@homeflare/alchemy 0.46.0 → 0.47.0

package/src/postgres/grants-relkind-wire.test.ts

@@ -51,12 +51,14 @@ const makeFake = () =>
     ],
   });
 
-describe('measured: the "char" relkind column decodes raw on the socket transport', () => {
-  test('PgTypes.decode returns the raw bytes for OID 18 — there is no "char" codec', () => {
+describe('measured: the "char" relkind column on the socket transport', () => {
+  // ★ MEASURED 2026-10-06 on @effect/sql-pg 4.0.1: OID 18 now decodes to the string (rc.115 had no
+  //   codec and returned `Uint8Array([114])`). The `::text` cast stays: it is correct on both, and
+  //   the readGrants tests below fail if it is dropped from the SQL the fake shapes rows from.
+  test('PgTypes.decode answers a string for OID 18 on 4.0.1 (rc.115 answered raw bytes)', () => {
     const decoded = PgTypes.decode(new Uint8Array([114]), 18, 1);
     if (!Result.isSuccess(decoded)) throw new Error('fixture: decode failed for OID 18');
-    expect(decoded.success instanceof Uint8Array).toBe(true);
-    expect(decoded.success).not.toBe('r');
+    expect(decoded.success).toBe('r');
   });
 
   test('the same byte string decodes as a string through the OID 25 text codec', () => {

package/src/postgres/index.ts

@@ -49,7 +49,9 @@ export {
   diffPostgresSchema,
   isPostgresSchema,
 } from './schema.ts';
+export { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
 export {
+  PostgresSchemaCascadeCrossSchemaRefused,
   PostgresSchemaCreateVanished,
   PostgresSchemaExistsRefused,
   PostgresSchemaIdentityRefused,

package/src/postgres/installed-classifier.ts

@@ -8,7 +8,7 @@
  * `PgConnection.ts#classifyFields` calls. If the driver moves the file, the import fails
  * loudly in the tests that use it rather than silently asserting a fabricated shape.
  */
-import { SqlError } from 'effect/unstable/sql/SqlError';
+import { SqlError } from 'effect/sql/SqlError';
 
 export const classifyInstalled = async (
   code: string,

package/src/postgres/psql-executor-escaping.test.ts

@@ -6,6 +6,7 @@ import { parseLiteral } from './fake-sql-quote.ts';
 import { buildCommentSchemaSql } from './schema-sql.ts';
 import { buildSetPasswordSql } from './role-sql.ts';
 import { makePsqlExecutor, redactPasswordLiterals } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const payload = "\\'; CREATE SCHEMA injected; --";
 const target = { database: 'postgres', username: 'postgres' };
@@ -22,7 +23,8 @@ for (const on of [true, false]) {
   test(`psql executor comment and bound param stay one literal with standard_conforming_strings=${String(on)}`, async () => {
     const fake = makeFakeSql({ schemas: [row], standardConformingStrings: on });
     const calls: string[] = [];
-    const pg = makePsqlExecutor(async ({ stdin }) => {
+    const pg = makePsqlExecutor(async ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
       calls.push(stdin);
       if (stdin.startsWith('COMMENT')) {
         await Effect.runPromise(fake.unsafe(stdin.slice(0, -1)));

package/src/postgres/psql-executor.test.ts

@@ -7,6 +7,7 @@ import { buildCreateDatabaseSql, isDuplicateDatabaseRace } from './database-sql.
 import { buildSetPasswordSql } from './role-sql.ts';
 import { scramSha256Verifier } from './role-scram.ts';
 import { type PsqlRunner, inlineParams, makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const target = { database: 'postgres', username: 'postgres' };
 const ok = (stdout: string) => Promise.resolve({ code: 0, stdout, stderr: '' });
@@ -24,7 +25,10 @@ describe('psql executor', () => {
       return ok('[{"oid":"16400","name":"x"}]\n');
     };
     const rows = await Effect.runPromise(
-      makePsqlExecutor(run, target).unsafe('SELECT 1 FROM pg_database WHERE datname = $1', ['x']),
+      makePsqlExecutor(run, target).unsafe(
+        'SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1',
+        ['x'],
+      ),
     );
     expect(rows).toEqual([{ oid: 16400, name: 'x' }]);
     expect(calls[0]?.argv.slice(0, 1)).toEqual(['psql']);
@@ -114,10 +118,12 @@ describe('runner transport through withPg', () => {
       tablespace: 'pg_default',
     };
     let created = false;
-    const run: PsqlRunner = ({ stdin }) => {
+    const run: PsqlRunner = ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
       stdins.push(stdin);
-      if (stdin.includes('pg_roles')) return ok('[{"present":1}]');
-      if (stdin.includes('FROM pg_database')) return ok(created ? JSON.stringify([row]) : '[]');
+      if (stdin.includes('pg_catalog.pg_roles')) return ok('[{"present":1}]');
+      if (stdin.includes('FROM pg_catalog.pg_database'))
+        return ok(created ? JSON.stringify([row]) : '[]');
       if (stdin.startsWith('CREATE DATABASE')) created = true;
       return ok('');
     };
@@ -141,7 +147,7 @@ describe('runner transport through withPg', () => {
   test('transaction is one psql script from BEGIN through COMMIT', async () => {
     const calls: string[] = [];
     const run: PsqlRunner = (call) => {
-      calls.push(call.stdin);
+      calls.push(stripPin(call.stdin));
       return ok('');
     };
     await Effect.runPromise(

package/src/postgres/psql-executor.ts

@@ -14,17 +14,14 @@
  * ★ ROWS COME BACK AS JSON: a row-returning statement (`SELECT`, or a `WITH` query) is wrapped
  *   in `json_agg`, so `oid` and `datconnlimit` arrive as JS numbers exactly as the socket client
  *   decodes them (database-sql.ts, no bigint).
+ * ⛔ EVERY SCRIPT IS PREFIXED WITH `SET search_path = pg_catalog, pg_temp;` — see `search-path.ts`.
  * ★ `VERBOSITY=verbose` puts the SQLSTATE in the error line, so `42P04` (duplicate database)
  *   stays recognisable to `isDuplicateDatabaseRace`.
  */
 import * as Effect from 'effect/Effect';
-import {
-  ConnectionError,
-  SqlError,
-  SqlSyntaxError,
-  UnknownError,
-} from 'effect/unstable/sql/SqlError';
+import { ConnectionError, SqlError, SqlSyntaxError, UnknownError } from 'effect/sql/SqlError';
 import { type PgExecutor, quoteStringLiteral } from './database-sql.ts';
+import { PIN_SCRIPT_PREFIX } from './search-path.ts';
 
 export interface PsqlResult {
   readonly code: number;
@@ -122,7 +119,8 @@ const runScript = (
             '-d',
             target.database,
           ],
-          stdin,
+          // ⛔ EVERY psql SESSION STARTS PINNED (`search-path.ts`): one process, one session.
+          stdin: `${PIN_SCRIPT_PREFIX}${stdin}`,
         }),
       catch: (cause) =>
         new SqlError({ reason: new ConnectionError({ cause, operation: 'psql exec' }) }),

package/src/postgres/role-adopt.test.ts

@@ -13,6 +13,7 @@ import * as Effect from 'effect/Effect';
 import { postgresRunnerConnection } from './connection.ts';
 import { parseLiteral } from './fake-sql-quote.ts';
 import { makeFakeSql } from './fake-sql.ts';
+import { stripPin } from './search-path.ts';
 import { type PsqlRunner } from './psql-executor.ts';
 import { postgresRoleHandlers } from './role-provider.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
@@ -42,7 +43,8 @@ const liveRole = (): PostgresRoleAttributes => ({
  */
 const runnerFor =
   (fake: ReturnType<typeof makeFakeSql>): PsqlRunner =>
-  async ({ stdin }) => {
+  async ({ stdin: raw }) => {
+    const stdin = stripPin(raw);
     const wrapped = /^SELECT coalesce\(json_agg\(t\), '\[\]'::json\)::text FROM \((.*)\) t;$/s.exec(
       stdin,
     );

package/src/postgres/role-membership-options.test.ts

@@ -3,6 +3,7 @@ import * as Effect from 'effect/Effect';
 import { makeFakeSql } from './fake-sql.ts';
 import { buildRepairMembershipSql, syncMemberships } from './role-membership-sql.ts';
 import { makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const props = {
   name: 'seat',
@@ -34,7 +35,8 @@ test.each(['2BP01', '42501'])(
     // denial); the real server is the dependency authority.
     const scripts: string[] = [];
     const pg = makePsqlExecutor(
-      ({ stdin }) => {
+      ({ stdin: raw }) => {
+        const stdin = stripPin(raw);
         scripts.push(stdin);
         return Promise.resolve(
           stdin.startsWith('BEGIN')

package/src/postgres/role-membership-repair.test.ts

@@ -84,9 +84,9 @@ test('reads INHERIT and repairs another grantor row for declared NOINHERIT', asy
   expect(before?.memberships).toEqual([
     { parent: 'parent', grantor: 'other', admin: false, set: false, inherit: true },
   ]);
-  expect(fake.statements.find((s) => s.text.includes('FROM pg_auth_members'))?.text).toContain(
-    'm.inherit_option AS inherit',
-  );
+  expect(
+    fake.statements.find((s) => s.text.includes('FROM pg_catalog.pg_auth_members'))?.text,
+  ).toContain('m.inherit_option AS inherit');
   expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: before }))).toEqual({
     action: 'update',
   });

package/src/postgres/role-membership-sql.ts

@@ -14,7 +14,7 @@
  *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still
  *   produce only a warning; the catalog re-read below catches surviving unsafe rows.
  */
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import * as Effect from 'effect/Effect';
 import type { PgExecutor } from './database-sql.ts';
 import { quoteIdent, roleExists } from './database-sql.ts';
@@ -40,10 +40,10 @@ const MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
     m.admin_option AS admin,
     m.set_option AS set,
     m.inherit_option AS inherit
-  FROM pg_auth_members m
-  JOIN pg_roles member ON member.oid = m.member
-  JOIN pg_roles parent ON parent.oid = m.roleid
-  LEFT JOIN pg_roles grantor ON grantor.oid = m.grantor
+  FROM pg_catalog.pg_auth_members m
+  JOIN pg_catalog.pg_roles member ON member.oid = m.member
+  JOIN pg_catalog.pg_roles parent ON parent.oid = m.roleid
+  LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid = m.grantor
   WHERE member.rolname = $1
   ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;
 

package/src/postgres/role-password-transports.test.ts

@@ -4,11 +4,12 @@ import * as PgClient from '@effect/sql-pg/PgClient';
 import * as Effect from 'effect/Effect';
 import * as Stream from 'effect/Stream';
 import * as Tracer from 'effect/Tracer';
-import * as Statement from 'effect/unstable/sql/Statement';
-import type { Connection } from 'effect/unstable/sql/SqlConnection';
+import * as Statement from 'effect/sql/Statement';
+import type { Connection } from 'effect/sql/SqlConnection';
 import type { PgExecutor } from './database-sql.ts';
 import { makeFakeSql } from './fake-sql.ts';
 import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 import { reconcileWithClient } from './role.ts';
 
 const props = {
@@ -84,7 +85,8 @@ test('psql runner receives only a verifier; echoed failure and state hold no pla
     for (const fail of [false, true]) {
       const calls: Parameters<PsqlRunner>[0][] = [];
       let created = exists;
-      const run: PsqlRunner = (call) => {
+      const run: PsqlRunner = (raw) => {
+        const call = { ...raw, stdin: stripPin(raw.stdin) };
         calls.push(call);
         if (call.stdin.includes('PASSWORD') && fail) {
           return Promise.resolve({
@@ -97,7 +99,7 @@ test('psql runner receives only a verifier; echoed failure and state hold no pla
         return Promise.resolve({
           code: 0,
           stderr: '',
-          stdout: call.stdin.includes('FROM pg_roles r')
+          stdout: call.stdin.includes('FROM pg_catalog.pg_roles r')
             ? JSON.stringify(created ? [live] : [])
             : '[]',
         });

package/src/postgres/role-sql.ts

@@ -17,7 +17,7 @@
  *   and the `pg_auth_members` read live in `role-membership-sql.ts` — this file stays the role
  *   row (`pg_roles`), its scalar statements and the compare between them.
  */
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import * as Effect from 'effect/Effect';
 import type { PgExecutor } from './database-sql.ts';
 import { quoteIdent, quoteStringLiteral } from './database-sql.ts';
@@ -46,7 +46,7 @@ const SELECT_ROLE_SQL = `SELECT
     r.rolreplication AS replication,
     r.rolbypassrls AS bypassrls,
     to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "validUntil"
-  FROM pg_roles r
+  FROM pg_catalog.pg_roles r
   WHERE r.rolname = $1`;
 
 export const selectRole = (

package/src/postgres/role.ts

@@ -29,7 +29,7 @@
 import { Resource } from 'alchemy';
 import * as Effect from 'effect/Effect';
 import * as Redacted from 'effect/Redacted';
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
 import { nameByteRefusal, validUntilRefusal } from './role-attrs.ts';

package/src/postgres/schema-assert.ts

@@ -19,7 +19,7 @@
  *   refused, and nothing is dropped.
  */
 import * as Effect from 'effect/Effect';
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import type { PgExecutor } from './database-sql.ts';
 import {
   type PostgresSchemaAttributes,

package/src/postgres/schema-closure-sql.ts

@@ -0,0 +1,108 @@
+/**
+ * The dependency closure `DROP SCHEMA … CASCADE` would walk, and the count of what it would take
+ * that does NOT live in the schema being dropped (`schema-drop-sql.ts` refuses when it is > 0).
+ *
+ * ⛔ THE CLOSURE IS DERIVED FROM THE NAMESPACE OBJECT, NOT FROM A LIST OF CLASSES. Until
+ *   2026-10-06 the scan started from four catalogs (`pg_class`, `pg_type`, `pg_proc`,
+ *   `pg_operator`), so `a.c` (a collation) used by `b.t.x` was invisible and the cascade reached
+ *   into `b.t.x` (Codex read of PR 357). Now the walk starts at `(pg_namespace, v_ns)` and follows
+ *   EVERY `pg_depend` row whose referenced object is already inside — the same edges
+ *   `findDependentObjects` (`dependency.c`) follows — so any object class `pg_depend` can name
+ *   (collation, conversion, opclass, opfamily, text-search, statistics, extension members, …)
+ *   is reached with no catalog enumerated to find it.
+ * ★ EVERY `deptype` FOLLOWS (`pg_depend`, catalogs.sgml); they differ only in attribution:
+ *     n NORMAL    cascade drops the dependent        → followed; foreign if it lives elsewhere
+ *     a AUTO      dropped with any drop              → followed; foreign if it lives elsewhere
+ *                 (an owned sequence in another schema is dropped with its table)
+ *     i INTERNAL  a part of the referenced object    → followed; attributed to its owner (below)
+ *     P / S       partition primary / secondary      → followed; a partition in another
+ *                 schema is dropped with its parent, so it is foreign
+ *     e EXTENSION member of an extension             → followed; the extension's members are
+ *                 dropped with it, wherever they live
+ *     x AUTO-EXT  auto, and dropped with the extension → followed like `a`
+ *     p PIN       system object, `refobjid = 0`      → never a referenced row, never joins
+ * ★ "INSIDE" is a home-schema test per class. TOAST is the case the old scan got wrong: a text
+ *   table's TOAST relation (and its index) lives in `pg_toast` and depends internally on the
+ *   table, so it is attributed to the table that owns it via `reltoastrelid` — otherwise every
+ *   cascade of a schema with a text column was refused. Constraints, triggers, rules, policies
+ *   and defaults have no schema of their own and take their table's.
+ * ⚠️ A CLASS THIS FILE DOES NOT KNOW (a cast, a foreign server, a language, an event trigger)
+ *   resolves to NULL, which is NOT inside: it counts as foreign. Unknown fails CLOSED. The walk
+ *   stops at a foreign object — one is enough to refuse.
+ * ★ A dependent created AFTER this scan is held off by the caller's locks (`schema-drop-sql.ts`).
+ */
+
+const cls = (name: string): string => `'pg_catalog.${name}'::pg_catalog.regclass`;
+
+/** `WHEN <class> THEN <namespace column of the row>` for a catalog that carries its own. */
+const direct = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT x.${column} FROM pg_catalog.${table} x WHERE x.oid = d.objid)`;
+
+/** The same for an object with no schema of its own: the schema of the relation it hangs on. */
+const viaRelation = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT c.relnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_class c ON c.oid = x.${column} WHERE x.oid = d.objid)`;
+
+/** An access-method member belongs to its operator family. */
+const viaFamily = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT f.opfnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_opfamily f ON f.oid = x.${column} WHERE x.oid = d.objid)`;
+
+/** A relation's home. A TOAST relation, or the index on one, is its owner's. */
+const RELATION_HOME = `WHEN ${cls('pg_class')} THEN COALESCE(
+            (SELECT o.relnamespace FROM pg_catalog.pg_class o
+              WHERE o.reltoastrelid <> 0
+                AND o.reltoastrelid IN (d.objid, (SELECT i.indrelid FROM pg_catalog.pg_index i WHERE i.indexrelid = d.objid))),
+            (SELECT x.relnamespace FROM pg_catalog.pg_class x WHERE x.oid = d.objid))`;
+
+const HOME_OF_DEPENDENT = `CASE d.classid
+          WHEN ${cls('pg_namespace')} THEN d.objid
+          ${RELATION_HOME}
+          ${direct('pg_type', 'typnamespace')}
+          ${direct('pg_proc', 'pronamespace')}
+          ${direct('pg_operator', 'oprnamespace')}
+          ${direct('pg_collation', 'collnamespace')}
+          ${direct('pg_conversion', 'connamespace')}
+          ${direct('pg_opclass', 'opcnamespace')}
+          ${direct('pg_opfamily', 'opfnamespace')}
+          ${direct('pg_ts_config', 'cfgnamespace')}
+          ${direct('pg_ts_dict', 'dictnamespace')}
+          ${direct('pg_ts_parser', 'prsnamespace')}
+          ${direct('pg_ts_template', 'tmplnamespace')}
+          ${direct('pg_statistic_ext', 'stxnamespace')}
+          ${direct('pg_constraint', 'connamespace')}
+          ${direct('pg_default_acl', 'defaclnamespace')}
+          ${direct('pg_extension', 'extnamespace')}
+          ${viaRelation('pg_trigger', 'tgrelid')}
+          ${viaRelation('pg_rewrite', 'ev_class')}
+          ${viaRelation('pg_attrdef', 'adrelid')}
+          ${viaRelation('pg_policy', 'polrelid')}
+          ${viaRelation('pg_publication_rel', 'prrelid')}
+          ${viaFamily('pg_amop', 'amopfamily')}
+          ${viaFamily('pg_amproc', 'amprocfamily')}
+        END`;
+
+/**
+ * `v_count := …`: how many objects the cascade would drop outside `v_ns`, PLUS how many objects
+ * INSIDE it hold an `e` or `i` edge to an object outside the closure.
+ * ⛔ THE SECOND TERM IS THE OWNERSHIP ESCAPE (Codex read of PR 357, 2026-10-06). An inside table
+ *   added to a foreign extension (`ALTER EXTENSION x ADD TABLE a.t`) has an OUTGOING `e` edge; the
+ *   walk only follows edges INTO the closure, so it saw nothing, while `findDependentObjects`
+ *   redirects the deletion of an extension member / internal part to its OWNER and drops that
+ *   owner's other objects too. Any outgoing `e` or `i` edge leaving the closure counts as foreign:
+ *   refuse, never follow-and-classify (the simplest correct answer fails closed).
+ */
+export const OUTSIDE_DEPENDENTS_SQL = `v_count := (
+      WITH RECURSIVE reach (classid, objid, inside) AS (
+        SELECT ${cls('pg_namespace')}::pg_catalog.oid, v_ns, true
+        UNION
+        SELECT d.classid, d.objid, (${HOME_OF_DEPENDENT}) IS NOT DISTINCT FROM v_ns
+        FROM pg_catalog.pg_depend d
+        JOIN reach r ON d.refclassid = r.classid AND d.refobjid = r.objid AND r.inside
+        WHERE d.deptype <> 'p'
+      )
+      SELECT (SELECT pg_catalog.count(*) FROM reach WHERE NOT inside)
+           + (SELECT pg_catalog.count(*) FROM pg_catalog.pg_depend e
+               JOIN reach r ON e.classid = r.classid AND e.objid = r.objid AND r.inside
+               WHERE e.deptype IN ('e', 'i') AND e.refobjid <> 0
+                 AND NOT EXISTS (SELECT 1 FROM reach o
+                                  WHERE o.inside AND o.classid = e.refclassid AND o.objid = e.refobjid))
+    )`;

package/src/postgres/schema-delete-proofs.test.ts

@@ -65,7 +65,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
           ),
         ),
     );
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 
   test('refuses on oid mismatch, CASCADE included — no DROP issued', async () => {
@@ -91,7 +91,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: 16442,
       lastOwner: 'seat_role',
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
     // Refused before the guarded drop, so the emptiness check never ran either.
     expect(stdins.some((s) => s.includes('AS empty'))).toBe(false);
   });
@@ -118,7 +118,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: 16442,
       lastOwner: 'seat_role',
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 
   test('a live row with no persisted proof fails closed — the delete client core refuses', async () => {
@@ -134,7 +134,7 @@ describe('delete drops only what it can prove it created (Important 1)', () => {
       lastOid: undefined,
       lastOwner: undefined,
     });
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(false);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(false);
   });
 });
 
@@ -153,7 +153,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
         ),
     );
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(argvs.length).toBe(1);
     expect(argvs[0]?.at(-1)).toBe('postgres');
   });
@@ -169,7 +169,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
     );
     expect(result).toBeUndefined();
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
   });
 
   test('the `database` override reaches `psql -d`: the probe targets the family database, the rest the declared one', async () => {
@@ -185,7 +185,7 @@ describe('a missing declared database is schema absent (Important 2)', () => {
           ),
         ),
     );
-    expect(stdins.some((s) => s.startsWith('DROP SCHEMA'))).toBe(true);
+    expect(stdins.some((s) => s.startsWith('DO '))).toBe(true);
     expect(argvs[0]?.at(-1)).toBe('postgres');
     expect(argvs.slice(1).every((argv) => argv.at(-1) === 'agents')).toBe(true);
   });

package/src/postgres/schema-delete.ts

@@ -1,6 +1,6 @@
 /**
  * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then
- * the guarded `DROP SCHEMA`.
+ * ONE atomic statement that re-proves it under a lock and drops (`schema-drop-sql.ts`).
  *
  * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When
  *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no
@@ -10,87 +10,129 @@
  *   row that no longer matches the persisted proof fails with
  *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any
  *   `DROP` is issued.
+ * ⛔ THE RE-READ ALONE IS A WINDOW. It is a separate autocommit statement (a separate `psql` on
+ *   the runner transport), so the schema can change between the read and the drop. The drop
+ *   therefore carries the proven `oid` + `owner` INTO one `DO` block that locks, re-verifies
+ *   them, checks emptiness or cross-schema dependents, and drops in one transaction. This
+ *   file's read is the typed, readable refusal; the block is the guarantee.
  */
 import * as Effect from 'effect/Effect';
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import type { PgExecutor } from './database-sql.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
 import { assertDatabase, deleteForeignRefusal } from './schema-assert.ts';
 import {
-  type PostgresSchemaDeleteForeignRefused,
+  PostgresSchemaCascadeCrossSchemaRefused,
+  PostgresSchemaDeleteForeignRefused,
   PostgresSchemaDropNotEmptyError,
   type PostgresSchemaWrongDatabase,
 } from './schema-errors.ts';
 import {
-  buildDropSchemaSql,
-  isDependentObjectsError,
-  schemaIsEmpty,
-  selectSchema,
-} from './schema-sql.ts';
+  CASCADE_SEQUENCES,
+  CROSS_SCHEMA_DEPENDENTS,
+  IDENTITY_CHANGED,
+  NOT_EMPTY,
+  buildAtomicDropSql,
+  dependentsCount,
+  sqlStateOf,
+} from './schema-drop-sql.ts';
+import { PostgresSchemaCascadeSequencesRefused, sequencesCount } from './schema-sequence-error.ts';
+import { isDependentObjectsError, selectSchema } from './schema-sql.ts';
+
+type DropError =
+  | PostgresSchemaDropNotEmptyError
+  | PostgresSchemaCascadeCrossSchemaRefused
+  | PostgresSchemaCascadeSequencesRefused
+  | PostgresSchemaDeleteForeignRefused
+  | SqlError;
 
 /**
- * The guarded `DROP SCHEMA`, against any {@link PgExecutor}: refuses a non-empty schema
- * without `cascade`, and classifies the server's own `2BP01` refusal as the same typed tag —
- * for an object kind the emptiness check's four catalogs do not cover. Callers have already
- * proven the connected database (`assertDatabase`) and, on the delete path, the schema's
- * ownership.
+ * The atomic guarded `DROP SCHEMA` for a row the caller has already read, against any
+ * {@link PgExecutor}. The server's refusals come back as typed tags: `HF001` (the row changed
+ * between read and drop) re-reads and refuses as a foreign schema; `HF002` and the server's own
+ * `2BP01` (an object kind the emptiness check's four catalogs miss) are the not-empty tag;
+ * `HF003` is the cross-schema dependents refusal, with the count only; `HF004` refuses a cascade
+ * over a schema holding a sequence.
  */
-const dropGuarded = (
+const dropAtomic = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
-): Effect.Effect<void, PostgresSchemaDropNotEmptyError | SqlError> =>
-  Effect.gen(function* () {
-    if (props.cascade !== true) {
-      const empty = yield* schemaIsEmpty(pg, props.name);
-      if (!empty) {
-        return yield* Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
-      }
+  live: PostgresSchemaAttributes,
+): Effect.Effect<void, DropError> => {
+  const cascade = props.cascade === true;
+  const classify = (error: SqlError): Effect.Effect<void, DropError> => {
+    const state = sqlStateOf(error);
+    if (state === NOT_EMPTY || (!cascade && isDependentObjectsError(error))) {
+      return Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
     }
-    // The server's own `2BP01` refusal (an object kind the four catalogs miss) is classified
-    // into the same typed tag the emptiness check raises — one fail branch, classified before
-    // the fail, exactly as `database-sql.ts` classifies the `42P04` race.
-    const dropRefusal = (error: SqlError): PostgresSchemaDropNotEmptyError | SqlError =>
-      props.cascade !== true && isDependentObjectsError(error)
-        ? new PostgresSchemaDropNotEmptyError({ schema: props.name })
-        : error;
-    yield* pg.unsafe(buildDropSchemaSql(props.name, props.cascade === true)).pipe(
-      Effect.asVoid,
-      Effect.catchTag('SqlError', (error) => Effect.fail(dropRefusal(error))),
-    );
-  });
+    if (state === CROSS_SCHEMA_DEPENDENTS) {
+      return Effect.fail(
+        new PostgresSchemaCascadeCrossSchemaRefused({
+          schema: props.name,
+          dependents: dependentsCount(error),
+        }),
+      );
+    }
+    if (state === CASCADE_SEQUENCES) {
+      return Effect.fail(
+        new PostgresSchemaCascadeSequencesRefused({
+          schema: props.name,
+          sequences: sequencesCount(error),
+        }),
+      );
+    }
+    if (state === IDENTITY_CHANGED) {
+      return Effect.flatMap(selectSchema(pg, props.name), (now) =>
+        now === undefined
+          ? Effect.void
+          : Effect.fail(
+              new PostgresSchemaDeleteForeignRefused({
+                schema: props.name,
+                database: props.database,
+                liveOid: now.oid,
+                liveOwner: now.owner,
+                lastOid: live.oid,
+                lastOwner: live.owner,
+              }),
+            ),
+      );
+    }
+    return Effect.fail(error);
+  };
+  return pg
+    .unsafe(buildAtomicDropSql({ name: props.name, oid: live.oid, owner: live.owner, cascade }))
+    .pipe(Effect.asVoid, Effect.catchTag('SqlError', classify));
+};
 
-/** Prove the connected database, then the guarded drop — the drop core on its own, for the
- * tests that drive it directly. */
+/** Prove the connected database, then the guarded drop of whatever row is live now — the drop
+ * core on its own, for the tests that drive it directly. No persisted proof is consulted: the
+ * row read here is the row the atomic drop re-verifies. */
 export const dropWithClient = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
-): Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDropNotEmptyError | SqlError> =>
+): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>
   Effect.gen(function* () {
     yield* assertDatabase(props, pg);
-    yield* dropGuarded(pg, props);
+    const live = yield* selectSchema(pg, props.name);
+    if (live === undefined) return;
+    yield* dropAtomic(pg, props, live);
   });
 
 /**
  * The core of `delete`: re-read first (see the file header), refuse a schema the persisted
- * proof cannot vouch for, then the guarded drop. `output` is the persisted state the engine
- * hands over — `undefined` is no proof and refuses too.
+ * proof cannot vouch for, then the atomic guarded drop. `output` is the persisted state the
+ * engine hands over — `undefined` is no proof and refuses too.
  */
 export const deleteWithClient = (
   pg: PgExecutor,
   props: PostgresSchemaProps,
   output: PostgresSchemaAttributes | undefined,
-): Effect.Effect<
-  void,
-  | PostgresSchemaWrongDatabase
-  | PostgresSchemaDeleteForeignRefused
-  | PostgresSchemaDropNotEmptyError
-  | SqlError
-> =>
+): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>
   Effect.gen(function* () {
     yield* assertDatabase(props, pg);
     const live = yield* selectSchema(pg, props.name);
     if (live === undefined) return;
     const refusal = deleteForeignRefusal(props, live, output);
     if (refusal !== undefined) return yield* Effect.fail(refusal);
-    yield* dropGuarded(pg, props);
+    yield* dropAtomic(pg, props, live);
   });