[OffgridwithJD]

Part of #1341, the object-store twin-parity item: objstore_allowlist.sh had no pytest twin. Writing the twin turned up a vacuous arm in the shell suite, which is fixed here in both twins.

The vacuous arm

"a superuser session SET works (admin override)" ran while the configured list was still other.example, 127.0.0.1. So the read succeeded whatever the session SET did, and the arm couldn't fail. Both twins now clear the configured list first, so only the session's SET can admit the read.

The setting defined PGC_SIGHUP (no session may SET it), PG17, main 4027b8d against this branch:

	main	this branch
shell	15 + 1 failed: the admin-override arm passed	14 + 2 failed: "a superuser session SET works (admin override): not a measurement… got []"
pytest twin	none	red at the first affected check, "a non-superuser cannot widen the list (42501): got '55P02'"

The twin (test_objstore_allowlist.py)

One test, all 16 shell checks by name, added to COMPLETE:

• How the list is changed: the operator's way, ALTER SYSTEM and a reload, reset in a finally, because the cluster is shared.
• The fixture server is the file's own: a Range-capable http.server in a thread, serving one Parquet file from server_dir. The shell's server is a script under test/, and the two harnesses don't call each other.
• Its premise is a real HEAD to that server.
• pyarrow: taken through expect.require_module.

Twin proof: an empty list that admits every endpoint reddens the two default-deny arms in the shell, on main and here, and the twin at "default: an http read is refused 42501: got ''".

Evidence

• Clean: objstore_allowlist 16/16 and the twin passed on each of PG 15–19.
• Ledger: objstore_allowlist had no rows, so it is seeded with all 16, four dated by the two mutations. 2361 → 2377 rows, the census 1801 → 1813, and suites_not_covered 246 → 245.
• Gate: rc=0.
• Counts: TESTS.md section 105, and cluster_tests 534 → 535. test: parallel_copy and parallel_export_parquet refuse a table the caller holds no grant on; import_export_privilege gets its twin and its ledger (#1341) #1362 and test: objstore_userinfo gets its pytest twin, every check by the shell's name (#1341) #1378 take section 105 too, so whichever lands later renumbers.
• Database-free set: 429 passed.

🤖 Generated with Claude Code

[jdatcmd]

The admin-override fix is right, and I verified it. One premise breaks #1236. Reviewed on PG18 at 323ffab.

The vacuous arm, and its fix. With objstore_allowed_endpoints changed from PGC_SUSET to PGC_SIGHUP (src/columnar_tableam.c:4329), main's shell fails only one check:
FAIL a non-superuser cannot widen the list (42501): got [55P02] want [42501]
The admin-override arm passed with the superuser's SET refused. On this PR it fails too:
FAIL a superuser session SET works (admin override): not a measurement, so nothing was compared: got [] want [1000]

The allow-list itself: with if (!ok) disabled (objstore/columnar_objstore_module.c:328), the shell fails 4. Among them:
FAIL default: an http read is refused 42501: got [] want [42501]
The twin also fails, and compare_to_bash shows 17 matches, 0 missing.

What to change:

1. "premise: the list defaults to empty" goes red when the GUC default changes (src/columnar_tableam.c:4328, "" → "127.0.0.1"):
   FAIL premise: the list defaults to empty: got [127.0.0.1] want []
   Drop the prefix in both twins and date the row with that mutation. The name came from main, but this PR seeds it.
2. Optional: the if (!ok) mutation also reddens "unlisted host" and "host:port entry, wrong port", which you seed as never. You could date them.
3. Rebase: TESTS.md §105, expected_tests.txt and the budget conflict.

One environment note: /root/pyenv here has no pyarrow, so the twin declines and reports "1 passed" with 0 checks. That's correct behaviour, but a green run without pyarrow proves nothing. My pytest results above used the system pyarrow.

[OffgridwithJD]

Both points in, plus your optional one: now 9f32f89, rebased on main.

1. "the list defaults to empty" is a check now, in both twins, renamed in the ledger with its history. With the default changed to 127.0.0.1, both twins are red (got [set: [127.0.0.1]] want [empty]), and it's dated by it. The shell compared against an empty string, so a query that never ran also passed. Now the query itself produces empty, or set: […] otherwise.
2. Optional, taken: with the allow-list check disabled (if (false && !ok)), "unlisted host" and "host:port entry, wrong port" are red too, and both are dated, alongside the two default arms.
3. Rebased: TESTS.md §109, cluster_tests 549 → 550; the seed is restated, giving 2529 rows, never 1937, ceiling 242 → 241. The gate is clean, and the guard set is 433/433.

Runs: 16/16 and the twin passing (with PGC_REQUIRE=pyarrow) on each of 15–19. Main hasn't changed the suite since the base.

On your environment note: agreed. A twin that declines without pyarrow proves nothing, so all my runs set PGC_REQUIRE=pyarrow, which turns a decline into a failure.

🤖 Generated with Claude Code

[jdatcmd]

Reproduced at 9f32f89 on PG18. objstore_allowlist is 16/16. With the GUC default changed to 127.0.0.1, it's 13 + 3: the list defaults to empty: got [set: [127.0.0.1]] want [empty], plus the two default arms that depend on it. The check now produces empty positively, so a dead session can't pass it. Approving. I'll merge once CI is green, after checking the approval is on this head.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 57f6e0e (#1401), on top of #1403. The new head is 02ad067. Only the count files changed, so this needs your re-approval.

• Same patch: outside the count files, the changed lines match the head you approved, except for TESTS.md section renumbers where main's new sections took the old numbers.
• The ledger is restated on main's census and agrees with its tsv: 2802 rows, 2104 never, 698 dated, read back from the file. Each changed paragraph's arithmetic starts from main's last numbers.
• cluster_tests 567, by collection over the cluster files on this tree. guard_tests 433 is unchanged.
• Runs on the rebased tree at 217f23b, PG17 and PG18: PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 objstore_allowlist: 16 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 pytest: 41 passed in 9.60s; PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 objstore_allowlist: 16 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 pytest: 41 passed in 9.11s. harness_selftest 1245/1245 and docs_style passed on both. fix: a read inside an aborted inner block no longer loses the enclosing statement's rows (#1360) #1403 has since changed the write path's subtransaction flush, which every suite here exercises, so I'm re-running them all on 758039f and will post the result. CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[OffgridwithJD]

Re-run finished on the tree after #1403 (758039f or later). Everything is green, so the head above stands:

• PG17 docs_style: passed
• PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 objstore_allowlist: 16 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 pytest: 42 passed in 8.31s
• PG17 vacuum_lock_privilege: 19 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 docs_style: passed
• PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 objstore_allowlist: 16 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 pytest: 42 passed in 8.33s
• PG18 vacuum_lock_privilege: 19 passed + 0 failed + 0 unrunnable + 0 skipped

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 7da848d (#1432, #1409). The new head is 72b5f34; only the count files changed, so please re-approve this head.

• Ledger, restated on main's census and read back from the tsv: 2889 rows, 2188 never, 701 dated, suites_not_covered 231. A branch that seeds a suite moves suites_not_covered one below main's 232, derived from the runner's suite list.
• Counts by collection: cluster_tests 568, guard_tests 435.
• What the earlier runs still cover: test: the Iceberg REST readers' server-file gate, and no borrowed environment token (#1341 items 8, 9, 14, 52) #1409 and test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 change no src/, so the PG17 and PG18 runs posted above still describe this code. test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 does change the pytest proxies, which now refuse attribute assignment, so I'm re-running every twin on PG18 and will post if anything moves. A scan of this branch's twins finds no assignment to pgc_conn or a cursor.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 72b5f34. Compared with 9f32f89, the head I approved, file by file: the changed lines are the same, apart from the count files (check_ledger_budget.txt, expected_tests.txt) and, in #1378/#1379/#1380/#1383, the TESTS.md section number, now 115.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 2d1a77f (#1413–#1424). The new head is ea3278f, so please re-approve this head.

• Ledger: 3127 rows, 2353 never, 774 dated, read back from the tsv.
• Collection: cluster_tests 588, guard_tests 435, both confirmed by collection.
• Runs: test: the row-identity lock out of SQL's reach, bulk_parallel_writer by hand, and the row_lock_buckets bound (#1341 items 55, 56, 16) #1415 and fix: a concurrent same-row UPDATE gets 40001, not 23505, on a table with a unique index (#1421) #1422 change src/ (row locks, unique, reader), so this PR's suites are rerunning on PG18 against this head. I'll post the results here.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at ea3278f, the rebase onto 2d1a77f. File by file, the changed lines are the same as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Restated for the chain you asked for. The new head is b0303e6, so please re-approve this head.

• Place in the chain: This PR is stacked on test: objstore_crlf gets its pytest twin, every check by the shell's name; seeds the ledger (#1341) #1380 and has to merge after it. Until test: objstore_crlf gets its pytest twin, every check by the shell's name; seeds the ledger (#1341) #1380 lands, GitHub's diff here also shows the commits below it. This PR's own are the top 5. After each merge, the next PR should merge with no conflicts and no restate.
• Ledger: 3176 rows, 2371 never, 805 dated, cumulative through this PR, read back from the tsv.
• Collection: cluster_tests 593, guard_tests 438, both confirmed by collection.
• Runs: this PR's suites passed on PG18 against its previous head, as did harness_selftest (1245) and docs_style. The code under test is unchanged since: test: the daemon cuts a date retention at its database's TimeZone, and how-to.md now says so (#1341) #1393 changes no src/.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at b0303e6, its place in the chain on 17420be. This PR's own commits, measured from the link below it, change the same lines as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code