@homeflare/alchemy 0.44.0 → 0.46.0

package/src/postgres/role-diff.ts

@@ -16,12 +16,13 @@ import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts'
 import {
   PostgresRoleIdentityRefused,
   type PostgresRoleNameRefused,
+  type PostgresRolePasswordNonAsciiRefused,
   PostgresRoleRenameRefused,
   type PostgresRoleValidUntilRefused,
 } from './role-errors.ts';
 import { membershipDrift, unsafeMemberships } from './role-membership-sql.ts';
-import { passwordMatchesSeal, resolvePassword } from './role-secrets.ts';
-import { scalarDrift } from './role-sql.ts';
+import { assertPasswordAscii, passwordMatchesSeal, resolvePassword } from './role-secrets.ts';
+import { privilegedFlags, scalarDrift } from './role-sql.ts';
 import { refuseAtPlan } from './role.ts';
 
 /** A catalog read the provider performed for this diff. `found: undefined` means the name is
@@ -47,6 +48,7 @@ export const diffPostgresRole = (
   | PostgresRoleNameRefused
   | PostgresRoleValidUntilRefused
   | PostgresRoleIdentityRefused
+  | PostgresRolePasswordNonAsciiRefused
 > =>
   Effect.gen(function* () {
     if (output === undefined || !isResolved(news)) return undefined;
@@ -73,14 +75,16 @@ export const diffPostgresRole = (
     const membership = membershipDrift(
       news.memberOf,
       compared.memberOf ?? [],
-      live === undefined ? new Set() : unsafeMemberships(live),
+      live === undefined ? new Set() : unsafeMemberships(live, news.inherit),
     );
     const resolved = resolvePassword(news, env);
+    yield* assertPasswordAscii(news.name, resolved);
     const passwordStale =
       resolved.value !== undefined && !passwordMatchesSeal(resolved.value, output.passwordSeal);
     const absent = observation !== undefined && live === undefined;
     const changed =
       absent ||
+      privilegedFlags(compared).length > 0 ||
       scalars.length > 0 ||
       membership.grants.length > 0 ||
       membership.revokes.length > 0 ||

package/src/postgres/role-errors.ts

@@ -1,9 +1,10 @@
 /**
  * `Postgres.Role` failures as typed tags (S21).
  *
- * ⛔ NONE OF THESE IS A STATUS-CODE OR MESSAGE MATCH. Every one is raised from a fact the
+ * ⛔ NEVER MATCH DRIVER MESSAGE TEXT. Most errors are raised from a fact the
  *   provider already checked (a byte count, a live catalog row, a missing environment variable,
- *   a vanished create) — never from sniffing a driver error's text. A `DROP ROLE` that the
+ *   a vanished create). Membership repair also maps raw SQLSTATE 2BP01/42501 to a typed
+ *   refusal naming the observed parent and grantor. A `DROP ROLE` that the
  *   server refuses (the role still owns objects, `2BP01 dependent_objects_still_exist`) surfaces
  *   as the `SqlError` the client raised, unclassified by this family.
  */
@@ -122,12 +123,9 @@ export class PostgresRoleCreateVanished extends Data.TaggedError('PostgresRoleCr
   }
 }
 
-/** A `pg_auth_members` row survived reconcile in a shape the declaration does not allow — not
- * wanted, still `ADMIN`, or still `SET` at the upstream default TRUE. A live grantor's row is
- * named in `REVOKE … GRANTED BY`, which either binds or fails loudly; the one shape no
- * statement this family may issue can touch is a row whose grantor role was dropped
- * (`pg_auth_members` keeps it keyed on the dead oid, and no `GRANTED BY` name reaches it), so
- * the message asks the operator to revoke it by hand as a bootstrap superuser and re-plan. */
+/** An option repair was refused, or a catalog row survived outside the declaration. A null grantor is a
+ * defensive corruption/test case: PostgreSQL tracks grantor dependencies, so ordinary
+ * DROP ROLE does not leave a dangling grantor. Refuse instead of claiming convergence. */
 export class PostgresRoleMembershipUnrepaired extends Data.TaggedError(
   'PostgresRoleMembershipUnrepaired',
 )<{
@@ -138,15 +136,15 @@ export class PostgresRoleMembershipUnrepaired extends Data.TaggedError(
 }> {
   override get message(): string {
     const who =
-      this.grantor === null ? 'a grantor role that no longer exists' : `grantor "${this.grantor}"`;
+      this.grantor === null
+        ? 'an unresolvable grantor (inconsistent catalog)'
+        : `grantor "${this.grantor}"`;
     return (
       `Postgres.Role "${this.role}": membership of "${this.parent}" ` +
       `(${this.declared ? 'declared, options unsafe' : 'not declared'}) could not be repaired ` +
-      `after its statements — the row still stands under ${who}. pg_auth_members keys a ` +
-      'membership on (parent, member, grantor), and a grantor that no longer exists cannot be ' +
-      'named in REVOKE … GRANTED BY. Revoke the row by hand as a bootstrap superuser ' +
-      '(`REVOKE role FROM member GRANTED BY <grantor>`; a grantor oid with no role name needs ' +
-      'catalog surgery) and re-plan.'
+      `under ${who}. The server refused the repair or the catalog re-read still found the row ` +
+      'outside the declaration. pg_auth_members keys a membership on (parent, member, grantor). ' +
+      'Check dependent grants, executor permissions and grantor identity before re-planning.'
     );
   }
 }
@@ -186,7 +184,17 @@ export class PostgresRoleIdentityRefused extends Data.TaggedError('PostgresRoleI
   }
 }
 
+/** Never carry the rejected password in this error: errors reach logs and traces. */
+export class PostgresRolePasswordNonAsciiRefused extends Data.TaggedError(
+  'PostgresRolePasswordNonAsciiRefused',
+)<{ readonly role: string }> {
+  override get message(): string {
+    return `Postgres.Role "${this.role}": password must be ASCII; this provider does not implement PostgreSQL SASLprep normalization. Nothing was written.`;
+  }
+}
+
 export type PostgresRoleError =
+  | PostgresRolePasswordNonAsciiRefused
   | PostgresRoleNameRefused
   | PostgresRoleRenameRefused
   | PostgresRoleValidUntilRefused

package/src/postgres/role-guard.test.ts

@@ -1,5 +1,5 @@
 /**
- * The create must not survive a missing parent, and a membership whose grantor role is gone
+ * The create must not survive a missing parent, and a synthetic inconsistent-catalog membership with no grantor
  * must fail typed rather than look repaired.
  */
 import { describe, expect, test } from 'bun:test';
@@ -30,7 +30,7 @@ const live = (): PostgresRoleAttributes => ({
   passwordSeal: '',
 });
 
-describe('missing parent and dead grantor', () => {
+describe('missing parent and inconsistent grantor', () => {
   test('a missing parent fails typed and issues no CREATE', async () => {
     const fake = makeFakeSql();
     const error = await fails(reconcileWithClient(fake, props));
@@ -48,7 +48,7 @@ describe('missing parent and dead grantor', () => {
     expect(fake.statements.some((s) => s.text.startsWith('CREATE ROLE'))).toBe(true);
   });
 
-  test('a wanted membership whose grantor role is gone fails typed', async () => {
+  test('a synthetic unresolvable grantor fails typed (not an ordinary DROP ROLE outcome)', async () => {
     const fake = makeFakeSql({ roleRows: [live()], roles: ['hf_agent'] });
     fake.memberships.add('seat-observability\0hf_agent\0');
     fake.membershipOptions.set('seat-observability\0hf_agent\0', { admin: true, set: true });

package/src/postgres/role-identity.test.ts

@@ -45,8 +45,9 @@ const runnerFor =
       stdin,
     );
     const body = (wrapped?.[1] ?? stdin).replace(/;\s*$/, '');
-    const bound = /^([\s\S]*) = (E'[\s\S]*')$/.exec(body);
-    const sql = bound === null ? body : `${bound[1]} = $1`;
+    // Membership reads have ORDER BY after the bound name; preserve that suffix.
+    const bound = /^([\s\S]*) = (E'(?:\\.|''|[^'\\])*')([\s\S]*)$/.exec(body);
+    const sql = bound === null ? body : `${bound[1]} = $1${bound[3]}`;
     const params = bound === null ? [] : [parseLiteral(bound[2] as string)];
     const rows = await Effect.runPromise(fake.unsafe(sql, params));
     return { code: 0, stdout: JSON.stringify(rows), stderr: '' };
@@ -74,6 +75,17 @@ const ids = {
 };
 
 describe('oid and live membership options', () => {
+  test('read returns the reconcile shape, without observe-only memberships', async () => {
+    const fake = makeFakeSql({ roleRows: [stored()], roles: ['hf_agent'] });
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    const output = stored();
+    const found = await Effect.runPromise(
+      readRoleHandler({ ...ids, olds: baseProps, output }).pipe(Effect.provide(layerFor(fake))),
+    );
+    expect(found).toEqual(output);
+    expect(found).not.toHaveProperty('memberships');
+  });
+
   test('a recycled oid is refused on read, diff and delete, and delete issues no DROP', async () => {
     const fake = makeFakeSql({ roleRows: [{ ...stored(), oid: 7 }] });
     const output = stored();

package/src/postgres/role-lifecycle.test.ts

@@ -206,8 +206,8 @@ describe('read', () => {
       validUntil: null,
       memberOf: ['hf_agent', 'seat-b'],
       memberships: [
-        { parent: 'hf_agent', grantor: 'postgres', admin: false, set: false },
-        { parent: 'seat-b', grantor: 'postgres', admin: false, set: false },
+        { parent: 'hf_agent', grantor: 'postgres', inherit: false, admin: false, set: false },
+        { parent: 'seat-b', grantor: 'postgres', inherit: false, admin: false, set: false },
       ],
     });
   });

package/src/postgres/role-membership-options.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeSql } from './fake-sql.ts';
+import { buildRepairMembershipSql, syncMemberships } from './role-membership-sql.ts';
+import { makePsqlExecutor } from './psql-executor.ts';
+
+const props = {
+  name: 'seat',
+  login: false,
+  inherit: true,
+  connectionLimit: -1,
+  memberOf: ['parent'],
+};
+const rows = [{ parent: 'parent', grantor: 'postgres', inherit: true, admin: true, set: true }];
+
+test('a failed option revoke rolls back earlier membership changes', async () => {
+  const fake = makeFakeSql({ roles: ['parent'], failNext: 'REVOKE SET OPTION' });
+  const key = 'seat\0parent\0postgres';
+  fake.memberships.add(key);
+  fake.membershipOptions.set(key, { admin: true, set: true });
+  const error = await Effect.runPromise(
+    syncMemberships(fake, props, rows).pipe(Effect.catchTag('SqlError', Effect.succeed)),
+  );
+  expect(error).toHaveProperty('_tag', 'SqlError');
+  expect(fake.memberships.has(key)).toBe(true);
+  expect(fake.membershipOptions.get(key)).toEqual({ admin: true, set: true });
+});
+
+test.each(['2BP01', '42501'])(
+  'repair refusal %s names parent and grantor over psql',
+  async (code) => {
+    // Measured on PG 17.11, 2026-10-02: RESTRICT refuses while member has granted parent
+    // onward; both membership rows remain. This test STUBS that response (and permission
+    // denial); the real server is the dependency authority.
+    const scripts: string[] = [];
+    const pg = makePsqlExecutor(
+      ({ stdin }) => {
+        scripts.push(stdin);
+        return Promise.resolve(
+          stdin.startsWith('BEGIN')
+            ? {
+                code: 3,
+                stdout: '',
+                stderr: `ERROR:  ${code}: repair refused`,
+              }
+            : { code: 0, stdout: '[{"present":1}]', stderr: '' },
+        );
+      },
+      { username: 'postgres', database: 'postgres' },
+    );
+    const error = await Effect.runPromise(
+      syncMemberships(pg, props, rows).pipe(
+        Effect.catchTag('PostgresRoleMembershipUnrepaired', Effect.succeed),
+      ),
+    );
+    expect(error).toMatchObject({
+      _tag: 'PostgresRoleMembershipUnrepaired',
+      parent: 'parent',
+      grantor: 'postgres',
+    });
+    expect(String(error)).toContain('parent');
+    expect(String(error)).toContain('postgres');
+    expect(scripts.at(-1)).toBe(
+      'BEGIN;\nREVOKE ADMIN OPTION FOR "parent" FROM "seat" GRANTED BY "postgres" RESTRICT;\nREVOKE SET OPTION FOR "parent" FROM "seat" GRANTED BY "postgres" RESTRICT;\nCOMMIT;',
+    );
+  },
+);
+
+test('option revocation quotes all three identities', () => {
+  expect(buildRepairMembershipSql('m"', 'p"', 'g"', 'ADMIN')).toBe(
+    'REVOKE ADMIN OPTION FOR "p""" FROM "m""" GRANTED BY "g""" RESTRICT',
+  );
+});

package/src/postgres/role-membership-repair.test.ts

@@ -0,0 +1,153 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import type { PgExecutor } from './database-sql.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import { classifyInstalled } from './installed-classifier.ts';
+import { diffPostgresRole } from './role-diff.ts';
+import { selectRoleMemberships, syncMemberships } from './role-membership-sql.ts';
+import { declarationMatches } from './role-sql.ts';
+import { readRole, reconcileWithClient } from './role.ts';
+
+const props = {
+  name: 'seat',
+  login: false,
+  inherit: false,
+  connectionLimit: -1,
+  memberOf: ['parent'],
+};
+const live = { ...props, oid: 42, validUntil: null, passwordSeal: '' };
+const unsafeRow = { parent: 'parent', grantor: 'other', admin: true, set: true, inherit: false };
+
+test.each(['2BP01', '42501'])(
+  'unwanted revokes stay committed after repair refusal %s',
+  async (code) => {
+    const fake = makeFakeSql({ roles: ['parent'], roleRows: [live] });
+    const unwanted = 'seat\0unwanted\0postgres';
+    const kept = 'seat\0parent\0other';
+    fake.memberships.add(unwanted);
+    fake.memberships.add(kept);
+    fake.membershipOptions.set(kept, unsafeRow);
+    const refusal = await classifyInstalled(code);
+    const batches: string[][] = [];
+    const pg: PgExecutor = {
+      unsafe: fake.unsafe,
+      transaction: (sqls) => {
+        batches.push([...sqls]);
+        return sqls.some((sql) => sql.startsWith('REVOKE ADMIN OPTION'))
+          ? Effect.fail(refusal)
+          : fake.transaction(sqls);
+      },
+    };
+    const error = await Effect.runPromise(
+      reconcileWithClient(pg, props, {}).pipe(
+        Effect.catchTag('PostgresRoleMembershipUnrepaired', Effect.succeed),
+      ),
+    );
+    expect(error).toMatchObject({
+      _tag: 'PostgresRoleMembershipUnrepaired',
+      role: 'seat',
+      parent: 'parent',
+      grantor: 'other',
+      declared: true,
+    });
+    expect(String(error)).toContain('"parent"');
+    expect(String(error)).toContain('"other"');
+    expect(batches).toEqual([
+      ['REVOKE "unwanted" FROM "seat" GRANTED BY "postgres"'],
+      [
+        'REVOKE ADMIN OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+        'REVOKE SET OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+      ],
+    ]);
+    expect(fake.memberships.has(unwanted)).toBe(false);
+    expect(fake.memberships.has(kept)).toBe(true);
+    expect(fake.membershipOptions.get(kept)).toEqual(unsafeRow);
+  },
+);
+
+test('unrelated socket errors propagate unchanged', async () => {
+  const fake = makeFakeSql({ roles: ['parent'] });
+  const refusal = await classifyInstalled('42601');
+  const pg: PgExecutor = { unsafe: fake.unsafe, transaction: () => Effect.fail(refusal) };
+  expect(await Effect.runPromise(Effect.flip(syncMemberships(pg, props, [unsafeRow])))).toBe(
+    refusal,
+  );
+});
+
+test('reads INHERIT and repairs another grantor row for declared NOINHERIT', async () => {
+  const fake = makeFakeSql({ roles: ['parent'], roleRows: [live] });
+  const key = 'seat\0parent\0other';
+  fake.memberships.add(key);
+  fake.membershipOptions.set(key, { admin: false, set: false, inherit: true });
+  const before = await Effect.runPromise(readRole(fake, 'seat'));
+  if (before === undefined) throw new Error('seeded role missing');
+  expect(before?.memberships).toEqual([
+    { parent: 'parent', grantor: 'other', admin: false, set: false, inherit: true },
+  ]);
+  expect(fake.statements.find((s) => s.text.includes('FROM pg_auth_members'))?.text).toContain(
+    'm.inherit_option AS inherit',
+  );
+  expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: before }))).toEqual({
+    action: 'update',
+  });
+  expect(declarationMatches(props, before)).toBe(false);
+  await Effect.runPromise(reconcileWithClient(fake, props, {}));
+  expect(fake.statements.filter((s) => s.text.startsWith('REVOKE')).map((s) => s.text)).toEqual([
+    'REVOKE INHERIT OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+  ]);
+  expect(fake.memberships.has(key)).toBe(true);
+  const after = await Effect.runPromise(readRole(fake, 'seat'));
+  if (after === undefined) throw new Error('reconciled role missing');
+  expect(after?.memberships?.[0]?.inherit).toBe(false);
+  expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: after }))).toEqual({
+    action: 'noop',
+  });
+  expect(declarationMatches(props, after)).toBe(true);
+});
+
+test('a warning-only INHERIT no-op fails the catalog backstop', async () => {
+  const fake = makeFakeSql({ roles: ['parent'] });
+  fake.memberships.add('seat\0parent\0other');
+  fake.membershipOptions.set('seat\0parent\0other', { admin: false, set: false, inherit: true });
+  const rows = await Effect.runPromise(selectRoleMemberships(fake, 'seat'));
+  const pg: PgExecutor = { unsafe: fake.unsafe, transaction: () => Effect.void };
+  const error = await Effect.runPromise(Effect.flip(syncMemberships(pg, props, rows)));
+  expect(error).toMatchObject({
+    _tag: 'PostgresRoleMembershipUnrepaired',
+    parent: 'parent',
+    grantor: 'other',
+  });
+  // INHERIT TRUE is safe when declared, and omitted memberOf still means not asserted.
+  await Effect.runPromise(syncMemberships(pg, { ...props, inherit: true }, rows));
+  const { memberOf: _unasserted, ...unasserted } = props;
+  await Effect.runPromise(syncMemberships(pg, unasserted, rows));
+});
+
+test('ADMIN or SET on the live read answers update; stored membership rows do not', async () => {
+  const declared = { ...props, inherit: true };
+  const stored = { ...live, inherit: true };
+  const row = (admin: boolean, set: boolean) => ({
+    found: {
+      ...stored,
+      memberships: [{ parent: 'parent', grantor: 'postgres', inherit: true, admin, set }],
+    },
+  });
+  expect(await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(true, true)))).toEqual({
+    action: 'update',
+  });
+  expect(await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(false, true)))).toEqual(
+    {
+      action: 'update',
+    },
+  );
+  expect(
+    await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(false, false))),
+  ).toEqual({
+    action: 'noop',
+  });
+  const stuffed = {
+    ...stored,
+    memberships: [{ parent: 'parent', grantor: 'postgres', inherit: true, admin: true, set: true }],
+  };
+  expect(await Effect.runPromise(diffPostgresRole(declared, stuffed))).toEqual({ action: 'noop' });
+});

package/src/postgres/role-membership-sql.ts

@@ -11,8 +11,8 @@
  *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.
  * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's
  *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing
- *   (`revoke.sgml`). Every revoke here names `GRANTED BY`, so the statement either removes
- *   the row it targets or fails loudly — never a silent no-op.
+ *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still
+ *   produce only a warning; the catalog re-read below catches surviving unsafe rows.
  */
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import * as Effect from 'effect/Effect';
@@ -22,21 +22,24 @@ import { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './r
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
 
 /** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made
- * the grant, and the two options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;
  * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null
- * when the granting role was later dropped — such a row can never be named in a `REVOKE …
- * GRANTED BY`, so it can only be repaired by hand as a bootstrap superuser. */
+ * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:
+ * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */
 export interface MembershipRow {
   readonly parent: string;
   readonly grantor: string | null;
   readonly admin: boolean;
   readonly set: boolean;
+  readonly inherit: boolean;
 }
 
 const MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
     grantor.rolname AS grantor,
     m.admin_option AS admin,
-    m.set_option AS set
+    m.set_option AS set,
+    m.inherit_option AS inherit
   FROM pg_auth_members m
   JOIN pg_roles member ON member.oid = m.member
   JOIN pg_roles parent ON parent.oid = m.roleid
@@ -55,11 +58,21 @@ export const selectRoleMemberships = (
 export const buildGrantMembershipSql = (member: string, parent: string): string =>
   `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;
 
-/** Repair an existing membership in place: one atomic full-options `GRANT` per parent.
- * Upstream keeps any `WITH` option the new `GRANT` omits (`grant.sgml`), so a repair must
- * spell both bits — `ADMIN FALSE, SET FALSE` — rather than rely on `SET FALSE` alone. */
-export const buildRepairMembershipSql = (member: string, parent: string): string =>
-  `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH ADMIN FALSE, SET FALSE`;
+/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made
+ * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:
+ * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES
+ * https://www.postgresql.org/docs/16/sql-revoke.html
+ * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;
+ * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.
+ * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.
+ * GRANTED BY targets the observed row, including a different grantor's row. */
+export const buildRepairMembershipSql = (
+  member: string,
+  parent: string,
+  grantor: string,
+  option: 'ADMIN' | 'SET' | 'INHERIT',
+): string =>
+  `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;
 
 /** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke
  * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */
@@ -70,12 +83,19 @@ export const buildRevokeGrantorMembershipSql = (
 ): string =>
   `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;
 
-/** Catalog flags this family never declares. A create lands on the server default (all false);
- * an absent field on a seeded test row is that default. */
+/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.
+ * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */
 export const unsafeMemberships = (
   live: Omit<PostgresRoleAttributes, 'passwordSeal'>,
+  /** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live
+   *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */
+  inherit: boolean,
 ): ReadonlySet<string> =>
-  new Set((live.memberships ?? []).filter((row) => row.admin || row.set).map((row) => row.parent));
+  new Set(
+    (live.memberships ?? [])
+      .filter((row) => row.admin || row.set || (row.inherit && !inherit))
+      .map((row) => row.parent),
+  );
 
 /** Membership drift: sorted set difference between declared and live. Duplicates in the
  * declaration collapse to one; `undefined` means "not asserted" — nothing to grant or revoke.
@@ -115,21 +135,14 @@ export const assertParentsExist = (
     }
   });
 
-/** Make live memberships equal the declaration, never dropping a membership the declaration
- * keeps. A wanted parent that is already granted is repaired with one
- * `GRANT … WITH ADMIN FALSE, SET FALSE` — `AddRoleMems` updates that grantor's row in place
- * (`user.c@REL_18_6` `SearchSysCache3` on role, member, grantor) — and any other grantor's
- * unsafe row is then revoked by name.
- *
- * 1. Rows the declaration does not want are revoked **by their own grantor** (dead-grantor
- *    rows are skipped and left for the backstop to report).
- * 2. Unsafe-but-wanted rows get one full-options repair `GRANT` per parent — atomic, in place,
- *    so the membership never drops even when another grantor's row also exists.
- * 3. A repair leaves other grantors' unsafe rows beside the safe one, so a mid re-read
- *    revokes every remaining unsafe row with a live grantor.
- * 4. Absent-but-wanted parents get a fresh seat grant.
- * 5. Backstop re-read: any row that is not wanted, or still unsafe, fails typed — including a
- *    dead-grantor row, which no statement this family may issue can repair. */
+/** Make live memberships equal the declaration, preserving wanted memberships in place.
+ * The previous full-options GRANT updated only its own grantor's row, then revoked other
+ * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).
+ * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows
+ * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).
+ * Each retained row's options share a transaction, attributing a dependency/permission
+ * refusal to that parent and grantor. No CASCADE and no replacement grantor row.
+ * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */
 export const syncMemberships = (
   pg: PgExecutor,
   props: PostgresRoleProps,
@@ -144,46 +157,58 @@ export const syncMemberships = (
     }
     yield* assertParentsExist(pg, props.name, props.memberOf);
     const wanted = [...new Set(props.memberOf)].sort();
-    // 1. Not-wanted rows: revoke each by its own grantor (dead-grantor rows skipped; the
-    //    backstop catches them).
+    const revokes: string[] = [];
     for (const row of rows) {
-      if (wanted.includes(row.parent) || row.grantor === null) continue;
-      yield* pg
-        .unsafe(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor))
-        .pipe(Effect.asVoid);
-    }
-    // 2. Unsafe-but-wanted rows: one full-options repair `GRANT` per parent.
-    const repaired = [
-      ...new Set(
-        rows
-          .filter(
-            (row) => wanted.includes(row.parent) && (row.admin || row.set) && row.grantor !== null,
-          )
-          .map((row) => row.parent),
-      ),
-    ];
-    for (const parent of repaired) {
-      yield* pg.unsafe(buildRepairMembershipSql(props.name, parent)).pipe(Effect.asVoid);
+      if (!wanted.includes(row.parent) && row.grantor !== null) {
+        revokes.push(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor));
+      }
     }
-    // 3. If any repair ran, other grantors' unsafe rows may still stand: re-read and revoke
-    //    them by grantor (the repair's own safe row remains).
-    if (repaired.length > 0) {
-      const midRead = yield* selectRoleMemberships(pg, props.name);
-      for (const row of midRead) {
-        if (wanted.includes(row.parent) && (row.admin || row.set) && row.grantor !== null) {
-          yield* pg
-            .unsafe(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor))
-            .pipe(Effect.asVoid);
+    if (revokes.length > 0) yield* pg.transaction(revokes);
+    for (const row of rows) {
+      if (row.grantor === null || !wanted.includes(row.parent)) continue;
+      const statements: string[] = [];
+      for (const option of ['ADMIN', 'SET', 'INHERIT'] as const) {
+        const unsafe =
+          option === 'ADMIN'
+            ? row.admin
+            : option === 'SET'
+              ? row.set
+              : row.inherit && !props.inherit;
+        if (unsafe) {
+          statements.push(buildRepairMembershipSql(props.name, row.parent, row.grantor, option));
         }
       }
+      if (statements.length > 0)
+        yield* pg.transaction(statements).pipe(
+          Effect.catchTag('SqlError', (error) => {
+            // Both installed socket and psql transports preserve raw SQLSTATE here.
+            // Class 2B is UnknownError, class 42 is SqlSyntaxError; never match messages.
+            const cause = error.reason.cause;
+            const code =
+              typeof cause === 'object' && cause !== null
+                ? (cause as { code?: unknown }).code
+                : undefined;
+            return Effect.fail(
+              code === '2BP01' || code === '42501'
+                ? new PostgresRoleMembershipUnrepaired({
+                    role: props.name,
+                    parent: row.parent,
+                    grantor: row.grantor,
+                    declared: true,
+                  })
+                : error,
+            );
+          }),
+        );
     }
-    // 4. Absent-but-wanted parents: fresh seat grant.
-    for (const parent of wanted.filter((p) => !rows.some((row) => row.parent === p))) {
-      yield* pg.unsafe(buildGrantMembershipSql(props.name, parent)).pipe(Effect.asVoid);
-    }
-    // 5. Backstop: anything not wanted or still unsafe fails typed.
+    // Absent-but-wanted parents get a fresh seat grant. Existing rows keep their grantor.
+    const grants = wanted
+      .filter((p) => !rows.some((row) => row.parent === p))
+      .map((parent) => buildGrantMembershipSql(props.name, parent));
+    if (grants.length > 0) yield* pg.transaction(grants);
+    // Backstop: anything not wanted or still unsafe fails typed.
     for (const row of yield* selectRoleMemberships(pg, props.name)) {
-      if (!wanted.includes(row.parent) || row.admin || row.set) {
+      if (!wanted.includes(row.parent) || row.admin || row.set || (row.inherit && !props.inherit)) {
         return yield* Effect.fail(
           new PostgresRoleMembershipUnrepaired({
             role: props.name,