DR-035 — Zero-anon-EXECUTE holds for BOTH schemas, enforced by a born-locked event trigger

The ID-115.10 invariant — only set_config carries anon EXECUTE — is reaffirmed for api AND public, revising S410’s “public is latent, no action” conclusion: PostgREST exposure is one config change away, and SECURITY DEFINER functions are reachable transitively.

Enforcement is the born-locked ddl_command_end event trigger dr035_born_locked_functions (signature-exact set_config exemption), not default privileges — ALTER DEFAULT PRIVILEGES … REVOKE FROM PUBLIC is empirically a no-op against Postgres’s compiled-in PUBLIC-EXECUTE default, and is retained only as defence-in-depth. Per-migration REVOKE discipline alone demonstrably regressed within days (S410→S450). Gated by check-api-view-coverage.ts INV-20 across both schemas.

Mechanism detail: canonical:supabase/CLAUDE.md.