner needs CREATE on the schema the object lives in. A schema that does not exist
  *      yet counts: this build creates it as the BUILDER, and the owner will not hold CREATE on it.
+ *   4. THE OWNER CANNOT USE THE SCHEMA. Every GRANT/REVOKE it runs on its objects (attachments,
+ *      a replace's revokes, regrants, the settle pass) names `schema.object`, and resolving that
+ *      needs USAGE — checked for schemas it creates in AND schemas it only grants in.
  */
 export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null {
   const builder = rows.find((r) => r.builder != null)?.builder;
@@ -396,6 +413,7 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   const missing = new Set<string>();
   const unassumable = new Set<string>();
   const noCreate: Array<{ owner: string; schema: string; exists: boolean }> = [];
+  const noUsage: Array<{ owner: string; schema: string }> = [];
 
   // A superuser builder creates as itself and ALTERs the owner, so it needs neither membership in
   // the owner nor CREATE on the owner's behalf. Refusing on either would be a false refusal that
@@ -411,16 +429,28 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
     // A superuser owner holds CREATE everywhere, including in a schema this build is about to
     // make — there is nothing to refuse.
     if (truthy(row.owner_is_superuser)) continue;
-    if (row.schema_name == null) continue;
-    if (!truthy(row.schema_exists)) noCreate.push({ owner, schema: String(row.schema_name), exists: false });
-    else if (!truthy(row.owner_can_create)) noCreate.push({ owner, schema: String(row.schema_name), exists: true });
+    const schema = String(row.schema_name);
+    const needsCreate = truthy(row.needs_create);
+    if (!truthy(row.schema_exists)) {
+      // Named whole, in one round: the owner will need both once the builder creates the schema.
+      if (needsCreate) {
+        noCreate.push({ owner, schema, exists: false });
+        noUsage.push({ owner, schema });
+      }
+      continue;
+    }
+    if (needsCreate && !truthy(row.owner_can_create)) noCreate.push({ owner, schema, exists: true });
+    // Every GRANT/REVOKE the owner runs names `schema.object`, and resolving it needs USAGE. An
+    // owned function always has one (its REVOKE ALL … FROM PUBLIC), so this was a mid-batch
+    // `permission denied for schema` before it was a refusal.
+    if (!truthy(row.owner_can_use)) noUsage.push({ owner, schema });
   }
 
-  if (!missing.size && !unassumable.size && !noCreate.length) return null;
+  if (!missing.size && !unassumable.size && !noCreate.length && !noUsage.length) return null;
 
   const lines: string[] = [
     `declared owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied.`,
-    `The one-command fix is \`everystack db:provision\`: it ENACTS these grants (and ADOPTS any`,
+    `The one-command fix is \`everystack db:provision\` (USAGE needs @everystack/server >= 0.4.33 on the stage): it ENACTS these grants (and ADOPTS any`,
     `pre-existing objects owned by the master) from the declared model, so you never hand-write them.`,
     `The exact statements, if you must run them by hand:`,
   ];
@@ -443,6 +473,12 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
       `      GRANT CREATE ON SCHEMA ${schema} TO ${owner};`,
     );
   }
+  for (const { owner, schema } of noUsage) {
+    lines.push(
+      `  NO USAGE ON SCHEMA  '${owner}' cannot use schema "${schema}" — its GRANT/REVOKE on the objects there name the schema:`,
+      `      GRANT USAGE ON SCHEMA ${schema} TO ${owner};`,
+    );
+  }
   return lines.join('\n');
 }
 

package/src/cli/derived-plan.ts

@@ -509,7 +509,13 @@ export function planReconcile(
   // Rebaselined objects join the lens: their live catalog rows are as real as a skip's,
   // and running the checks NOW means a migration converges (grants ride the same apply)
   // instead of surfacing on the next plan.
-  const lensSet = new Set([...skipped, ...rebaseline, ...backfill]);
+  //
+  // Baselined objects join it too. A baseline trusts the STRUCTURE it cannot verify (source text
+  // and live deparse live in different hash spaces); the grants it CAN verify, so it never trusts
+  // them. Without this, an object restored with default privileges — every function EXECUTE to
+  // PUBLIC, SECURITY DEFINER ones included — was adopted with its open grants recorded as fine.
+  // (needsBaseline objects stay out: nothing is adopted, so nothing is touched.)
+  const lensSet = new Set([...skipped, ...rebaseline, ...backfill, ...baseline]);
   for (const src of source.objects) {
     if (!lensSet.has(src.identity)) continue;
     if (src.kind === 'trigger' || src.kind === 'sql') continue; // no grants, no rewrite edges

package/src/cli/exec-digest.ts

@@ -1,7 +1,9 @@
 /**
  * exec-digest — the catalog content-address that makes db:exec DML-only WITHOUT a role, a
  * superuser, or a regex. A self-contained SQL query that md5s the schema-relevant catalog
- * (pg_class / pg_attribute / pg_constraint / pg_index / pg_proc / pg_type) for the given app
+ * (pg_class / pg_attribute / pg_constraint / pg_index / pg_proc / pg_type, plus the behaviour
+ * attached to relations — pg_rewrite / pg_trigger / pg_attrdef — and the database-wide
+ * pg_event_trigger / pg_extension) for the given app
  * schemas. db:exec takes this digest before and after the file inside one transaction; any
  * difference is a schema change — however it was caused (a CREATE/ALTER/DROP, a function, a DO
  * block, dynamic SQL) — and rolls the whole transaction back.
@@ -66,7 +68,7 @@ FROM (
   -- but CAN change who may read it is not a DML-only lane. None of the three move under DML.
   SELECT format('rel:%s.%s:%s:%s:%s:%s:%s', n.nspname, c.relname, c.relkind, c.relpersistence,
                 coalesce(c.relacl::text, ''), c.relrowsecurity, c.relforcerowsecurity) AS line
-    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS} AND c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
   UNION ALL
   -- Row policies: a CREATE/ALTER/DROP POLICY rewrites who sees which rows and touches no other
@@ -74,32 +76,32 @@ FROM (
   SELECT format('pol:%s.%s.%s:%s:%s:%s:%s:%s', n.nspname, c.relname, pol.polname, pol.polcmd,
                 pol.polpermissive,
                 coalesce((SELECT string_agg(r.rolname, ',' ORDER BY r.rolname)
-                          FROM pg_roles r WHERE r.oid = ANY(pol.polroles)), 'PUBLIC'),
+                          FROM pg_catalog.pg_roles r WHERE r.oid = ANY(pol.polroles)), 'PUBLIC'),
                 coalesce(pg_get_expr(pol.polqual, pol.polrelid), ''),
                 coalesce(pg_get_expr(pol.polwithcheck, pol.polrelid), ''))
-    FROM pg_policy pol
-    JOIN pg_class c ON c.oid = pol.polrelid
-    JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_policy pol
+    JOIN pg_catalog.pg_class c ON c.oid = pol.polrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS}
   UNION ALL
   -- Columns: number, type, typmod, not-null — the shape ALTER TABLE moves, DML never.
   SELECT format('att:%s.%s.%s:%s:%s:%s:%s',
                 n.nspname, c.relname, a.attname, a.attnum, a.atttypid, a.atttypmod, a.attnotnull)
-    FROM pg_attribute a
-    JOIN pg_class c ON c.oid = a.attrelid
-    JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_attribute a
+    JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS} AND a.attnum > 0 AND NOT a.attisdropped
   UNION ALL
   -- Constraints: the full textual definition (PK/FK/unique/check predicate).
   SELECT format('con:%s.%s:%s', n.nspname, con.conname, pg_get_constraintdef(con.oid))
-    FROM pg_constraint con JOIN pg_namespace n ON n.oid = con.connamespace
+    FROM pg_catalog.pg_constraint con JOIN pg_catalog.pg_namespace n ON n.oid = con.connamespace
     WHERE ${NS}
   UNION ALL
   -- Indexes: the full textual definition (columns, uniqueness, partial WHERE).
   SELECT format('idx:%s.%s:%s', n.nspname, ic.relname, pg_get_indexdef(i.indexrelid))
-    FROM pg_index i
-    JOIN pg_class ic ON ic.oid = i.indexrelid
-    JOIN pg_namespace n ON n.oid = ic.relnamespace
+    FROM pg_catalog.pg_index i
+    JOIN pg_catalog.pg_class ic ON ic.oid = i.indexrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = ic.relnamespace
     WHERE ${NS}
   UNION ALL
   -- Routines: name + arg types + a hash of the body, PLUS proacl (the EXECUTE grants) and
@@ -107,14 +109,57 @@ FROM (
   -- that opens one, is a privilege change and must trip the guard like any other.
   SELECT format('proc:%s.%s:%s:%s:%s:%s', n.nspname, p.proname, p.proargtypes::text,
                 md5(coalesce(p.prosrc, '')), coalesce(p.proacl::text, ''), p.prosecdef)
-    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+    FROM pg_catalog.pg_proc p JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
     WHERE ${NS}
   UNION ALL
+  -- Behaviour ATTACHED to a relation — no column, constraint or index moves, so each of these
+  -- passed the guard until the closing-gate review (2026-09-24) proved it: a RULE on the ledger
+  -- could retire every future restore witness at birth. Rules (view bodies included: a view
+  -- redefinition is DDL too), user triggers, and column defaults, by their full definitions.
+  SELECT format('rule:%s.%s.%s:%s', n.nspname, c.relname, r.rulename, md5(pg_get_ruledef(r.oid)))
+    FROM pg_catalog.pg_rewrite r
+    JOIN pg_catalog.pg_class c ON c.oid = r.ev_class
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS}
+  UNION ALL
+  SELECT format('trg:%s.%s.%s:%s:%s', n.nspname, c.relname, t.tgname, t.tgenabled, md5(pg_get_triggerdef(t.oid)))
+    FROM pg_catalog.pg_trigger t
+    JOIN pg_catalog.pg_class c ON c.oid = t.tgrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS} AND NOT t.tgisinternal
+  UNION ALL
+  SELECT format('def:%s.%s.%s:%s', n.nspname, c.relname, a.attname, pg_get_expr(d.adbin, d.adrelid))
+    FROM pg_catalog.pg_attrdef d
+    JOIN pg_catalog.pg_attribute a ON a.attrelid = d.adrelid AND a.attnum = d.adnum
+    JOIN pg_catalog.pg_class c ON c.oid = d.adrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS}
+  UNION ALL
+  -- Database-wide behaviour: event triggers fire on every DDL, extensions install whole schemas.
+  SELECT format('evt:%s:%s:%s:%s', e.evtname, e.evtevent, e.evtenabled, e.evtfoid::regproc::text)
+    FROM pg_catalog.pg_event_trigger e
+  UNION ALL
+  SELECT format('ext:%s:%s', x.extname, x.extversion)
+    FROM pg_catalog.pg_extension x
+  UNION ALL
+  -- TEMP triggers and functions. Temp TABLES stay out (ordinary scripts stage data in them), but a
+  -- DML file never needs a trigger or a function of its own — and one on a temp relation is how a
+  -- file runs code at COMMIT, after the checks (closing-gate review round 3).
+  SELECT format('ttrg:%s.%s:%s', c.relname, t.tgname, md5(pg_get_triggerdef(t.oid)))
+    FROM pg_catalog.pg_trigger t
+    JOIN pg_catalog.pg_class c ON c.oid = t.tgrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname LIKE 'pg_temp%' AND NOT t.tgisinternal
+  UNION ALL
+  SELECT format('tproc:%s:%s', p.proname, md5(coalesce(p.prosrc, '')))
+    FROM pg_catalog.pg_proc p JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname LIKE 'pg_temp%'
+  UNION ALL
   -- Types: kind + ordered enum labels. CREATE TYPE / ALTER TYPE ADD VALUE move it.
   SELECT format('type:%s.%s:%s:%s', n.nspname, t.typname, t.typtype,
                 coalesce((SELECT string_agg(e.enumlabel, ',' ORDER BY e.enumsortorder)
-                          FROM pg_enum e WHERE e.enumtypid = t.oid), ''))
-    FROM pg_type t JOIN pg_namespace n ON n.oid = t.typnamespace
+                          FROM pg_catalog.pg_enum e WHERE e.enumtypid = t.oid), ''))
+    FROM pg_catalog.pg_type t JOIN pg_catalog.pg_namespace n ON n.oid = t.typnamespace
     WHERE ${NS}
 ) s
 `.trim();

package/src/cli/exec-run.ts

@@ -46,6 +46,74 @@ export class SchemaChangedError extends Error {
   }
 }
 
+/**
+ * The ledger violation: the file wrote to the `everystack` schema. Those tables are what every
+ * safety decision reads — schema_log is the descent anchor and a restore's witness, derived_provenance
+ * decides what the reconciler trusts, exec_log is this lane's own audit. A DML lane that can write
+ * them can forge any of it, so the whole transaction was rolled back.
+ */
+export class LedgerWriteError extends Error {
+  constructor(detail: string) {
+    super(
+      `db:exec cannot write the everystack schema (${detail}) — its tables are the ledgers every safety check reads, ` +
+        'and a write here could forge one. The whole transaction was rolled back; nothing was applied.',
+    );
+    this.name = 'LedgerWriteError';
+  }
+}
+
+/**
+ * Rows written to everystack.* by THIS transaction (pg_stat_xact_* counts the open transaction), and
+ * each table's relfilenode — TRUNCATE touches no row counter but always gives the table a new file.
+ * Semantic, like the catalog digest: it reads what happened, not what the SQL text looks like.
+ */
+export const LEDGER_GUARD_SQL = `
+SELECT coalesce(sum(s.n_tup_ins + s.n_tup_upd + s.n_tup_del), 0)::bigint AS writes,
+       coalesce(string_agg(c.relname || ':' || c.relfilenode::text, ',' ORDER BY c.relname), '') AS files,
+       -- A table that INHERITS from a ledger table (a temp one is enough) makes its rows read as
+       -- ledger rows, and its writes count against the child. Ledger tables never have children.
+       (SELECT count(*) FROM pg_catalog.pg_inherits i JOIN pg_catalog.pg_class p ON p.oid = i.inhparent
+          JOIN pg_catalog.pg_namespace pn ON pn.oid = p.relnamespace WHERE pn.nspname = 'everystack')::int AS children,
+       pg_catalog.current_setting('track_counts') AS track_counts
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+LEFT JOIN pg_catalog.pg_stat_xact_user_tables s ON s.relid = c.oid
+WHERE n.nspname = 'everystack' AND c.relkind IN ('r', 'p')`.trim();
+
+/**
+ * Fire every DEFERRED constraint trigger NOW. A deferred trigger runs at COMMIT — after both
+ * checks — so a file could hide DDL or a ledger write inside one (closing-gate review round 2).
+ * Made immediate here, it fires inside the window the checks read.
+ */
+export const FIRE_DEFERRED_SQL = 'SET CONSTRAINTS ALL IMMEDIATE';
+
+/**
+ * The digest reads `pg_get_*def` / `pg_get_expr` text, which qualifies names relative to the
+ * search_path: a file that sets its own path would move the digest with no schema change (a
+ * serial default prints `nextval('t_id_seq')` or `nextval('public.t_id_seq')`). Pin the path for
+ * the read, then give the file its own back.
+ */
+// pg_temp named LAST: unnamed, PostgreSQL searches it FIRST for relations, and a file's temp view
+// called pg_class would answer the check (closing-gate review round 3). Every catalog the checks
+// read is also written pg_catalog.x; this pin is the second lock.
+const PATH_SAVE_SQL = `SELECT pg_catalog.current_setting('search_path') AS path`;
+const PATH_PIN_SQL = `SELECT pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true)`;
+const pathRestoreSql = (path: string): string => `SELECT pg_catalog.set_config('search_path', '${path.replace(/'/g, "''")}', true)`;
+
+/** Run a check query under the pinned path, then give the file its own path back. */
+async function pinned(run: TxRunner, query: string): Promise<ExecStmtResult> {
+  const saved = (await run(PATH_SAVE_SQL)).rows?.[0]?.path;
+  await run(PATH_PIN_SQL);
+  const res = await run(query); // a failure aborts the transaction: nothing to restore, keep its error
+  if (typeof saved === 'string') await run(pathRestoreSql(saved));
+  return res;
+}
+
+const pinnedDigest = async (run: TxRunner, digestQuery: string): Promise<string> => readDigest(await pinned(run, digestQuery));
+
+/** A WITH HOLD cursor finishes its query at COMMIT — after the checks. Close them all first. */
+export const CLOSE_CURSORS_SQL = 'CLOSE ALL';
+
 /** Transaction rails — a file can't hang the plane or block behind a lock forever. */
 export interface ExecRails {
   statementTimeoutMs?: number;
@@ -87,7 +155,8 @@ export async function runExecInTx(
   for (const rail of railStatements(opts.rails)) await run(rail);
 
   const digestQuery = catalogDigestQuery(opts.schemas);
-  const before = readDigest(await run(digestQuery));
+  const before = await pinnedDigest(run, digestQuery);
+  const ledgerBefore = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
 
   const rowsAffected: number[] = [];
   for (const stmt of splitSqlStatements(fileSql)) {
@@ -95,8 +164,18 @@ export async function runExecInTx(
     rowsAffected.push(res.count);
   }
 
-  const after = readDigest(await run(digestQuery));
+  await run(FIRE_DEFERRED_SQL);
+  await run(CLOSE_CURSORS_SQL);
+  const after = await pinnedDigest(run, digestQuery);
   if (before !== after) throw new SchemaChangedError(before, after);
+  const ledgerAfter = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
+  if (String(ledgerAfter.track_counts ?? 'on') === 'off') {
+    throw new LedgerWriteError('track_counts was turned off, so ledger writes could not be counted');
+  }
+  if (Number(ledgerAfter.children ?? 0) > 0) throw new LedgerWriteError('a table inherits from a ledger table');
+  const wrote = Number(ledgerAfter.writes ?? 0) - Number(ledgerBefore.writes ?? 0);
+  if (wrote > 0) throw new LedgerWriteError(`${wrote} row(s) written`);
+  if (String(ledgerAfter.files ?? '') !== String(ledgerBefore.files ?? '')) throw new LedgerWriteError('a table was truncated or rewritten');
   return rowsAffected;
 }