test: logical_decoding_cdc_recipe gains its pytest twin, and a rollback that undid nothing no longer passes (#1341)

test/check_ledger_budget.txt

@@ -15,7 +15,7 @@
 #
 #   Adding a check to a suite that is already covered does not move it, which is
 #   what makes it safe to bound.
-suites_not_covered 102
+suites_not_covered 97
 #
 # checks_never_observed_red -- A CENSUS. NOT a ceiling, and it must not become
 #   one.
@@ -5439,4 +5439,101 @@ suites_not_covered 102
 #     never         3883 + 1 = 3884
 #     dated         2282 + 4 = 2286
 #     3884 + 2286 == 6170
-checks_never_observed_red 3884
+# #1341, iceberg_dv seeded, with its twin (OffgridwithJD): 3884 -> 3885, and
+# suites_not_covered 102 -> 101. The suite had no rows. It enters with 26 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after two fixes.
+# "a manifest/footer offset mismatch is refused (XX001)" read the SQLSTATE alone, and
+# several guards here raise XX001: with the offset match removed a later XX001 refused
+# the same file, and main's shell passed 26/26. Every refusal now reads its own guard's
+# message. And the three "backend still up" checks read SELECT 1, which answers again
+# after crash recovery: with the referenced_data_file check removed a backend died on
+# the arm, and main passed the survival check. They now also read the server log's
+# count of killed backends, and each refusal waits for the server first, so a crash
+# reddens its own arm and its section's survival check and nothing else. 25 are dated by
+# seventeen mutations, each reddening the same names in both twins. 1 arrives never:
+# the survival check after the DV applications, which no mutation crashed.
+#
+#     ledger rows   6170 + 26 = 6196
+#     never         3884 + 1 = 3885
+#     dated         2286 + 25 = 2311
+#     3885 + 2311 == 6196
+#
+# #1341, logical_decoding_source seeded, with its twin (OffgridwithJD): 3885 -> 3897,
+# and suites_not_covered 101 -> 100. The suite had no rows. It enters with its 12
+# checks, all green on each of 15-19 in shell and twin alike. The missing-plugin name
+# pgc_skip records is now a literal both twins share, but it is a skip, not a check, so
+# it has no row: CI has test_decoding and never emits it. After one fix.
+# The second slot had no heap control: created after the 5000-row insert, it decoded
+# nothing, and "it too emits no decodable change" and "100x the rows does not give 100x
+# the internal records" (0 < anything) both passed, 11/11 on main. A heap table now writes
+# through that slot in the same window and must decode its 5000 inserts, and the ratio
+# check refuses a slot that carried no internal records. Under that harness mutation both
+# are red in both twins. No source mutation reddens a check: the claim is that pgcolumnar
+# writes nothing logical decoding can read, and a default chunk group of 100 rows still
+# keeps the internal records following groups (114 for 50 groups, under the 10x bound).
+# 0 are dated. 12 arrive never.
+#
+#     ledger rows   6196 + 12 = 6208
+#     never         3885 + 12 = 3897
+#     dated         2311 + 0 = 2311
+#     3897 + 2311 == 6208
+#
+# #1341, iceberg_deletes seeded, with its twin (OffgridwithJD): 3897 -> 3903, and
+# suites_not_covered 100 -> 99. The suite had no rows. It enters with 49 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after one fix.
+# The six "backend still up" checks read SELECT 1, which answers again after crash
+# recovery: with abort() in place of the null-pos refusal, or the partition spec's
+# fields guard removed (a segfault), main's shell passed the survival check once
+# recovery had finished. They now also read the server log's count of killed
+# backends, and every reading waits for the server first, so a crash reddens its own
+# arm and its section's survival check, not the two arms after it. Every refusal now
+# also reads its own guard's message (XX001 and 22023 are shared), and the oracle
+# comparisons refuse an empty side. 43 are dated by twenty-three mutations, each reddening
+# the same names in both twins. The equal-sequence equality check is dated only by
+# relaxing both of its layered guards: the per-file strict < alone passed, because the
+# pre-skip at the oldest data file's sequence number already drops that delete.
+# 6 arrive never.
+#
+#     ledger rows   6208 + 49 = 6257
+#     never         3897 + 6 = 3903
+#     dated         2311 + 43 = 2354
+#     3903 + 2354 == 6257
+#
+# #1341, logical_subscriber seeded, with its twin (OffgridwithJD): 3903 -> 3907,
+# and suites_not_covered 99 -> 98. The suite had no rows. It enters with 20 checks
+# from five-major runs (all green on each of 15-19, shell and twin alike), after four fixes.
+# With the insert-only subscription disabled before its UPDATE, main's shell passed 20/20:
+# "skipped by design" and "no apply errors" read after a fixed sleep, and nothing applied
+# is nothing applied wrongly. An INSERT after the UPDATE must now arrive first. With no
+# UPDATE sent, "does NOT say only 'row locking'" and "the wedge is real" passed; the first
+# now needs the replication error in the log, the second reads publisher -> subscriber.
+# With the lock statements failing on a missing table, the three "is not told about
+# replication" checks passed; they now need the generic error first. And the second
+# subscription's sync check lost its premise prefix: COPY failing in a logical worker
+# reddens it. The lock loop is unrolled so the twin grader reads each name.
+# 16 are dated by five mutations, each reddening the same names in both twins. 4
+# arrive never.
+#
+#     ledger rows   6257 + 20 = 6277
+#     never         3903 + 4 = 3907
+#     dated         2354 + 16 = 2370
+#     3907 + 2370 == 6277
+#
+# #1341, logical_decoding_cdc_recipe seeded, with its twin (OffgridwithJD): 3907 -> 3936,
+# and suites_not_covered 98 -> 97. The suite had no rows. It enters with its 36 checks from five-major
+# runs (all green on each of 15-19, shell and twin alike), after two fixes. The
+# missing-plugin name pgc_skip records is a skip, not a check, so it has no row: CI has
+# test_decoding and never emits it. The rollback arm read the capture count
+# and the row after ROLLBACK only, so a rolled-back INSERT that never ran passed both arms:
+# with it made a duplicate key, main passed 35/35. A reading inside the transaction, before
+# the rollback, now requires the row captured and present. And "it saw the same values the
+# table holds" compared two readings with check, so with the server gone "" = "" passed; it
+# is check_text. The recipe-contains premises are unrolled into literal names. Three
+# table-AM mutations and two mutations of the guide's own recipe date checks, each red by the
+# same names in both twins. 7 are dated. 29 arrive never.
+#
+#     ledger rows   6277 + 36 = 6313
+#     never         3907 + 29 = 3936
+#     dated         2370 + 7 = 2377
+#     3936 + 2377 == 6313
+checks_never_observed_red 3936