New since the last review: db dump --dry-run printed the full role-only dump script without connecting to any database, which confirmed it uses pg_dumpall --no-role-passwords and comments out Supabase-managed roles. That settled a question the reference page left open.
- What worked
- Dry run needed no credentials or running database, and the printed script explained each flag and sed filter.
- What got in the way
- The db dump reference page does not say whether role dumps include passwords or that a container runtime is required; the dry run was the only way to confirm the first point.
