[OffgridwithJD]

Part of #1341: the High expire items. They are a non-owner refused, and a retention column that is not a time type (42804) or no longer exists (42703). Arms are in both twins, plus a new pytest function, test_expire_refuses_what_it_cannot_honour.

The fixture makes a missing refusal destructive

Every refused table holds 3,000 rows, ten days old, in three row groups, under a one-day retention. Each arm asserts the SQLSTATE and the row count, so "refused" means nothing was dropped.

The owner's control runs on its own identical table (ttl_ctl). On the first draft it shared ttl_own: under the no-owner mutant the non-owner had already dropped the rows, so the control reddened as collateral. pgc_ledger merge refused to record that, rightly.

Arms and mutations

PG17, both twins, main 8af86e8 against this branch:

arm	mutation of pgcolumnar_expire	main	this branch
a role that does not own the table cannot expire it, even holding DELETE (42501)	PgColumnarRequireTableOwnerByOid removed	sh 67/67, py 9 passed	"got [|0] want [42501|3000]": the non-owner retired every group
expire refuses a retention column that no longer exists (42703)	the 42703 branch returns 0 instead	green	"got [|3000] want [42703|3000]"
expire refuses a retention column that is not a time type (42804)	the 42804 branch returns 0 instead	green	"got [|3000] want [42804|3000]"

The fourth row is a real gap made visible: without the owner check, a role that holds only DELETE could drop whole row groups of a table it doesn't own.

There are four never rows:

• a premise on the fixture's layout;
• a premise that the declaration still names the dropped column;
• set_options accepting an int column, which is what makes the refusal expire's job;
• the owner's control.

Not done here: the half-declaration item. Removing PgColumnarReadTtl's both-halves test dereferences a NULL interval, so the only mutant crashes the backend. I'd rather design a non-crashing proof than date an arm with a segfault.

Evidence

• Clean: ttl_expire 74/74 and test_ttl_expire.py 10 passed on each of PG 15–19.
• Ledger: seven rows, three dated: 2340 → 2347, census 1801 → 1805.
• Gate: rc=0 against main bd99606.
• Bookkeeping: a TESTS.md row and cluster_tests 532 → 533. test: ttl_expire, the #1339 findings in both twins: a timestamp column, a zone that always differs, accurate premises #1353 also takes 533, so whichever lands second goes to 534.
• Database-free set: 429 passed.

🤖 Generated with Claude Code

[jdatcmd]

Approving the content at d2d1fe7. On PG17 I reproduced the owner claim with PgColumnarRequireTableOwnerByOid removed from pgcolumnar_expire:

• main: ttl_expire passes 70/70.
• this head: "a role that does not own the table cannot expire it, even holding DELETE (42501): got [|0] want [42501|3000]". The non-owner retired every row, as you say.

Keeping the owner's control on its own table (ttl_ctl) is the right fix for the collateral red. Leaving the half-declaration item until there is a non-crashing proof is the right call too.

Needs a rebase before merge. Main is 1933577, with #1353 and #1355 in, which share ttl_expire.sh and test_ttl_expire.py. That gives:

• Ledger: 2343 / 1796, so with your seven rows (three dated) I expect 2350 / 1800.
• Count: cluster_tests is now 533, so yours goes to 534.

Restate both from a recount and a collection, and I'll check and merge.

[OffgridwithJD]

@jdatcmd, rebasing onto c558971 now. #1353 and #1355 changed both ttl files since this PR's evidence. The test files auto-merged; cluster_tests conflicted and becomes 534. I'm re-running the merged files clean on 15–19, with all three mutants, and will regenerate the ledger rows from those logs rather than reuse the old ones. I'll push with the restated totals (I expect your 2361 / 1801) once the runs are in.

[OffgridwithJD]

@jdatcmd, rebased onto c558971. The new head is cc5557b, replacing d2d1fe7. Ledger: 2361 / 1801, cluster_tests 534, as you expected.

• Merged test files, re-run: ttl_expire.sh and test_ttl_expire.py auto-merged with test: ttl_expire, the #1339 findings in both twins: a timestamp column, a zone that always differs, accurate premises #1353's and test: ttl_expire's twins ask the same question: expire's return on a date column, the no-retention SQLSTATE (#1339) #1355's changes. On the merged files: ttl_expire 77/77 and test_ttl_expire.py 11 passed on each of PG 15–19.
• Mutants against main c558971, PG17: each reddens only its own arm, in both twins:
  • no owner check: "got [|0] want [42501|3000]";
  • the 42703 refusal returning 0: "got [|3000]";
  • the 42804 refusal returning 0: "got [|3000]".
• Ledger: the old ledger commit was dropped and the rows regenerated from these logs. Gate rc=0 with the census agreeing.
• Counts: expected_tests.txt conflicted on the comment lines; resolved, with 533 → 534. The database-free set gives 429 passed.

I'll ping on green CI.

[jdatcmd]

Re-approving cc5557b.

• Ledger: a recount gives 2361 / 1801, which agrees with the budget. No duplicate keys, no dated premise: row.
• Patch: the ttl_expire changes are the same 125 lines as d2d1fe7, the head I reviewed and reproduced, rebased around #1353 and #1355.
• Counts: cluster_tests 534 by collection; the database-free set gives 429 passed.

Merging.