Database ownership
One PostgreSQL cluster is allowed in V1, but each semantic owner has its own schema and login role. Cross-owner writes and application JOINs are forbidden. Cross-owner foreign keys are forbidden by default.
bootstrap/001_roles_and_schemas.sql is run by a dedicated bootstrap/migration principal, never automatically by every runtime replica.