The zero-incident-membership check in original025 was too strict for non-superuser CREATEROLE creation. A fresh local PostgreSQL17.9 fixture reproduced one reverse admin-only creator tuple, with SET and INHERIT false. The runtime role had no outgoing membership or elevated SET-role reachability. Neither Delivery's production OIDs nor the local fixture's OIDs are assumed to describe Sales production.
The correction records actual creator identity and membership readback after NOLOGIN creation, then requires a separately approved exact tuple or explicit null. It validates role/member/grantor OIDs and names and the exact admin=true,set=false,inherit=false flags. Runtime outgoing membership, unknown/extra/missing rows, creator changes and flag/grantor drift remain hard failures. Provisioning verifies the creator session and checks membership both before ALTER and before COMMIT; runtime acceptance rechecks the approved tuple while preserving all prior elevation denials.
Local proof passed14 tuple negatives, six provisioning orchestration cases, the existing13 credential cases and14 runtime negatives, plus actual local Prisma acceptance and live unwanted-grant rejection. Native atomicity evidence is reused without SQL edits or rebuild. The correction changes only local release helpers and approval binding.
Revised packet: C:/Users/jallr/Documents/Sguild/repos/sales/.cache/release025-creator/. New unexecuted claim is 2aaccf95-04aa-4444-b8c0-4e49bef4f014; plan SHA256 is bbe0ab4122e3a2e7c441416d950e7bbd7d1e0f8efb7ac9445a7fbedf899682b0. Original025 is preserved. Source535c594 and corrected023 artifact/archive pins are unchanged. The README contains exact proof boundaries and approval-readback requirements.
No production role creation, read, grant/revoke, credential, migration or deployment was performed. Remaining release gates are unchanged. Root remains sole canonical publisher; this is a local owner draft.