[OffgridwithJD]

Part of #1341. tier_partition and partition_create_ahead aren't SECURITY DEFINER, so every statement they run executes as the caller, and core's privilege checks are what stop a role that doesn't own the table. Nothing tested that. Made SECURITY DEFINER, either would run as the extension's owner. Any caller could then replace a partition with a Parquet file, or add partitions (and their ACCESS EXCLUSIVE locks) to a table it doesn't own.

The arms, in both twins

Two non-superuser roles. Each holds every other privilege the call needs, so ownership is all that separates them. For tier_partition that means the server-file role, USAGE on the server, CREATE on the schema, and SELECT on the partition.

suite	arm
tier_partition	a non-owner is refused 42501; the partition stays local and attached, every row once; no foreign table is left behind; no export file is written
partition_lifecycle	a non-owner is refused 42501 and creates nothing
both	a non-superuser owner does it, on a table of its own

No export file. The first statement that needs more than SELECT is LOCK ... IN SHARE MODE, ahead of the export. So the refusal comes before any file is written: absent on all five majors. Under the mutant the file is written, so this is an arm, not a note.

Owner controls on tables of their own. In the first run they sat on the same table as the attack. Under the mutant the peer had already tiered or created the partitions, so the controls failed for the peer's reason. They now use pw and pw2, and stay green under both mutants.

Evidence

Clean, both twins: tier_partition 79/79 (80/80 on 18–19, which add the virtual-column arm), partition_lifecycle 64/64, and pytest 7 passed, on each of PG15–19.

Mutants (PG17), the install script appending ALTER FUNCTION ... SECURITY DEFINER:

mutant	shell	pytest
tier_partition SECURITY DEFINER	4 red: refused (got [ok]), left local, no foreign table, no file (got [written])	red, by name
partition_create_ahead SECURITY DEFINER	1 red: `got [3	3] want [42501

The owner controls stay green under both.

Not included: the drop-plan statements

partition_drop_plan's statements are plain DDL that the caller runs, and the function only returns text. A non-owner check on them would test core, and no repository change could turn it red, so it would be a premise. I'll note that on #1341 instead.

Bookkeeping

• Ledger: 11 rows in suites that are already covered; 5 dated, 6 never. 2460 + 11 = 2471; never 1899; dated 572. Ceiling 244. The gate is clean against origin/main.
• cluster_tests 539 → 541 (collection +2 against main). guard_tests is 429/429. Two TESTS.md rows are added.

🤖 Generated with Claude Code

[jdatcmd]

Reproduced at 3575694 on PG18. The install script got ALTER FUNCTION ... SECURITY DEFINER appended, as in your mutants.

run	shell	pytest (both files)
this PR	tier_partition 80/80, partition_lifecycle 64/64	7 passed
tier_partition SECURITY DEFINER	76 + 4 failed: refused got [ok], left local, foreign table got [1], export got [written]	1 failed, by name: got 'ok' want '42501'
partition_create_ahead SECURITY DEFINER	63 + 1 failed: `got [3	3] want [42501

The owner controls stay green under both mutants. Putting them on tables of their own was the right call.

One thing I checked and couldn't make fail. "premise: tier_peer can open a session and read the partition" reads a columnar partition as a non-owner. I suspected a reader change could turn it red, so I made pgcolumnar_scan_begin refuse every non-owner who isn't a superuser. The suite stayed 80/80: count(*) doesn't go through that path. So I have no evidence against the premise, and I'm not asking for a change.

Approving. It needs a rebase onto main (f4a7591: ledger 2464 / 1895 / 569, cluster_tests 541). After that, and with CI green, I'll check the patch against 3575694 and merge.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 57f6e0e (#1401), on top of #1403. The new head is 4681f69. Only the count files changed, so this needs your re-approval.

• Same patch: outside the count files, the changed lines match the head you approved, except for TESTS.md section renumbers where main's new sections took the old numbers.
• The ledger is restated on main's census and agrees with its tsv: 2797 rows, 2101 never, 696 dated, read back from the file. Each changed paragraph's arithmetic starts from main's last numbers.
• cluster_tests 568, by collection over the cluster files on this tree. guard_tests 433 is unchanged.
• Runs on the rebased tree at 217f23b, PG17 and PG18: PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 partition_lifecycle: 64 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 pytest: 7 passed in 16.20s; PG17 tier_partition: 79 passed + 0 failed + 0 unrunnable + 1 skipped; PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 partition_lifecycle: 64 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 pytest: 7 passed in 16.45s; PG18 tier_partition: 80 passed + 0 failed + 0 unrunnable + 0 skipped. harness_selftest 1245/1245 and docs_style passed on both. fix: a read inside an aborted inner block no longer loses the enclosing statement's rows (#1360) #1403 has since changed the write path's subtransaction flush, which every suite here exercises, so I'm re-running them all on 758039f and will post the result. CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[OffgridwithJD]

Re-run finished on the tree after #1403 (758039f or later). Everything is green, so the head above stands:

• PG17 docs_style: passed
• PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 partition_lifecycle: 64 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 pytest: 7 passed in 15.46s
• PG17 tier_partition: 79 passed + 0 failed + 0 unrunnable + 1 skipped
• PG18 docs_style: passed
• PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 partition_lifecycle: 64 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 pytest: 7 passed in 15.49s
• PG18 tier_partition: 80 passed + 0 failed + 0 unrunnable + 0 skipped

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 7da848d (#1432, #1409). The new head is 0cf5dd8; only the count files changed, so please re-approve this head.

• Ledger, restated on main's census and read back from the tsv: 2884 rows, 2185 never, 699 dated, suites_not_covered 232. A branch that seeds a suite moves suites_not_covered one below main's 232, derived from the runner's suite list.
• Counts by collection: cluster_tests 569, guard_tests 435.
• What the earlier runs still cover: test: the Iceberg REST readers' server-file gate, and no borrowed environment token (#1341 items 8, 9, 14, 52) #1409 and test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 change no src/, so the PG17 and PG18 runs posted above still describe this code. test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 does change the pytest proxies, which now refuse attribute assignment, so I'm re-running every twin on PG18 and will post if anything moves. A scan of this branch's twins finds no assignment to pgc_conn or a cursor.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 0cf5dd8. Compared with 3575694, the head I approved, file by file: the changed lines are the same, apart from the count files (check_ledger_budget.txt, expected_tests.txt) and, in #1378/#1379/#1380/#1383, the TESTS.md section number, now 115.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 1f7b5da (#1411, #1412, #1417, #1418). The new head is a9289dc. Only the count files changed, plus TESTS.md section numbers where main took 115, so please re-approve this head.

• Ledger: 2995 rows, 2284 never, 711 dated, read back from the tsv, with suites_not_covered 231.
• Collection: cluster_tests 572, guard_tests 435.
• Re-running every suite and twin on PG18: fix: REINDEX reclaims the entries of deleted rows no snapshot can see (#1407) #1412 changes the index build in src/, and these suites use indexes. I'll post the results here; CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at a9289dc, the rebase onto 1f7b5da. File by file, the changed lines are the same as the head I approved before, apart from the count files and, in #1378/#1379/#1380/#1383, the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

The PG18 re-run on this head (a9289dc, on 1f7b5da with #1412's index-build change) is all green:

• docs_style: passed
• harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• partition_lifecycle: 64 passed + 0 failed + 0 unrunnable + 0 skipped
• pytest: 7 passed in 15.11s
• tier_partition: 80 passed + 0 failed + 0 unrunnable + 0 skipped

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 37ea557 (#1414, #1425). The new head is a84f2ea. Only the count files changed, so please re-approve this head.

• Ledger: 3009 rows, 2287 never, 722 dated, read back from the tsv.
• Collection: cluster_tests 577, guard_tests 435.
• Runs: test: the settings reference is held to the server (#1341 items 42, 57, 83) #1414 and test: megabyte-scale values are stored exactly (#1341) #1425 change no src/, so the PG18 re-run posted above, on 1f7b5da, still covers this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto f2bd5f1 (#1427). The new head is bb2be70. Only the count files changed, so please re-approve this head.

• Ledger: 3018 rows, 2288 never, 730 dated, read back from the tsv.
• Collection: cluster_tests 578, guard_tests 435.
• Runs: test: tables that skip WAL at wal_level=minimal survive a crash (#1341) #1427 changes no src/, so the PG18 re-run posted above still covers this code.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at bb2be70, the rebase onto f2bd5f1. File by file, the changed lines are the same as the head I approved before, apart from the count files and, in #1378/#1379/#1380/#1383, the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto d5c0a5e (#1391). The new head is 8c50923, so please re-approve this head.

• Ledger: 3019 rows, 2288 never, 731 dated, read back from the tsv.
• Collection: cluster_tests 579, guard_tests 435.
• Runs: test: row_tid refuses a row number below 1, and without the floor row_tid(0) crashes the backend (#1341) #1391 changes no src/, so the PG18 runs posted above still cover this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 2d1a77f (#1413–#1424). The new head is 3af6a68, so please re-approve this head.

• Ledger: 3122 rows, 2350 never, 772 dated, read back from the tsv.
• Collection: cluster_tests 589, guard_tests 435, both confirmed by collection.
• Runs: test: the row-identity lock out of SQL's reach, bulk_parallel_writer by hand, and the row_lock_buckets bound (#1341 items 55, 56, 16) #1415 and fix: a concurrent same-row UPDATE gets 40001, not 23505, on a table with a unique index (#1421) #1422 change src/ (row locks, unique, reader), so this PR's suites are rerunning on PG18 against this head. I'll post the results here.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 3af6a68, the rebase onto 2d1a77f. File by file, the changed lines are the same as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Restated for the chain you asked for. The new head is bfa284c, so please re-approve this head.

• Place in the chain: This PR is stacked on test: recluster recomputes the column extent, in both twins (#1341 item 75) #1410 and has to merge after it. Until test: recluster recomputes the column extent, in both twins (#1341 item 75) #1410 lands, GitHub's diff here also shows the commits below it. This PR's own are the top 3. After each merge, the next PR should merge with no conflicts and no restate.
• Ledger: 3129 rows, 2352 never, 777 dated, cumulative through this PR, read back from the tsv.
• Collection: cluster_tests 590, guard_tests 438, both confirmed by collection.
• Runs: this PR's suites passed on PG18 against its previous head, as did harness_selftest (1245) and docs_style. The code under test is unchanged since: test: the daemon cuts a date retention at its database's TimeZone, and how-to.md now says so (#1341) #1393 changes no src/.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at bfa284c, its place in the chain on 17420be. This PR's own commits, measured from the link below it, change the same lines as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code