@homeflare/alchemy 0.46.0 → 0.46.1

package/src/postgres/schema-delete-proofs.test.ts

@@ -65,7 +65,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
           ),
         ),
     );
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 
   test('refuses on oid mismatch, CASCADE included — no DROP issued', async () => {
@@ -91,7 +91,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: 16442,
       lastOwner: 'seat_role',
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
     // Refused before the guarded drop, so the emptiness check never ran either.
     expect(stdins.some((s) => s.includes('AS empty'))).toBe(false);
   });
@@ -118,7 +118,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: 16442,
       lastOwner: 'seat_role',
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 
   test('a live row with no persisted proof fails closed — the delete client core refuses', async () => {
@@ -134,7 +134,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: undefined,
       lastOwner: undefined,
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 });
 
@@ -153,7 +153,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
         ),
     );
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(argvs.length).toBe(1);
     expect(argvs[0]?.at(-1)).toBe('postgres');
   });
@@ -169,7 +169,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
     );
     expect(result).toBeUndefined();
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
   });
 
   test('the `database` override reaches `psql -d`: the probe targets the family database, the rest the declared one', async () => {
@@ -185,7 +185,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
           ),
         ),
     );
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(true);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(true);
     expect(argvs[0]?.at(-1)).toBe('postgres');
     expect(argvs.slice(1).every((argv) => argv.at(-1) === 'agents')).toBe(true);
   });

package/src/postgres/schema-delete.ts

@@ -1,6 +1,6 @@
 /**
  * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then
- * the guarded `DROP SCHEMA`.
+ * ONE atomic statement that re-proves it under a lock and drops (`schema-drop-sql.ts`).
  *
  * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When
  *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no
@@ -10,6 +10,11 @@
  *   row that no longer matches the persisted proof fails with
  *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any
  *   `DROP` is issued.
+ * ⛔ THE RE-READ ALONE IS A WINDOW. It is a separate autocommit statement (a separate `psql` on
+ *   the runner transport), so the schema can change between the read and the drop. The drop
+ *   therefore carries the proven `oid` + `owner` INTO one `DO` block that locks, re-verifies
+ *   them, checks emptiness or cross-schema dependents, and drops in one transaction. This
+ *   file's read is the typed, readable refusal; the block is the guarantee.
  */
 import * as Effect from 'effect/Effect';
 import type { SqlError } from 'effect/unstable/sql/SqlError';
@@ -17,80 +22,117 @@ import type { PgExecutor } from './database-sql.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
 import { assertDatabase, deleteForeignRefusal } from './schema-assert.ts';
 import {
-  type PostgresSchemaDeleteForeignRefused,
+  PostgresSchemaCascadeCrossSchemaRefused,
+  PostgresSchemaDeleteForeignRefused,
   PostgresSchemaDropNotEmptyError,
   type PostgresSchemaWrongDatabase,
 } from './schema-errors.ts';
 import {
-  buildDropSchemaSql,
-  isDependentObjectsError,
-  schemaIsEmpty,
-  selectSchema,
-} from './schema-sql.ts';
+  CASCADE_SEQUENCES,
+  CROSS_SCHEMA_DEPENDENTS,
+  IDENTITY_CHANGED,
+  NOT_EMPTY,
+  buildAtomicDropSql,
+  dependentsCount,
+  sqlStateOf,
+} from './schema-drop-sql.ts';
+import { PostgresSchemaCascadeSequencesRefused, sequencesCount } from './schema-sequence-error.ts';
+import { isDependentObjectsError, selectSchema } from './schema-sql.ts';
+
+type DropError =
+  | PostgresSchemaDropNotEmptyError
+  | PostgresSchemaCascadeCrossSchemaRefused
+  | PostgresSchemaCascadeSequencesRefused
+  | PostgresSchemaDeleteForeignRefused
+  | SqlError;
 
 /**
- * The guarded `DROP SCHEMA`, against any {@link PgExecutor}: refuses a non-empty schema
- * without `cascade`, and classifies the server's own `2BP01` refusal as the same typed tag —
- * for an object kind the emptiness check's four catalogs do not cover. Callers have already
- * proven the connected database (`assertDatabase`) and, on the delete path, the schema's
- * ownership.
+ * The atomic guarded `DROP SCHEMA` for a row the caller has already read, against any
+ * {@link PgExecutor}. The server's refusals come back as typed tags: `HF001` (the row changed
+ * between read and drop) re-reads and refuses as a foreign schema; `HF002` and the server's own
+ * `2BP01` (an object kind the emptiness check's four catalogs miss) are the not-empty tag;
+ * `HF003` is the cross-schema dependents refusal, with the count only; `HF004` refuses a cascade
+ * over a schema holding a sequence.
  */
-const dropGuarded = (
+const dropAtomic = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
-): Effect.Effect<void, PostgresSchemaDropNotEmptyError | SqlError> =>
-  Effect.gen(function* () {
-    if (props.cascade !== true) {
-      const empty = yield* schemaIsEmpty(pg, props.name);
-      if (!empty) {
-        return yield* Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
-      }
+  live: PostgresSchemaAttributes,
+): Effect.Effect<void, DropError> => {
+  const cascade = props.cascade === true;
+  const classify = (error: SqlError): Effect.Effect<void, DropError> => {
+    const state = sqlStateOf(error);
+    if (state === NOT_EMPTY || (!cascade && isDependentObjectsError(error))) {
+      return Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
     }
-    // The server's own `2BP01` refusal (an object kind the four catalogs miss) is classified
-    // into the same typed tag the emptiness check raises — one fail branch, classified before
-    // the fail, exactly as `database-sql.ts` classifies the `42P04` race.
-    const dropRefusal = (error: SqlError): PostgresSchemaDropNotEmptyError | SqlError =>
-      props.cascade !== true && isDependentObjectsError(error)
-        ? new PostgresSchemaDropNotEmptyError({ schema: props.name })
-        : error;
-    yield* pg.unsafe(buildDropSchemaSql(props.name, props.cascade === true)).pipe(
-      Effect.asVoid,
-      Effect.catchTag('SqlError', (error) => Effect.fail(dropRefusal(error))),
-    );
-  });
+    if (state === CROSS_SCHEMA_DEPENDENTS) {
+      return Effect.fail(
+        new PostgresSchemaCascadeCrossSchemaRefused({
+          schema: props.name,
+          dependents: dependentsCount(error),
+        }),
+      );
+    }
+    if (state === CASCADE_SEQUENCES) {
+      return Effect.fail(
+        new PostgresSchemaCascadeSequencesRefused({
+          schema: props.name,
+          sequences: sequencesCount(error),
+        }),
+      );
+    }
+    if (state === IDENTITY_CHANGED) {
+      return Effect.flatMap(selectSchema(pg, props.name), (now) =>
+        now === undefined
+          ? Effect.void
+          : Effect.fail(
+              new PostgresSchemaDeleteForeignRefused({
+                schema: props.name,
+                database: props.database,
+                liveOid: now.oid,
+                liveOwner: now.owner,
+                lastOid: live.oid,
+                lastOwner: live.owner,
+              }),
+            ),
+      );
+    }
+    return Effect.fail(error);
+  };
+  return pg
+    .unsafe(buildAtomicDropSql({ name: props.name, oid: live.oid, owner: live.owner, cascade }))
+    .pipe(Effect.asVoid, Effect.catchTag('SqlError', classify));
+};
 
-/** Prove the connected database, then the guarded drop — the drop core on its own, for the
- * tests that drive it directly. */
+/** Prove the connected database, then the guarded drop of whatever row is live now — the drop
+ * core on its own, for the tests that drive it directly. No persisted proof is consulted: the
+ * row read here is the row the atomic drop re-verifies. */
 export const dropWithClient = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
-): Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDropNotEmptyError | SqlError> =>
+): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>
   Effect.gen(function* () {
     yield* assertDatabase(props, pg);
-    yield* dropGuarded(pg, props);
+    const live = yield* selectSchema(pg, props.name);
+    if (live === undefined) return;
+    yield* dropAtomic(pg, props, live);
   });
 
 /**
  * The core of `delete`: re-read first (see the file header), refuse a schema the persisted
- * proof cannot vouch for, then the guarded drop. `output` is the persisted state the engine
- * hands over — `undefined` is no proof and refuses too.
+ * proof cannot vouch for, then the atomic guarded drop. `output` is the persisted state the
+ * engine hands over — `undefined` is no proof and refuses too.
  */
 export const deleteWithClient = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
   output: PostgresSchemaAttributes | undefined,
-): Effect.Effect<
-  void,
-  | PostgresSchemaWrongDatabase
-  | PostgresSchemaDeleteForeignRefused
-  | PostgresSchemaDropNotEmptyError
-  | SqlError
-> =>
+): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>
   Effect.gen(function* () {
     yield* assertDatabase(props, pg);
     const live = yield* selectSchema(pg, props.name);
     if (live === undefined) return;
     const refusal = deleteForeignRefusal(props, live, output);
     if (refusal !== undefined) return yield* Effect.fail(refusal);
-    yield* dropGuarded(pg, props);
+    yield* dropAtomic(pg, props, live);
   });

package/src/postgres/schema-drop-2bp01.test.ts

@@ -17,6 +17,7 @@ import { classifyInstalled } from './installed-classifier.ts';
 import { postgresRunnerConnection } from './connection.ts';
 import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
 import { isDependentObjectsError } from './schema-sql.ts';
+import { stripPin } from './search-path.ts';
 import { PostgresSchemaDropNotEmptyError } from './schema-errors.ts';
 import { dropWithClient, postgresSchemaHandlers } from './schema.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
@@ -25,16 +26,16 @@ const baseProps: PostgresSchemaProps = { name: 'ledger', database: 'postgres', o
 
 const socket2bp01 = (): Promise<SqlError> => classifyInstalled('2BP01');
 
-/** Emptiness check says empty; the following DROP is the server's real `2BP01`. */
+/** The live row is ours; the atomic `DO` drop is the server's real `2BP01`. */
 const emptyThenRefuse = (drop: Effect.Effect<ReadonlyArray<object>, SqlError>): PgExecutor => ({
   unsafe: <A extends object>(text: string) => {
-    if (text.startsWith('SELECT current_database()')) {
-      return Effect.succeed([{ database: 'postgres' }] as unknown as ReadonlyArray<A>);
+    if (text.startsWith('DO ')) return drop as Effect.Effect<ReadonlyArray<A>, SqlError>;
+    if (text.includes('FROM pg_catalog.pg_namespace')) {
+      return Effect.succeed([
+        { name: 'ledger', oid: 1, owner: 'tim', comment: null, database: 'postgres' },
+      ] as unknown as ReadonlyArray<A>);
     }
-    if (text.includes('AS empty')) {
-      return Effect.succeed([{ empty: true }] as unknown as ReadonlyArray<A>);
-    }
-    return drop as Effect.Effect<ReadonlyArray<A>, SqlError>;
+    return Effect.succeed([{ database: 'postgres' }] as unknown as ReadonlyArray<A>);
   },
   transaction: () => Effect.void,
 });
@@ -54,12 +55,18 @@ describe('2BP01 classification', () => {
   });
 
   test('the runner transport classifies a verbose 2BP01 line as the typed not-empty tag', async () => {
-    const run: PsqlRunner = ({ stdin }) => {
-      if (stdin.includes('current_database()')) {
-        return Promise.resolve({ code: 0, stdout: '[{"database":"postgres"}]', stderr: '' });
+    const run: PsqlRunner = ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
+      if (!stdin.startsWith('DO ') && stdin.includes('FROM pg_catalog.pg_namespace')) {
+        return Promise.resolve({
+          code: 0,
+          stdout:
+            '[{"name":"ledger","oid":"1","owner":"tim","comment":null,"database":"postgres"}]',
+          stderr: '',
+        });
       }
-      if (stdin.includes('AS empty')) {
-        return Promise.resolve({ code: 0, stdout: '[{"empty":true}]', stderr: '' });
+      if (!stdin.startsWith('DO ') && stdin.includes('current_database()')) {
+        return Promise.resolve({ code: 0, stdout: '[{"database":"postgres"}]', stderr: '' });
       }
       return Promise.resolve({
         code: 3,
@@ -92,18 +99,23 @@ describe('2BP01 classification', () => {
     // Order is load-bearing (schema-handlers.test.ts#route): the probe must answer PRESENT so
     // the absent-database short-circuit does not swallow the test, and the ownership re-read
     // must answer the row the persisted output vouches for, so the delete reaches the DROP.
-    const run: PsqlRunner = ({ stdin }) => {
-      if (stdin.includes('AS empty')) {
-        return Promise.resolve({ code: 0, stdout: '[{"empty":true}]', stderr: '' });
+    const run: PsqlRunner = ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
+      if (stdin.startsWith('DO ')) {
+        return Promise.resolve({
+          code: 3,
+          stdout: '',
+          stderr: 'ERROR:  2BP01: dependent objects still exist\n',
+        });
       }
-      if (stdin.includes('FROM pg_namespace')) {
+      if (stdin.includes('FROM pg_catalog.pg_namespace')) {
         return Promise.resolve({
           code: 0,
           stdout: '[{"name":"ledger","oid":1,"owner":"tim"}]',
           stderr: '',
         });
       }
-      if (stdin.includes('FROM pg_database')) {
+      if (stdin.includes('FROM pg_catalog.pg_database')) {
         return Promise.resolve({ code: 0, stdout: '[{"present":1}]', stderr: '' });
       }
       if (stdin.includes('current_database()')) {

package/src/postgres/schema-drop-real.test.ts

@@ -0,0 +1,190 @@
+/**
+ * The atomic schema drop against a REAL PostgreSQL. The in-memory fake substitutes a COUNT for the
+ * dependency scan and cannot lock, so it cannot see the three defects Codex found in PR 357:
+ * an advisory lock that DDL ignores, a closure that missed `pg_collation`, and a TOAST table
+ * counted as foreign.
+ *
+ * ⛔ SKIPPED LOUDLY WITHOUT A SERVER. Set `HF_TEST_POSTGRES=1` and the libpq variables
+ *   (`PGHOST`, `PGUSER`, `PGDATABASE`, `PGPASSWORD` or a socket); the kit has no container
+ *   harness of its own (measured 2026-10-06: no podman/initdb use in `packages/alchemy` tests).
+ *   The connected role needs `CREATE` on the database. Every schema is uniquely named and dropped
+ *   on every exit path; nothing else is touched.
+ */
+import { afterAll, describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
+import { PostgresSchemaCascadeCrossSchemaRefused } from './schema-errors.ts';
+import { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
+import { dropWithClient } from './schema.ts';
+
+const enabled = process.env['HF_TEST_POSTGRES'] === '1';
+if (!enabled) {
+  console.warn(
+    'SKIPPED schema-drop-real.test.ts: no PostgreSQL. Set HF_TEST_POSTGRES=1 (+ PG* env) to run it.',
+  );
+}
+const suite = enabled ? describe : describe.skip;
+
+const database = process.env['PGDATABASE'] ?? 'postgres';
+const username = process.env['PGUSER'] ?? 'postgres';
+
+const spawnPsql = async (argv: readonly string[], stdin: string) => {
+  const proc = Bun.spawn([...argv], {
+    stdin: new TextEncoder().encode(stdin),
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { code, stdout, stderr };
+};
+const runner: PsqlRunner = ({ argv, stdin }) => spawnPsql(argv, stdin);
+const pg = makePsqlExecutor(runner, { database, username });
+const psql = (sql: string) =>
+  spawnPsql(
+    ['psql', '-X', '-q', '-A', '-t', '-v', 'ON_ERROR_STOP=1', '-U', username, '-d', database],
+    sql,
+  );
+
+const stamp = `${Date.now().toString(36)}${Math.floor(Math.random() * 1e4)}`;
+const names: string[] = [];
+const fresh = (label: string): string => {
+  const name = `hf_${label}_${stamp}`;
+  names.push(name);
+  return name;
+};
+afterAll(async () => {
+  if (!enabled) return;
+  for (const name of names) await psql(`DROP SCHEMA IF EXISTS "${name}" CASCADE;`);
+});
+
+const present = async (name: string): Promise<boolean> =>
+  (await psql(`SELECT count(*) FROM pg_namespace WHERE nspname = '${name}';`)).stdout.trim() ===
+  '1';
+const props = (name: string) => ({ name, database, cascade: true });
+
+suite('atomic drop on a real PostgreSQL', () => {
+  test("an isolated text table cascades: its TOAST relation is the table's", async () => {
+    const a = fresh('toast');
+    await psql(`CREATE SCHEMA "${a}"; CREATE TABLE "${a}".t (x text);`);
+    await Effect.runPromise(dropWithClient(pg, props(a)));
+    expect(await present(a)).toBe(false);
+  });
+
+  test("a collation used by another schema's table refuses the cascade", async () => {
+    const a = fresh('coll_a');
+    const b = fresh('coll_b');
+    await psql(
+      `CREATE SCHEMA "${a}"; CREATE COLLATION "${a}".c (provider = libc, locale = 'C');
+       CREATE SCHEMA "${b}"; CREATE TABLE "${b}".t (x text COLLATE "${a}".c);
+       INSERT INTO "${b}".t VALUES ('kept');`,
+    );
+    const error = await Effect.runPromise(Effect.flip(dropWithClient(pg, props(a))));
+    expect(error).toBeInstanceOf(PostgresSchemaCascadeCrossSchemaRefused);
+    expect(await present(a)).toBe(true);
+    expect((await psql(`SELECT x FROM "${b}".t;`)).stdout.trim()).toBe('kept');
+  });
+
+  test('a replacement attempted while the drop holds its locks waits and is refused', async () => {
+    const a = fresh('race');
+    await psql(`CREATE SCHEMA "${a}"; CREATE TABLE "${a}".t (x text);`);
+    // Holder: an open transaction reading the table keeps our LOCK TABLE waiting AFTER the
+    // schema-object lock is taken — a deterministic pause between lock and drop.
+    const holder = spawnPsql(
+      ['psql', '-X', '-q', '-v', 'ON_ERROR_STOP=1', '-U', username, '-d', database],
+      `BEGIN; SELECT 1 FROM "${a}".t; SELECT pg_sleep(4); COMMIT;`,
+    );
+    await Bun.sleep(700);
+    const drop = Effect.runPromise(dropWithClient(pg, props(a)));
+    // ⛔ MATCH THE WAIT BY ITS BLOCKER, NOT BY QUERY TEXT: `pg_stat_activity.query` is cut at
+    //   `track_activity_query_size` (1024 bytes by default) and the `DO` body's `LOCK TABLE`
+    //   sits past it, so a text match never fired and the rival ran after the drop had finished
+    //   (measured on PostgreSQL 18, 2026-10-06). A backend blocked by another one is the drop.
+    let parked = false;
+    for (let i = 0; i < 30 && !parked; i += 1) {
+      const waiting = await psql(
+        `SELECT count(*) FROM pg_stat_activity WHERE wait_event_type = 'Lock' AND cardinality(pg_catalog.pg_blocking_pids(pid)) > 0 AND query LIKE 'DO %' AND pid <> pg_backend_pid();`,
+      );
+      parked = waiting.stdout.trim() !== '0';
+      if (!parked) await Bun.sleep(100);
+    }
+    expect(parked).toBe(true);
+    // The drop is now parked holding the namespace lock. A competing DROP + CREATE must not get in.
+    const rival = await psql(
+      `SET lock_timeout = '800ms'; BEGIN; DROP SCHEMA "${a}" CASCADE; CREATE SCHEMA "${a}"; COMMIT;`,
+    );
+    expect(rival.code).not.toBe(0);
+    expect(rival.stderr).toContain('lock timeout');
+    await holder;
+    await drop;
+    expect(await present(a)).toBe(false);
+  });
+
+  test('a cascade of a schema holding a sequence refuses and loses nothing', async () => {
+    const a = fresh('seq_a');
+    const b = fresh('seq_b');
+    await psql(
+      `CREATE SCHEMA "${a}"; CREATE TABLE "${a}".t (id serial, x text);
+       INSERT INTO "${a}".t (x) VALUES ('kept');
+       CREATE SCHEMA "${b}"; CREATE VIEW "${b}".v AS SELECT last_value FROM "${a}".t_id_seq;`,
+    );
+    const error = await Effect.runPromise(Effect.flip(dropWithClient(pg, props(a))));
+    expect(error).toBeInstanceOf(PostgresSchemaCascadeSequencesRefused);
+    expect(error).toMatchObject({ schema: a, sequences: 1 });
+    expect(await present(a)).toBe(true);
+    expect((await psql(`SELECT x FROM "${a}".t;`)).stdout.trim()).toBe('kept');
+    expect((await psql(`SELECT count(*) FROM "${b}".v;`)).stdout.trim()).toBe('1');
+  });
+
+  test('a table added to a foreign extension refuses the cascade (ownership edge leaves)', async () => {
+    const a = fresh('ext_a');
+    const b = fresh('ext_b');
+    await psql(
+      `CREATE SCHEMA "${b}"; CREATE EXTENSION hstore SCHEMA "${b}";
+       CREATE SCHEMA "${a}"; CREATE TABLE "${a}".t (id int);
+       ALTER EXTENSION hstore ADD TABLE "${a}".t;`,
+    );
+    try {
+      const error = await Effect.runPromise(Effect.flip(dropWithClient(pg, props(a))));
+      expect(error).toBeInstanceOf(PostgresSchemaCascadeCrossSchemaRefused);
+      expect(await present(a)).toBe(true);
+      const kept = await psql(`SELECT count(*) FROM pg_extension WHERE extname = 'hstore';`);
+      expect(kept.stdout.trim()).toBe('1');
+    } finally {
+      await psql(`ALTER EXTENSION hstore DROP TABLE "${a}".t; DROP EXTENSION IF EXISTS hstore;`);
+    }
+  });
+
+  test('a rename-then-recreate while the drop is parked is refused, the replacement survives', async () => {
+    const a = fresh('ren');
+    const saved = fresh('ren_saved');
+    await psql(`CREATE SCHEMA "${a}"; CREATE TABLE "${a}".t (x text);`);
+    const holder = spawnPsql(
+      ['psql', '-X', '-q', '-v', 'ON_ERROR_STOP=1', '-U', username, '-d', database],
+      `BEGIN; SELECT 1 FROM "${a}".t; SELECT pg_sleep(4); COMMIT;`,
+    );
+    await Bun.sleep(700);
+    const drop = Effect.runPromise(Effect.flip(dropWithClient(pg, props(a))));
+    let parked = false;
+    for (let i = 0; i < 30 && !parked; i += 1) {
+      const waiting = await psql(
+        `SELECT count(*) FROM pg_stat_activity WHERE wait_event_type = 'Lock' AND cardinality(pg_catalog.pg_blocking_pids(pid)) > 0 AND query LIKE 'DO %' AND pid <> pg_backend_pid();`,
+      );
+      parked = waiting.stdout.trim() !== '0';
+      if (!parked) await Bun.sleep(100);
+    }
+    expect(parked).toBe(true);
+    // RENAME takes no namespace object lock, so it commits while the drop waits.
+    const swap = await psql(
+      `ALTER SCHEMA "${a}" RENAME TO "${saved}"; CREATE SCHEMA "${a}"; CREATE TABLE "${a}".keep (id int);`,
+    );
+    expect(swap.code).toBe(0);
+    await holder;
+    await drop;
+    expect((await psql(`SELECT count(*) FROM "${a}".keep;`)).stdout.trim()).toBe('0');
+    expect(await present(saved)).toBe(true);
+  });
+});

package/src/postgres/schema-drop-sql.ts

@@ -0,0 +1,135 @@
+/**
+ * The atomic `DROP SCHEMA` `Postgres.Schema` issues: ONE `DO` statement that takes a lock,
+ * re-proves the schema inside the same transaction, refuses what must not be dropped, and only
+ * then drops.
+ *
+ * ⛔ PROOF AND DROP ARE ONE STATEMENT, ONE TRANSACTION. Before 2026-10-02 the re-read, the
+ *   emptiness check and the `DROP` were three autocommit statements — three `psql` processes on
+ *   the runner transport — so an out-of-band drop-and-recreate between them was dropped by name,
+ *   `CASCADE` included (Opus read of PR 334). A `DO` block is atomic on both transports and needs
+ *   no `BEGIN`/`COMMIT` the runner would have to thread through.
+ * ⛔ THE LOCK MUST CONFLICT WITH DDL, NOT ONLY WITH OTHER RUNS OF THIS PROVIDER. An advisory lock
+ *   (`pg_advisory_xact_lock`) is cooperative: an ordinary `DROP SCHEMA` + `CREATE SCHEMA` ignores
+ *   it, and the by-name `DROP` below would then drop the REPLACEMENT, `CASCADE` included (Codex
+ *   read of PR 357, 2026-10-06). So, BEFORE the re-verify and held to the end of the transaction:
+ *   (1) `COMMENT ON SCHEMA <name> IS <its current comment>` — `CommentObject` resolves the schema
+ *   through `get_object_address(…, ShareUpdateExclusiveLock)`, which locks the namespace OBJECT
+ *   (`LockDatabaseObject`), and `DROP SCHEMA` takes `AccessExclusiveLock` on that same object
+ *   (`AcquireDeletionLock`), so a concurrent drop waits for us; (2) on a cascade, `LOCK TABLE …
+ *   IN ACCESS EXCLUSIVE MODE` on every table-like relation in the schema, which holds off a
+ *   concurrent creator of a dependent (a view or foreign key reads the table it references).
+ *   Lock modes: PostgreSQL docs, explicit-locking.html §13.3; `COMMENT`: sql-comment.html.
+ *   `lock_timeout` turns any wait into `55P03`, an unclassified error: the drop is REFUSED, never
+ *   forced. A comment-less schema is rewritten as `IS NULL`, which still takes the lock.
+ * ⛔ RENAME TAKES NO SUCH LOCK (Codex read of PR 357, 2026-10-06): `ALTER SCHEMA … RENAME` updates
+ *   `pg_namespace` without locking the object, so a rename-then-`CREATE SCHEMA` of the same name
+ *   committed while we waited on a table lock would make the by-name `DROP` delete the
+ *   REPLACEMENT. The last statement before the `DROP` re-reads the name of the verified OID and
+ *   refuses `HF001` if it moved; only the statements between that read and the `DROP` remain.
+ * ⛔ SEQUENCES REFUSE THE CASCADE (`HF004`, KNOWN LIMIT; `schema-sequence-error.ts`). `LOCK TABLE`
+ *   cannot lock a sequence, so an uncommitted `CREATE VIEW b.v AS SELECT last_value FROM a.s` is
+ *   invisible to the closure scan, and PostgreSQL's deletion (locks first, THEN scans dependents)
+ *   would cascade into `b.v` once it commits. A schema with serial or identity columns therefore
+ *   cannot be cascade-dropped here: drop its contents first. The check runs before any table lock.
+ * ⚠️ NOT COVERED: a type,
+ *   function or collation created in ANOTHER schema to use ours has no relation to wait on. The
+ *   advisory lock stays: it serialises runs of this provider, which is cheap and correct.
+ * ★ THE VALUES ARE LITERALS INSIDE THE BODY, AND THE BODY IS ONE `E'…'` LITERAL. A `DO` body
+ *   takes no bind parameters, and a dollar-quote tag could be forged by a schema NAME containing
+ *   it; `quoteStringLiteral` doubles backslashes and quotes, so nesting it twice is exact.
+ *   The `DROP` text inside is `buildDropSchemaSql` run through `EXECUTE`, so the quoting rule is
+ *   the same single one.
+ * ★ REFUSALS ARE CUSTOM SQLSTATEs, read from `reason.cause.code` exactly like `2BP01`
+ *   (`schema-sql.ts#isDependentObjectsError`): `HF001` identity changed, `HF002` not empty,
+ *   `HF003` dependents in another schema, `HF004` a cascade over a schema holding a sequence. Class `HF` is not `42`, so both transports wrap it as
+ *   `UnknownError` with the raw code. The `HF003` message carries a COUNT only: another owner's
+ *   object names must not reach this stack's logs.
+ */
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import { quoteStringLiteral } from './database-sql.ts';
+import { OUTSIDE_DEPENDENTS_SQL } from './schema-closure-sql.ts';
+import { buildDropSchemaSql, emptyPredicate } from './schema-sql.ts';
+
+export const IDENTITY_CHANGED = 'HF001';
+export const NOT_EMPTY = 'HF002';
+export const CROSS_SCHEMA_DEPENDENTS = 'HF003';
+export const CASCADE_SEQUENCES = 'HF004';
+
+/** How long any lock in the block may wait before the drop is refused (`55P03`, fails closed). */
+const LOCK_TIMEOUT = '10s';
+
+export interface AtomicDrop {
+  readonly name: string;
+  readonly oid: number;
+  readonly owner: string;
+  readonly cascade: boolean;
+}
+
+/** The whole atomic drop: lock → re-verify → refuse or drop. Pure text, no client. */
+export const buildAtomicDropSql = (drop: AtomicDrop): string => {
+  const body = `DECLARE
+  v_name text := ${quoteStringLiteral(drop.name)};
+  v_oid oid := ${String(Math.trunc(drop.oid))};
+  v_owner text := ${quoteStringLiteral(drop.owner)};
+  v_cascade boolean := ${drop.cascade ? 'true' : 'false'};
+  v_ns oid;
+  v_count bigint;
+  v_comment text;
+  v_rel text;
+BEGIN
+  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n WHERE n.nspname = v_name;
+  IF v_ns IS NULL THEN RETURN; END IF;
+  PERFORM pg_catalog.set_config('lock_timeout', '${LOCK_TIMEOUT}', true);
+  PERFORM pg_catalog.pg_advisory_xact_lock(v_ns::pg_catalog.int8);
+  v_comment := pg_catalog.obj_description(v_ns, 'pg_namespace');
+  EXECUTE pg_catalog.format('COMMENT ON SCHEMA %I IS %L', v_name, v_comment);
+  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n
+    WHERE n.nspname = v_name AND n.oid = v_oid
+      AND pg_catalog.pg_get_userbyid(n.nspowner) = v_owner;
+  IF v_ns IS NULL THEN
+    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';
+  END IF;
+  IF NOT v_cascade THEN
+    IF NOT (${emptyPredicate('v_ns')}) THEN
+      RAISE EXCEPTION 'schema not empty' USING ERRCODE = '${NOT_EMPTY}';
+    END IF;
+  ELSE
+    SELECT count(*) INTO v_count FROM pg_catalog.pg_class c
+      WHERE c.relnamespace = v_ns AND c.relkind = 'S';
+    IF v_count > 0 THEN
+      RAISE EXCEPTION 'cascade sequences: %', v_count USING ERRCODE = '${CASCADE_SEQUENCES}';
+    END IF;
+    FOR v_rel IN SELECT c.oid::pg_catalog.regclass::pg_catalog.text FROM pg_catalog.pg_class c
+        WHERE c.relnamespace = v_ns AND c.relkind IN ('r', 'p', 'v', 'm', 'f') ORDER BY c.oid LOOP
+      EXECUTE pg_catalog.format('LOCK TABLE %s IN ACCESS EXCLUSIVE MODE', v_rel);
+    END LOOP;
+    ${OUTSIDE_DEPENDENTS_SQL};
+    IF v_count > 0 THEN
+      RAISE EXCEPTION 'cross-schema dependents: %', v_count USING ERRCODE = '${CROSS_SCHEMA_DEPENDENTS}';
+    END IF;
+  END IF;
+  PERFORM 1 FROM pg_catalog.pg_namespace n WHERE n.oid = v_oid AND n.nspname = v_name;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';
+  END IF;
+  EXECUTE ${quoteStringLiteral(buildDropSchemaSql(drop.name, drop.cascade))};
+END`;
+  return `DO ${quoteStringLiteral(body)}`;
+};
+
+/** The server's SQLSTATE on a failed statement, whichever transport raised it. */
+export const sqlStateOf = (error: SqlError): string | undefined => {
+  const cause = error.reason.cause;
+  const code =
+    typeof cause === 'object' && cause !== null ? (cause as { code?: unknown }).code : '';
+  return typeof code === 'string' ? code : undefined;
+};
+
+/** The dependents COUNT out of an `HF003` error. An unreadable message still refuses: it
+ * answers 1, never 0 — the refusal is the fail-closed answer. */
+export const dependentsCount = (error: SqlError): number => {
+  const cause = error.reason.cause;
+  const message = typeof cause === 'object' && cause !== null ? (cause as Error).message : '';
+  const parsed = /dependents:\s*(\d+)/.exec(message ?? '')?.[1];
+  return Math.max(1, Number(parsed ?? 1));
+};