Postgres "REASSIGN OWNED" fails with "permission denied for schema public" - amazon-aurora

Question

In our application we have components that can modify DB structure. At times it is desirable to prohibit this and to do this we reduce the level of privilege of the Postgres group role that owns all of our DB structures (tables, sequences, views, etc.). Additionally, because owners can still do whatever they want to existing structure they own, we reassign ownership of all the structures to a temporary user role who cannot login. The latter step is accomplished by issuing a REASSIGN OWNED BY XXX TO YYY; command. Recently, when testing, we noticed that for one of our databases this command was failing with a "permission denied for schema public" error message. This is odd since all of our DBs define equivalent group roles for reading, writing, and administrative/DDL operations and this operation continues to work fine for other DBs on the same Postgres host. Furthermore I can see no inconsistencies in schema privileges or object ownership. Is there a way to get more information from Postgres about what it is objecting to?
I have run the \dn+ command on both the affected / failing DB and on one behaving normally and see no difference in the privilege of the "superuser" I'm using to issue the commands, not to mention create and administer the roles in question. Most of my searches on the subject yield results where the REASSIGN OWNED BY command is used to help remedy permission denied errors and I've yet to find any information on what to look for if that command itself is throwing such an error. Any help would be greatly appreciated.
The user I'm using is the highest privileged user AWS Aurora provides us. The output from \du for the role is basically unusable since that role is a member of ALL groups for all the DBs on our system resulting in a membership list that is hundreds of elements long and almost unreadable in the terminal let alone here. I'll try and provide more selective information using the pg_roles and pg_auth_members views below.
d0000000033_0000000031=> select current_user;
current_user
--------------
datamart
(1 row)
d0000000033_0000000031=> select * from pg_roles where rolname = 'datamart';
rolname | rolsuper | rolinherit | rolcreaterole | rolcreatedb | rolcanlogin | rolreplication | rolconnlimit | rolpassword | rolvaliduntil | rolbypassrls | rolconfig | oid
----------+----------+------------+---------------+-------------+-------------+----------------+--------------+-------------+---------------+--------------+-----------+-------
datamart | f | t | t | t | t | f | -1 | ******** | infinity | f | | 16393
(1 row)
The schema privileges for the DB are as follows:
d0000000033_0000000031=> \dn+ public
List of schemas
Name | Owner | Access privileges | Description
--------+----------+---------------------------------------------+------------------------
public | rdsadmin | datamart=UC/rdsadmin +| standard public schema
| | d0000000033_0000000031_g_admins=UC/rdsadmin+|
| | d0000000033_0000000031_g_writers=U/rdsadmin+|
| | d0000000033_0000000031_g_readers=U/rdsadmin |
(1 row)
The memberships for the associated group roles are:
d0000000033_0000000031=> select r1.rolname as role, r2.rolname as member, r3.rolname as grantor, am.admin_option
from pg_roles r1
inner join pg_auth_members am on r1.oid = am.roleid
inner join pg_roles r2 on r2.oid = am.member
inner join pg_roles r3 on r3.oid = am.grantor
where r1.rolname like 'd0000000033_0000000031_g%';
role | member | grantor | admin_option
----------------------------------+---------------------------------+----------+--------------
d0000000033_0000000031_g_admins | datamart | datamart | t
d0000000033_0000000031_g_admins | clari_global_admins | datamart | f
d0000000033_0000000031_g_admins | d0000000033_0000000031_u_admin | datamart | f
d0000000033_0000000031_g_readers | datamart | datamart | t
d0000000033_0000000031_g_readers | clari_global_readers | datamart | f
d0000000033_0000000031_g_readers | d0000000033_0000000031_u_reader | datamart | f
d0000000033_0000000031_g_writers | datamart | datamart | t
d0000000033_0000000031_g_writers | clari_global_writers | datamart | f
d0000000033_0000000031_g_writers | d0000000033_0000000031_u_writer | datamart | f
(9 rows)
The details for the associated roles are:
d0000000033_0000000031=> select * from pg_roles where rolname like 'd0000000033_0000000031%' or rolname like 'clari_global%';
rolname | rolsuper | rolinherit | rolcreaterole | rolcreatedb | rolcanlogin | rolreplication | rolconnlimit | rolpassword | rolvaliduntil | rolbypassrls | rolconfig | oid
----------------------------------+----------+------------+---------------+-------------+-------------+----------------+--------------+-------------+---------------+--------------+-----------+-------
clari_global_admins | f | f | f | f | f | f | -1 | ******** | | f | | 25971
clari_global_readers | f | t | f | f | f | f | -1 | ******** | | f | | 25973
clari_global_writers | f | f | f | f | f | f | -1 | ******** | | f | | 25972
d0000000033_0000000031_g_admins | f | f | f | f | f | f | -1 | ******** | | f | | 96724
d0000000033_0000000031_g_readers | f | f | f | f | f | f | -1 | ******** | | f | | 96730
d0000000033_0000000031_g_writers | f | f | f | f | f | f | -1 | ******** | | f | | 96725
d0000000033_0000000031_u_admin | f | t | f | f | t | f | -1 | ******** | | f | | 97411
d0000000033_0000000031_u_reader | f | t | f | f | t | f | -1 | ******** | | f | | 97078
d0000000033_0000000031_u_writer | f | t | f | f | t | f | -1 | ******** | | f | | 96731
(9 rows)
I just realized I missed an important piece of information RE the user I'm reassigning ownership to:
d0000000033_0000000031=> \du d0000000033_0000000031_u_restricted;
List of roles
Role name | Attributes | Member of
-------------------------------------+--------------+-----------
d0000000033_0000000031_u_restricted | Cannot login | {}
The flow of commands leading up to the failure of the REASSIGN OWNED BY is this:
REVOKE ALL ON SCHEMA public FROM d0000000033_0000000031_g_admins;
GRANT USAGE ON SCHEMA public TO d0000000033_0000000031_g_admins;
CREATE ROLE d0000000033_0000000031_u_restricted WITH ADMIN datamart;
GRANT ALL ON SCHEMA public TO d0000000033_0000000031_u_restricted;
REASSIGN OWNED BY d0000000033_0000000031_g_admins TO d0000000033_0000000031_u_restricted;
Executing these for the affected DB I get:
d0000000033_0000000031=> REVOKE ALL ON SCHEMA public FROM d0000000033_0000000031_g_admins;
WARNING: no privileges could be revoked for "public"
REVOKE
d0000000033_0000000031=> GRANT USAGE ON SCHEMA public TO d0000000033_0000000031_g_admins;
WARNING: no privileges were granted for "public"
GRANT
d0000000033_0000000031=> CREATE ROLE d0000000033_0000000031_u_restricted WITH ADMIN datamart;
CREATE ROLE
d0000000033_0000000031=> GRANT ALL ON SCHEMA public TO d0000000033_0000000031_u_restricted;
WARNING: no privileges were granted for "public"
GRANT
d0000000033_0000000031=> REASSIGN OWNED BY d0000000033_0000000031_g_admins TO d0000000033_0000000031_u_restricted;
ERROR: permission denied for schema public
Executing the same for my unaffected DB I get:
d0000000033_0000000029=> REVOKE ALL ON SCHEMA public FROM d0000000033_0000000029_g_admins;
WARNING: no privileges could be revoked for "public"
REVOKE
d0000000033_0000000029=> GRANT USAGE ON SCHEMA public TO d0000000033_0000000029_g_admins;
WARNING: no privileges were granted for "public"
GRANT
d0000000033_0000000029=> CREATE ROLE d0000000033_0000000029_u_restricted WITH ADMIN datamart;
CREATE ROLE
d0000000033_0000000029=> GRANT ALL ON SCHEMA public TO d0000000033_0000000029_u_restricted;
WARNING: no privileges were granted for "public"
GRANT
d0000000033_0000000029=> REASSIGN OWNED BY d0000000033_0000000029_g_admins TO d0000000033_0000000029_u_restricted;
REASSIGN OWNED