@homeflare/alchemy 0.46.0 → 0.46.1

package/src/postgres/schema-drop.test.ts

@@ -0,0 +1,241 @@
+/**
+ * `Postgres.Schema`'s atomic drop (`schema-drop-sql.ts`) against `fake-sql.ts`: one `DO`
+ * statement that re-verifies identity under a lock, refuses a non-empty schema or cross-schema
+ * dependents, and only then drops. The Opus read of PR 334 (2026-10-02) found the old
+ * three-autocommit drop racy, and `cascade: true` reaching other stacks' objects.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { SqlError, UnknownError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+import { buildAtomicDropSql } from './schema-drop-sql.ts';
+import {
+  PostgresSchemaCascadeCrossSchemaRefused,
+  PostgresSchemaDeleteForeignRefused,
+  PostgresSchemaDropNotEmptyError,
+} from './schema-errors.ts';
+import { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
+import { deleteWithClient, dropWithClient } from './schema.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> => Effect.runPromise(Effect.flip(eff));
+
+const baseProps: PostgresSchemaProps = { name: 'ledger', database: 'postgres', owner: 'tim' };
+const liveRow = (over: Partial<PostgresSchemaAttributes> = {}): PostgresSchemaAttributes => ({
+  name: 'ledger',
+  database: 'postgres',
+  oid: 30000,
+  owner: 'tim',
+  comment: null,
+  ...over,
+});
+const drops = (fake: ReturnType<typeof makeFakeSql>) =>
+  fake.statements.filter((s) => s.text.startsWith('DO '));
+
+describe('drop: the proof and the DROP are one statement', () => {
+  test('an empty schema is dropped by ONE DO carrying the proven oid and owner', async () => {
+    const fake = makeFakeSql({ schemas: [liveRow()] });
+    await run(dropWithClient(fake, baseProps));
+    expect(drops(fake).map((s) => s.text)).toEqual([
+      buildAtomicDropSql({ name: 'ledger', oid: 30000, owner: 'tim', cascade: false }),
+    ]);
+    // No bare DROP and no separate emptiness probe reached the server.
+    expect(fake.statements.some((s) => s.text.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(fake.statements.some((s) => s.text.includes('AS empty'))).toBe(false);
+    expect(fake.schemas.get('ledger')).toBeUndefined();
+  });
+
+  test('the block locks BEFORE it re-verifies, re-verifies oid + owner, and drops last', () => {
+    const sql = buildAtomicDropSql({ name: 'ledger', oid: 30000, owner: 'tim', cascade: false });
+    const at = (needle: string): number => sql.indexOf(needle);
+    expect(at('pg_advisory_xact_lock')).toBeGreaterThan(-1);
+    expect(at('pg_advisory_xact_lock')).toBeLessThan(at('n.oid = v_oid'));
+    expect(at('pg_get_userbyid(n.nspowner) = v_owner')).toBeGreaterThan(-1);
+    // The DDL-conflicting lock (a no-op COMMENT on the schema object) precedes the re-verify too.
+    expect(at('COMMENT ON SCHEMA %I')).toBeGreaterThan(-1);
+    expect(at('COMMENT ON SCHEMA %I')).toBeLessThan(at('n.oid = v_oid'));
+    expect(at("''lock_timeout''")).toBeLessThan(at('pg_advisory_xact_lock'));
+    expect(at('n.oid = v_oid')).toBeLessThan(sql.lastIndexOf('EXECUTE'));
+  });
+
+  test('a schema replaced between the read and the drop is refused, nothing dropped (HF001)', async () => {
+    const fake = makeFakeSql({ schemas: [liveRow()] });
+    // The read sees oid 30000; before the DO runs another role drops and recreates the name.
+    const racing: PgExecutor = {
+      ...fake,
+      unsafe: (text, params) => {
+        if (text.startsWith('DO ')) {
+          fake.schemas.set('ledger', liveRow({ oid: 30001, owner: 'intruder' }));
+        }
+        return fake.unsafe(text, params);
+      },
+    };
+    const error = await fails(deleteWithClient(racing, baseProps, liveRow()));
+    expect(error).toBeInstanceOf(PostgresSchemaDeleteForeignRefused);
+    expect(error).toMatchObject({ liveOid: 30001, liveOwner: 'intruder', lastOid: 30000 });
+    expect(fake.schemas.get('ledger')).toMatchObject({ oid: 30001 });
+  });
+
+  test('a schema that vanished between the read and the drop is idempotent success', async () => {
+    const fake = makeFakeSql({ schemas: [liveRow()] });
+    const racing: PgExecutor = {
+      ...fake,
+      unsafe: (text, params) => {
+        if (text.startsWith('DO ')) fake.schemas.delete('ledger');
+        return fake.unsafe(text, params);
+      },
+    };
+    await run(dropWithClient(racing, baseProps));
+  });
+});
+
+describe('drop: emptiness', () => {
+  test('refuses a non-empty schema with cascade false (HF002 → typed tag)', async () => {
+    const fake = makeFakeSql({ schemas: [liveRow()], schemasWithRelations: ['ledger'] });
+    expect(await fails(dropWithClient(fake, baseProps))).toBeInstanceOf(
+      PostgresSchemaDropNotEmptyError,
+    );
+    expect(fake.schemas.get('ledger')).not.toBeUndefined();
+  });
+
+  test('drops a non-empty schema with cascade true when nothing outside depends on it', async () => {
+    const fake = makeFakeSql({ schemas: [liveRow()], schemasWithRelations: ['ledger'] });
+    await run(dropWithClient(fake, { ...baseProps, cascade: true }));
+    expect(fake.schemas.get('ledger')).toBeUndefined();
+    expect(drops(fake)[0]?.text).toContain(`'DROP SCHEMA IF EXISTS "ledger" CASCADE'`);
+  });
+
+  test("the server's own 2BP01 (an object kind the four catalogs miss) is the same typed tag", async () => {
+    const refusing: PgExecutor = {
+      unsafe: <A extends object>(text: string) =>
+        text.startsWith('SELECT current_database()')
+          ? Effect.succeed([{ database: 'postgres' }] as unknown as ReadonlyArray<A>)
+          : !text.startsWith('DO ') && text.includes('FROM pg_catalog.pg_namespace')
+            ? Effect.succeed([liveRow()] as unknown as ReadonlyArray<A>)
+            : Effect.fail(
+                new SqlError({
+                  reason: new UnknownError({
+                    cause: Object.assign(new Error('ERROR:  2BP01: dependent objects'), {
+                      code: '2BP01',
+                    }),
+                    message: 'dependent_objects_still_exist',
+                    operation: 'DO',
+                  }),
+                }),
+              ),
+      transaction: () => Effect.void,
+    };
+    expect(await fails(dropWithClient(refusing, baseProps))).toBeInstanceOf(
+      PostgresSchemaDropNotEmptyError,
+    );
+  });
+});
+
+describe('drop: cascade never reaches another schema', () => {
+  test('refuses cascade when objects in other schemas depend on this one — count only (HF003)', async () => {
+    const fake = makeFakeSql({
+      schemas: [liveRow()],
+      schemasWithRelations: ['ledger'],
+      dependentsOutside: { ledger: 3 },
+    });
+    const error = await fails(dropWithClient(fake, { ...baseProps, cascade: true }));
+    expect(error).toBeInstanceOf(PostgresSchemaCascadeCrossSchemaRefused);
+    expect(error).toMatchObject({ schema: 'ledger', dependents: 3 });
+    // The message names a count and this schema — never another owner's object.
+    expect((error as Error).message).toContain('3 dependent object(s)');
+    expect(fake.schemas.get('ledger')).not.toBeUndefined();
+    expect(fake.relationsIn.has('ledger')).toBe(true);
+  });
+
+  test('refuses cascade over a schema holding a sequence — count only (HF004), nothing dropped', async () => {
+    const fake = makeFakeSql({
+      schemas: [liveRow()],
+      schemasWithRelations: ['ledger'],
+      sequencesIn: { ledger: 2 },
+    });
+    const error = await fails(dropWithClient(fake, { ...baseProps, cascade: true }));
+    expect(error).toBeInstanceOf(PostgresSchemaCascadeSequencesRefused);
+    expect(error).toMatchObject({ schema: 'ledger', sequences: 2 });
+    expect((error as Error).message).toContain('2 sequence(s)');
+    expect(fake.schemas.get('ledger')).not.toBeUndefined();
+    expect(fake.relationsIn.has('ledger')).toBe(true);
+  });
+
+  test('the sequence check precedes every table lock in the generated block', () => {
+    const sql = buildAtomicDropSql({ name: 'ledger', oid: 1, owner: 'tim', cascade: true });
+    expect(sql).toContain("c.relkind = ''S''");
+    expect(sql.indexOf("c.relkind = ''S''")).toBeLessThan(sql.indexOf('LOCK TABLE'));
+  });
+
+  test('cascade false never runs the dependents check: the emptiness refusal comes first', async () => {
+    const fake = makeFakeSql({
+      schemas: [liveRow()],
+      schemasWithRelations: ['ledger'],
+      dependentsOutside: { ledger: 3 },
+    });
+    expect(await fails(dropWithClient(fake, baseProps))).toBeInstanceOf(
+      PostgresSchemaDropNotEmptyError,
+    );
+  });
+
+  test('the dependents query counts per catalog class and treats an unknown class as foreign', () => {
+    const sql = buildAtomicDropSql({ name: 'ledger', oid: 1, owner: 'tim', cascade: true });
+    expect(sql).toContain('pg_catalog.pg_depend');
+    // A class the CASE does not know yields NULL; IS DISTINCT FROM counts NULL as foreign, so an
+    // unclassifiable dependent refuses the cascade instead of slipping through.
+    expect(sql).toContain('IS NOT DISTINCT FROM v_ns');
+    // The walk follows every deptype except the pin (`p`): n a i P S e x each cascade or attribute.
+    expect(sql).toContain("d.deptype <> ''p''");
+    for (const catalog of [
+      'pg_collation',
+      'pg_conversion',
+      'pg_opclass',
+      'pg_opfamily',
+      'pg_ts_config',
+      'pg_statistic_ext',
+      'pg_extension',
+      'pg_constraint',
+      'pg_trigger',
+      'pg_rewrite',
+      'pg_attrdef',
+      'pg_policy',
+    ]) {
+      // Inside the body's `E'…'` literal every quote is doubled.
+      expect(sql).toContain(`''pg_catalog.${catalog}''::pg_catalog.regclass`);
+    }
+  });
+});
+
+describe('drop: the generated text cannot be broken out of by a name', () => {
+  test('a schema name holding quotes, backslashes and a dollar-quote tag stays inside its literal', () => {
+    const name = `x$$; DROP TABLE t; --'\\"`;
+    const sql = buildAtomicDropSql({ name, oid: 1, owner: `o'wn\\er`, cascade: false });
+    expect(sql.startsWith("DO E'")).toBe(true);
+    expect(sql.endsWith("'")).toBe(true);
+    // No unescaped quote before the final one: every `'` inside is doubled by the quoter.
+    expect(sql.slice(5, -1).replace(/''/g, '')).not.toContain("'");
+  });
+
+  test('applyAtomicDrop reads such a name and owner back exactly (fake parses its own output)', async () => {
+    const name = `x$$; DROP TABLE t; --'\\"`;
+    const owner = `o'wn\\er$tag$`;
+    const fake = makeFakeSql({ schemas: [liveRow({ name, owner })] });
+    await run(dropWithClient(fake, { name, database: 'postgres' }));
+    expect(fake.schemas.get(name)).toBeUndefined();
+    // A different owner with the same tricky name is a refusal, not a by-name drop.
+    const other = makeFakeSql({ schemas: [liveRow({ name, owner: 'someone' })] });
+    const racing: PgExecutor = {
+      ...other,
+      unsafe: (text, params) => {
+        if (text.startsWith('DO ')) other.schemas.set(name, liveRow({ name, owner }));
+        return other.unsafe(text, params);
+      },
+    };
+    await fails(
+      deleteWithClient(racing, { name, database: 'postgres' }, liveRow({ name, owner: 'someone' })),
+    );
+    expect(other.schemas.get(name)).toBeDefined();
+  });
+});

package/src/postgres/schema-errors.ts

@@ -4,6 +4,7 @@
  * Refusals use checked catalog facts or raw SQLSTATE (42P06 / 2BP01), never driver message text.
  */
 import * as Data from 'effect/Data';
+import type { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
 
 /** A declared name would be silently truncated (same as `PostgresDatabaseNameRefused`). */
 export class PostgresSchemaNameRefused extends Data.TaggedError('PostgresSchemaNameRefused')<{
@@ -94,6 +95,29 @@ export class PostgresSchemaDropNotEmptyError extends Data.TaggedError(
   }
 }
 
+/**
+ * `cascade: true` refused: `DROP SCHEMA … CASCADE` would also drop objects that live in OTHER
+ * schemas because they depend on something in this one (a view, a foreign key or a trigger
+ * another stack owns). The refusal carries the COUNT only — never an object name, so the error
+ * cannot disclose another owner's catalog. Nothing was dropped: move or drop those dependents
+ * deliberately, or empty this schema by hand and declare `cascade: false`.
+ */
+export class PostgresSchemaCascadeCrossSchemaRefused extends Data.TaggedError(
+  'PostgresSchemaCascadeCrossSchemaRefused',
+)<{
+  readonly schema: string;
+  /** How many dependent objects live outside this schema (at least one when raised). */
+  readonly dependents: number;
+}> {
+  override get message(): string {
+    return (
+      `Postgres.Schema "${this.schema}": cascade: true refused — ${String(this.dependents)} ` +
+      'dependent object(s) outside this schema would be dropped with it. No DROP was issued. ' +
+      'Remove or move those dependents first.'
+    );
+  }
+}
+
 /** Every statement this resource issues must run against the DECLARED database. The family
  * connection points at a maintenance database, so the schema handlers open `props.database`
  * themselves (`withPg`'s database override); this failure means the server answered
@@ -204,6 +228,8 @@ export type PostgresSchemaError =
   | PostgresSchemaDrift
   | PostgresSchemaCreateVanished
   | PostgresSchemaDropNotEmptyError
+  | PostgresSchemaCascadeCrossSchemaRefused
+  | PostgresSchemaCascadeSequencesRefused
   | PostgresSchemaDeleteForeignRefused
   | PostgresSchemaWrongDatabase
   | PostgresSchemaDatabaseRefused;

package/src/postgres/schema-handlers.test.ts

@@ -14,6 +14,7 @@ import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-att
 import { Unowned } from 'alchemy/AdoptPolicy';
 import { postgresSchemaHandlers } from './schema.ts';
 import { PostgresSchemaDropNotEmptyError, PostgresSchemaWrongDatabase } from './schema-errors.ts';
+import { buildAtomicDropSql } from './schema-drop-sql.ts';
 import { deleteArgs, ok, readArgs, route, router, runnerWith } from './schema-test-kit.ts';
 
 const sampleOutput: PostgresSchemaAttributes = {
@@ -51,10 +52,12 @@ describe('delete handler (runner transport)', () => {
           ),
         ),
     );
-    expect(stdins.find((s) => s.startsWith('DROP SCHEMA'))).toBe(
-      'DROP SCHEMA IF EXISTS "ledger" CASCADE;',
+    // The drop is ONE `DO` statement carrying the proven oid + owner (`schema-drop-sql.ts`),
+    // not a re-read followed by a separate `DROP`.
+    expect(stdins.find((s) => s.startsWith('DO '))).toBe(
+      `${buildAtomicDropSql({ name: 'ledger', oid: 1, owner: 'tim', cascade: true })};`,
     );
-    // One `psql` argv per STATEMENT: probe, proof, ownership re-read, drop. The probe's argv
+    // One `psql` argv per STATEMENT: probe, proof, ownership re-read, atomic drop. The probe's argv
     // targets the family database; the delete's argvs target the declared one — the `-d` value
     // is the argv's last element.
     expect(argvs.length).toBe(4);
@@ -80,17 +83,19 @@ describe('delete handler (runner transport)', () => {
           ),
         ),
     );
-    expect(stdins.find((s) => s.startsWith('DROP SCHEMA'))).toBe('DROP SCHEMA IF EXISTS "ledger";');
+    expect(stdins.find((s) => s.startsWith('DO '))).toBe(
+      `${buildAtomicDropSql({ name: 'ledger', oid: 1, owner: 'tim', cascade: false })};`,
+    );
   });
 
-  test('the real handler refuses a non-empty schema over the runner transport, no DROP issued', async () => {
-    const { run, stdins } = runnerWith(
-      router({
-        probe: '[{"present":1}]',
-        schema: '[{"name":"ledger","oid":1,"owner":"tim"}]',
-        empty: '[{"empty":false}]',
-        proof,
-      }),
+  test('a non-empty schema is the typed refusal the atomic drop raises (HF002), over one psql', async () => {
+    const answers = router({
+      probe: '[{"present":1}]',
+      schema: '[{"name":"ledger","oid":1,"owner":"tim"}]',
+      proof,
+    });
+    const { run, stdins } = runnerWith(answers, (stdin) =>
+      stdin.startsWith('DO ') ? 'ERROR:  HF002: schema not empty' : undefined,
     );
     const error = await Effect.runPromise(
       Effect.flip(
@@ -104,7 +109,9 @@ describe('delete handler (runner transport)', () => {
       ),
     );
     expect(error).toBeInstanceOf(PostgresSchemaDropNotEmptyError);
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    // Proof and drop were ONE statement: exactly one `DO`, and no separate emptiness probe.
+    expect(stdins.filter((s) => s.startsWith('DO ')).length).toBe(1);
+    expect(stdins.some((s) => s.includes('AS empty'))).toBe(false);
   });
 
   test('the real handler refuses a wrong connected database before any DROP', async () => {
@@ -128,7 +135,7 @@ describe('delete handler (runner transport)', () => {
       ),
     );
     expect(error).toBeInstanceOf(PostgresSchemaWrongDatabase);
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 
   test('defaultRemovalPolicy is retain — declared on the Resource for Postgres.Schema itself', () => {

package/src/postgres/schema-lifecycle.test.ts

@@ -1,18 +1,16 @@
 /**
  * `reconcile`, `read`, and `drop` for `Postgres.Schema` against `fake-sql.ts`'s recording fake.
  * Tests the greenfield create, comment creation, already-present/drift, owner-missing guard,
- * quoting, the safe-drop rules, and the `current_database()` proof every write path runs first.
+ * quoting, and the `current_database()` proof every write path runs first. The drop rules live
+ * in `schema-drop.test.ts`.
  */
 import { describe, expect, test } from 'bun:test';
 import * as Effect from 'effect/Effect';
-import { SqlError, UnknownError } from 'effect/unstable/sql/SqlError';
 import { makeFakeSql } from './fake-sql.ts';
 import { type PostgresSchemaAttributes, type PostgresSchemaProps } from './schema-attrs.ts';
-import type { PgExecutor } from './database-sql.ts';
 import {
   PostgresSchemaCreateVanished,
   PostgresSchemaDrift,
-  PostgresSchemaDropNotEmptyError,
   PostgresSchemaExistsRefused,
   PostgresSchemaOwnerMissing,
   PostgresSchemaWrongDatabase,
@@ -42,7 +40,9 @@ describe('the current_database() proof', () => {
     expect(refusal.declared).toBe('agents');
     expect(refusal.connected).toBe('postgres');
     // The refusal fires before the first pg_namespace read, so nothing but the proof ran.
-    expect(fake.statements.some((s) => s.text.includes('FROM pg_namespace'))).toBe(false);
+    expect(fake.statements.some((s) => s.text.includes('FROM pg_catalog.pg_namespace'))).toBe(
+      false,
+    );
     expect(fake.statements.some((s) => s.text.startsWith('CREATE SCHEMA'))).toBe(false);
   });
 
@@ -50,7 +50,7 @@ describe('the current_database() proof', () => {
     const fake = makeFakeSql({ schemas: [liveRow()] });
     const error = await fails(dropWithClient(fake, { ...baseProps, database: 'agents' }));
     expect(error).toBeInstanceOf(PostgresSchemaWrongDatabase);
-    expect(fake.statements.some((s) => s.text.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(fake.statements.some((s) => s.text.startsWith('DO '))).toBe(false);
     expect(fake.schemas.get('ledger')).not.toBeUndefined();
   });
 
@@ -190,57 +190,3 @@ describe('read', () => {
     expect(await run(readWithClient(fake, 'ledger'))).toEqual(liveRow());
   });
 });
-
-describe('drop', () => {
-  test('drops an empty schema with cascade false', async () => {
-    const fake = makeFakeSql({ schemas: [liveRow()] });
-    await run(dropWithClient(fake, baseProps));
-    const drops = fake.statements.filter((s) => s.text.startsWith('DROP SCHEMA'));
-    expect(drops.length).toBe(1);
-    expect(drops[0]?.text).toBe('DROP SCHEMA IF EXISTS "ledger"');
-    expect(fake.schemas.get('ledger')).toBeUndefined();
-  });
-
-  test('refuses to drop a non-empty schema with cascade false', async () => {
-    const fake = makeFakeSql({ schemas: [liveRow()], schemasWithRelations: ['ledger'] });
-    const error = await fails(dropWithClient(fake, baseProps));
-    expect(error).toBeInstanceOf(PostgresSchemaDropNotEmptyError);
-    expect(fake.schemas.get('ledger')).not.toBeUndefined();
-  });
-
-  test('drops a non-empty schema with cascade true', async () => {
-    const fake = makeFakeSql({ schemas: [liveRow()], schemasWithRelations: ['ledger'] });
-    await run(dropWithClient(fake, { ...baseProps, cascade: true }));
-    const drop = fake.statements.find((s) => s.text.startsWith('DROP SCHEMA'));
-    expect(drop?.text).toBe('DROP SCHEMA IF EXISTS "ledger" CASCADE');
-    expect(fake.schemas.get('ledger')).toBeUndefined();
-  });
-
-  test('classifies the server 2BP01 refusal as the typed not-empty tag', async () => {
-    // The emptiness check said empty, but the server refuses with SQLSTATE 2BP01 — an object
-    // kind the check's four catalogs do not cover. Class `2B` is not `42`, so both drivers
-    // wrap it as UnknownError with the raw code on the cause; this executor replays that shape.
-    const refusing: PgExecutor = {
-      unsafe: <A extends object>(text: string) =>
-        text.startsWith('SELECT current_database()')
-          ? Effect.succeed([{ database: 'postgres' }] as unknown as ReadonlyArray<A>)
-          : text.includes('AS empty')
-            ? Effect.succeed([{ empty: true }] as unknown as ReadonlyArray<A>)
-            : Effect.fail(
-                new SqlError({
-                  reason: new UnknownError({
-                    cause: Object.assign(
-                      new Error('ERROR:  2BP01: dependent objects still exist'),
-                      { code: '2BP01' },
-                    ),
-                    message: 'dependent_objects_still_exist',
-                    operation: 'DROP SCHEMA',
-                  }),
-                }),
-              ),
-      transaction: () => Effect.void,
-    };
-    const error = await fails(dropWithClient(refusing, baseProps));
-    expect(error).toBeInstanceOf(PostgresSchemaDropNotEmptyError);
-  });
-});

package/src/postgres/schema-sequence-error.ts

@@ -0,0 +1,38 @@
+import * as Data from 'effect/Data';
+
+/**
+ * `cascade: true` on a schema that holds a SEQUENCE is refused (`HF004`, `schema-drop-sql.ts`).
+ *
+ * ⛔ A sequence cannot be locked by `LOCK TABLE`, so the drop's closure proof has a hole there: a
+ *   concurrent, uncommitted `CREATE VIEW other.v AS SELECT last_value FROM ours.seq` is invisible
+ *   to the scan, and when it commits while the drop waits on the sequence, PostgreSQL's deletion
+ *   cascades into `other.v` (Codex read of PR 357, 2026-10-06). Serial and identity columns each
+ *   own a sequence, so such a schema cannot be cascade-dropped by this provider.
+ * The message carries a COUNT only. Nothing was dropped: drop the schema's contents deliberately
+ * (the sequences included), then declare `cascade: false`.
+ */
+export class PostgresSchemaCascadeSequencesRefused extends Data.TaggedError(
+  'PostgresSchemaCascadeSequencesRefused',
+)<{
+  readonly schema: string;
+  /** How many sequences the schema holds (at least one when raised). */
+  readonly sequences: number;
+}> {
+  override get message(): string {
+    return (
+      `Postgres.Schema "${this.schema}": cascade: true refused — the schema holds ` +
+      `${String(this.sequences)} sequence(s) (serial/identity columns own one), which cannot be ` +
+      'locked, so a concurrent dependent could escape the cascade proof. No DROP was issued. ' +
+      'Drop the schema contents first, then declare cascade: false.'
+    );
+  }
+}
+
+/** The sequence COUNT out of an `HF004` error; unreadable still refuses (1, never 0). */
+export const sequencesCount = (error: {
+  readonly reason: { readonly cause?: unknown };
+}): number => {
+  const cause = error.reason.cause;
+  const message = typeof cause === 'object' && cause !== null ? (cause as Error).message : '';
+  return Math.max(1, Number(/sequences:\s*(\d+)/.exec(message ?? '')?.[1] ?? 1));
+};

package/src/postgres/schema-socket.test.ts

@@ -11,7 +11,8 @@ import * as PgClientModule from '@effect/sql-pg/PgClient';
 import type { PgClient as PgClientService } from '@effect/sql-pg/PgClient';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import { SqlClient } from 'effect/unstable/sql/SqlClient';
+import { SqlClient, TransactionConnection } from 'effect/unstable/sql/SqlClient';
+import { PIN_SEARCH_PATH_SQL } from './search-path.ts';
 import { isDependentObjectsError } from './schema-sql.ts';
 import { classifyInstalled } from './installed-classifier.ts';
 import { PostgresPool, postgresConnection } from './connection.ts';
@@ -31,6 +32,8 @@ const schemaRead = postgresSchemaHandlers.read;
 const pools: Array<{ database?: string | undefined }> = [];
 /** Every SQL text the fake client ran, in order. */
 const queries: string[] = [];
+/** The pool count at each `SET search_path`: one pin per pool, before that pool's statements. */
+const pins: number[] = [];
 /** The router answers for the current test (`schema-test-kit.ts` markers, JSON strings). */
 let answers: RouteAnswers = {};
 
@@ -38,7 +41,15 @@ let answers: RouteAnswers = {};
 // callbacks), and `Statement<A>` is an `Effect<ReadonlyArray<A>, SqlError>` — a plain succeed
 // satisfies the same call shape.
 const fakeClient = {
+  // `pinnedSocketExecutor` reserves one connection and routes every statement through the
+  // client's own `transactionService` — the fake only has to answer both.
+  reserve: Effect.succeed({}),
+  transactionService: TransactionConnection(0),
   unsafe: (text: string) => {
+    if (text === PIN_SEARCH_PATH_SQL) {
+      pins.push(pools.length);
+      return Effect.succeed([] as never);
+    }
     queries.push(text);
     const answer = route(text, answers);
     return Effect.succeed(
@@ -72,6 +83,7 @@ describe('socket transport: a missing declared database is schema absent', () =>
   beforeEach(() => {
     pools.length = 0;
     queries.length = 0;
+    pins.length = 0;
     answers = {};
   });
 
@@ -85,8 +97,8 @@ describe('socket transport: a missing declared database is schema absent', () =>
     expect(pools.length).toBe(1);
     expect(pools[0]?.database).toBe('postgres');
     expect(queries.length).toBe(1);
-    expect(queries[0]).toContain('FROM pg_database');
-    expect(queries.some((q) => q.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(queries[0]).toContain('FROM pg_catalog.pg_database');
+    expect(queries.some((q) => q.startsWith('DO '))).toBe(false);
   });
 
   test('read answers absent: the untyped 3D000 connect never happens', async () => {
@@ -98,7 +110,7 @@ describe('socket transport: a missing declared database is schema absent', () =>
     expect(pools.length).toBe(1);
     expect(pools[0]?.database).toBe('postgres');
     expect(queries.length).toBe(1);
-    expect(queries[0]).toContain('FROM pg_database');
+    expect(queries[0]).toContain('FROM pg_catalog.pg_database');
   });
 
   test('the `database` override reaches the pool: probe over the family pool, statements over the declared one', async () => {
@@ -113,7 +125,9 @@ describe('socket transport: a missing declared database is schema absent', () =>
     );
     // The probe opened the family database; every statement after it opened `agents`.
     expect(pools.map((pool) => pool.database)).toEqual(['postgres', 'agents']);
-    expect(queries.some((q) => q.startsWith('DROP SCHEMA'))).toBe(true);
+    // Each pool's reserved connection is pinned before its first statement: pool 1, then pool 2.
+    expect(pins).toEqual([1, 2]);
+    expect(queries.some((q) => q.startsWith('DO '))).toBe(true);
   });
 
   test('read over an existing declared database answers the row from the overridden pool', async () => {
@@ -147,7 +161,7 @@ describe('socket transport: a missing declared database is schema absent', () =>
     );
     expect(error).toBeInstanceOf(PostgresSchemaDeleteForeignRefused);
     expect(error).toMatchObject({ liveOid: 16443, liveOwner: 'other_role', lastOid: 16442 });
-    expect(queries.some((q) => q.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(queries.some((q) => q.startsWith('DO '))).toBe(false);
   });
 
   test('the installed classifier keeps 3D000 as UnknownError with the raw code — the untyped failure the probe prevents', async () => {

package/src/postgres/schema-sql.ts

@@ -32,10 +32,10 @@ export const buildDropSchemaSql = (name: string, cascade: boolean): string =>
 const SELECT_SCHEMA_SQL = `SELECT
     n.oid AS oid,
     n.nspname AS name,
-    pg_get_userbyid(n.nspowner) AS owner,
-    obj_description(n.oid, 'pg_namespace') AS comment,
+    pg_catalog.pg_get_userbyid(n.nspowner) AS owner,
+    pg_catalog.obj_description(n.oid, 'pg_namespace') AS comment,
     current_database() AS database
-  FROM pg_namespace n
+  FROM pg_catalog.pg_namespace n
   WHERE n.nspname = $1`;
 
 /** The read: one bound `SELECT` on `pg_namespace`. `undefined` when absent. The row carries
@@ -84,18 +84,23 @@ export const currentUser = (pg: PgExecutor): Effect.Effect<string, SqlError> =>
  *
  * ⚠️ THE FAKE (`fake-schema-sql.ts`) ROUTES THIS STATEMENT BY `AS empty` + `pg_class` — keep both
  *   markers in any rewrite, and keep this check matched BEFORE the plain `pg_namespace` branch
- *   (this SQL contains `FROM pg_namespace` too, inside its `WITH`).
+ *   (this SQL contains `FROM pg_catalog.pg_namespace` too, inside its `WITH`).
  */
-const SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_namespace WHERE nspname = $1)
-  SELECT NOT EXISTS (
-    SELECT 1 FROM pg_class c WHERE c.relnamespace = (SELECT oid FROM ns)
+/** The four-catalog emptiness predicate over a namespace oid expression — shared by this read
+ * and by the atomic drop's in-transaction check (`schema-drop-sql.ts`), so the two cannot
+ * disagree about what "empty" means. */
+export const emptyPredicate = (ns: string): string => `NOT EXISTS (
+    SELECT 1 FROM pg_catalog.pg_class c WHERE c.relnamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_proc p WHERE p.pronamespace = (SELECT oid FROM ns)
+    SELECT 1 FROM pg_catalog.pg_proc p WHERE p.pronamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_type t WHERE t.typnamespace = (SELECT oid FROM ns)
+    SELECT 1 FROM pg_catalog.pg_type t WHERE t.typnamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_operator o WHERE o.oprnamespace = (SELECT oid FROM ns)
-  ) AS empty`;
+    SELECT 1 FROM pg_catalog.pg_operator o WHERE o.oprnamespace = ${ns}
+  )`;
+
+const SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+  SELECT ${emptyPredicate('(SELECT oid FROM ns)')} AS empty`;
 
 /** `true` when the schema holds none of the four object catalogs above (used before a
  * non-cascade `DROP SCHEMA`). */

package/src/postgres/schema-takeover.test.ts

@@ -5,6 +5,7 @@ import { postgresSchemaHandlers, reconcileWithClient } from './schema.ts';
 import { postgresRunnerConnection } from './connection.ts';
 import { makeFakeSql } from './fake-sql.ts';
 import { readArgs, router, runnerWith } from './schema-test-kit.ts';
+import { stripPin } from './search-path.ts';
 import type { PostgresSchemaAttributes } from './schema-attrs.ts';
 
 const props = { name: 'ledger', database: 'postgres', owner: 'postgres', cascade: true };
@@ -101,21 +102,23 @@ test('same-owner create race is a typed exists refusal, never a comment or adopt
 
 test('runner 42P06 becomes an adoption refusal; other SQLSTATEs remain SqlError', async () => {
   for (const code of ['42P06', '42501']) {
-    const run = ({ stdin }: { stdin: string }) =>
-      Promise.resolve(
+    const run = ({ stdin: raw }: { stdin: string }) => {
+      const stdin = stripPin(raw);
+      return Promise.resolve(
         stdin.startsWith('CREATE')
           ? { code: 3, stdout: '', stderr: `ERROR:  ${code}: refused` }
           : {
               code: 0,
               stdout:
-                stdin.includes('current_database()') && !stdin.includes('pg_namespace')
+                stdin.includes('current_database()') && !stdin.includes('pg_catalog.pg_namespace')
                   ? '[{"database":"postgres"}]'
-                  : stdin.includes('pg_roles')
+                  : stdin.includes('pg_catalog.pg_roles')
                     ? '[{"present":1}]'
                     : '[]',
               stderr: '',
             },
       );
+    };
     const error = await Effect.runPromise(
       postgresSchemaHandlers
         .reconcile(args())