PostgreSQL refuses CREATE OR REPLACE FUNCTION when the owning role has no EXECUTE on it, which is the CNPG shape (the runtime role owns the schema and worm-audit:6 revokes its EXECUTE). worm-audit:13 now grants EXECUTE back to the migrating role only when missing, replaces the function, and revokes it again inside the same changeset transaction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>