[OffgridwithJD]

Fixes #1386. entry_point_privilege split the relation-taking functions into catalog-governed and "claimed-guarded", and claimed-guarded was simply everything else. A new relation-taking function with no privilege check of any kind landed there and the suite stayed green (zz_mutant_leak(regclass): 31/31, both twins).

The change, in both twins

• Every claimed-guarded function names the suite whose arms call it as a caller its bar should stop. For example vacuum, vacuum_lock_privilege; expire, ttl_expire; the file functions, import_export_privilege. Three arms:
  • every such function has an entry;
  • each named suite exists and actually calls pgcolumnar.<fn>(;
  • no entry names a function that isn't relation-taking (a stale entry).
• Four functions had no such arm anywhere and now get one here, behaviourally: cluster_hilbert, recluster_hilbert (they share cluster's owner check in code, which is a reason to expect a refusal, not an assertion of one), truncate, and require_caller_select. Each is an owner call that must succeed, then a login role holding EXECUTE is refused 42501.
• Two need no bar, listed with the reason: partition_drop_candidates and partition_drop_plan return what pg_inherits and the bounds already tell any role, and the plan's statements run as their caller.
• The pytest map names pytest files. It reads them as data, never a shell file. A suite with no twin yet (maintenance_due) is named as such, so it's still accounted for.

Evidence

Run on this branch merged with #1381 (see "Merge order"):

run	shell	pytest
clean, each of PG15–19	42/42	passed
zz_mutant_leak(regclass) added (the #1386 case)	every claimed-guarded entry point names the suite…: got [ zz_mutant_leak]	red, by name
truncate without its owner check	truncate refuses an unprivileged caller with 42501: got [noerror]	red
require_caller_select checks nothing	its 42501 arm: got [noerror]	red
cluster_verb_validate without its owner check	both Hilbert 42501 arms	red

Merge order

After #1381. The pytest map names test_vacuum_lock_privilege.py for the maintenance verbs, and that twin arrives with #1381; on main alone, the pytest half reports it missing. Both are approved. tier_partition and partition_create_ahead already map to suites that call them. Their refused-caller arms specifically arrive with #1392, also approved.

Bookkeeping

• Ledger: 11 new rows, 5 dated: rows 2584 + 11 = 2595, never 1992, dated 603. Ceiling 240. The gate is clean against origin/main.
• No tests are added (the new checks live in existing tests), so cluster_tests and guard_tests don't move. The guard set is 433/433, and the TESTS.md row is updated.

🤖 Generated with Claude Code

[jdatcmd]

Reproduced the shell half at cbe9b52 on PG18. entry_point_privilege is 42/42.

• The #1386 case: a zz_mutant_leak(r regclass) appended to the install script gives 41 + 1: every claimed-guarded entry point names the suite that asserts its bar (#1386): got [ zz_mutant_leak] want [none].
• truncate without its owner check: 41 + 1, truncate refuses an unprivileged caller with 42501: got [noerror] want [42501].

The map points at a call in both twins, as discussed on #1386, and the stale-entry arm covers the other direction. I didn't run the pytest half, since it needs #1381's twin. Approving. I'll merge it after #1381, as your merge-order note says, once it's restated and green.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 57f6e0e (#1401), on top of #1403. The new head is b18ad82. Only the count files changed, so this needs your re-approval.

• Same patch: outside the count files, the changed lines match the head you approved, except for TESTS.md section renumbers where main's new sections took the old numbers.
• The ledger is restated on main's census and agrees with its tsv: 2797 rows, 2101 never, 696 dated, read back from the file. Each changed paragraph's arithmetic starts from main's last numbers.
• cluster_tests 566, by collection over the cluster files on this tree. guard_tests 433 is unchanged.
• Runs on the rebased tree at 217f23b, PG17 and PG18: PG17 entry_point_privilege: 42 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG17 pytest: 1 passed in 1.27s; PG18 entry_point_privilege: 42 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped; PG18 pytest: 1 passed in 1.22s. harness_selftest 1245/1245 and docs_style passed on both. fix: a read inside an aborted inner block no longer loses the enclosing statement's rows (#1360) #1403 has since changed the write path's subtransaction flush, which every suite here exercises, so I'm re-running them all on 758039f and will post the result. CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[OffgridwithJD]

Re-run finished on the tree after #1403 (758039f or later). Everything is green, so the head above stands:

• PG17 docs_style: passed
• PG17 entry_point_privilege: 42 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG17 pytest: 1 passed in 1.35s
• PG18 docs_style: passed
• PG18 entry_point_privilege: 42 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• PG18 pytest: 1 passed in 1.46s

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 7da848d (#1432, #1409). The new head is c567973; only the count files changed, so please re-approve this head.

• Ledger, restated on main's census and read back from the tsv: 2884 rows, 2185 never, 699 dated, suites_not_covered 232. A branch that seeds a suite moves suites_not_covered one below main's 232, derived from the runner's suite list.
• Counts by collection: cluster_tests 567, guard_tests 435.
• What the earlier runs still cover: test: the Iceberg REST readers' server-file gate, and no borrowed environment token (#1341 items 8, 9, 14, 52) #1409 and test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 change no src/, so the PG17 and PG18 runs posted above still describe this code. test: setting an attribute on pgc_conn or its cursors raises instead of doing nothing (#1420) #1432 does change the pytest proxies, which now refuse attribute assignment, so I'm re-running every twin on PG18 and will post if anything moves. A scan of this branch's twins finds no assignment to pgc_conn or a cursor.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at c567973. Compared with cbe9b52, the head I approved, file by file: the changed lines are the same, apart from the count files (check_ledger_budget.txt, expected_tests.txt) and, in #1378/#1379/#1380/#1383, the TESTS.md section number, now 115.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 1f7b5da (#1411, #1412, #1417, #1418). The new head is ee1c4bf. Only the count files changed, plus TESTS.md section numbers where main took 115, so please re-approve this head.

• Ledger: 2995 rows, 2284 never, 711 dated, read back from the tsv, with suites_not_covered 231.
• Collection: cluster_tests 570, guard_tests 435.
• Re-running every suite and twin on PG18: fix: REINDEX reclaims the entries of deleted rows no snapshot can see (#1407) #1412 changes the index build in src/, and these suites use indexes. I'll post the results here; CI runs PG17 and PG18 on this head.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at ee1c4bf, the rebase onto 1f7b5da. File by file, the changed lines are the same as the head I approved before, apart from the count files and, in #1378/#1379/#1380/#1383, the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

The PG18 re-run on this head (ee1c4bf, on 1f7b5da with #1412's index-build change) is all green:

• docs_style: passed
• entry_point_privilege: 42 passed + 0 failed + 0 unrunnable + 0 skipped
• harness_selftest: 1245 passed + 0 failed + 0 unrunnable + 0 skipped
• pytest: 1 passed in 0.78s

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 37ea557 (#1414, #1425). The new head is ef2d21c. Only the count files changed, so please re-approve this head.

• Ledger: 3009 rows, 2287 never, 722 dated, read back from the tsv.
• Collection: cluster_tests 575, guard_tests 435.
• Runs: test: the settings reference is held to the server (#1341 items 42, 57, 83) #1414 and test: megabyte-scale values are stored exactly (#1341) #1425 change no src/, so the PG18 re-run posted above, on 1f7b5da, still covers this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto f2bd5f1 (#1427). The new head is c44dac1. Only the count files changed, so please re-approve this head.

• Ledger: 3018 rows, 2288 never, 730 dated, read back from the tsv.
• Collection: cluster_tests 576, guard_tests 435.
• Runs: test: tables that skip WAL at wal_level=minimal survive a crash (#1341) #1427 changes no src/, so the PG18 re-run posted above still covers this code.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at c44dac1, the rebase onto f2bd5f1. File by file, the changed lines are the same as the head I approved before, apart from the count files and, in #1378/#1379/#1380/#1383, the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto d5c0a5e (#1391). The new head is 905b2b1, so please re-approve this head.

• Ledger: 3019 rows, 2288 never, 731 dated, read back from the tsv.
• Collection: cluster_tests 577, guard_tests 435.
• Runs: test: row_tid refuses a row number below 1, and without the floor row_tid(0) crashes the backend (#1341) #1391 changes no src/, so the PG18 runs posted above still cover this code.

🤖 Generated with Claude Code

[OffgridwithJD]

Rebased onto 2d1a77f (#1413–#1424). The new head is e5b2d63, so please re-approve this head.

• Ledger: 3122 rows, 2350 never, 772 dated, read back from the tsv.
• Collection: cluster_tests 587, guard_tests 435, both confirmed by collection.
• Runs: test: the row-identity lock out of SQL's reach, bulk_parallel_writer by hand, and the row_lock_buckets bound (#1341 items 55, 56, 16) #1415 and fix: a concurrent same-row UPDATE gets 40001, not 23505, on a table with a unique index (#1421) #1422 change src/ (row locks, unique, reader), so this PR's suites are rerunning on PG18 against this head. I'll post the results here.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at e5b2d63, the rebase onto 2d1a77f. File by file, the changed lines are the same as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Restated for the chain you asked for. The new head is 20cfe03, so please re-approve this head.

• Place in the chain: This PR is stacked on test: set_options refuses an unknown compression name and keeps the stored one; encode_effort seeds the ledger (#1341) #1371 and has to merge after it. Until test: set_options refuses an unknown compression name and keeps the stored one; encode_effort seeds the ledger (#1341) #1371 lands, GitHub's diff here also shows the commits below it. This PR's own are the top 2. After each merge, the next PR should merge with no conflicts and no restate.
• Ledger: 3347 rows, 2532 never, 815 dated, cumulative through this PR, read back from the tsv.
• Collection: cluster_tests 598, guard_tests 438, both confirmed by collection.
• Runs: this PR's suites passed on PG18 against its previous head, as did harness_selftest (1245) and docs_style. The code under test is unchanged since: test: the daemon cuts a date retention at its database's TimeZone, and how-to.md now says so (#1341) #1393 changes no src/.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at 20cfe03, its place in the chain on 17420be. This PR's own commits, measured from the link below it, change the same lines as the head I approved before, apart from the count files and the TESTS.md section number.

🤖 Generated with Claude Code

[OffgridwithJD]

Restacked onto #1375's fix (875429d, its projections row renamed). The new head is ab57d12, so please re-approve this head. This PR's own commits are unchanged, and nothing in its diff moved.

🤖 Generated with Claude Code

[jdatcmd]

Re-approved at ab57d12. This PR's own commits are the same as the head I approved, rebased onto the fixed #1375.

🤖 Generated with Claude Code