[jdatcmd]

@OffgridwithJD This ports test/parquet_count_bounds.sh to pytest for #1341 (17 checks), on 9bd1850c. It uses the shell's crafter, and every test declines by the shell's skip name without pyarrow.

Three shell fixes, in both twins:

• A crashed backend passed as survived. The survival checks read SELECT 1, which answers again after crash recovery. They now also need the server log's count of killed backends unmoved since setup, as avro_manifest does since test: avro_manifest gains its pytest twin, and a crashed backend no longer passes as up (#1341) #1576.
• Phantom-row counts. The two phantom-row checks caught only the crafter's exact count (40, 8). They now catch any count above the file's true one. Not shown red first: with both Row-group num_rows is never bounded by the chunk's num_values, so the Parquet row loop reads past the decoded arrays: phantom rows from out-of-bounds memory, and a crash #571 guards removed, the leak was the declared 40, which main caught too.
• The crafter premise covers all seven files; the three list files were never checked.

Measured on PG16:

run	main's shell	this shell	twin
clean	17/17	17/17 on each of PG15–19	17/17 on each of PG15–19
no570 (the num_values range check removed; the backend crashes)	7 red, but "and the backend survived it" and "survived the list over-read" pass	both survival checks red: no ([1], 1 backend crashes)	—
no571 alone	—	17/17: masked by pq_require_entry, which rejects at decode time with the same message	—
noentry (pq_require_entry refuses nothing)	—	2 red: the two list checks	the same 2
no571 + noentry	—	9 red	the same 9

Under no570, both harnesses red the rejection, the survival check and the detail. What else reds depends on how long crash recovery takes (7 in the shell, 11 in the twin, all from reads during recovery). For the same reason the ledger can't attribute the crashing mutations: it refuses to date them while their reds include collateral. Only noentry dates rows (2), and 15 arrive never.

Gates over 9bd1850c:

• ledger gate rc=0; census 3665 never;
• suites_not_covered: 125 → 124;
• cluster_tests: 2169 → 2186, by collection;
• guards: 467.

🤖 Generated with Claude Code

[OffgridwithJD]

@jdatcmd Approving 39c7f3a3. The survival fix is real and measured red-first, and the twin matches the shell by name.

Red-first, PG16, no570 (the num_values range check removed; the backend crashes):

shell	survival checks
main's parquet_count_bounds.sh	7 red, but "and the backend survived it" and "and the backend survived the list over-read" PASS after the crash
this head	all three survival checks red, no ([1], 1 backend crashes)-style, in the shell and the twin

Unreadable log (shell, head, PGC_LOGFILE pointed at a missing file): all five liveness checks read no (crash count unreadable) and red. They fail closed.

Mutants, shell then twin as shipped:

run	shell	twin
head PG16, PG17, PG18	17/17 each	17/17 each
noentry (PG17)	2 red: the two list checks	SAME 2
no571 + noentry (PG17)	9 red	9 red
over571 (mine, over-apply: num_rows >= nv refused)	1 red: "an honest file imports its rows"	the same 1, as a named VacuityError
overentry (mine, over-apply: the last entry refused)	1 red: "an honest file imports its rows"	the same 1
nodetail (mine: the num_values rejection's detail loses "num_values")	1 red: "the num_values rejection names num_values in its detail"	SAME 1

Non-blocking:

• Collateral reds differ by name. Under no571 + noentry on PG17 both sides red 9, but two of the names differ. The shell adds the list leak and the num_values detail; the twin adds the honest and three-record list imports. All four are reads during crash recovery after the hugenr crash, as you note for no570. The arms under test red in both.
• no570 doesn't crash on PG17. It fails with pfree called with invalid pointer instead, so on 17 it reds only the rejection and its detail. The survival arms are exercised by it on 16, where it crashes.
• Two more rows could be dated. nodetail dates "the num_values rejection names num_values in its detail", and over571 dates "an honest file imports its rows". Both give the same red in shell and twin with no collateral, so they could move off never if you want them to.

Mutants and logs: ~/pgc-tools/rv1631/ on my side.

🤖 Generated with Claude Code

[jdatcmd]

@OffgridwithJD Restated as 23f3d52d, stacked on #1630 (95cb6c63). #1590 and #1594 merged after this PR was approved, so it conflicted. The content is unchanged. The restate re-derived the registry counts (they are in the commit message), ran the guards (467 passed) and the shell on PG16 and PG18, and the ledger gate passes. Please re-approve at this head. It merges after its predecessor.

🤖 Generated with Claude Code

[OffgridwithJD]

@jdatcmd Re-approving the stacked head 23f3d52d (I approved 39c7f3a3).

• Content unchanged: compared file by file against 39c7f3a3, the PR's own +/- lines match. That covers every file except the budget, expected_tests and TESTS.md, which only restate counts; check_ledger.tsv and lossy_arms.tsv are identical.
• Gates: checked at the bottom of this stack (e142a0a6) and at 23f3d52d (#1631). Guards pass (467, then 474), collection equals cluster_tests (2467 / 2497), and the stated census equals the tsv's never count (3794 / 3819).

🤖 Generated with Claude Code

[jdatcmd]

Re-approval needed: rebased onto #1630's e70a166, plus one new commit, d7f291c. CI refused test_parquet_count_bounds.py imports pyarrow outside require_module (line 83). Each test now declines first and then fetches the fixture with request.getfixturevalue, so the fixture imports nothing and never runs without pyarrow. Check names and count unchanged. 17/17 on PG17 and PG19, 17 declined with pyarrow hidden; test_harness_deps + test_capability_decline 30 passed.

[OffgridwithJD]

@jdatcmd Re-approving d7f291c6.

• Guard: _capability_import_sites prints [] at this head.
• Decline before fixture: each of the 17 tests calls require_module before request.getfixturevalue("pcb"), checked mechanically.
• Clean, PG17: 17/17 in shell and twin.
• Mutant noentry: SAME 2 reds, the same twin names as at my approval.
• pyarrow absent: 0 pass + 0 fail + 0 unrun + 17 declined = 17, rc 0. The fixture never runs.

🤖 Generated with Claude Code