feat(executor): prove claimed relation names free before the create runs

docs/capabilities.md

@@ -198,7 +198,7 @@ Status legend: ✅ T1 (supported today) · 🟡 T2 (planned; typed refusal today
 | Unlogged tables | 🟡 | native, planned flow | Yes | Typed refusal: persistence is not modeled, converging it (`SET LOGGED`) is a full rewrite, and rendering the table as plain `CREATE TABLE` would silently change crash-safety |
 | Explicit column collations | 🟡 | native, planned flow | Yes | Typed refusal: dropping a `COLLATE` clause from a rendered baseline silently changes sort order and index semantics; a collation delta cannot converge without a rewrite |
 | Columns whose default uses a sequence the column does not own | 🟡 | native, planned flow | Yes | Typed refusal: in a desired-state model that sequence exists only inside the scratch transaction, so no derived plan can reference it. Column-owned (`serial`-style) sequences are fine |
-| Greenfield `CREATE TABLE` apply (the table does not exist yet — a fresh database or a new table in a live one) | ✅ | native, as-is | Yes — a `REFERENCES` clause would take a brief `SHARE ROW EXCLUSIVE` on each **referenced** live table, but desired files refuse foreign keys today, so no live table is locked | Desired-state execution creates the table: the absence preflight (`CheckTableAbsent`) verifies the name is free, `CheckCreatePrivileges` verifies the role can create in the schema, and the executor runs the `CREATE TABLE` and the index builds as brief bounded steps under the engine's `lock_timeout` / `statement_timeout` budgets. An occupied name is a typed `create-collision` refusal; `PARTITION OF`, `INHERITS`, `LIKE`, `OF`, `IF NOT EXISTS`, and in-set duplicate names are typed refusals before anything runs, while `REFERENCES` and `CONCURRENTLY` are refused upstream at desired-file parse and re-checked at admission as defense in depth |
+| Greenfield `CREATE TABLE` apply (the table does not exist yet — a fresh database or a new table in a live one) | ✅ | native, as-is | Yes — a `REFERENCES` clause would take a brief `SHARE ROW EXCLUSIVE` on each **referenced** live table, but desired files refuse foreign keys today, so no live table is locked | Desired-state execution creates the table: `CheckTableAbsent` verifies the table relation and composite-type name are free, the executor verifies every relation name the desired file states (explicit index names and first-choice constraint-index and column-sequence names) is free in the schema, and `CheckCreatePrivileges` verifies the role can create there. It then runs the `CREATE TABLE` and index builds as brief bounded steps under the engine's budgets. An occupied claimed name is a typed `create-collision` refusal before execution — drop or rename the occupant, name a constraint's index explicitly, or for a sequence use an explicitly named sequence or a non-serial column. Duplicate-name SQLSTATEs backstop races for explicit names; for server-chosen names, the probe narrows the race to the time-of-check window, but nothing catches a name taken inside it. `PARTITION OF`, `INHERITS`, `LIKE`, `OF`, `IF NOT EXISTS`, and in-set duplicate names are typed refusals before anything runs, while `REFERENCES` and `CONCURRENTLY` are refused upstream at desired-file parse and re-checked at admission as defense in depth |
 
 ### Types and non-table objects
 

docs/cli-output-examples.md

@@ -87,7 +87,7 @@ in `detail`. The set is closed and pinned by test (`verdict.Reasons()`).
 | `backend-unavailable` | The change routes to an execution strategy this build does not implement (copy-and-swap). |
 | `destructive-change` | The desired-state plan discards live structure — a dropped column, constraint, index, or `NOT NULL` — and desired-state execution runs no destructive statement; run the drop deliberately instead ([execution model](execution-model.md)). |
 | `plan-fingerprint-mismatch` | The plan recomputed at execution time does not carry the pinned fingerprint: the plan a reviewer approved is not the plan that would execute, so nothing runs ([execution model](execution-model.md)). |
-| `create-collision` | The greenfield create plan's target name is already occupied — a relation or standalone type took it after the plan was derived. Nothing runs; re-derive the plan against the live catalog and review what it says now. |
+| `create-collision` | The greenfield create plan's table name or a claimed index, constraint-index, or sequence name is occupied. Nothing runs; re-derive the plan against the live catalog to see what holds the name, then drop or rename the occupant, name a constraint's index explicitly, or for a sequence use an explicitly named sequence or a non-serial column — re-planning alone reproduces the refusal. Catalog absence checks handle existing occupants. Duplicate-name SQLSTATEs backstop races for explicit names; for server-chosen names, the probe narrows the race to the time-of-check window, but nothing catches a name taken inside it. |
 
 ## Migrate
 

docs/limitations.md

@@ -44,7 +44,7 @@ composition of the model boundaries above with those gates. At a glance:
 
 | Desired-file edit | Outcome today |
 | --- | --- |
-| A desired file whose table does not exist yet | Converges — the greenfield create path verifies the name is free and the role holds `CREATE` on the schema, then runs the `CREATE TABLE` and the index builds as brief bounded steps. An occupied name (a relation or standalone type) is a typed `create-collision` refusal; `PARTITION OF` and `IF NOT EXISTS` are typed refusals before anything runs. |
+| A desired file whose table does not exist yet | Converges — the greenfield create path verifies the table name and every relation name the desired file states (explicit index names and first-choice constraint-index and column-sequence names) are free and the role holds `CREATE` on the schema, then runs the `CREATE TABLE` and index builds as brief bounded steps. Names the server invents rather than names the desired file states are outside this coverage. An occupied claimed name is a typed `create-collision` refusal before anything runs — drop or rename the occupant, name a constraint's index explicitly, or for a sequence use an explicitly named sequence or a non-serial column. Duplicate-name SQLSTATEs backstop races for explicit names; for server-chosen names, the probe narrows the race to the time-of-check window, but nothing catches a name taken inside it. `PARTITION OF` and `IF NOT EXISTS` are also typed refusals before execution. |
 | Add a column | Converges. Runs as a bounded attempt of the submitted form, so the table-size guard applies (below). |
 | Widen a column type (`varchar(50)` → `varchar(255)`) | Converges — the same bounded attempt, under the same size guard. |
 | Add an index | Converges via `CREATE INDEX CONCURRENTLY`. Not size-guarded: long online work on a large table is the pattern's purpose. |

docs/schemabot-integration.md

@@ -150,7 +150,7 @@ it to one of four things:
 | Outcome | Routing class |
 | --- | --- |
 | Executed | The table and its indexes exist; a rerun converges to an empty plan |
-| `create-collision` refusal | **Re-plan**: re-diff the live catalog — something now owns the name; never blindly retry |
+| `create-collision` refusal | **Re-plan, then fix the occupant**: the table name or a claimed index, constraint-index, or sequence name is occupied. Re-diff the live catalog to see what holds it; re-planning alone reproduces the refusal — drop or rename the occupant, name a constraint's index explicitly, or for a sequence use an explicitly named sequence or a non-serial column. Never blindly retry |
 | `insufficient-privileges` refusal (`*preflight.PrivilegeError`, `Tier == TierCreateTable`) | **Operator provisioning action**: the role needs the exact `GRANT` the error carries — not a desired-file fix, and not retryable until granted |
 | Admission refusal (`unsupported-statement`) | **Author action**: the desired file states a shape the create path refuses; retrying unchanged cannot succeed |
 
@@ -167,7 +167,8 @@ The greenfield `CREATE TABLE` path is a fixed call order, all inside the apply s
    `CONCURRENTLY`, qualified names).
 2. `preflight.CheckTableAbsent` — mint the `AbsentTarget` proof for the table name.
 3. `preflight.CheckCreatePrivileges` — mint the `CreationRole` proof for the target schema.
-4. `executor.ExecuteCreate` — consume both proofs and run the set.
+4. `executor.ExecuteCreate` — consume both proofs, admit the set, probe `pg_class` for every
+   index, constraint-index, and sequence name the set claims, then run the set.
 
 For the shapes the create path admits, the plan's `exec_sql` is the statement as written —
 the plain `CREATE TABLE` and index builds this path runs, with each build's decision
@@ -176,10 +177,13 @@ born in that run.
 
 `migrate.RunDesired` runs this sequence itself when the plan is greenfield — the adapter
 does not assemble it and must not mint either proof separately (a proof minted outside the
-executing session proves nothing about it). The order decides which refusal wins when both
-preflights would fail: absence is checked first, so an occupied name refuses as
-`create-collision` even when the role also lacks `CREATE` — the collision is the more
-actionable message (the change is not a create at all) and absence is the cheaper check.
+executing session proves nothing about it). The order decides which refusal wins when more
+than one check would fail. The table name is checked first, so an occupied **table** name
+refuses as `create-collision` even when the role also lacks `CREATE` — the collision is the
+more actionable message (the change is not a create at all) and absence is the cheaper
+check. Claimed **index** names are probed last, inside `ExecuteCreate`: an occupied index
+name with a role lacking `CREATE` surfaces as `insufficient-privileges`, and the index
+collision appears only once the grant is in place.
 
 Both proofs share one rule the adapter must respect: they are **minted inside the apply
 session and consumed there** — never serialized into `SchemaChange.Metadata`, carried across
@@ -206,7 +210,19 @@ them, don't retry them uniformly:
 | `ErrPartitionOfUnsupported` (`partition-of-unsupported`) | `PARTITION OF` binds to a live parent the absence proof does not cover | Fix the desired file; out of the create path's scope |
 | `ErrIfNotExistsUnsupported` (`if-not-exists-unsupported`) | `CREATE ... IF NOT EXISTS` succeeds as a name-only no-op over a relation it cannot vouch for — the opposite of the absence proof's fail-closed contract; refused at admission, nothing ran | Fix the desired file: state the plain `CREATE`; the absence check owns collision handling |
 | `ErrUnsupportedCreateStep` (`unsupported-create-step`) | A desired statement is not a shape the create path can run | Fix the desired file |
-| `ErrCreateCollision` (`create-collision`) | A concurrent writer took a needed name after a valid proof | Re-diff the live catalog and re-plan — the world changed; never blindly retry the create |
+| `ErrCreateCollision` (`create-collision`) | A claimed index, constraint-index, or sequence name was already occupied, or a concurrent writer took a needed name after the absence checks | Re-diff the live catalog to see what holds the name, then drop or rename the occupant, name a constraint's index explicitly, or for a sequence use an explicitly named sequence or a non-serial column — re-planning alone reproduces the refusal; never blindly retry the create |
+
+Before the first step, `ExecuteCreate` probes `pg_class` in one schema-scoped catalog
+snapshot for every relation name the desired file states — explicit `CREATE INDEX` names
+and the first-choice names of implicit constraint indexes and column-owned sequences. Names
+the server invents rather than names the desired file states, such as an unnamed `CREATE
+INDEX ON t (v)`, are outside this coverage because the probe has nothing to check.
+`CheckTableAbsent` separately covers the table relation and composite type. Duplicate-name
+SQLSTATEs backstop races for explicit names. For server-chosen names, the probe narrows the
+race to the time-of-check window, but nothing catches a name taken inside it.
+
+A `create-collision` can identify a name the table needs — an index, constraint index, or
+sequence — rather than the table name itself.
 
 A failed create is not rolled back wholesale: each step committed in its own bounded
 transaction, so the steps before the failure remain