Symptom
Removing an object from HCL emits a runnable DROP TABLE with no guard. Only in-place-impossible changes are withheld from the SQL stream (internal/loader/hcl/sqlgen.go:168-174); intentional-looking drops are emitted as executable DDL. There is no Terraform-style prevent_destroy/protect mechanism.
Impact
An accidental deletion of a table block (bad merge, wrong layer resolution) generates a DROP that, once an apply path exists or an operator pipes the output, destroys data with no friction.
Fix direction
- A
protect = true (or lifecycle { prevent_destroy = true }) attribute on tables/MVs/dictionaries that turns a generated DROP into an error.
- Optionally a global
-forbid-drops flag for CI diff runs.
Found in the 2026-07-02 deep-dive audit (docs/plans/2026-07-02-deep-dive-improvement-areas.md, C2).
Symptom
Removing an object from HCL emits a runnable
DROP TABLEwith no guard. Only in-place-impossible changes are withheld from the SQL stream (internal/loader/hcl/sqlgen.go:168-174); intentional-looking drops are emitted as executable DDL. There is no Terraform-styleprevent_destroy/protect mechanism.Impact
An accidental deletion of a table block (bad merge, wrong layer resolution) generates a DROP that, once an apply path exists or an operator pipes the output, destroys data with no friction.
Fix direction
protect = true(orlifecycle { prevent_destroy = true }) attribute on tables/MVs/dictionaries that turns a generated DROP into an error.-forbid-dropsflag for CI diff runs.Found in the 2026-07-02 deep-dive audit (docs/plans/2026-07-02-deep-dive-improvement-areas.md, C2).