[OffgridwithJD]

Part of #1341: the High twin-parity item "userinfo in a caller-written URL is refused (22023) on every path". objstore_userinfo.sh had no pytest twin. test_objstore_userinfo.py is one now, covering all 26 shell checks by name, and it is added to COMPLETE so compare_to_bash holds it there. The existing test_objstore_endpoint_userinfo.py covers the endpoint half independently and says it doesn't pair with the shell, so it's left as it is.

The twin

Three tests: the URL guard, the controls, and the configured-endpoint guard.

• Each refusal: asserted by SQLSTATE plus whether the primary message names userinfo, the endpoint, AWS_ENDPOINT_URL or AWS_ACCESS_KEY_ID, as the shell's msg_of/msg_has do.
• The allow-list: set per session (it's superuser-settable), as the endpoint file does.
• Isolation: nothing reads anything under test/*.sh.

Proof it is a twin, not just a file

The write path's userinfo guard removed (os_write_handle, the shell header's own removal proof). PG17, main 4027b8d against this branch:

	shell (main, and this branch)	pytest twin
guard removed	24 + 2 failed: "and the export_parquet message names userinfo: got [0]", "export_arrow refuses userinfo…: got [42501]"	red at the same check: "and the export_parquet message names userinfo: got 0 want 1"

The export is still refused 22023, by a different guard, so only the message tells the userinfo guard is gone. Both twins see that.

Evidence

• Clean: objstore_userinfo 26/26 and the twin's 3 tests passed on each of PG 15–19.
• Ledger: no change. The ledger rows are the shell's, and this PR adds no shell check.
• Counts: TESTS.md section 105, and cluster_tests 533 → 536. test: parallel_copy and parallel_export_parquet refuse a table the caller holds no grant on; import_export_privilege gets its twin and its ledger (#1341) #1362 also takes section 105 and moves cluster_tests; it lands first, so I'll renumber and restate on rebase.
• Database-free set: 429 passed.

🤖 Generated with Claude Code

[jdatcmd]

Approving 416cf02 on content. Reproduced on PG18.

• Green: shell 26/26; pytest 3 passed; compare_to_bash: 26 literal matches, 0 missing.
• Red: with the os_write_handle userinfo guard disabled (objstore/columnar_objstore_module.c:1795, if (false && memchr(…))), both twins fail the same two names:
  FAIL and the export_parquet message names userinfo: got [0] want [1]
FAIL export_arrow refuses userinfo through the same handle (22023): got [42501] want [22023]

Notes, not blocking:

• Inherited from main: "export_parquet refuses userinfo (22023, not an allow-list 42501)" stays green with that guard removed, in both twins. The 22023 likely comes from parsing u:p@ as a port (unverified). The suite header's claim that the write arms "read 42501 again" is half true. That belongs on #1339.
• The twin's "…names no userinfo" controls read only the primary message. The shell greps all of psql's output, including DETAIL and HINT.
• Unlike #1379 and #1380, this PR seeds no ledger rows.

Before merge: a rebase. TESTS.md §105 is taken on main by test_import_export_privilege.py, and cluster_tests and expected_tests.txt conflict.

[OffgridwithJD]

Rebased onto 57f6e0e (#1401), on top of #1403. The new head is 4799e34. Only the count files changed, so this needs your re-approval.

• Same patch: outside the count files, the changed lines match the head you approved, except for TESTS.md section renumbers where main's new sections took the old numbers.
• The ledger is restated on main's census and agrees with its tsv: 2786 rows, 2095 never, 691 dated, read back from the file. Each changed paragraph's arithmetic starts from main's last numbers.
• cluster_tests 569, by collection over the cluster files on this tree. guard_tests 433 is unchanged.
• Runs on the rebased tree at 217f23b, PG17 and PG18: PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 pytest: 43 passed in 5.82s; PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 pytest: 43 passed in 7.68s. harness_selftest 1245/1245 and docs_style passed on both. fix: a read inside an aborted inner block no longer loses the enclosing statement's rows (#1360) #1403 has since changed the write path's subtransaction flush, which every suite here exercises, so I'm re-running them all on 758039f and will post the result. CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[OffgridwithJD]

Re-run finished on the tree after #1403 (758039f or later). Everything is green, so the head above stands:

• PG17 docs_style: passed
• PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 pytest: 44 passed in 4.31s
• PG17 vacuum_lock_privilege: 19 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 docs_style: passed
• PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 pytest: 44 passed in 4.61s
• PG18 vacuum_lock_privilege: 19 passed + 0 failed + 0 unrunnable + 0 skipped

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 7da848d (#1432, #1409). The new head is d0febce; only the count files changed, so please re-approve this head.

• Ledger, restated on main's census and read back from the tsv: 2873 rows, 2179 never, 694 dated, suites_not_covered 232. A branch that seeds a suite moves suites_not_covered one below main's 232, derived from the runner's suite list.
• Counts by collection: cluster_tests 570, guard_tests 435.
• What the earlier runs still cover: test: the Iceberg REST readers' server-file gate, and no borrowed environment token (#1341 items 8, 9, 14, 52) #1409 and test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 change no src/, so the PG17 and PG18 runs posted above still describe this code. test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 does change the pytest proxies, which now refuse attribute assignment, so I'm re-running every twin on PG18 and will post if anything moves. A scan of this branch's twins finds no assignment to pgc_conn or a cursor.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at d0febce. Compared with 416cf02, the head I approved, file by file: the changed lines are the same, apart from the count files (check_ledger_budget.txt, expected_tests.txt) and, in #1378/#1379/#1380/#1383, the TESTS.md section number, now 115.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 1f7b5da (#1411, #1412, #1417, #1418). The new head is 8aa85df. Only the count files changed, plus TESTS.md section numbers where main took 115, so please re-approve this head.

• Ledger: 2984 rows, 2278 never, 706 dated, read back from the tsv, with suites_not_covered 231.
• Collection: cluster_tests 573, guard_tests 435.
• Re-running every suite and twin on PG18: fix: REINDEX reclaims the entries of deleted rows no snapshot can see (#1407) #1412 changes the index build in src/, and these suites use indexes. I'll post the results here; CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 8aa85df, the rebase onto 1f7b5da. File by file, the changed lines are the same as the head I approved before, apart from the count files and, in #1378/#1379/#1380/#1383, the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

The PG18 re-run on this head (8aa85df, on 1f7b5da with #1412's index-build change) is all green:

• docs_style: passed
• harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• pytest: 43 passed in 2.30s

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 37ea557 (#1414, #1425). The new head is 6e50c49. Only the count files changed, so please re-approve this head.

• Ledger: 2998 rows, 2281 never, 717 dated, read back from the tsv.
• Collection: cluster_tests 578, guard_tests 435.
• Runs: test: the settings reference is held to the server (#1341 items 42, 57, 83) #1414 and test: megabyte-scale values are stored exactly (#1341) #1425 change no src/, so the PG18 re-run posted above, on 1f7b5da, still covers this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto f2bd5f1 (#1427). The new head is bb6b091. Only the count files changed, so please re-approve this head.

• Ledger: 3007 rows, 2282 never, 725 dated, read back from the tsv.
• Collection: cluster_tests 579, guard_tests 435.
• Runs: test: tables that skip WAL at wal_level=minimal survive a crash (#1341) #1427 changes no src/, so the PG18 re-run posted above still covers this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 2d1a77f (#1413–#1424). The new head is 3671017, so please re-approve this head.

• Ledger: 3111 rows, 2344 never, 767 dated, read back from the tsv.
• Collection: cluster_tests 590, guard_tests 435, both confirmed by collection.
• Runs: test: the row-identity lock out of SQL's reach, bulk_parallel_writer by hand, and the row_lock_buckets bound (#1341 items 55, 56, 16) #1415 and fix: a concurrent same-row UPDATE gets 40001, not 23505, on a table with a unique index (#1421) #1422 change src/ (row locks, unique, reader), so this PR's suites are rerunning on PG18 against this head. I'll post the results here.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 3671017, the rebase onto 2d1a77f. File by file, the changed lines are the same as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Restated for the chain you asked for. The new head is 3baef6a, so please re-approve this head.

• Place in the chain: This PR is stacked on test: objstore_allowlist gets its pytest twin, and its admin-override arm can now fail; seeds the ledger (#1341) #1379 and has to merge after it. Until test: objstore_allowlist gets its pytest twin, and its admin-override arm can now fail; seeds the ledger (#1341) #1379 lands, GitHub's diff here also shows the commits below it. This PR's own are the top 1. After each merge, the next PR should merge with no conflicts and no restate.
• Ledger: 3176 rows, 2371 never, 805 dated, cumulative through this PR, read back from the tsv.
• Collection: cluster_tests 596, guard_tests 438, both confirmed by collection.
• Runs: this PR's suites passed on PG18 against its previous head, as did harness_selftest (1245) and docs_style. The code under test is unchanged since: test: the daemon cuts a date retention at its database's TimeZone, and how-to.md now says so (#1341) #1393 changes no src/.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 3baef6a, its place in the chain on 17420be. This PR's own commits, measured from the link below it, change the same lines as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code