[warheart1984-ctrl]

Main's CI is red on #107's and #108's merge commits. Cause (reproduced locally): tests that create and drop their own schemas (test_block_anchors, test_pg_replay) did not drop v10's new <schema>_control twin, and CI runs the suite twice on the same Postgres server, so the second pass fails with schema "jarvis_control" already exists / "restored_control" already exists. These fixes were finished just after the merges, so they are not in main yet.

Test fix (the red CI)

Those two tests now drop the control schema twin. Verified by running the schema-managing test files twice on one server in whole-suite Postgres mode (149 passed each pass, 0 leftover control schemas; without the fix the second pass fails exactly as in CI).

Four Codex findings on #107 (round 2), all valid, each with a test that fails when the fix is removed

• Key issuance racing a deletion: the BEFORE INSERT trigger reads the tenant row FOR SHARE, so a transition to deleting/deleted waits for an uncommitted insert (then revokes that key) and an insert waits for an uncommitted transition (then is refused). A two-thread test holds each side open in turn (and cleans up after itself).
• --expires-days 0 meant "never": it now means "expires now", omitting it still means no expiry, negative is refused.
• Rollback SQL did not quote a mixed-case control schema name: pg_schema.v10_rollback_sql(schema) quotes it as v10 created it (tests migrate and roll back a mixed-case schema).
• A repeated deleted overwrote the first deleted_at: now coalesce(deleted_at, now()).

Not deployed; the live box is still on v9 (no migration has run there). Drill (v9 -> v10, key tenants, rollback) was re-run on the fixed code earlier: 52/52.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T22:52:59.263206Z	b680f05	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f7ad9b81a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b680f05d2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid recursive placeholder substitution in rollback SQL

When a valid ledger schema contains the literal __LEDGER__ (for example, foo__LEDGER__bar), the second replacement also rewrites that substring inside the already-substituted control-schema identifier, producing malformed SQL such as "foo"foo__LEDGER__bar"bar_control". Consequently, v10_rollback_sql() cannot roll back every schema accepted by validate_schema_name(); construct the two statements independently or use collision-proof formatting rather than sequential global replacements.

Useful? React with 👍 / 👎.