[OffgridwithJD]

#1341, the twin-less suites: native_dict_underfill.sh had no pytest twin. This PR adds one, every check by the shell's name, seeds the suite into the ledger, and tightens the shell's two arms, which accepted more than a clean refusal.

Stacked on #1454, at the top of my chain. This branch is #1454's head plus two commits.

What changes

• test/pytest/test_native_dict_underfill.py, the twin: one test in a private schema. It turns the post-codec encoding choice (opt: every encoder but FSST decides on pre-codec size, costing 7.17% of stored bytes on real data #1132) off for its own session, where the shell sets it for its database, so the change can't reach other tests. compare_to_bash.py grades it as covering all 4 names, and it joins COMPLETE.
• The survival arm accepted a crash. It was a fresh SELECT 1, which a crashed backend passes once crash recovery has finished, and the suite computed a crash flag it never checked. It now counts "terminated by signal" in the server log. This is the same fix as test: corruption gets its pytest twin, and a backend crash can no longer pass for a refusal (#1341 item 25) #1446's corruption suite.
• The rejection arm matched does not match|corrupt|invalid|out of in any message. "out of memory" satisfies that too. It now requires XX001, read with VERBOSITY verbose.
• A premise: the descriptor inflation rewrote exactly one chunk.
• Ledger: native_dict_underfill is seeded with 4 rows from five-major runs, and 2 of the 4 rows dated. suites_not_covered goes 216 → 215, and the census is 3687 + 4 = 3691 rows, 2703 + 2 = 2705 never and 984 + 2 = 986 dated, matching the tsv. The gate gives rc=0 against origin/main.

Red first

Each mutation of the DICT fill check (columnar_encoding.c:1424) was run on PG18, through both twins, with the .so md5 printed every time.

mutation	native_dict_underfill.sh	test_native_dict_underfill.py	the arms that went red
none (the head)	4/4	4/4	none
the check removed	3/4	fails	rejection: no error at all. The garbage tail is read back silently.
the refusal replaced by abort()	2/4	fails	rejection: no SQLSTATE (server closed the connection unexpectedly); survival: 1 backend crashes

Before this PR, the abort mutant was caught by the survival arm only because SELECT 1 reached the server before recovery finished.

Never red (2): the two premises.

Runs

major	native_dict_underfill.sh	test_native_dict_underfill.py
15	4/4	4/4
16	4/4	4/4
17	4/4	4/4
18	4/4	4/4
19	4/4	4/4

Also measured: the guard half (438 tests), harness_selftest 1245/1245 and docs_style. cluster_tests goes 673 → 674 by collection, and TESTS.md gets §147.

🤖 Generated with Claude Code

[jdatcmd]

Approving ec9d941.

Measured on PG17: native_dict_underfill.sh 4/4, and test_native_dict_underfill.py 4 checks. The tsv at this head is 3691 / 2705 / 986, matching its budget.

The abort mutant, run myself: DECODE_CORRUPT("DICT output length does not match raw length") → abort().

• shell 2/4: under-filled DICT chunk is rejected with a clean error, got [no SQLSTATE (server closed the connection unexpectedly)] want [XX001]; and backend survives the under-filled DICT chunk, got [|1 backend crashes].
• pytest: the rejection arm, with the same no SQLSTATE (…). Its "1 error" is teardown losing the connection to the crashed server.

So neither a crash nor an "out of memory" can pass for the refusal any more.

[jdatcmd]

Re-approving 2548d98, the restate onto main db56168. I compared every commit's patch with the approved stack using git range-diff. The test and source commits are unchanged, and the ledger-seed commits changed only by re-anchoring on #1470. The census at this head matches its budget paragraph, and the counts step consistently. At #1467's head: the guards pass (438), 687 collected (matching the file), and harness_selftest is 1245/1245.