diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0512c9031..71b5b7753 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,6 +93,11 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+      # The docs_style twin compares each dated CHANGELOG section with its release tag
+      # (#1341). The default checkout fetches no tags, so without this its four changelog
+      # arms would decline here on every run. Depth 1, as in the suites job.
+      - name: fetch the release tags, for the changelog section comparisons
+        run: git fetch --depth=1 origin '+refs/tags/v1.0-alpha*:refs/tags/v1.0-alpha*'
       - name: install pytest, pinned from requirements-test.txt, WITHOUT the driver
         run: |
           set -euo pipefail
diff --git a/test/audit.sh b/test/audit.sh
index a75405a26..ed6eadf7c 100755
--- a/test/audit.sh
+++ b/test/audit.sh
@@ -62,10 +62,10 @@ set -euo pipefail
 # not turn an abort into a pass; it stops an abort from being mistaken for a
 # short run that went fine.
 AUDIT_REACHED_END=0
-trap 'rc=$?; if [ "$AUDIT_REACHED_END" = 0 ]; then
-	echo; echo "AUDIT TEST ABORTED (exit $rc) before reaching its verdict.";
-	echo "The checks after the failing command did not run.";
-fi' EXIT
+# THE NOTICE LIVES IN cleanup() BELOW, NOT IN A trap OF ITS OWN. It was a trap here,
+# and `trap cleanup EXIT` further down replaced it, so it never printed: with
+# set_options failing at entry the suite stopped after the partitioned arm, 13 checks
+# unrecorded, and the log ended on the server's error with no notice at all.
 
 # lib.sh for the check vocabulary (#965). It sources portlib.sh itself
 # (lib.sh:110), so this is a superset of what was here, and its top level is
@@ -121,8 +121,14 @@ fi
 run_pg() { "${RUNPG[@]}" env PATH="$BINDIR:$PATH" bash -lc "$1"; }
 
 cleanup() {
+	local rc=$?
+	if [ "$AUDIT_REACHED_END" = 0 ]; then
+		echo; echo "AUDIT TEST ABORTED (exit $rc) before reaching its verdict."
+		echo "The checks after the failing command did not run."
+	fi
 	run_pg "pg_ctl -D '$PGDATA' stop -m immediate -w" >/dev/null 2>&1 || true
 	rm -rf "$WORKDIR"
+	return $rc
 }
 trap cleanup EXIT
 
@@ -137,46 +143,36 @@ run_pg "createdb -p $PORT audit"
 PSQL="psql -p $PORT -d audit -qAtX -v ON_ERROR_STOP=1"
 q() { run_pg "$PSQL -c \"$1\""; }
 
-fail=0
-# RECORDS RATHER THAN ONLY PRINTING (#965). This suite emitted human PASS lines
-# and no RESULT records, so every mechanism built on the record vocabulary -- the
-# ledger, the census, checks_never_observed_red, the red-observation record,
-# duplicate-name detection -- was blind to all of them. The ledger did not merely
-# return nothing on this log, it REFUSED it: "no RESULT records, so there is
-# nothing to reconcile".
-#
-# `pgc_record` takes the DISPLAY whole, so the human output below is byte-for-byte
-# what it was. NOT lib.sh's own `check`: that composes its own display and would
-# drop the `: $got` suffix, which is the measured value rather than a label.
+# LIB.SH'S check, NOT A LOCAL ONE (#1341). This suite used to define its own
+# check() and call pgc_record from it, to keep the measured value on every PASS
+# line. Nothing else here needs a local recorder, and a suite that calls
+# pgc_record directly cannot have a pytest twin (test_compare_to_bash's seed
+# arm), so it records through lib.sh like the rest of the corpus. A FAIL line still
+# carries both sides; a PASS line carries the name.
+
+# expect_error NAME SQL MESSAGE -- PASS when SQL is refused WITH MESSAGE.
 #
-# `fail` is still set, so this suite's exit logic is untouched. Its verdict line
-# stays for the same reason: under `set -euo pipefail` a failing command aborts the
-# suite, and the verdict is what distinguishes finished from stopped.
+# ANY error used to pass. Measured on PG17 with set_options failing at entry for a
+# reason that is none of its guards (a division by zero): all five refusal arms below
+# passed, while the two that already read the reason went red. MESSAGE is the guard's
+# own text, so a refusal must come from the guard the arm names.
 #
-# The `checks run:` line is READ BY NOTHING YET. The matrix gates reconciliation on
-# the ACCOUNTING line via `pgc_log_shows_accounting`, and this suite emits none
-# because it emits no accounting line. The line is still correct and wanted --
-# it is the total the records reconcile against -- so the remaining step is a gate
-# flip rather than new work (@jdatcmd, #969 review).
-check() {
-	local name="$1" got="$2" want="$3"
-	if [ "$got" = "$want" ]; then
-		pgc_record PASS "$name" "PASS  $name: $got"
-	else
-		pgc_record FAIL "$name" "FAIL  $name: got [$got] want [$want]"
-		fail=1
-	fi
-}
-
-# run SQL that is expected to raise an error; PASS when it does.
+# The name stays `expect_error`: selftest 270 recognises an out-of-range set_options
+# literal as deliberate only inside this helper.
 expect_error() {
-	local name="$1" sql="$2"
-	if run_pg "$PSQL -c \"$sql\"" >/dev/null 2>&1; then
-		pgc_record FAIL "$name" "FAIL  $name: statement unexpectedly succeeded"
-		fail=1
+	local name="$1" sql="$2" want="$3" out
+	local got
+	if out="$(run_pg "$PSQL -c \"$sql\"" 2>&1)"; then
+		got="statement unexpectedly succeeded"
+	elif [ -z "$want" ]; then
+		got="no refusal message to require (harness)"
 	else
-		pgc_record PASS "$name" "PASS  $name (rejected)"
+		case "$out" in
+			*"$want"*) got="rejected" ;;
+			*) got="refused for another reason: $(printf '%s\n' "$out" | head -1)" ;;
+		esac
 	fi
+	check "$name" "$got" "rejected"
 }
 
 q "CREATE EXTENSION pgcolumnar;" >/dev/null
@@ -262,11 +258,14 @@ q "DROP TABLE col;" >/dev/null
 # ---------------------------------------------------------------------------
 q "CREATE TABLE opt (a int) USING pgcolumnar;" >/dev/null
 expect_error "reject chunk_group_row_limit 0" \
-	"SELECT pgcolumnar.set_options('opt'::regclass, chunk_group_row_limit => 0);"
+	"SELECT pgcolumnar.set_options('opt'::regclass, chunk_group_row_limit => 0);" \
+	"chunk_group_row_limit must be at least 100"
 expect_error "reject stripe_row_limit 5" \
-	"SELECT pgcolumnar.set_options('opt'::regclass, stripe_row_limit => 5);"
+	"SELECT pgcolumnar.set_options('opt'::regclass, stripe_row_limit => 5);" \
+	"stripe_row_limit must be at least 1000"
 expect_error "reject compression_level 99" \
-	"SELECT pgcolumnar.set_options('opt'::regclass, compression_level => 99);"
+	"SELECT pgcolumnar.set_options('opt'::regclass, compression_level => 99);" \
+	"compression_level must be between 1 and 22"
 
 # A relation that is not columnar must be refused rather than recorded. The drop
 # hook that clears pgcolumnar.options fires only for columnar relations, so a row
@@ -276,9 +275,10 @@ expect_error "reject compression_level 99" \
 # as the bare oid, while the identical sequence on a columnar table cleaned up.
 q "CREATE TABLE opt_heap (a int) USING heap;" >/dev/null
 expect_error "reject set_options on a heap table" \
-	"SELECT pgcolumnar.set_options('opt_heap'::regclass, chunk_group_row_limit => 1000);"
-# expect_error passes on ANY error, including a typo in this file's own SQL, so
-# assert the reason too. Captured and then matched: piping an erroring psql into
+	"SELECT pgcolumnar.set_options('opt_heap'::regclass, chunk_group_row_limit => 1000);" \
+	"is not a columnar table"
+# expect_error now requires the guard's message too; this check reads the full
+# reason the same way, and stays as its own record. Captured and then matched: piping an erroring psql into
 # grep reports on the pipeline rather than on the message.
 # `|| true` because this file runs under `set -e` and the call is EXPECTED to
 # fail: without it the assignment takes the non-zero status and aborts the suite
@@ -332,13 +332,16 @@ if [ "$audit_srv" -ge 170000 ]; then
 		"$(q "SELECT c.relkind::text || '/' || a.amname FROM pg_class c JOIN pg_am a ON a.oid = c.relam WHERE c.relname = 'opt_part';")" \
 		"p/pgcolumnar"
 	expect_error "reject set_options on a partitioned parent" \
-		"SELECT pgcolumnar.set_options('opt_part'::regclass, chunk_group_row_limit => 1000);"
+		"SELECT pgcolumnar.set_options('opt_part'::regclass, chunk_group_row_limit => 1000);" \
+		"is not a columnar table"
 	check "nothing was recorded for the partitioned parent" \
 		"$(q "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt_part'::regclass;")" "0"
 	# And the leaf, which is an ordinary table, must still be accepted -- the guard
 	# has to refuse the parent without refusing the thing that actually stores rows.
 	q "CREATE TABLE opt_part_1 PARTITION OF opt_part FOR VALUES FROM (0) TO (100);" >/dev/null
-	q "SELECT pgcolumnar.set_options('opt_part_1'::regclass, chunk_group_row_limit => 1000);" >/dev/null
+	# `|| true`: a set_options that fails here is what the next check reports, by name.
+	# Under set -e it used to end the suite instead, with every later check unrecorded.
+	q "SELECT pgcolumnar.set_options('opt_part_1'::regclass, chunk_group_row_limit => 1000);" >/dev/null || true
 	check "the partition itself is still accepted" \
 		"$(q "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt_part_1'::regclass;")" "1"
 	q "DROP TABLE opt_part;" >/dev/null
@@ -355,8 +358,9 @@ else
 fi
 
 # valid values are accepted, and delete/update work (no divide-by-zero)
+# `|| true` for the same reason: "is recorded" below names a failed call.
 q "SELECT pgcolumnar.set_options('opt'::regclass,
-     chunk_group_row_limit => 1000, stripe_row_limit => 2000, compression_level => 9);" >/dev/null
+     chunk_group_row_limit => 1000, stripe_row_limit => 2000, compression_level => 9);" >/dev/null || true
 q "INSERT INTO opt SELECT g FROM generate_series(1,10) g;" >/dev/null
 q "DELETE FROM opt WHERE a=5;" >/dev/null
 check "valid options delete works" "$(q "SELECT count(*) FROM opt;")" "9"
@@ -378,18 +382,27 @@ q "DROP TABLE opt;" >/dev/null
 q "SET pgcolumnar.stripe_row_limit=10000;
    CREATE TABLE idxleak (a int, b int) USING pgcolumnar WITH (parallel_workers=2);" >/dev/null
 q "INSERT INTO idxleak SELECT g, g%100 FROM generate_series(1,50000) g;" >/dev/null
-run_pg "$PSQL -c \"SET max_parallel_maintenance_workers=2; SET min_parallel_table_scan_size=0;
-   CREATE INDEX idxleak_a_idx ON idxleak(a);\"" >/dev/null 2>&1 || true
+# THE BUILD'S OUTCOME IS RECORDED, NOT DISCARDED. It was `>/dev/null 2>&1 || true`.
+# Measured on PG17 with a parallel build participant raising an error: CREATE INDEX
+# failed, no index existed, and "no relation leak" passed (nothing was built, so
+# nothing leaked) and "rows indexed once" passed (50000, counted by a Seq Scan).
+# Only the plan check went red, and it was labelled a premise.
+idx_out="$(run_pg "$PSQL -c \"SET max_parallel_maintenance_workers=2; SET min_parallel_table_scan_size=0;
+   CREATE INDEX idxleak_a_idx ON idxleak(a);\"" 2>&1)" && idx_rc=0 || idx_rc=$?
+check "the parallel CREATE INDEX completed" \
+	"$([ "$idx_rc" = 0 ] && echo yes || echo "no: $(printf '%s\n' "$idx_out" | head -1)")" "yes"
 
 # the server logfile must carry no resource-leak warning
 LEAKS="$(run_pg "grep -c 'resource was not closed' '$LOGFILE'" || true)"
 check "create index no relation leak" "$LEAKS" "0"
 
 # and every row is indexed exactly once (no duplicate TIDs from a per-worker rescan)
-check "premise: the indexed-once count reads idxleak_a_idx" \
-	"$(reads_index idxleak_a_idx "SELECT count(*) FROM idxleak WHERE a>0")" "yes"
+# NOT A PREMISE: a failed parallel build reddens it (#1339). And the count is read
+# only when that plan reads the index, so a Seq Scan cannot answer for it.
+idx_plan="$(reads_index idxleak_a_idx "SELECT count(*) FROM idxleak WHERE a>0")"
+check "the indexed-once count reads idxleak_a_idx" "$idx_plan" "yes"
 check "create index rows indexed once" \
-	"$(q "$IDXONLY SELECT count(*) FROM idxleak WHERE a>0;" | tail -1)" "50000"
+	"$([ "$idx_plan" = yes ] && q "$IDXONLY SELECT count(*) FROM idxleak WHERE a>0;" | tail -1 || echo "not read through idxleak_a_idx")" "50000"
 q "DROP TABLE idxleak;" >/dev/null
 
 # ---------------------------------------------------------------------------
@@ -454,13 +467,13 @@ q "DROP TABLE ss_dup;" >/dev/null
 
 echo
 AUDIT_REACHED_END=1
-if [ "$fail" = "0" ]; then
-	echo "checks run: $PGC_CHECKS"
+# The verdict is lib.sh's, from the counters every check updates. pgc_summary adds
+# the accounting line the matrix reconciles on, which this suite never printed.
+if [ "${PGC_FAIL:-0}" = "0" ]; then
 	echo "AUDIT TEST PASSED"
 else
-	echo "checks run: $PGC_CHECKS"
 	echo "AUDIT TEST FAILED"
 	echo "---- server log tail ----"
 	run_pg "tail -30 '$LOGFILE'" || true
 fi
-exit $fail
+pgc_summary
diff --git a/test/bench_guards.sh b/test/bench_guards.sh
index 04cf8cde6..54dd50e8c 100755
--- a/test/bench_guards.sh
+++ b/test/bench_guards.sh
@@ -25,28 +25,21 @@
 # The argument is accepted and ignored; this suite needs no cluster.
 # Written fresh for pgColumnar.
 set -uo pipefail
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 SRCDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
+# No cluster needed; pgc_setup is skipped deliberately, as in wal_envelope.sh. The
+# checks go through lib.sh's check() so each one is a RESULT record the ledger and
+# the pytest twin can name (#1341); the suite used to keep its own tally, which
+# emitted none. PGC_MAJOR comes from the pg_config every suite is handed, and
+# degrades to `unknown` rather than to a guessed major when there is none.
+PGC_MAJOR="$(pgc_major_of "${1:-}" 2>/dev/null)"
 PGC_CHECKS=0
 PGC_FAIL=0
-check() {
-	local name="$1" got="$2" want="$3"
-	PGC_CHECKS=$((PGC_CHECKS + 1))
-	if [ "$got" = "$want" ]; then
-		echo "PASS  $name"
-	else
-		echo "FAIL  $name: got [$got] want [$want]"
-		PGC_FAIL=1
-	fi
-}
 
 GUARDS="$SRCDIR/bench/cb_guards.sh"
-if [ ! -f "$GUARDS" ]; then
-	echo "FAIL  bench/cb_guards.sh is missing, so the benchmark's guards are untestable"
-	PGC_CHECKS=$((PGC_CHECKS + 1))
-	PGC_FAIL=1
-	echo; echo "checks run: $PGC_CHECKS"; echo "$(basename "$0"): FAILED"; exit 1
-fi
+check "premise: bench/cb_guards.sh is present to be judged" "$([ -f "$GUARDS" ] && echo yes || echo no)" "yes"
+[ -f "$GUARDS" ] || pgc_summary
 # shellcheck source=/dev/null
 . "$GUARDS"
 
@@ -60,37 +53,83 @@ echo "== pgColumnar test: $(basename "$0") =="
 # requirement the script does not enforce is the same shape as selftest 080 not
 # scanning bench/: the rule existed, the check did not.
 #
-# Asserted on the SOURCE rather than by running the benchmarks, because running
-# them takes minutes and the question is whether the guard is present and shaped
-# right.
-for _bp in "$(dirname "${BASH_SOURCE[0]}")/../bench/"run_*.sh; do
+# Asserted by RUNNING each runner's own guard, not by grepping for its words
+# (#1341). The guard is the block from the runner's --configure capture through
+# the `fi` that closes its ALLOW_CASSERT test, read with comments removed, and it
+# is run against a stand-in pg_config that reports an assert build, a plain one,
+# or nothing. Running the whole runner is not an option: past its guard it
+# builds, loads and downloads.
+#
+# The greps this replaces passed with the refusal gone. Every runner's header
+# mentions --enable-cassert, and the cannot-tell block's `exit 1` sits within 24
+# lines of that mention, so with the assert branch's `exit 1` turned into `true`,
+# with the empty-capture `exit 1` removed, with every build refused, or with the
+# override ignored, main's suite passed all 60 checks. Measured on run_bench.sh.
+#
+# EVERY assertion still keys on shared TEXT, never on a prefix: run_profile.sh
+# uses PROFILE_* where the other five use BENCH_*, so the override variable is
+# read from the runner's own guard rather than spelled here.
+_fake="$(mktemp -d)"
+for _mode in cassert plain empty; do
+	{
+		echo '#!/bin/sh'
+		echo 'case "$1" in'
+		case "$_mode" in
+			cassert) echo "  --configure) echo \"'--prefix=/nonexistent' '--enable-cassert'\" ;;" ;;
+			plain) echo "  --configure) echo \"'--prefix=/nonexistent'\" ;;" ;;
+			empty) echo "  --configure) exit 1 ;;" ;;
+		esac
+		echo '  --bindir) echo /nonexistent/bin ;;'
+		echo '  --version) echo "PostgreSQL 17.0" ;;'
+		echo '  *) echo /nonexistent ;;'
+		echo 'esac'
+	} >"$_fake/pg_config_$_mode"
+	chmod +x "$_fake/pg_config_$_mode"
+done
+guard_of() {	# guard_of RUNNER -> its assert guard as code, comments removed, or nothing
+	# Only a COMPLETE guard is returned: the capture, an ALLOW_CASSERT test and the
+	# `fi` closing it, within 60 code lines. Anything else returns nothing, which
+	# the checks below refuse. Returning a partial block would run whatever follows
+	# it in the runner -- the build, the load, the download -- and with the assert
+	# test removed it once returned the rest of run_bench.sh.
+	awk '/^[[:space:]]*#/ {next}
+		!on && /--configure/ && /PG_CONFIG/ {on=1}
+		on {buf = buf $0 "\n"; n++}
+		on && /ALLOW_CASSERT/ {seen=1}
+		on && seen && /^fi$/ {printf "%s", buf; exit}
+		n > 60 {exit}' "$1"
+}
+run_guard() {	# run_guard RUNNER MODE [ALLOW] -> "rc=N" then the guard's output
+	local block var out rc
+	block="$(guard_of "$1")"
+	var="$(grep -oE '[A-Z_]*ALLOW_CASSERT' <<<"$block" | head -1)"
+	out="$(env -i PATH=/usr/bin:/bin PG_CONFIG="$_fake/pg_config_$2" ${3:+"${var:-NO_OVERRIDE_FOUND}=1"} \
+		bash -c "set -uo pipefail; $block" 2>&1)"
+	rc=$?
+	echo "rc=$rc"
+	echo "$out"
+}
+for _bp in "$SRCDIR/bench/"run_*.sh; do
 	_bs="$(basename "$_bp")"
+	_asrt="$(run_guard "$_bp" cassert)"
+	_ovrd="$(run_guard "$_bp" cassert allow)"
+	_pln="$(run_guard "$_bp" plain)"
+	_none="$(run_guard "$_bp" empty)"
 	check "[$_bs] refuses an assert build rather than documenting the requirement" \
-		"$([ "$(grep -c 'enable-cassert' "$_bp")" -gt 0 ] && echo yes || echo no)" "yes"
-	# EVERY assertion here keys on shared TEXT, never on a prefix, and that is
-	# load-bearing rather than incidental: run_profile.sh uses PROFILE_* where
-	# the other five use BENCH_*, so a check written against `BENCH_ALLOW_CASSERT`
-	# would pass on five runners and silently stop covering the sixth. Proved:
-	# keying that one check on BENCH_ALLOW_CASSERT leaves run_profile.sh as the
-	# only red. The unprefixed match below is what keeps it in scope.
-	#
-	# If anyone tidies the prefixes to match, this comment says the checks need
-	# no change. If anyone tidies the CHECKS to match the prefixes, that is the
-	# moment coverage is lost with nothing going red.
+		"$(grep -q 'is an --enable-cassert build' <<<"$_asrt" && echo yes || echo "no: $(head -c 200 <<<"$_asrt" | tr '\n' ' ')")" "yes"
 	check "[$_bs] and offers a named override rather than only refusing" \
-		"$([ "$(grep -cE 'ALLOW_CASSERT' "$_bp")" -gt 0 ] && echo yes || echo no)" "yes"
-	check "[$_bs] and exits non-zero rather than warning past it" \
-		"$([ "$(grep -A24 'enable-cassert' "$_bp" | grep -c 'exit 1')" -gt 0 ] && echo yes || echo no)" "yes"
+		"$(head -1 <<<"$_ovrd")/$(grep -c 'WARNING' <<<"$_ovrd")" "rc=0/1"
+	check "[$_bs] and exits non-zero rather than warning past it" "$(head -1 <<<"$_asrt")" "rc=1"
+	check "[$_bs] and lets a non-assert build through" \
+		"$(head -1 <<<"$_pln")/$(grep -c 'FATAL' <<<"$_pln")" "rc=0/0"
 	# "not an assert build" and "could not tell" are different answers and only
-	# one of them is a pass. Written as a bare `--configure | grep -c`, a missing
-	# or failing pg_config gives empty output, grep -c gives 0, and the guard
-	# returns its cleanest verdict on the least information -- so it must capture
-	# the output and refuse an empty one.
+	# one of them is a pass: a missing or failing pg_config must be refused.
 	check "[$_bs] refuses when it CANNOT TELL, rather than treating that as a pass" \
-		"$([ "$(grep -c 'produced no --configure output' "$_bp")" -gt 0 ] && echo yes || echo no)" "yes"
+		"$(head -1 <<<"$_none")/$(grep -c 'produced no --configure output' <<<"$_none")" "rc=1/1"
 	check "[$_bs] and does not decide from an unbuffered pipe into grep -c" \
-		"$([ "$(grep -cE '\$\("\$PG_CONFIG" --configure[^)]*\| *grep -c' "$_bp")" -eq 0 ] && echo yes || echo no)" "yes"
+		"$([ "$(guard_of "$_bp" | grep -cE '\$\("\$PG_CONFIG" --configure[^)]*\| *grep -c')" -eq 0 ] && echo yes || echo no)" "yes"
 done
+rm -rf "$_fake"
 
 # The control: the scan has to be reading files that exist, or four greps over
 # nothing would report compliance.
@@ -144,7 +183,7 @@ check "N + 1 is still refused: the coordinator needs a slot too" \
 	"$(cb_worker_slots_ok 9 8 && echo ok || echo refused)" "refused"
 check "N + 2 is accepted, the measured minimum" \
 	"$(cb_worker_slots_ok 10 8 && echo ok || echo refused)" "ok"
-check "more than enough is accepted" \
+check "more than enough worker slots are accepted" \
 	"$(cb_worker_slots_ok 32 8 && echo ok || echo refused)" "ok"
 check "the rule holds at another worker count (4 needs 6)" \
 	"$(cb_worker_slots_ok 6 4 && echo ok || echo refused)" "ok"
@@ -218,7 +257,7 @@ tag_none="$(cb_cold_tag none 2>/dev/null)"
 # "lukewarm-cold-run", and "the run was not called cold" therefore PASSES against
 # no implementation whatever. Seen, not reasoned about -- it passed exactly that
 # way on the first red run of this suite.
-check "premise: the guard exists and emitted a tag to judge" \
+check "the guard exists and emitted a tag to judge" \
 	"$([ -n "$tag_none" ] && echo yes || echo no)" "yes"
 check "a host that could not drop the page cache is not called a cold run" \
 	"$(grep -qi 'lukewarm-cold-run' <<<"$tag_none" && echo claimed || echo not-claimed)" \
@@ -239,7 +278,7 @@ check "and the tag says plainly that the run was warm" \
 #
 # The three numbers below are that run's q13, the smallest real case: heap
 # 1588.095 ms, columnar 1582.859 ms, and a warm-try scatter of 0.99 percent.
-check "premise: the verdict helpers are present to be judged" \
+check "the verdict helpers are present to be judged" \
 	"$(type -t cb_verdict)/$(type -t cb_warm_spread)/$(type -t cb_band)" \
 	"function/function/function"
 
@@ -294,11 +333,13 @@ CB="$SRCDIR/bench/run_clickbench.sh"
 check "premise: the benchmark script is present to be judged" \
 	"$([ -f "$CB" ] && echo yes || echo no)" "yes"
 
+# Matched as a WHOLE name (#1341): `r[12]=` alone also matched `rr1=`, so with
+# the variables renamed this premise passed and the check below read nothing.
 # Without this premise the next check is vacuous. Rename r1 and "no ratio value
 # decides anything" passes against a report that has gone back to deciding on one
 # under another name -- the grep finds nothing and nothing is what it approves.
 check "premise: the report still captures ratio() into a display variable" \
-	"$([ "$(grep -c 'r[12]=\$(ratio' "$CB")" -ge 1 ] && echo yes || echo no)" "yes"
+	"$([ "$(grep -cE '(^|[^[:alnum:]_])r[12]=\$\(ratio' "$CB")" -ge 1 ] && echo yes || echo no)" "yes"
 
 check "ratio()'s output reaches printf and nothing else" \
 	"$(grep '\$r[12]' "$CB" | grep -vc 'printf')" "0"
@@ -316,8 +357,11 @@ check "ratio()'s output reaches printf and nothing else" \
 # `cb_verdict "` is the shape a call takes here and a mention almost never does.
 # Measured on the bypassed tree: loose 1 (approves), tight 0 (rejects); on the
 # good tree tight is 1 and still approves.
+# Read as CODE: a comment that keeps the call's shape is not a call. With the
+# verdict recomputed inline and `# was: case "$(cb_verdict "$c" ...` left behind,
+# main's suite passed this check (#1341).
 check "and the verdict is asked of cb_verdict rather than recomputed inline" \
-	"$([ "$(grep -c 'cb_verdict "' "$CB")" -ge 1 ] && echo yes || echo no)" "yes"
+	"$([ "$(grep -vE '^[[:space:]]*#' "$CB" | grep -c 'cb_verdict "')" -ge 1 ] && echo yes || echo no)" "yes"
 
 # ---- the accelerator claim must not call a separation "variation" (#565) ----
 #
@@ -369,11 +413,4 @@ echo "  tuned-arm settings named on the page:$([ -z "$_miss" ] && echo ' all fou
 check "the tuned-arm section names all four settings and the group-cap value" \
 	"missing:$_miss" "missing:"
 
-echo
-echo "checks run: $PGC_CHECKS"
-if [ "$PGC_FAIL" != 0 ]; then
-	echo "$(basename "$0"): FAILED"
-	exit 1
-fi
-echo "$(basename "$0"): PASSED"
-exit 0
+pgc_summary
diff --git a/test/check_ledger.tsv b/test/check_ledger.tsv
index 218e6a82f..dbe6471d4 100644
--- a/test/check_ledger.tsv
+++ b/test/check_ledger.tsv
@@ -395,6 +395,41 @@ arrow_nested_import	arrow_nested_import	import rows	15;16;17;18;19	2026-10-20	ex
 arrow_nested_import	arrow_nested_import	nested import round-trips (arrays + composite)	15;16;17;18;19	2026-10-20	export: the final partial record batch never written;import: a NULL List element read as a value;import: a NULL Struct's validity bit ignored;import: an empty List read as a NULL array
 arrow_nested_import	arrow_nested_import	premise: the delete left 3999 live rows in the source	15;16;17;18;19	never	-
 arrow_nested_import	arrow_nested_import	round-trips after delete	15;16;17;18;19	2026-10-20	export: deleted rows exported too;export: the final partial record batch never written;import: a NULL List element read as a value;import: a NULL Struct's validity bit ignored;import: an empty List read as a NULL array
+audit	audit	add-column aggregate	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column const default	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column index scan	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column mid-transaction keeps a later UPDATE	15;16;17;18;19	2026-10-22	columnar_write_state.c: a write buffer opened before ADD COLUMN in the transaction is reused
+audit	audit	add-column mid-transaction keeps the inserted value	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column mixed rows	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column nullable is null	15;16;17;18;19	never	-
+audit	audit	add-column projected only	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column text default	15;16;17;18;19	2026-10-22	columnar_reader.c: a column added after the data reads NULL instead of its missing value
+audit	audit	add-column without a default keeps the inserted value	15;16;17;18;19	2026-10-22	columnar_write_state.c: a write buffer opened before ADD COLUMN in the transaction is reused
+audit	audit	collation pushdown == no-pushdown	15;16;17;18;19	2026-10-22	columnar_customscan.c: a predicate under another collation is pushed into chunk-group skipping
+audit	audit	collation result correct	15;16;17;18;19	2026-10-22	columnar_customscan.c: a predicate under another collation is pushed into chunk-group skipping
+audit	audit	create index no relation leak	15;16;17;18;19	2026-10-22	columnar_tableam.c: index_build_range_scan does not end the scan a build participant was handed
+audit	audit	create index rows indexed once	15;16;17;18;19	2026-10-22	columnar_tableam.c: every build participant reads through a private full-table reader
+audit	audit	nothing was recorded for the heap table	15;16;17;18;19	never	-
+audit	audit	nothing was recorded for the partitioned parent	17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options accepts relkind p as columnar
+audit	audit	premise: the SQLSTATE probe reads a known code	15;16;17;18;19	never	-
+audit	audit	premise: the add-column lookup reads ac_c_idx	15;16;17;18;19	never	-
+audit	audit	premise: this major really lets a partitioned parent carry the AM	17;18;19	never	-
+audit	audit	reject chunk_group_row_limit 0	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options drops its chunk_group_row_limit < 100 guard
+audit	audit	reject compression_level 99	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options drops its compression_level 1..22 guard
+audit	audit	reject set_options on a heap table	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options raises division_by_zero at entry, before any guard
+audit	audit	reject set_options on a partitioned parent	17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options accepts relkind p as columnar
+audit	audit	reject stripe_row_limit 5	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options drops its stripe_row_limit < 1000 guard
+audit	audit	same-collation still pushes	15;16;17;18;19	never	-
+audit	audit	same-statement duplicate inserted nothing	15;16;17;18;19	never	-
+audit	audit	same-statement duplicate is rejected, not spun on	15;16;17;18;19	never	-
+audit	audit	set_options on a non-columnar relation raises 42809, not P0001	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options raises division_by_zero at entry, before any guard
+audit	audit	the indexed-once count reads idxleak_a_idx	15;16;17;18;19	2026-10-22	columnar_tableam.c: a parallel index build participant raises an error
+audit	audit	the parallel CREATE INDEX completed	15;16;17;18;19	2026-10-22	columnar_tableam.c: a parallel index build participant raises an error
+audit	audit	the partition itself is still accepted	17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options raises division_by_zero at entry, before any guard
+audit	audit	the partitioned-parent arm	15;16	never	-
+audit	audit	the refusal says the relation is not columnar	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options raises division_by_zero at entry, before any guard
+audit	audit	the same call on a columnar table is recorded	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options raises division_by_zero at entry, before any guard
+audit	audit	valid options delete works	15;16;17;18;19	never	-
 autovacuum	autovacuum	OFF-again: a new deleted table is left alone after disabling	15;16;17;18;19	2026-10-20	columnar_autovacuum.c: the launcher runs its passes with pgcolumnar.autovacuum off
 autovacuum	autovacuum	OFF: the daemon did not touch the table (dead rows unchanged)	15;16;17;18;19	2026-10-20	columnar_autovacuum.c: the launcher runs its passes with pgcolumnar.autovacuum off
 autovacuum	autovacuum	ON: the daemon compacted the deleted-heavy table (dead rows now 0)	15;16;17;18;19	2026-10-20	columnar_autovacuum.c: the maintenance launcher is never registered
@@ -468,6 +503,97 @@ batch_fold_explain	batch_fold_explain	premise: control table returns the right s
 batch_fold_explain	batch_fold_explain	premise: fallback table returns the right sum	15;16;17;18;19	never	-
 batch_fold_explain	batch_fold_explain	premise: fixture loaded every row	15;16;17;18;19	never	-
 batch_fold_explain	batch_fold_explain	premise: with parallelism free, the planner gives the parallel partial fold	15;16;17;18;19	never	-
+bench_guards	bench_guards	N + 1 is still refused: the coordinator needs a slot too	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: an N-worker arm is said to need N + 1 worker slots
+bench_guards	bench_guards	N + 2 is accepted, the measured minimum	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_bench.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_bench.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_bench.sh: the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_bench.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_bench.sh: every build is refused as an assert build (over-applied)
+bench_guards	bench_guards	[run_bench.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_bench.sh: BENCH_ALLOW_CASSERT is ignored, so the override never runs
+bench_guards	bench_guards	[run_bench.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	2026-10-21	bench/run_bench.sh: the assert-build test removed outright, the header comment still naming it
+bench_guards	bench_guards	[run_bench.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_bench.sh: an empty --configure capture is no longer refused (its exit 1 became true)
+bench_guards	bench_guards	[run_bench_fsst.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_bench_fsst.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_bench_fsst.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner refuses every build as an assert build (over-applied)
+bench_guards	bench_guards	[run_bench_fsst.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner ignores its ALLOW_CASSERT override
+bench_guards	bench_guards	[run_bench_fsst.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_bench_fsst.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, an empty --configure capture is no longer refused
+bench_guards	bench_guards	[run_bench_join.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_bench_join.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_bench_join.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner refuses every build as an assert build (over-applied)
+bench_guards	bench_guards	[run_bench_join.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner ignores its ALLOW_CASSERT override
+bench_guards	bench_guards	[run_bench_join.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_bench_join.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, an empty --configure capture is no longer refused
+bench_guards	bench_guards	[run_bench_readstream.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_bench_readstream.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_bench_readstream.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner refuses every build as an assert build (over-applied)
+bench_guards	bench_guards	[run_bench_readstream.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner ignores its ALLOW_CASSERT override
+bench_guards	bench_guards	[run_bench_readstream.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_bench_readstream.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, an empty --configure capture is no longer refused
+bench_guards	bench_guards	[run_clickbench.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_clickbench.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_clickbench.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner refuses every build as an assert build (over-applied)
+bench_guards	bench_guards	[run_clickbench.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner ignores its ALLOW_CASSERT override
+bench_guards	bench_guards	[run_clickbench.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_clickbench.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, an empty --configure capture is no longer refused
+bench_guards	bench_guards	[run_profile.sh] and does not decide from an unbuffered pipe into grep -c	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner decides from pg_config --configure piped straight into grep -c
+bench_guards	bench_guards	[run_profile.sh] and exits non-zero rather than warning past it	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, the assert-build refusal warns past it (its exit 1 became true)
+bench_guards	bench_guards	[run_profile.sh] and lets a non-assert build through	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner refuses every build as an assert build (over-applied)
+bench_guards	bench_guards	[run_profile.sh] and offers a named override rather than only refusing	15;16;17;18;19	2026-10-21	bench/run_*.sh: every runner ignores its ALLOW_CASSERT override
+bench_guards	bench_guards	[run_profile.sh] refuses an assert build rather than documenting the requirement	15;16;17;18;19	never	-
+bench_guards	bench_guards	[run_profile.sh] refuses when it CANNOT TELL, rather than treating that as a pass	15;16;17;18;19	2026-10-21	bench/run_*.sh: in every runner, an empty --configure capture is no longer refused
+bench_guards	bench_guards	a clear loss is a loss	15;16;17;18;19	never	-
+bench_guards	bench_guards	a clear win is a win	15;16;17;18;19	never	-
+bench_guards	bench_guards	a gap just outside the band is still called	15;16;17;18;19	never	-
+bench_guards	bench_guards	a host that could not drop the page cache is not called a cold run	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_cold_tag claims a cold run whatever happened
+bench_guards	bench_guards	a missing count is refused rather than compared with the expectation	15;16;17;18;19	never	-
+bench_guards	bench_guards	a missing current value is refused, not compared	15;16;17;18;19	never	-
+bench_guards	bench_guards	a serial arm needs no prepared transactions	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_prepared_xacts_ok wants more than the worker count (-gt for -ge)
+bench_guards	bench_guards	a serial arm needs no worker slots	15;16;17;18;19	never	-
+bench_guards	bench_guards	a short load is refused	15;16;17;18;19	never	-
+bench_guards	bench_guards	a single warm try has no measurable scatter	15;16;17;18;19	never	-
+bench_guards	bench_guards	a zero best is refused rather than divided by	15;16;17;18;19	never	-
+bench_guards	bench_guards	an empty load is refused, which is what an errored parallel arm produces	15;16;17;18;19	never	-
+bench_guards	bench_guards	an errored arm has no verdict	15;16;17;18;19	never	-
+bench_guards	bench_guards	an exact load is accepted	15;16;17;18;19	never	-
+bench_guards	bench_guards	an exact match is accepted	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_prepared_xacts_ok wants more than the worker count (-gt for -ge)
+bench_guards	bench_guards	an unknown band suppresses the verdict, it does not strict-compare	15;16;17;18;19	never	-
+bench_guards	bench_guards	and a loss just outside it likewise	15;16;17;18;19	never	-
+bench_guards	bench_guards	and a missing expectation is refused too	15;16;17;18;19	never	-
+bench_guards	bench_guards	and is unknown if either arm is unknown	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_band is gone
+bench_guards	bench_guards	and neither does a zero baseline	15;16;17;18;19	never	-
+bench_guards	bench_guards	and one below it does not	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: an N-worker arm is said to need N + 1 worker slots
+bench_guards	bench_guards	and says it needs a restart	15;16;17;18;19	never	-
+bench_guards	bench_guards	and says it needs a restart, which is why this runs first	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: the prepared-transaction message no longer says a restart is needed
+bench_guards	bench_guards	and the number it must reach	15;16;17;18;19	never	-
+bench_guards	bench_guards	and the tag says plainly that the run was warm	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_cold_tag claims a cold run whatever happened
+bench_guards	bench_guards	and the value it must reach, not merely the worker count	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: an N-worker arm is said to need N + 1 worker slots
+bench_guards	bench_guards	and the verdict is asked of cb_verdict rather than recomputed inline	15;16;17;18;19	2026-10-21	bench/run_clickbench.sh: the verdict decided inline, a comment still carrying the cb_verdict call
+bench_guards	bench_guards	and under a band wider than the gap it is a tie, not a win either	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_verdict ignores the band
+bench_guards	bench_guards	columnar ahead by 0.33 percent is not a LOSS, which is the #531 defect	15;16;17;18;19	never	-
+bench_guards	bench_guards	more than enough is accepted	15;16;17;18;19	never	-
+bench_guards	bench_guards	more than enough worker slots are accepted	15;16;17;18;19	never	-
+bench_guards	bench_guards	no query is called run-to-run variation unless its figures are a measured tie	15;16;17;18;19	never	-
+bench_guards	bench_guards	no usable try yields no spread, not zero	15;16;17;18;19	never	-
+bench_guards	bench_guards	one short is refused, which is the off-by-one that would run 7 workers	15;16;17;18;19	never	-
+bench_guards	bench_guards	order does not matter, and ERR tries are dropped	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_warm_spread divides by the worst try, not the best
+bench_guards	bench_guards	premise: bench/cb_guards.sh is present to be judged	15;16;17;18;19	never	-
+bench_guards	bench_guards	premise: every bench runner was read, not a hand-kept subset	15;16;17;18;19	never	-
+bench_guards	bench_guards	premise: the benchmark page is present to be judged	15;16;17;18;19	never	-
+bench_guards	bench_guards	premise: the benchmark script is present to be judged	15;16;17;18;19	never	-
+bench_guards	bench_guards	premise: the report still captures ratio() into a display variable	15;16;17;18;19	never	-
+bench_guards	bench_guards	ratio()'s output reaches printf and nothing else	15;16;17;18;19	never	-
+bench_guards	bench_guards	spread is the fractional range over the best	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_warm_spread divides by the worst try, not the best
+bench_guards	bench_guards	the band is the wider of the two arms	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_band is gone
+bench_guards	bench_guards	the guard exists and emitted a tag to judge	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_cold_tag prints nothing
+bench_guards	bench_guards	the message names the setting to change	15;16;17;18;19	never	-
+bench_guards	bench_guards	the rule holds at another worker count (4 needs 6)	15;16;17;18;19	never	-
+bench_guards	bench_guards	the stock 0 is refused for an 8-worker parallel arm	15;16;17;18;19	never	-
+bench_guards	bench_guards	the stock 8 is refused for an 8-worker arm, which is the case that bit us	15;16;17;18;19	never	-
+bench_guards	bench_guards	the tuned-arm section names all four settings and the group-cap value	15;16;17;18;19	never	-
+bench_guards	bench_guards	the variation-claim extractor reads ids wrapped across two lines	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_doc_variation_qids reads line by line, missing a wrapped claim
+bench_guards	bench_guards	the verdict helpers are present to be judged	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_band is gone
+bench_guards	bench_guards	the worker-slot message names the setting	15;16;17;18;19	never	-
+bench_guards	bench_guards	two missing measurements are refused, not called equal	15;16;17;18;19	2026-10-21	bench/cb_guards.sh: cb_rows_ok compares without requiring numbers
 bloom_lazy	bloom_lazy	a range predicate still agrees with the heap	15;16;17;18;19	never	-
 bloom_lazy	bloom_lazy	a scan that keeps every group reads more	15;16;17;18;19	2026-10-20	columnar_reader.c: the bloom filter is never fetched
 bloom_lazy	bloom_lazy	an absent value agrees with bloom filters disabled	15;16;17;18;19	never	-
@@ -1050,6 +1176,59 @@ doc_parallel_premise	doc_parallel_premise	the fixture holds several row groups,
 doc_parallel_premise	doc_parallel_premise	the group counters were read, not blank	15;16;17;18;19	2026-10-21	EXPLAIN stops printing Columnar Chunk Groups Read;pgcolumnar.enable_custom_scan boots false (columnar_tableam.c)
 doc_parallel_premise	doc_parallel_premise	the page still names a narrow query	15;16;17;18;19	2026-10-21	docs/limitations.md stops naming a narrow query
 doc_parallel_premise	doc_parallel_premise	the sel plan is exactly one columnar scan node	15;16;17;18;19	2026-10-21	pgcolumnar.enable_custom_scan boots false (columnar_tableam.c)
+docs_style	docs_style	CHANGELOG.md carries no em or en dash	15;16;17;18;19	2026-10-21	CHANGELOG.md: a line with an em dash
+docs_style	docs_style	CHANGELOG.md has a union merge driver, so two entries do not conflict	15;16;17;18;19	2026-10-21	.gitattributes: the CHANGELOG.md merge=union line removed
+docs_style	docs_style	META.json provides.pgcolumnar.version is the version VERSION holds, in PGXN form	15;16;17;18;19	2026-10-21	META.json: provides.pgcolumnar.version left at 1.0.0-alpha.4
+docs_style	docs_style	META.json version is the version VERSION holds, in PGXN form	15;16;17;18;19	2026-10-21	META.json: version left at 1.0.0-alpha.4
+docs_style	docs_style	README's badge alt text names the version VERSION holds	15;16;17;18;19	2026-10-21	README.md: the badge alt text left at 1.0-alpha3
+docs_style	docs_style	administration.md states it in the section that says to lower the setting	15;16;17;18;19	2026-10-21	docs/administration.md: the stripe_row_limit floor written as 1000
+docs_style	docs_style	and CHANGELOG.md still has the union merge driver those instructions are about	15;16;17;18;19	2026-10-21	.gitattributes: the CHANGELOG.md merge=union line removed
+docs_style	docs_style	and CONTEXT.md tells a contributor what a CONFLICTING badge means	15;16;17;18;19	2026-10-21	CONTEXT.md: the CONFLICTING-badge heading reworded
+docs_style	docs_style	and it actually examined the documents	15;16;17;18;19	never	-
+docs_style	docs_style	and names the command rather than only the problem	15;16;17;18;19	2026-10-21	CONTEXT.md: git rebase origin/main written as git rebase main
+docs_style	docs_style	and says WHY rebasing works where merging does not	15;16;17;18;19	2026-10-21	CONTEXT.md: merging **into** without its emphasis
+docs_style	docs_style	and the page that nav entry points at exists	15;16;17;18;19	2026-10-21	docs/roadmap.md deleted, its nav entry kept
+docs_style	docs_style	and warns against the button that reintroduces the conflict	15;16;17;18;19	2026-10-21	CONTEXT.md: do not click reworded
+docs_style	docs_style	best-practices names clustering on the join key	15;16;17;18;19	2026-10-21	docs/best-practices.md: join key kept only inside an HTML comment
+docs_style	docs_style	best-practices.md carries it with the load-sizing advice	15;16;17;18;19	2026-10-21	docs/best-practices.md: the stripe_row_limit floor written as 1000
+docs_style	docs_style	configuration.md states the 1024 floor where it documents the setting	15;16;17;18;19	2026-10-21	docs/configuration.md: the 1024 floor kept only inside an HTML comment
+docs_style	docs_style	each shipped version starts exactly one upgrade script, so the chain is a walk	15;16;17;18;19	2026-10-21	an untracked pgcolumnar--1.0-alpha2--1.0-alphaX.sql, a second script starting at 1.0-alpha2
+docs_style	docs_style	every dated changelog section has its own section at its release tag	15;16;17;18;19	2026-10-21	CHANGELOG.md: a dated 1.0-alpha2.5 section no tag shipped
+docs_style	docs_style	every dated changelog section holds what its tag shipped, plus only what is recorded	15;16;17;18;19	2026-10-21	CHANGELOG.md: an entry added to the released 1.0-alpha4 section
+docs_style	docs_style	every dated changelog section still holds every entry its tag shipped	15;16;17;18;19	2026-10-21	CHANGELOG.md: an entry removed from the released 1.0-alpha4 section
+docs_style	docs_style	every document citing VERSION quotes the version VERSION holds	15;16;17;18;19	2026-10-21	docs/limitations.md: a stale VERSION citation, the right one only in an HTML comment
+docs_style	docs_style	every document making the claim states it in a form this rule can read	15;16;17;18;19	2026-10-21	README.md: the latest-published claim reworded out of both readable forms
+docs_style	docs_style	every document names the same latest published pre-release	15;16;17;18;19	2026-10-21	docs/roadmap.md: the latest-published claim names v1.0-alpha1
+docs_style	docs_style	every document stating the upgrade chain states it in a form this rule can read	15;16;17;18;19	2026-10-21	docs/limitations.md: the upgrade-chain sentence names no destination
+docs_style	docs_style	every pgcolumnar--*.sql in the tree is in the published distribution	15;16;17;18;19	2026-10-21	an untracked pgcolumnar--1.0-alpha2--1.0-alphaX.sql, a second script starting at 1.0-alpha2
+docs_style	docs_style	every recorded post-tag entry carries a reason	15;16;17;18;19	2026-10-21	test/changelog_post_tag.txt: a row with no reason
+docs_style	docs_style	every such document names default_version as the version one UPDATE reaches	15;16;17;18;19	2026-10-21	docs/limitations.md: the upgrade-chain sentence names no destination
+docs_style	docs_style	every such document names the versions that reach default_version in one update	15;16;17;18;19	2026-10-21	docs/limitations.md: 1.0-alpha2 dropped from the starting versions
+docs_style	docs_style	every user-facing document meets the measurable plain-language rules	15;16;17;18;19	2026-10-21	docs/how-to.md: a sentence with an em dash
+docs_style	docs_style	how-to names clustering on the join key for the runtime filter	15;16;17;18;19	2026-10-21	docs/how-to.md: join key reworded to join column
+docs_style	docs_style	no document carries a merge conflict marker	15;16;17;18;19	2026-10-21	docs/user-guide.md: a merge conflict marker line
+docs_style	docs_style	no documented query tests pg_extension while listing databases	15;16;17;18;19	2026-10-21	docs/how-to.md: a sql block testing pg_extension while listing pg_database
+docs_style	docs_style	no recorded post-tag entry is stale, so the allowance cannot widen silently	15;16;17;18;19	2026-10-21	test/changelog_post_tag.txt: a row for 1.0-alpha9, which has no section
+docs_style	docs_style	premise: META.json is present and parses	15;16;17;18;19	never	-
+docs_style	docs_style	premise: META.json names a base install script	15;16;17;18;19	never	-
+docs_style	docs_style	premise: and it names VERSION's version at all	15;16;17;18;19	never	-
+docs_style	docs_style	premise: at least one document cites the VERSION file	15;16;17;18;19	never	-
+docs_style	docs_style	premise: at least one document names the latest published pre-release	15;16;17;18;19	never	-
+docs_style	docs_style	premise: at least one document states the upgrade chain	15;16;17;18;19	never	-
+docs_style	docs_style	premise: some shipped version reaches default_version, so the walk found a chain	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the PGXN form was derived from VERSION, not empty	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the VERSION file has a version to compare against	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the changelog sweep found dated release sections	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the control file names a default_version to arrive at	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the post-tag allowance file is present and readable	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the scan read SQL statements from the documents	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the tree has install scripts to check	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the tree ships upgrade scripts to derive the chain from	15;16;17;18;19	never	-
+docs_style	docs_style	premise: the version badge is present	15;16;17;18;19	never	-
+docs_style	docs_style	the how-to keeps its pg_partman section under its own heading	15;16;17;18;19	2026-10-21	docs/how-to.md: a paragraph inserted between the pg_partman heading and its steps
+docs_style	docs_style	the roadmap is in the documentation nav	15;16;17;18;19	2026-10-21	mkdocs.yml: the roadmap nav entry commented out with #
+docs_style	docs_style	the script META.json names is in the published distribution	15;16;17;18;19	2026-10-21	META.json: provides.pgcolumnar.file names pgcolumnar--1.0-alpha3.sql
+docs_style	docs_style	the version badge names no version other than VERSION's	15;16;17;18;19	2026-10-21	badges/version.svg: one of its three version strings left at 1.0-alpha3
 eager_ordering_record	eager_ordering_record	an unsorted rewrite claims no ordering	15;16;17;18;19	2026-10-21	an unsorted rewrite still records a lexicographic run
 eager_ordering_record	eager_ordering_record	and it rewrote no group: the physical layout is unchanged	15;16;17;18;19	2026-10-21	the recluster self-gate never fires
 eager_ordering_record	eager_ordering_record	and records it as a lexicographic run	15;16;17;18;19	2026-10-21	eager vacuum_sorted records no key and no kind (#758)
@@ -1255,6 +1434,48 @@ fsst_verdict_cache	fsst_verdict_cache	premise: the prose corpus KEEPS fsst, so t
 fsst_verdict_cache	fsst_verdict_cache	premise: the prose fixture loaded	15;16;17;18;19	never	-
 fsst_verdict_cache	fsst_verdict_cache	premise: the three changing-column loads all produced bytes to compare	15;16;17;18;19	never	-
 fsst_verdict_cache	fsst_verdict_cache	the cached load returns the same values as heap	15;16;17;18;19	2026-10-21	FSST decode writes symbol 1's bytes for symbol 0
+fuzz	fuzz	every iteration loaded all its rows	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's IS NULL count agrees with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's compound filter agrees with heap	15;16;17;18;19	2026-10-22	columnar_reader.c: the > skip predicate also skips a group whose min is at most the constant
+fuzz	fuzz	every iteration's counts agree with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's date range agrees with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's equality lookup agrees with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's integer range agrees with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's min and max agree with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's storage options read back as set	15;16;17;18;19	2026-10-22	pgcolumnar--1.0-alpha5.sql: set_options stores NULL for chunk_group_row_limit, so the table keeps the default
+fuzz	fuzz	every iteration's sums and averages agree with heap	15;16;17;18;19	never	-
+fuzz	fuzz	every iteration's whole rows agree with heap	15;16;17;18;19	never	-
+fuzz	fuzz	the run covered every iteration	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	every mutant was generated and ran the import	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	no mutant crashed the backend	15;16;17;18;19	2026-10-22	columnar_arrow.c: truncated IPC metadata crashes the backend instead of raising
+fuzz_arrow	fuzz_arrow	no mutant hung the decode	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	no mutant tripped a sanitizer	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	the corpus reached the decoder at all	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	the importer accepts some pristine seed	15;16;17;18;19	never	-
+fuzz_arrow	fuzz_arrow	the seed corpus generator produced files	15;16;17;18;19	never	-
+fuzz_avro	fuzz_avro	control: the valid manifest reaches the decoder (2 entries)	15;16;17;18;19	never	-
+fuzz_avro	fuzz_avro	control: the valid manifest-list reaches the decoder (1 entry)	15;16;17;18;19	never	-
+fuzz_avro	fuzz_avro	every iteration wrote a fresh mutant	15;16;17;18;19	never	-
+fuzz_avro	fuzz_avro	every mutant ran (errors + clean == iters)	15;16;17;18;19	2026-10-22	columnar_avro.c: a file with bad magic loops forever instead of raising
+fuzz_avro	fuzz_avro	no mutant crashed the backend	15;16;17;18;19	2026-10-22	columnar_avro.c: a malformed Avro header crashes the backend instead of raising
+fuzz_avro	fuzz_avro	no mutant hung the decoder	15;16;17;18;19	2026-10-22	columnar_avro.c: a file with bad magic loops forever instead of raising
+fuzz_avro	fuzz_avro	no mutant tripped a sanitizer	15;16;17;18;19	never	-
+fuzz_avro	fuzz_avro	the corpus reached the decoder at all	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	control: a valid listing reaches the parser and reads the object	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	every iteration wrote a fresh mutant	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	every mutant ran (errors + clean == iters)	15;16;17;18;19	2026-10-22	objstore/columnar_objstore_module.c: a non-advancing continuation token crashes the backend instead of raising
+fuzz_listing	fuzz_listing	no mutant crashed the backend	15;16;17;18;19	2026-10-22	objstore/columnar_objstore_module.c: a non-advancing continuation token crashes the backend instead of raising
+fuzz_listing	fuzz_listing	no mutant hung the parser	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	no mutant tripped a sanitizer	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	premise: fixture up	15;16;17;18;19	never	-
+fuzz_listing	fuzz_listing	the corpus reached the parser at all (some mutant errored or accepted)	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	every mutant was generated and ran its three statements	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	no mutant crashed the backend	15;16;17;18;19	2026-10-22	columnar_parquet_reader.c: unparseable Parquet metadata crashes the backend instead of raising
+fuzz_parquet	fuzz_parquet	no mutant hung the decode	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	no mutant tripped a sanitizer	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	the corpus reached the decoder at all	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	the reader renders some pristine seed's schema	15;16;17;18;19	never	-
+fuzz_parquet	fuzz_parquet	the seed corpus generator produced files	15;16;17;18;19	never	-
 generated_columns	generated_columns	stored generated: aggregate matches	15;16;17;18;19	2026-10-21	the flush skips STORED generated columns too, which are materialized
 generated_columns	generated_columns	stored generated: chunk present for attr 2	15;16;17;18;19	2026-10-21	the flush skips STORED generated columns too, which are materialized
 generated_columns	generated_columns	stored generated: filtered scan matches	15;16;17;18;19	2026-10-21	the flush skips STORED generated columns too, which are materialized
@@ -1612,7 +1833,7 @@ harness_selftest	320-a-check-that-could-not-run	premise: the fixtures carry the
 harness_selftest	320-a-check-that-could-not-run	premise: the harness library is where this part thinks it is	15;16;17;18;19	never	-
 harness_selftest	320-a-check-that-could-not-run	premise: the major-verdict mapping evalled out of the runner is callable	15;16;17;18;19	never	-
 harness_selftest	320-a-check-that-could-not-run	premise: the runner defines the classifier this part is about to eval	15;16;17;18;19	never	-
-harness_selftest	320-a-check-that-could-not-run	premise: the sweep read the corpus and found sites to classify	15;16;17;18;19	never	-
+harness_selftest	320-a-check-that-could-not-run	premise: the sweep read the corpus	15;16;17;18;19	never	-
 harness_selftest	320-a-check-that-could-not-run	the original rule flags a bump that records no outcome	15;16;17;18;19	never	-
 harness_selftest	320-a-check-that-could-not-run	the runner calls a clean exit a pass	15;16;17;18;19	never	-
 harness_selftest	320-a-check-that-could-not-run	the runner's INCOMPLETE branch calls the mapping rather than a local flag	15;16;17;18;19	never	-
@@ -2331,7 +2552,7 @@ harness_selftest	480-an-unrunnable-record-names-its-check	premise: and it compar
 harness_selftest	480-an-unrunnable-record-names-its-check	premise: that clean run had a refusal site to be silent ABOUT	15;16;17;18;19	never	-
 harness_selftest	480-an-unrunnable-record-names-its-check	premise: the sweep found unrunnable sites at all	15;16;17;18;19	never	-
 harness_selftest	480-an-unrunnable-record-names-its-check	premise: the sweep tool is present	15;16;17;18;19	never	-
-harness_selftest	480-an-unrunnable-record-names-its-check	the refusal emitters are the two the tree defines	15;16;17;18;19	never	-
+harness_selftest	480-an-unrunnable-record-names-its-check	the refusal emitters are the ones the tree defines	15;16;17;18;19	never	-
 harness_selftest	480-an-unrunnable-record-names-its-check	the sweep EXITS non-zero when it reports a mismatch	15;16;17;18;19	never	-
 harness_selftest	480-an-unrunnable-record-names-its-check	the sweep REPORTS a name the file records only in its refusal branch	15;16;17;18;19	never	-
 harness_selftest	490-a-one-line-body-ends-at-its-own-brace	a body that never closes is NAMED rather than silently swallowing the file	15;16;17;18;19	never	-
@@ -2537,6 +2758,190 @@ harness_selftest	640-every-suite-job-installs-the-extensions	the detector names
 harness_selftest	640-every-suite-job-installs-the-extensions	the detector names a workflow in which it finds no suite job	15;16;17;18;19	2026-10-14	640's _ej_missing without its no-suite-job guard
 harness_selftest	640-every-suite-job-installs-the-extensions	the detector names a workflow it cannot read	15;16;17;18;19	2026-10-14	640's _ej_missing without its unreadable-file guard
 harness_selftest	640-every-suite-job-installs-the-extensions	the suite-running jobs are exactly the five this part knows	15;16;17;18;19	2026-10-14	640's job scan no longer counts a cluster job that runs pytest
+hilbert_curve	hilbert_curve	C0 premise: the battery encoded every case and every point	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C0 premise: the encoder was called once per point	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C1 the Hilbert index set is exactly the contiguous range	15;16;17;18;19	2026-10-21	columnar_curve.c: the transpose clears the top bit of X[0], so curve indices collide
+hilbert_curve	hilbert_curve	C2 consecutive points in memcmp key order are unit-adjacent	15;16;17;18;19	2026-10-21	columnar_curve.c: the transpose clears the top bit of X[0], so curve indices collide
+hilbert_curve	hilbert_curve	C3 every dyadic sub-cube occupies a contiguous run of indices	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave emits the bit rounds lowest first, a permutation whose dyadic sub-cubes are scattered
+hilbert_curve	hilbert_curve	C4a premise: the bridge covered every case and every point	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C4a the full-width key prefix does not move when the low bits change	15;16;17;18;19	2026-10-21	columnar_curve.c: the lowest bit of the last transposed word is folded into the top bit of the first
+hilbert_curve	hilbert_curve	C4a the full-width key prefixes are exactly the index range	15;16;17;18;19	2026-10-21	columnar_curve.c: the transpose clears the top bit of X[0], so curve indices collide
+hilbert_curve	hilbert_curve	C4b consecutive keys decode to unit-adjacent points, re-encoded by the code under test	15;16;17;18;19	2026-10-21	columnar_curve.c: a correct transpose that flips bit 0 of X[0] when ncols == 8 and the low byte of X[3] is 0x5a
+hilbert_curve	hilbert_curve	C4b control: a mutated inverse breaks every round trip the clean one made	15;16;17;18;19	2026-10-21	columnar_curve.c: a correct transpose that flips bit 0 of X[0] when ncols == 8 and the low byte of X[3] is 0x5a
+hilbert_curve	hilbert_curve	C4b premise: 3,000 DISTINCT full-width keys per ncols were round-tripped	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C4b premise: consecutive key pairs were formed	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C4b the published inverse round-trips full-width keys	15;16;17;18;19	2026-10-21	columnar_curve.c: a correct transpose that flips bit 0 of X[0] when ncols == 8 and the low byte of X[3] is 0x5a
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 max	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=1 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=2 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 max	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=3 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=4 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 max	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=5 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=6 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 max	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=7 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 golden Hilbert keys: ncols=8 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C5 the pack bit order: pack(0, 2^63) starts 0x40	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 the pack bit order: pack(2^63, 0) starts 0x80	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=1	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=2	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=3	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=4	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=5	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=6	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=7	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack establishes exactly 8*ncols bytes: ncols=8	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=1	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=2	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=3	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=4	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=5	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=6	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=7	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack sets every bit of the key for an all-ones vector: ncols=8	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=1	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=2	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=3	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=4	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=5	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=6	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=7	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C5 the pack wrote nothing past the key: ncols=8	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave writes one byte past the 8*ncols-byte key
+hilbert_curve	hilbert_curve	C6 ncols == 1 agrees with Z-order over 200,000 random values	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C6 ncols == 1 is the big-endian ordinal over 200,000 random values	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C6 ncols == 1 is the big-endian ordinal: 0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C6 ncols == 1 is the big-endian ordinal: 1	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C6 ncols == 1 is the big-endian ordinal: 2^63	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C6 ncols == 1 is the big-endian ordinal: UINT64_MAX	15;16;17;18;19	2026-10-21	columnar_curve.c: the final mask t loses its lowest bit, so only bit 0 of each transposed word moves
+hilbert_curve	hilbert_curve	C6 premise: the comparison loop ran 200,000 times	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave emits the bit rounds lowest first, a permutation whose dyadic sub-cubes are scattered
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=1 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=2 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=3 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave emits the bit rounds lowest first, a permutation whose dyadic sub-cubes are scattered
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=4 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave emits the bit rounds lowest first, a permutation whose dyadic sub-cubes are scattered
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=5 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave emits the bit rounds lowest first, a permutation whose dyadic sub-cubes are scattered
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=6 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes one byte short of the key
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=7 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 asym	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 lowbit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 max	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave stops after 32 of its 64 rounds
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 mixed	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 tie	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 topbit0	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 unit	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	C7 the Z-order pack is byte-for-byte what it was: ncols=8 zero	15;16;17;18;19	2026-10-21	columnar_curve.c: cluster_pack_interleave zeroes at most 48 bytes, so a 7- or 8-column key is not fully established
+hilbert_curve	hilbert_curve	INSTRUMENT C0 premise: the control battery encoded every case and every point	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C0 premise: the control encoders were called once per point	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C1 control: Z-order is a permutation of the index range	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C1 control: a truncating encoder FAILS the permutation test in every case	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C1 control: the serpentine is a permutation of the index range	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C2 control: Z-order FAILS unit-step adjacency in every multi-column case	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C2 control: the serpentine PASSES unit-step adjacency	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C3 control: Z-order PASSES dyadic contiguity	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT C3 control: the serpentine FAILS dyadic contiguity in every nested case	15;16;17;18;19	never	-
+hilbert_curve	hilbert_curve	INSTRUMENT the control's own pack reproduces the frozen Z-order bytes	15;16;17;18;19	never	-
 iceberg_catalog	iceberg_catalog	a dangling current-snapshot-id is refused (data_corrupted XX001)	15;16;17;18;19	2026-10-21	a dangling current-snapshot-id reads as no current snapshot
 iceberg_catalog	iceberg_catalog	a non-Iceberg JSON object is refused (invalid_parameter_value 22023)	15;16;17;18;19	2026-10-21	any JSON object is read as Iceberg table metadata
 iceberg_catalog	iceberg_catalog	a pg_read_server_files member who is not superuser may read the catalog	15;16;17;18;19	2026-10-21	the Iceberg SRF gate admits only superusers, refusing every pg_read_server_files member
@@ -2549,6 +2954,81 @@ iceberg_catalog	iceberg_catalog	malformed JSON is rejected (22P02), backend surv
 iceberg_catalog	iceberg_catalog	resolves the named current snapshot, not snapshots[0]	15;16;17;18;19	2026-10-21	the resolver returns the first snapshot rather than the one named current
 iceberg_catalog	iceberg_catalog	the decoy snapshot is not returned	15;16;17;18;19	2026-10-21	the resolver returns the first snapshot rather than the one named current
 iceberg_catalog	iceberg_catalog	the first snapshot has no parent (NULL)	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	...and the boundary refusal names the escape	15;16;17;18;19	2026-10-21	columnar_iceberg.c: ice_rebase does not hold a recorded path under the recorded table location
+iceberg_deletes	iceberg_deletes	...and the negative-pos refusal names the negative pos	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a negative position-delete pos is not refused
+iceberg_deletes	iceberg_deletes	...and the null-pos refusal names pos	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position-delete row with a null pos is not refused (the n1 || n2 guard skipped)
+iceberg_deletes	iceberg_deletes	...and the refusal names the type	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a timestamp equality-delete column is mapped to text instead of refused
+iceberg_deletes	iceberg_deletes	a cross-spec partition-scoped delete applies to nothing (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition-scoped equality delete applies across partition spec ids
+iceberg_deletes	iceberg_deletes	a data file lacking partition_spec_id is refused under a partitioned delete (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a data file without partition_spec_id is not refused under a partition-scoped delete
+iceberg_deletes	iceberg_deletes	a delete older than the data (lower seq) does not apply (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies whatever its sequence number
+iceberg_deletes	iceberg_deletes	a delete scoped to an empty partition deletes nothing (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition-scoped equality delete ignores the partition value
+iceberg_deletes	iceberg_deletes	a dotdot-escaping delete path is refused (22023)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: ice_rebase does not re-check containment after canonicalize_path
+iceberg_deletes	iceberg_deletes	a manifest list without partition_spec_id is refused for equality deletes (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete whose manifest list carries no partition_spec_id is not refused
+iceberg_deletes	iceberg_deletes	a never-applicable equality delete is skipped, not validated (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete at the oldest data file's sequence number is not skipped before validation
+iceberg_deletes	iceberg_deletes	a never-applicable equality delete without equality_ids is skipped (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete at the oldest data file's sequence number is not skipped before validation
+iceberg_deletes	iceberg_deletes	a null delete value matches only null data values	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a null equality-delete value matches any data value (comparing the null Datum kills the backend)
+iceberg_deletes	iceberg_deletes	a partition spec without its fields key is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition spec without a fields array is not refused (a NULL deref kills the backend)
+iceberg_deletes	iceberg_deletes	a partition-scoped delete with an uncomparable partition value is refused (0A000)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition-scoped equality delete with an uncomparable partition tuple is not refused
+iceberg_deletes	iceberg_deletes	a partition-scoped equality delete applies only to its partition	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition-scoped equality delete ignores the partition value
+iceberg_deletes	iceberg_deletes	a position delete naming a different data file deletes nothing (5 rows)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies to every data file, not only the one it names
+iceberg_deletes	iceberg_deletes	a position delete of ordinal 0 deletes the first row (id 1 gone, 4 remain)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	a position delete with a negative pos is refused (XX001, not cast inert)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a negative position-delete pos is not refused
+iceberg_deletes	iceberg_deletes	a position delete with a null pos is refused (XX001, not silently dropped)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position-delete row with a null pos is not refused (the n1 || n2 guard skipped)
+iceberg_deletes	iceberg_deletes	a position delete with an inherited (null-entry) sequence number applies	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	a v1 manifest without a sequence_number column reads (default 0, 5 rows)	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	an EXISTING entry with a null sequence number is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an EXISTING (status 0) manifest entry with a null sequence number is not refused
+iceberg_deletes	iceberg_deletes	an equality column missing from the data file errors (22023)	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	an equality delete at an equal sequence number does not apply	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete applies at an equal sequence number (both the pre-skip and the per-file strict < relaxed to <=)
+iceberg_deletes	iceberg_deletes	an equality delete on an unsupported column type is refused (0A000)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a timestamp equality-delete column is mapped to text instead of refused
+iceberg_deletes	iceberg_deletes	an equality delete without equality_ids is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete without equality_ids is not refused
+iceberg_deletes	iceberg_deletes	an equality-delete path outside the table location is refused (22023)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: ice_rebase does not hold a recorded path under the recorded table location
+iceberg_deletes	iceberg_deletes	an equality_ids value beyond int32 refuses the manifest (XX001)	15;16;17;18;19	2026-10-21	columnar_avro.c: an equality_ids value beyond int32 is not refused (truncated)
+iceberg_deletes	iceberg_deletes	backend still up after the audit arms	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition spec without a fields array is not refused (a NULL deref kills the backend)
+iceberg_deletes	iceberg_deletes	backend still up after the bad-sequence refusal	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	backend still up after the equality applications	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a null equality-delete value matches any data value (comparing the null Datum kills the backend)
+iceberg_deletes	iceberg_deletes	backend still up after the equality refusals	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	backend still up after the negative-pos refusal	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	backend still up after the null-pos refusal	15;16;17;18;19	2026-10-21	columnar_iceberg.c: abort() in place of the null-pos refusal
+iceberg_deletes	iceberg_deletes	columns beyond equality_ids are ignored for matching	15;16;17;18;19	2026-10-21	columnar_iceberg.c: no equality-delete row ever matches
+iceberg_deletes	iceberg_deletes	equality delete drops matching rows (survivors == oracle)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: no equality-delete row ever matches
+iceberg_deletes	iceberg_deletes	equality deletes apply when the delete column is not projected	15;16;17;18;19	2026-10-21	columnar_iceberg.c: no equality-delete row ever matches
+iceberg_deletes	iceberg_deletes	exactly the two deleted rows were removed (5 - 2 = 3)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	multi-column equality matches all columns (AND, not OR)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: an equality delete compares only its first equality column (multi-column match becomes first-column)
+iceberg_deletes	iceberg_deletes	multiple equality-delete files apply their union	15;16;17;18;19	2026-10-21	columnar_iceberg.c: no equality-delete row ever matches
+iceberg_deletes	iceberg_deletes	position and equality deletes combine	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	position deletes apply under column projection (id only -> 1,3,5)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	position deletes drop the listed rows (surviving == oracle)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	the data file has 5 rows before deletes	15;16;17;18;19	never	-
+iceberg_deletes	iceberg_deletes	the deleted ids (2, 4) are gone	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies only when strictly newer than the data (> where the spec says >=)
+iceberg_deletes	iceberg_deletes	the null-region row is gone, the non-null rows remain	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a null equality-delete value matches any data value (comparing the null Datum kills the backend)
+iceberg_deletes	iceberg_deletes	the us-partition rows survive an eu-scoped delete	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a partition-scoped equality delete ignores the partition value
+iceberg_deletes	iceberg_deletes	the would-be-deleted ids survive when the delete is older than the data	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a position delete applies whatever its sequence number
+iceberg_dv	iceberg_dv	...and the refusal names the compressed footer	15;16;17;18;19	2026-10-21	columnar_puffin.c: a compressed Puffin footer (flags bit 0) is not refused
+iceberg_dv	iceberg_dv	...and the refusal names the format version	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a deletion vector in a format-version 2 table is not refused
+iceberg_dv	iceberg_dv	a DV blob declaring a compression codec is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a deletion-vector blob may declare a compression codec
+iceberg_dv	iceberg_dv	a DV entry without referenced_data_file is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV without referenced_data_file is not refused (a NULL path reaches strcmp and the backend dies)
+iceberg_dv	iceberg_dv	a DV whose offset+size overflows int64 is refused, not read (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a DV's offset and size are not bounded by the blob region (a wild read kills the backend)
+iceberg_dv	iceberg_dv	a DV with run containers and a high-bucket position decodes	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies only when strictly newer than the data (> where the spec says >=)
+iceberg_dv	iceberg_dv	a Puffin path outside the table location is refused (22023)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: ice_open_path does not hold a path under the table location
+iceberg_dv	iceberg_dv	a bitset-container DV decodes	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies only when strictly newer than the data (> where the spec says >=)
+iceberg_dv	iceberg_dv	a compressed Puffin footer is refused (0A000)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a compressed Puffin footer (flags bit 0) is not refused
+iceberg_dv	iceberg_dv	a corrupted DV CRC is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a deletion vector's CRC-32 is not checked
+iceberg_dv	iceberg_dv	a deletion vector at an equal sequence number applies (survivors == oracle)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies only when strictly newer than the data (> where the spec says >=)
+iceberg_dv	iceberg_dv	a deletion vector in a format-version 2 table is refused (0A000)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a deletion vector in a format-version 2 table is not refused
+iceberg_dv	iceberg_dv	a deletion vector older than the data does not apply	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies whatever its sequence number (dv->seq >= d->seq always true)
+iceberg_dv	iceberg_dv	a manifest/footer offset mismatch is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: the Puffin footer's blob need not match the manifest's offset and length (the !found refusal skipped)
+iceberg_dv	iceberg_dv	a record_count that disagrees with the DV cardinality is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a manifest record_count that disagrees with the DV cardinality is not refused
+iceberg_dv	iceberg_dv	a run container overflowing its 16-bit range is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a run container whose start+length passes 0x10000 is not refused
+iceberg_dv	iceberg_dv	a run-optimized DV (cookie 12347) decodes	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies only when strictly newer than the data (> where the spec says >=)
+iceberg_dv	iceberg_dv	a wrong DV blob magic is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_puffin.c: a deletion vector's magic sequence is not checked
+iceberg_dv	iceberg_dv	an aliased duplicate DV (scheme vs no scheme) is refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: the one-DV-per-data-file check compares paths without stripping the file:// scheme
+iceberg_dv	iceberg_dv	an applicable DV supersedes position-delete files for its data file	15;16;17;18;19	2026-10-21	columnar_iceberg.c: position-delete files apply even when a DV applies (no supersede)
+iceberg_dv	iceberg_dv	backend still up after the DV applications	15;16;17;18;19	never	-
+iceberg_dv	iceberg_dv	backend still up after the DV refusals	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV without referenced_data_file is not refused (a NULL path reaches strcmp and the backend dies)
+iceberg_dv	iceberg_dv	backend still up after the audit arms	15;16;17;18;19	2026-10-21	columnar_puffin.c: a DV's offset and size are not bounded by the blob region (a wild read kills the backend)
+iceberg_dv	iceberg_dv	supersede is per data file, not global	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies to every data file, not only the one it references
+iceberg_dv	iceberg_dv	two DV blobs in one Puffin file each apply to their own data file	15;16;17;18;19	2026-10-21	columnar_iceberg.c: a DV applies to every data file, not only the one it references
+iceberg_dv	iceberg_dv	two DV entries for one data file are refused (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg.c: two DVs for one data file are not refused
 iceberg_fdw_estimate	iceberg_fdw_estimate	a filtered scan estimates fewer rows than the whole table (selectivity applied)	15;16;17;18;19	2026-10-21	the Iceberg FDW sets rows directly, so the scan's selectivity never applies
 iceberg_fdw_estimate	iceberg_fdw_estimate	backend alive	15;16;17;18;19	never	-
 iceberg_fdw_estimate	iceberg_fdw_estimate	the FDW estimates a positive row count from the manifests	15;16;17;18;19	never	-
@@ -2636,24 +3116,47 @@ iceberg_objstore	iceberg_objstore	name mapping reads an id-less file over s3 (5
 iceberg_objstore	iceberg_objstore	position deletes read over s3 (surviving == filesystem oracle)	15;16;17;18;19	2026-10-21	columnar_objstore_module.c: os_check_endpoint_allowed refuses every endpoint, the listed one included
 iceberg_objstore	iceberg_objstore	premise: sigv4 fixture server is up	15;16;17;18;19	never	-
 iceberg_objstore	iceberg_objstore	the position-deleted ids are gone over s3	15;16;17;18;19	2026-10-21	columnar_objstore_module.c: os_check_endpoint_allowed refuses every endpoint, the listed one included
+iceberg_rest	iceberg_rest	a catalog endpoint off the allow-list is refused (42501)	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: every address reads as link-local and the allow-list is gone
+iceberg_rest	iceberg_rest	a link-local catalog host is refused even if allow-listed (42501)	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: the allow-list refuses every endpoint and the link-local refusal is gone
+iceberg_rest	iceberg_rest	a non-object catalog config is refused, not walked (XX001)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a non-object /v1/config body is not refused
+iceberg_rest	iceberg_rest	a wrong bearer token is refused (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a catalog 401/403 is not mapped to 28000
+iceberg_rest	iceberg_rest	an anonymous request to a token-protected catalog is refused (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a catalog 401/403 is not mapped to 28000
+iceberg_rest	iceberg_rest	an over-cap catalog response is refused (54000)	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: os_slurp_body does not refuse an advertised length over the cap
+iceberg_rest	iceberg_rest	an unknown table surfaces a clean not-found (42P01)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a catalog 404 is not mapped to 42P01
+iceberg_rest	iceberg_rest	backend still up after the REST refusals	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the backend aborts on a catalog 404 (abort() before the 42P01 refusal)
+iceberg_rest	iceberg_rest	loadTable resolves the current metadata-location	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
+iceberg_rest	iceberg_rest	premise: rest fixture server is up	15;16;17;18;19	never	-
+iceberg_rest	iceberg_rest	premise: the PG server log holds lines to search	15;16;17;18;19	never	-
+iceberg_rest	iceberg_rest	the loadTable request carried an Authorization header	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the bearer token also travels in the request URL's query string
+iceberg_rest	iceberg_rest	the token never appears in the server (PG) log	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: rest_get_json logs the bearer token (elog LOG)
+iceberg_rest	iceberg_rest	the token value never appears in the catalog request log	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the bearer token also travels in the request URL's query string
+iceberg_rest_scan	iceberg_rest_scan	backend still up after the REST read	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the backend aborts on a catalog 404 (abort() before the 42P01 refusal)
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_namespaces lists the catalog's namespaces	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: iceberg_rest_namespaces drops the catalog's last namespace
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_scan matches iceberg_scan of the same table (same oracle)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_scan of an unknown table is a clean not-found (42P01)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a catalog 404 is not mapped to 42P01
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_scan projects and reorders by field id (amount, id)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_scan returns the five current-snapshot rows	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
+iceberg_rest_scan	iceberg_rest_scan	iceberg_rest_tables lists a namespace's tables	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
+iceberg_rest_scan	iceberg_rest_scan	premise: rest fixture server is up	15;16;17;18;19	never	-
+iceberg_rest_scan	iceberg_rest_scan	the catalog reports the relocated metadata location	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: no Authorization header is ever sent
 iceberg_rest_server	iceberg_rest_server	a catalog_uri option on the USER MAPPING is rejected (HV00D)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	a half OAuth2 credential (id, no secret) is refused before any request (28000)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	a link-local oauth_token_uri is refused by the allow-list (42501)	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	a half OAuth2 credential (id, no secret) is refused before any request (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a half OAuth2 credential (id, no secret) is not refused, so the mint runs with a NULL secret and the backend dies
+iceberg_rest_server	iceberg_rest_server	a link-local oauth_token_uri is refused by the allow-list (42501)	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: an endpoint off pgcolumnar.objstore_allowed_endpoints is not refused
 iceberg_rest_server	iceberg_rest_server	a non-superuser with no token mapping is refused (28000) despite the environment token, before any request	15;16;17;18;19	2026-10-15	the REST resolver letting every role borrow the environment token
 iceberg_rest_server	iceberg_rest_server	a server with an OAuth2 mapping reads by a minted bearer	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	a token option on the SERVER is rejected (HV00D)	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	a warehouse option on the SERVER is accepted (not HV00D)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	a warehouse-configured server resolves a table location	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	a warehouse-configured server resolves a table location	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the USER MAPPING token option is ignored
 iceberg_rest_server	iceberg_rest_server	a wrong OAuth2 client secret is refused (28000)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	a wrong mapping token is refused (28000)	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	a wrong mapping token is refused (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: abort() in place of the catalog's 401/403 refusal
 iceberg_rest_server	iceberg_rest_server	an oauth option on the SERVER is rejected (HV00D)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	an off-allow-list oauth_token_uri host is refused (42501)	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	an off-allow-list oauth_token_uri host is refused (42501)	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: an endpoint off pgcolumnar.objstore_allowed_endpoints is not refused
 iceberg_rest_server	iceberg_rest_server	and it cannot mark its own mapping credentials_required false (42501)	15;16;17;18;19	2026-10-15	the catalog validator letting a non-superuser set credentials_required false
-iceberg_rest_server	iceberg_rest_server	backend still up	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	backend still up	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: a half OAuth2 credential (id, no secret) is not refused, so the mint runs with a NULL secret and the backend dies
 iceberg_rest_server	iceberg_rest_server	control: with credentials_required false set by a superuser, the same role reads by the environment token	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	iceberg_rest_table_location('cat',...) reads via the mapping token	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	iceberg_rest_table_location('cat',...) reads via the mapping token	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the USER MAPPING token option is ignored
 iceberg_rest_server	iceberg_rest_server	loadTable then carried the minted bearer (Authorization present)	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	no mapping and no env token is refused, not bypassed (28000)	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	no mapping and no env token is refused, not bypassed (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: abort() in place of the catalog's 401/403 refusal
 iceberg_rest_server	iceberg_rest_server	oauth options are accepted on a USER MAPPING (no error)	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	premise: rest fixture up	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	premise: the PG server log holds lines to search, for the client secret	15;16;17;18;19	never	-
@@ -2663,8 +3166,18 @@ iceberg_rest_server	iceberg_rest_server	the catalog-URI form still works with th
 iceberg_rest_server	iceberg_rest_server	the client secret never appears in the PG server log	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	the client secret never appears in the fixture request log	15;16;17;18;19	never	-
 iceberg_rest_server	iceberg_rest_server	the mapping token never appears in the PG server log	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	the request carried an Authorization header	15;16;17;18;19	never	-
-iceberg_rest_server	iceberg_rest_server	the warehouse was sent on GET /v1/config (?warehouse=wh1)	15;16;17;18;19	never	-
+iceberg_rest_server	iceberg_rest_server	the request carried an Authorization header	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the USER MAPPING token option is ignored
+iceberg_rest_server	iceberg_rest_server	the warehouse was sent on GET /v1/config (?warehouse=wh1)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the warehouse server option is never sent on GET /v1/config
+iceberg_rest_vended	iceberg_rest_vended	a table vending no creds still reads with ambient (cfg NULL path)	15;16;17;18;19	never	-
+iceberg_rest_vended	iceberg_rest_vended	a wrong vended secret is refused by S3, not bypassed (28000)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: vended credentials are never built, so every read falls back to ambient
+iceberg_rest_vended	iceberg_rest_vended	backend still up after the vended-credential arms	15;16;17;18;19	2026-10-21	objstore/columnar_objstore_module.c: abort() in place of the HTTP 403 refusal
+iceberg_rest_vended	iceberg_rest_vended	iceberg_rest_scan reads via vended credentials (no ambient creds set)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: vended credentials are never built, so every read falls back to ambient
+iceberg_rest_vended	iceberg_rest_vended	premise: the PG server log holds lines to search	15;16;17;18;19	never	-
+iceberg_rest_vended	iceberg_rest_vended	premise: the SigV4 S3 fixture is up	15;16;17;18;19	never	-
+iceberg_rest_vended	iceberg_rest_vended	storage-credentials longest-prefix match selects the right creds	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: rest_vended_cfg never reads the storage-credentials array and signs with the flat config
+iceberg_rest_vended	iceberg_rest_vended	the vended secret never appears in the PG server log	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: the vended secret is written to the server log
+iceberg_rest_vended	iceberg_rest_vended	the vended secret never appears in the S3 request log	15;16;17;18;19	never	-
+iceberg_rest_vended	iceberg_rest_vended	vended creds for an off-allow-list endpoint are refused (42501)	15;16;17;18;19	2026-10-21	columnar_iceberg_rest.c: vended credentials are never built, so every read falls back to ambient
 iceberg_scan	iceberg_scan	a column renamed in the schema still reads by field id (amt2 = amount)	15;16;17;18;19	2026-10-21	iceberg_scan resolves output columns by position rather than field id
 iceberg_scan	iceberg_scan	a pg_read_server_files member who is not superuser may scan	15;16;17;18;19	2026-10-21	iceberg_scan admits only superusers, refusing every pg_read_server_files member
 iceberg_scan	iceberg_scan	an output column not in the schema is refused (42703)	15;16;17;18;19	2026-10-21	iceberg_scan does not refuse an output column the schema lacks
@@ -2876,6 +3389,74 @@ local_open_race_free	local_open_race_free	the partition coordinator never stats
 local_open_race_free	local_open_race_free	the partition coordinator opens O_NONBLOCK (a FIFO cannot block its open)	15;16;17;18;19	2026-10-21	the partition coordinator opens without O_NONBLOCK
 local_open_race_free	local_open_race_free	the race-free opener exists	15;16;17;18;19	never	-
 local_open_race_free	local_open_race_free	the racy stat-before-open helper is gone	15;16;17;18;19	2026-10-21	the racy PgColumnarRejectNonRegularFile helper comes back
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	CONTROL: the columnar table itself still emits nothing	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	a DELETE captures the OLD values, which are gone from the table	15;16;17;18;19	2026-10-21	docs/user-guide.md: the recipe's trigger fires on INSERT OR UPDATE only, not DELETE
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	a bulk load writes exactly one capture row per loaded row	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	a rolled-back transaction captures nothing	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	a row trigger on a COLUMNAR table fires once per inserted row	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	an UPDATE captures exactly one row	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_update leaves the old row version live
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and it is recorded as UPDATE with the NEW value	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_update writes its new row version with every column null
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and it saw the same values the table holds	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and leaves no row in the columnar table either	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and the DELETE as a DELETE	15;16;17;18;19	2026-10-21	docs/user-guide.md: the recipe's trigger fires on INSERT OR UPDATE only, not DELETE
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and the rolled-back row is not in the stream	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	and the row really is gone from the columnar table	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_delete marks nothing deleted
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	inside the transaction the row was captured and is in the columnar table, before the rollback	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	nor the storage's internal INSERT	15;16;17;18;19	2026-10-21	docs/user-guide.md: the recipe's capture records every non-DELETE change as an INSERT
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	one decoded capture row per captured change	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: FOR ALL TABLES really does include pgcolumnar's internal tables	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: and it is the whole block, not a fragment	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: events is a COLUMNAR table	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: events_cdc is a HEAP table	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [CREATE FUNCTION events_capture]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [CREATE TABLE events]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [CREATE TABLE events_cdc]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [CREATE TRIGGER events_cdc_t]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [OLD.id]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [TG_OP = 'DELETE']	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extracted recipe contains [USING pgcolumnar]	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the extraction is not empty	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the guide is where this suite expects it	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the identical insert COMMITTED does capture, so the arm above is real	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the same matcher finds the INSERTs, so a 1 above is a real match	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the server is running at wal_level=logical	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the slot decoded something at all	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	premise: the slot exists and is logical	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	the capture table IS carried by the slot	15;16;17;18;19	never	-
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	the decoded stream carries the UPDATE as an UPDATE	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_update leaves the old row version live
+logical_decoding_cdc_recipe	logical_decoding_cdc_recipe	the update did NOT leak the storage's internal DELETE	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	100x the rows does not give 100x the internal records	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	CONTROL: the heap table's 50 inserts ARE decoded	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	CONTROL: the second slot decodes the heap table's 5000 inserts	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	a columnar table emits no decodable change	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	although the rows are there	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	and it too emits no decodable change of its own	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	premise: both tables hold the same 50 rows	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	premise: the 100x table really holds 100x the rows	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	premise: the server is running at wal_level=logical	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	premise: the slot decoded something at all	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	premise: the slot exists and is logical	15;16;17;18;19	never	-
+logical_decoding_source	logical_decoding_source	the slot carries pgcolumnar's internal catalog instead	15;16;17;18;19	never	-
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR NO KEY UPDATE is not told about replication	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR NO KEY UPDATE keeps the generic message	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR SHARE is not told about replication	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR SHARE keeps the generic message	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR UPDATE is not told about replication	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	an ordinary SELECT ... FOR UPDATE keeps the generic message	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock raises the replication error for every row lock, not only the apply worker's
+logical_subscriber	logical_subscriber	insert-only: initial sync copied every row	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_multi_insert raises in a logical worker, so initial sync's COPY fails
+logical_subscriber	logical_subscriber	insert-only: no apply errors	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_insert raises in a logical worker, so streamed INSERTs fail
+logical_subscriber	logical_subscriber	insert-only: streamed INSERTs applied	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_insert raises in a logical worker, so streamed INSERTs fail
+logical_subscriber	logical_subscriber	insert-only: the UPDATE is skipped by design, not applied	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_insert raises in a logical worker, so streamed INSERTs fail
+logical_subscriber	logical_subscriber	it retries rather than giving up, so the subscription is wedged	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock never takes the IsLogicalWorker() branch, so the apply worker gets the generic row-locking error
+logical_subscriber	logical_subscriber	premise: the lock fixture really is columnar	15;16;17;18;19	never	-
+logical_subscriber	logical_subscriber	premise: the publisher has logical decoding on	15;16;17;18;19	never	-
+logical_subscriber	logical_subscriber	premise: the subscriber cluster answers	15;16;17;18;19	never	-
+logical_subscriber	logical_subscriber	premise: the subscriber loaded pgcolumnar	15;16;17;18;19	never	-
+logical_subscriber	logical_subscriber	the error does NOT say only 'row locking is not supported'	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock never takes the IsLogicalWorker() branch, so the apply worker gets the generic row-locking error
+logical_subscriber	logical_subscriber	the error names logical replication, not row locking	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_tuple_lock never takes the IsLogicalWorker() branch, so the apply worker gets the generic row-locking error
+logical_subscriber	logical_subscriber	the hint names the insert-only publication	15;16;17;18;19	2026-10-21	columnar_tableam.c: the apply worker's hint stops naming CREATE PUBLICATION ... WITH (publish = 'insert')
+logical_subscriber	logical_subscriber	the second subscription synced before the UPDATE	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_multi_insert raises in a logical worker, so initial sync's COPY fails
+logical_subscriber	logical_subscriber	the wedge is real: the row is still unchanged on the subscriber	15;16;17;18;19	2026-10-21	columnar_tableam.c: pgcolumnar_multi_insert raises in a logical worker, so initial sync's COPY fails
 maintenance_crash	maintenance_crash	after a crash with compact committed, the index reads the rows the scan reads	15;16;17;18;19	2026-10-16	pgcolumnar_index_fetch_tuple finds no row (columnar_tableam.c)
 maintenance_crash	maintenance_crash	after a crash with compact committed, the table is as compact left it, with the same rows	15;16;17;18;19	never	-
 maintenance_crash	maintenance_crash	after a crash with compact uncommitted, the index reads the rows the scan reads	15;16;17;18;19	2026-10-16	pgcolumnar_index_fetch_tuple finds no row (columnar_tableam.c)
diff --git a/test/check_ledger_budget.txt b/test/check_ledger_budget.txt
index 2970fed4d..87b7fef53 100644
--- a/test/check_ledger_budget.txt
+++ b/test/check_ledger_budget.txt
@@ -15,7 +15,7 @@
 #
 #   Adding a check to a suite that is already covered does not move it, which is
 #   what makes it safe to bound.
-suites_not_covered 102
+suites_not_covered 85
 #
 # checks_never_observed_red -- A CENSUS. NOT a ceiling, and it must not become
 #   one.
@@ -5439,4 +5439,311 @@ suites_not_covered 102
 #     never         3883 + 1 = 3884
 #     dated         2282 + 4 = 2286
 #     3884 + 2286 == 6170
-checks_never_observed_red 3884
+# #1341, iceberg_dv seeded, with its twin (OffgridwithJD): 3884 -> 3885, and
+# suites_not_covered 102 -> 101. The suite had no rows. It enters with 26 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after two fixes.
+# "a manifest/footer offset mismatch is refused (XX001)" read the SQLSTATE alone, and
+# several guards here raise XX001: with the offset match removed a later XX001 refused
+# the same file, and main's shell passed 26/26. Every refusal now reads its own guard's
+# message. And the three "backend still up" checks read SELECT 1, which answers again
+# after crash recovery: with the referenced_data_file check removed a backend died on
+# the arm, and main passed the survival check. They now also read the server log's
+# count of killed backends, and each refusal waits for the server first, so a crash
+# reddens its own arm and its section's survival check and nothing else. 25 are dated by
+# seventeen mutations, each reddening the same names in both twins. 1 arrives never:
+# the survival check after the DV applications, which no mutation crashed.
+#
+#     ledger rows   6170 + 26 = 6196
+#     never         3884 + 1 = 3885
+#     dated         2286 + 25 = 2311
+#     3885 + 2311 == 6196
+#
+# #1341, logical_decoding_source seeded, with its twin (OffgridwithJD): 3885 -> 3897,
+# and suites_not_covered 101 -> 100. The suite had no rows. It enters with its 12
+# checks, all green on each of 15-19 in shell and twin alike. The missing-plugin name
+# pgc_skip records is now a literal both twins share, but it is a skip, not a check, so
+# it has no row: CI has test_decoding and never emits it. After one fix.
+# The second slot had no heap control: created after the 5000-row insert, it decoded
+# nothing, and "it too emits no decodable change" and "100x the rows does not give 100x
+# the internal records" (0 < anything) both passed, 11/11 on main. A heap table now writes
+# through that slot in the same window and must decode its 5000 inserts, and the ratio
+# check refuses a slot that carried no internal records. Under that harness mutation both
+# are red in both twins. No source mutation reddens a check: the claim is that pgcolumnar
+# writes nothing logical decoding can read, and a default chunk group of 100 rows still
+# keeps the internal records following groups (114 for 50 groups, under the 10x bound).
+# 0 are dated. 12 arrive never.
+#
+#     ledger rows   6196 + 12 = 6208
+#     never         3885 + 12 = 3897
+#     dated         2311 + 0 = 2311
+#     3897 + 2311 == 6208
+#
+# #1341, iceberg_deletes seeded, with its twin (OffgridwithJD): 3897 -> 3903, and
+# suites_not_covered 100 -> 99. The suite had no rows. It enters with 49 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after one fix.
+# The six "backend still up" checks read SELECT 1, which answers again after crash
+# recovery: with abort() in place of the null-pos refusal, or the partition spec's
+# fields guard removed (a segfault), main's shell passed the survival check once
+# recovery had finished. They now also read the server log's count of killed
+# backends, and every reading waits for the server first, so a crash reddens its own
+# arm and its section's survival check, not the two arms after it. Every refusal now
+# also reads its own guard's message (XX001 and 22023 are shared), and the oracle
+# comparisons refuse an empty side. 43 are dated by twenty-three mutations, each reddening
+# the same names in both twins. The equal-sequence equality check is dated only by
+# relaxing both of its layered guards: the per-file strict < alone passed, because the
+# pre-skip at the oldest data file's sequence number already drops that delete.
+# 6 arrive never.
+#
+#     ledger rows   6208 + 49 = 6257
+#     never         3897 + 6 = 3903
+#     dated         2311 + 43 = 2354
+#     3903 + 2354 == 6257
+#
+# #1341, logical_subscriber seeded, with its twin (OffgridwithJD): 3903 -> 3907,
+# and suites_not_covered 99 -> 98. The suite had no rows. It enters with 20 checks
+# from five-major runs (all green on each of 15-19, shell and twin alike), after four fixes.
+# With the insert-only subscription disabled before its UPDATE, main's shell passed 20/20:
+# "skipped by design" and "no apply errors" read after a fixed sleep, and nothing applied
+# is nothing applied wrongly. An INSERT after the UPDATE must now arrive first. With no
+# UPDATE sent, "does NOT say only 'row locking'" and "the wedge is real" passed; the first
+# now needs the replication error in the log, the second reads publisher -> subscriber.
+# With the lock statements failing on a missing table, the three "is not told about
+# replication" checks passed; they now need the generic error first. And the second
+# subscription's sync check lost its premise prefix: COPY failing in a logical worker
+# reddens it. The lock loop is unrolled so the twin grader reads each name.
+# 16 are dated by five mutations, each reddening the same names in both twins. 4
+# arrive never.
+#
+#     ledger rows   6257 + 20 = 6277
+#     never         3903 + 4 = 3907
+#     dated         2354 + 16 = 2370
+#     3907 + 2370 == 6277
+#
+# #1341, logical_decoding_cdc_recipe seeded, with its twin (OffgridwithJD): 3907 -> 3936,
+# and suites_not_covered 98 -> 97. The suite had no rows. It enters with its 36 checks from five-major
+# runs (all green on each of 15-19, shell and twin alike), after two fixes. The
+# missing-plugin name pgc_skip records is a skip, not a check, so it has no row: CI has
+# test_decoding and never emits it. The rollback arm read the capture count
+# and the row after ROLLBACK only, so a rolled-back INSERT that never ran passed both arms:
+# with it made a duplicate key, main passed 35/35. A reading inside the transaction, before
+# the rollback, now requires the row captured and present. And "it saw the same values the
+# table holds" compared two readings with check, so with the server gone "" = "" passed; it
+# is check_text. The recipe-contains premises are unrolled into literal names. Three
+# table-AM mutations and two mutations of the guide's own recipe date checks, each red by the
+# same names in both twins. 7 are dated. 29 arrive never.
+#
+#     ledger rows   6277 + 36 = 6313
+#     never         3907 + 29 = 3936
+#     dated         2370 + 7 = 2377
+#     3936 + 2377 == 6313
+#
+# #1341, iceberg_rest seeded, with its twin (OffgridwithJD): 3936 -> 3938, and
+# suites_not_covered 97 -> 96. The suite had no rows. It enters with 14 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after two fixes.
+# The 42501 arms read the SQLSTATE alone, and two guards raise 42501: with the allow-list
+# refusing everything and the link-local refusal gone, "a link-local catalog host is
+# refused" passed on the allow-list's 42501, and with every address read as link-local
+# and the allow-list gone, "a catalog endpoint off the allow-list is refused" passed on
+# the link-local guard's. Every refusal now reads its own guard's message. And "backend
+# still up after the REST refusals" read SELECT 1, which answers again after crash
+# recovery: with the backend aborting on the catalog's 404, main passed it. It now also
+# reads the server log's count of killed backends. 12 are dated by eleven mutations,
+# each reddening the same names in both twins. 2 arrive never: the two premises.
+#
+#     ledger rows   6313 + 14 = 6327
+#     never         3936 + 2 = 3938
+#     dated         2377 + 12 = 2389
+#     3938 + 2389 == 6327
+#
+# #1341, iceberg_rest_scan seeded, with its twin (OffgridwithJD): 3938 -> 3939, and
+# suites_not_covered 96 -> 95. The suite had no rows. It enters with 9 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after one fix.
+# "backend still up after the REST read" read SELECT 1, which answers again after crash
+# recovery: with the backend aborting on the catalog's 404 and the probe 3s later, main
+# passed it. It now also reads the server log's count of killed backends, and the
+# not-found arm reads the catalog's own 404 message. 8 are dated by five mutations,
+# each reddening the same names in both twins. 1 arrives never: the premise.
+#
+#     ledger rows   6327 + 9 = 6336
+#     never         3938 + 1 = 3939
+#     dated         2389 + 8 = 2397
+#     3939 + 2397 == 6336
+#
+# #1341, iceberg_rest_vended seeded, with its twin (OffgridwithJD): 3939 -> 3943, and
+# suites_not_covered 95 -> 94. The suite had no rows. It enters with 10 checks from
+# five-major runs (all green on each of 15-19, shell and twin alike), after three fixes.
+# The longest-prefix arm passed with the storage-credentials array never read: the
+# catalog's flat config carried the same right credentials, so the fixture's flat config
+# is now wrong too. The wrong-secret arm read 28000 alone, which "no credentials" also
+# raises: with vended credentials never built, it passed; it now needs the 403 message.
+# The survival check read SELECT 1: with abort() in place of the 403 refusal it passed;
+# it now also reads the server log's count of killed backends. 6 are dated by six
+# mutations, each reddening the same names in both twins. 4 arrive never.
+#
+#     ledger rows   6336 + 10 = 6346
+#     never         3939 + 4 = 3943
+#     dated         2397 + 6 = 2403
+#     3943 + 2403 == 6346
+#
+# #1341, iceberg_rest_server's twin (OffgridwithJD): 3943 -> 3933. The suite
+# already had its 29 rows; none is added. Four fixes in the shell, mirrored in
+# the twin. "backend still up" read SELECT 1: with the half-credential guard removed
+# (the backend segfaults) or abort() in place of the 401 refusal, it passed; it now
+# also reads the server log's count of killed backends, and every reading waits for
+# the server first. The two "accepted" arms read an empty SQLSTATE, which a stopped
+# server also gives, so with the server stopped both passed; a statement that ran now
+# reads "ok". "refused by the allow-list (42501)" read the SQLSTATE alone, and the
+# link-local guard raises 42501 too: with the allow-list removed it passed. Every
+# refusal now needs its own message, and the half-credential arm also counts the
+# fixture's requests. 10 more rows are dated by five mutations, each reddening the
+# same names in both twins.
+#
+#     ledger rows   6346 + 0 = 6346
+#     never         3943 - 10 = 3933
+#     dated         2403 + 10 = 2413
+#     3933 + 2413 == 6346
+#
+# #1341, hilbert_curve seeded, with its twin (OffgridwithJD): 3933 -> 3949, and
+# suites_not_covered 94 -> 93. The suite had no rows. It enters with its 184
+# checks from five-major runs, 184/184 in the shell and in the twin on each of 15-19.
+# Seventeen mutations of src/columnar_curve.c each reddened checks in the shell on
+# main, and between them every arm but the six premises and the ten INSTRUMENT
+# controls, which link nothing from src/ by design. Two shell changes. The battery
+# now fills every key buffer with 0xa5 before the pack writes it: under a memset one
+# byte short, which goldens went red depended on what the previous call had left in
+# the buffer (121 red on main, against a stable 124), and the first use of a buffer
+# read uninitialized memory. And the two list-taking helpers are written out as loops
+# at their call sites, so compare_to_bash reads the suite instead of refusing it,
+# which it did as the tree's one refused suite. The seventeen date 168 rows, each
+# reddening the same names in the shell and the twin. 16 arrive never: the six
+# premises and the ten controls.
+#
+#     ledger rows   6346 + 184 = 6530
+#     never         3933 + 16 = 3949
+#     dated         2413 + 168 = 2581
+#     3949 + 2581 == 6530
+#
+# #1341, bench_guards seeded, with its twin (OffgridwithJD): 3949 -> 3991, and
+# suites_not_covered 93 -> 92. The suite had no rows: it kept its own tally
+# and emitted no RESULT records. It now goes through lib.sh's check, with no cluster, and
+# enters with 91 checks from five-major runs (all green on each of 15-19, shell and twin
+# alike). Its per-runner checks grepped each bench runner for words, and the header comment
+# and the cannot-tell block's exit 1 satisfied them: with the assert refusal warning past
+# it, with the empty-capture refusal removed, with every build refused, or with the
+# override ignored, main's suite passed. Each runner's own guard is now run against a
+# stand-in pg_config, and a sixth check per runner wants a plain build let through. The
+# verdict-call check counted a comment that kept the call's shape, and now reads code only.
+# The ratio premise matched rr1= as r1=, and now matches a whole name. Two premises that a
+# one-line change to bench/cb_guards.sh reddens lost the prefix. 49 are dated by
+# twenty-two mutations, each reddening the same names in both twins. 42 arrive never.
+#
+#     ledger rows   6530 + 91 = 6621
+#     never         3949 + 42 = 3991
+#     dated         2581 + 49 = 2630
+#     3991 + 2630 == 6621
+#
+# #1341, docs_style seeded, with its twin (OffgridwithJD): 3991 -> 4008, and
+# suites_not_covered 92 -> 91. The suite kept a private tally and emitted no RESULT
+# records, so nothing could be seeded for it. It now records through lib.sh's check() and
+# pgc_summary, as wal_envelope.sh does, with no cluster. Four arms read text a reader never
+# sees: with the 1024 floor or the join key kept only in an HTML comment, a stale VERSION
+# citation beside a hidden right one, or the roadmap nav entry commented out with #, main
+# passed all 58 checks. Each arm now reads the page without its comments. The per-version
+# changelog checks put the version in their names and the META.json pair came from a loop,
+# so neither could be graded: three fixed names and two literal checks replace them. 36
+# are dated by documentation mutations, each reddening the same name in both twins. 17
+# arrive never: the premises, and the checker's own examined-count control.
+#
+#     ledger rows   6621 + 53 = 6674
+#     never         3991 + 17 = 4008
+#     dated         2630 + 36 = 2666
+#     4008 + 2666 == 6674
+#
+# #1341, audit seeded, with its twin (OffgridwithJD): 4008 -> 4018, and
+# suites_not_covered 91 -> 90. The suite had no rows. It enters with 35 rows: 34 checks
+# on 17-19, of which the four partitioned-parent checks run only there, and on 15 and 16
+# the one skip that arm records instead. From five-major runs (all green on each of 15-19,
+# shell and twin alike), after three fixes. The refusal arms
+# accepted any error: with set_options failing at entry for a reason that is none of its
+# guards, all five passed; each now requires its guard's own message. The parallel CREATE
+# INDEX's outcome was discarded: with a build participant raising an error, no index existed
+# and both the leak check and the indexed-once count passed (the count by a Seq Scan); the
+# build is now a check, the count is read only through the index, and the plan check is no
+# longer a premise. And the abort notice never printed, because a second EXIT trap replaced
+# it. Eleven mutations date checks, each red by the same names in both twins. 25 are
+# dated. 10 arrive never, the skip row among them.
+#
+#     ledger rows   6674 + 35 = 6709
+#     never         4008 + 10 = 4018
+#     dated         2666 + 25 = 2691
+#     4018 + 2691 == 6709
+# #1341, fuzz seeded, with its twin (OffgridwithJD): 4018 -> 4028, and
+# suites_not_covered 90 -> 89. The suite had no rows. It enters with its 12
+# checks from five-major runs, green on each of 15-19 in the shell and the twin alike.
+# The shell drew its runs from bash's $RANDOM, which changed algorithm in 5.1, and
+# named each check after its iteration, so the names moved with the seed and no twin
+# could draw the same run. It now draws from its own 31-bit LCG, the twin transcribes
+# it, and each property is asserted once over the run. set_options' result was
+# thrown away: with the chunk-group limit dropped, main passed 250/250. Its options
+# now read back, which optdrop reddens, and gtmin reddens the compound filter.
+# 2 are dated, each mutation reddening the same names in both twins. 10 arrive never.
+#
+#     ledger rows   6709 + 12 = 6721
+#     never         4018 + 10 = 4028
+#     dated         2691 + 2 = 2693
+#     4028 + 2693 == 6721
+#
+# #1341, fuzz_avro seeded, with its twin (OffgridwithJD): 4028 -> 4033, and
+# suites_not_covered 89 -> 88. The suite had no rows. It enters with its 8
+# checks from five-major runs, green on each of 15-19 in the shell and the twin alike.
+# A generator that wrote nothing left the previous file in place, read as an
+# ERROR or a clean accept, and main passed 7/7. The mutant is now removed before it
+# is generated and every iteration must write one, and a file the backend could
+# not open does not count as reaching the decoder.
+# 3 are dated, each mutation reddening the same names in both twins. 5 arrive never.
+#
+#     ledger rows   6721 + 8 = 6729
+#     never         4028 + 5 = 4033
+#     dated         2693 + 3 = 2696
+#     4033 + 2696 == 6729
+#
+# #1341, fuzz_listing seeded, with its twin (OffgridwithJD): 4033 -> 4039, and
+# suites_not_covered 88 -> 87. The suite had no rows. It enters with its 8
+# checks from five-major runs, green on each of 15-19 in the shell and the twin alike.
+# With no override the fixture serves the real listing, so a generator that wrote
+# nothing read as a clean accept 40 times out of 40 and main passed 7/7. The override
+# is now removed before each mutant is generated, and every iteration must write one.
+# 2 are dated, each mutation reddening the same names in both twins. 6 arrive never.
+#
+#     ledger rows   6729 + 8 = 6737
+#     never         4033 + 6 = 4039
+#     dated         2696 + 2 = 2698
+#     4039 + 2698 == 6737
+#
+# #1341, fuzz_arrow seeded, with its twin (OffgridwithJD): 4039 -> 4045, and
+# suites_not_covered 87 -> 86. The suite had no rows. It enters with its 7
+# checks from five-major runs, green on each of 15-19 in the shell and the twin alike.
+# A mutate that failed was skipped, so a corpus run that generated half its mutants
+# passed on main, 4/4. Every mutant must now be generated and imported, and an empty
+# or wholly rejected seed corpus is a named check rather than an unnamed FAIL.
+# 1 are dated, each mutation reddening the same names in both twins. 6 arrive never.
+#
+#     ledger rows   6737 + 7 = 6744
+#     never         4039 + 6 = 4045
+#     dated         2698 + 1 = 2699
+#     4045 + 2699 == 6744
+#
+# #1341, fuzz_parquet seeded, with its twin (OffgridwithJD): 4045 -> 4051, and
+# suites_not_covered 86 -> 85. The suite had no rows. It enters with its 7
+# checks from five-major runs, green on each of 15-19 in the shell and the twin alike.
+# A mutate that failed was skipped, so a corpus run that generated half its mutants
+# passed on main, 4/4. Every mutant must now be generated and run through its three
+# statements, and an empty or unrenderable seed corpus is a named check rather than
+# an unnamed FAIL.
+# 1 are dated, each mutation reddening the same names in both twins. 6 arrive never.
+#
+#     ledger rows   6744 + 7 = 6751
+#     never         4045 + 6 = 4051
+#     dated         2699 + 1 = 2700
+#     4051 + 2700 == 6751
+checks_never_observed_red 4051
diff --git a/test/docs_style.sh b/test/docs_style.sh
index 9bdb55052..0044784d7 100755
--- a/test/docs_style.sh
+++ b/test/docs_style.sh
@@ -53,30 +53,22 @@
 # Written fresh for pgColumnar.
 
 set -uo pipefail
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 SRCDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
-checks=0
-fail=0
-check() {
-	local name="$1" got="$2" want="$3"
-	checks=$((checks + 1))
-	if [ "$got" = "$want" ]; then
-		echo "PASS  $name"
-	else
-		echo "FAIL  $name: got [$got] want [$want]"
-		fail=1
-	fi
-}
+# lib.sh's check() AND pgc_summary, NOT A PRIVATE TALLY (#1341). This suite kept its
+# own counter and emitted no RESULT records, so no ledger row could ever be seeded for
+# it and its pytest twin had nothing to be compared with. It now records like every
+# other suite. Like wal_envelope.sh it needs no cluster, so pgc_setup is skipped and
+# the counters check() expects are provided here. PGC_MAJOR comes from the pg_config
+# the runner passes every suite, so a record names the major it ran on (#1121).
+PGC_MAJOR="$(pgc_major_of "${1:-}")"
+PGC_CHECKS=0
+PGC_FAIL=0
 
-# THIS SUITE KEEPS ITS OWN TALLY, not lib.sh's, and emits none of the machine
-# RESULT vocabulary. So it cannot report a `SKIP` OUTCOME: selftest 400 refuses
-# `echo "SKIP` in any file that calls `check`, because a skip there is a check
-# result a count and a record must see, and this suite has neither to put it in.
-#
-# A property this suite cannot compare is therefore a NOTE: printed for a reader,
-# counted as nothing, claiming no outcome. Where the reason is itself a fact about
-# the tree it is asserted with `check` instead -- see the no-baseline arm below --
-# so "this cannot be checked" is itself checked rather than asserted.
+# A property this suite cannot compare in a checkout without release tags is a NOTE,
+# printed for a reader and counted as nothing; see the changelog block below for why it
+# is not recorded unrunnable. note() is not lib.sh's: it is defined here.
 #
 # Reaching for lib.sh's helper of that name here is `command not found`: it prints
 # nothing, counts nothing and fails nothing while the suite reports PASSED.
@@ -87,6 +79,17 @@ note() {	# note TEXT
 
 command -v python3 >/dev/null || { echo "FAIL  python3 not found"; exit 1; }
 
+# WHAT A READER SEES, NOT WHAT THE FILE HOLDS (#1341 port). Every arm below that asks
+# whether a page SAYS something read the raw file, so the sentence passed from inside
+# an HTML comment that no reader ever sees. Measured on main: the 1024-floor line moved
+# into `<!-- -->`, "join key" kept only in a comment, and a stale VERSION citation with
+# the right one hidden beside it each left the whole suite green. `_md` is the page as
+# rendered prose: the file with its HTML comments removed.
+_md() {	# _md FILE -> the file's text without <!-- --> comments
+	python3 -c 'import re, sys
+sys.stdout.write(re.sub(r"<!--.*?-->", "", open(sys.argv[1], encoding="utf-8").read(), flags=re.S))' "$1"
+}
+
 echo "== pgColumnar test: docs_style.sh =="
 
 # The full rules over every user-facing document.
@@ -111,7 +114,9 @@ check "and it actually examined the documents" \
 # That case is also caught by "mkdocs build --strict" in docs.yml, which fails on a nav
 # entry pointing at nothing. Half a property here and half in a workflow is how the
 # missing half goes unnoticed, so both halves are stated here.
-nav_roadmap=$(grep -c "roadmap.md" "$SRCDIR/mkdocs.yml" || true)
+# A COMMENTED-OUT ENTRY IS NOT IN THE NAV. The raw grep counted `# - Roadmap: roadmap.md`,
+# so a nav entry disabled with `#` passed: measured on main.
+nav_roadmap=$(sed -E 's/(^|[[:space:]])#.*//' "$SRCDIR/mkdocs.yml" | grep -c "roadmap.md" || true)
 check "the roadmap is in the documentation nav" "$([ "$nav_roadmap" -ge 1 ] && echo yes || echo no)" "yes"
 check "and the page that nav entry points at exists" \
 	"$([ -f "$SRCDIR/docs/roadmap.md" ] && echo yes || echo no)" "yes"
@@ -132,7 +137,7 @@ check "no document carries a merge conflict marker" \
 # values and percentiles approximately". The section is found by its heading and
 # must open with the pg_partman paragraph its steps belong to.
 partman_open="$(awk '$0 == "## Manage time partitions with pg_partman" {f=1; next}
-	f && NF {print; exit}' "$SRCDIR/docs/how-to.md")"
+	f && NF {print; exit}' <(_md "$SRCDIR/docs/how-to.md"))"
 check "the how-to keeps its pg_partman section under its own heading" \
 	"$(printf '%s' "$partman_open" | grep -c '^pg_partman can create and drop columnar partitions')" "1"
 
@@ -149,7 +154,8 @@ _howto_rf() {
 	python3 - "$SRCDIR/docs/how-to.md" <<'PY'
 from pathlib import Path
 import sys
-text = Path(sys.argv[1]).read_text(encoding="utf-8")
+import re
+text = re.sub(r"<!--.*?-->", "", Path(sys.argv[1]).read_text(encoding="utf-8"), flags=re.S)
 heading = "## Skip fact-table work under a star-schema join"
 start = text.find(heading)
 if start < 0:
@@ -168,7 +174,8 @@ _practices_jk() {
 	python3 - "$SRCDIR/docs/best-practices.md" <<'PY'
 from pathlib import Path
 import sys
-text = Path(sys.argv[1]).read_text(encoding="utf-8").lower()
+import re
+text = re.sub(r"<!--.*?-->", "", Path(sys.argv[1]).read_text(encoding="utf-8"), flags=re.S).lower()
 print("yes" if "join key" in text else "no")
 PY
 }
@@ -207,7 +214,8 @@ check "best-practices names clustering on the join key" \
 # reader got wrong: blank lines are absent inside a markdown table and arbitrary in
 # prose, while a heading is declared.
 _floor_line() {	# _floor_line FILE -- yes if one line names the setting and the floor
-	if grep -qE 'stripe_row_limit.*1024|1024.*stripe_row_limit' "$1"; then
+	# grep -c, not -q: an early-exit reader under pipefail turns a match into a failure
+	if [ "$(_md "$1" | grep -cE 'stripe_row_limit.*1024|1024.*stripe_row_limit')" -gt 0 ]; then
 		echo yes
 	else
 		echo no
@@ -220,7 +228,7 @@ _floor_same_section() {	# _floor_same_section FILE ADVICE -- yes if both are und
 			if (index(tolower($0), tolower(advice))) a[h] = 1
 			if (/stripe_row_limit/ && /1024/) f[h] = 1
 		}
-		END { for (k in a) if (k in f) { print "yes"; exit } print "no" }' "$1"
+		END { for (k in a) if (k in f) { print "yes"; exit } print "no" }' <(_md "$1")
 }
 check "configuration.md states the 1024 floor where it documents the setting" \
 	"$(_floor_line "$SRCDIR/docs/configuration.md")" "yes"
@@ -258,7 +266,7 @@ check "premise: at least one document cites the VERSION file" \
 
 _stale=""
 for _d in $_verdocs; do
-	grep -q "\`$_ver\`, recorded in \`VERSION\`" "$_d" || _stale="$_stale $(basename "$_d")"
+	[ "$(_md "$_d" | grep -c "\`$_ver\`, recorded in \`VERSION\`")" -gt 0 ] || _stale="$_stale $(basename "$_d")"
 done
 check "every document citing VERSION quotes the version VERSION holds" \
 	"$(printf '%s' "$_stale" | sed 's/^ //')" ""
@@ -328,14 +336,14 @@ check "premise: at least one document names the latest published pre-release" \
 # and yields no version is a file this rule cannot see, and it is named rather
 # than skipped.
 # shellcheck disable=SC2086
-_pubvers="$( { grep -rhoE 'latest published pre-release is `v[^`]*`' $_pubdocs 2>/dev/null
-               grep -rhoE '`v[^`]*` is the latest published pre-release' $_pubdocs 2>/dev/null
-             } | grep -oE '`v[^`]*`' | tr -d '`' | LC_ALL=C sort -u)"
+_pubvers="$(for _d in $_pubdocs; do _md "$_d"; done \
+	| grep -oE 'latest published pre-release is `v[^`]*`|`v[^`]*` is the latest published pre-release' \
+	| grep -oE '`v[^`]*`' | tr -d '`' | LC_ALL=C sort -u)"
 
 _pubunparsed=""
 for _d in $_pubdocs; do
-	grep -qE 'latest published pre-release is `v[^`]*`|`v[^`]*` is the latest published pre-release' \
-		"$_d" || _pubunparsed="$_pubunparsed $(basename "$_d")"
+	[ "$(_md "$_d" | grep -cE 'latest published pre-release is `v[^`]*`|`v[^`]*` is the latest published pre-release')" -gt 0 ] \
+		|| _pubunparsed="$_pubunparsed $(basename "$_d")"
 done
 check "every document making the claim states it in a form this rule can read" \
 	"$(printf '%s' "$_pubunparsed" | sed 's/^ //')" ""
@@ -484,7 +492,7 @@ _upg_sentences() {	# _upg_sentences FILE -> one sentence per line
 	# by period-space, which also protects a sentence ENDING in a number and
 	# merges it with the next one -- demonstrated by @OffgridwithJD with
 	# `The corpus held 1444. ` injected ahead of the claim.
-	sed -E 's/^([0-9]+)\. /\1.@LM@/' "$1" \
+	_md "$1" | sed -E 's/^([0-9]+)\. /\1.@LM@/' \
 		| tr '\n' ' ' \
 		| sed 's/\. /.\n/g' \
 		| sed 's/@LM@/ /g'
@@ -576,14 +584,19 @@ _pgxn_ver="$(printf '%s' "$_ver" | awk -F- '{
 check "premise: the PGXN form was derived from VERSION, not empty" \
 	"$([ -n "$_pgxn_ver" ] && echo yes || echo no)" "yes"
 
-for _mk in version provides.pgcolumnar.version; do
-	check "META.json $_mk is the version VERSION holds, in PGXN form" \
-		"$(python3 -c "
+_meta_get() {	# _meta_get DOTTED.KEY -> that value of META.json, or empty
+	python3 -c "
 import json,sys
 m=json.load(open(sys.argv[1]))
 for k in sys.argv[2].split('.'): m=m[k]
-print(m)" "$_meta" "$_mk" 2>/dev/null)" "$_pgxn_ver"
-done
+print(m)" "$_meta" "$1" 2>/dev/null
+}
+# TWO LITERAL CHECKS, not a loop: a name built from a loop variable is invisible to the
+# twin grader, which reads only literal names.
+check "META.json version is the version VERSION holds, in PGXN form" \
+	"$(_meta_get version)" "$_pgxn_ver"
+check "META.json provides.pgcolumnar.version is the version VERSION holds, in PGXN form" \
+	"$(_meta_get provides.pgcolumnar.version)" "$_pgxn_ver"
 
 # The defect that actually shipped. `git archive` rather than a filesystem test,
 # because what matters is whether the DISTRIBUTION contains it -- an export-ignore
@@ -724,18 +737,19 @@ fi
 
 _cl_seen=0
 _cl_usedrows=""
+_cl_nosec=""
+_cl_bad=""
+_cl_lost=""
+# THREE CHECKS WITH FIXED NAMES, each naming the versions it found wrong in its
+# reading. One check per version per property put the version in the NAME, which no
+# twin grader can read and which grows by two names every release (#1341 port).
 while read -r _cl_v; do
 	[ -n "$_cl_v" ] || continue
 	_cl_seen=$((_cl_seen + 1))
-	_cl_name="the $_cl_v section holds what v$_cl_v shipped, plus only what is recorded"
-	if [ -n "$_cl_why" ]; then
-		note "$_cl_name: not compared ($_cl_why)"
-		continue
-	fi
+	[ -z "$_cl_why" ] || continue
 	_cl_tagged="$(_cl_git show "v$_cl_v:CHANGELOG.md" | _cl_entries "$_cl_v" | LC_ALL=C sort)"
 	if [ -z "$_cl_tagged" ]; then
-		check "v$_cl_v carries a dated section of its own to compare against" \
-			"no section for $_cl_v at v$_cl_v" "a section for $_cl_v at v$_cl_v"
+		_cl_nosec="$_cl_nosec $_cl_v"
 		continue
 	fi
 	_cl_nowents="$(_cl_entries "$_cl_v" < "$SRCDIR/CHANGELOG.md" | LC_ALL=C sort)"
@@ -748,11 +762,27 @@ while read -r _cl_v; do
 	_cl_allowed="$(awk -F'\t' -v v="$_cl_v" '$1==v && $2 != "" {print $2}' "$_cl_allowfile" 2>/dev/null | LC_ALL=C sort)"
 	[ -n "$_cl_allowed" ] && _cl_usedrows="$_cl_usedrows$_cl_allowed
 "
-	check "$_cl_name" "$_cl_extra" "$_cl_allowed"
-	check "the $_cl_v section still holds every entry v$_cl_v shipped" "$_cl_gone" ""
+	[ "$_cl_extra" = "$_cl_allowed" ] \
+		|| _cl_bad="$_cl_bad $_cl_v: added [$(printf '%s' "$_cl_extra" | tr '\n' '|')] recorded [$(printf '%s' "$_cl_allowed" | tr '\n' '|')]"
+	[ -z "$_cl_gone" ] || _cl_lost="$_cl_lost $_cl_v: [$(printf '%s' "$_cl_gone" | tr '\n' '|')]"
 done <<CLEOF
 $(_cl_versions < "$SRCDIR/CHANGELOG.md")
 CLEOF
+# WITHOUT TAGS THESE ARE NOTES, as they always were: the nightly coverage job checks
+# out with no tags and counts any non-zero suite as failed, so recording them unrunnable
+# there would redden a job for a checkout's shape. Every job that runs this suite to
+# decide anything (ci suites, nightly suites) fetches the release tags.
+if [ -n "$_cl_why" ]; then
+	note "every dated changelog section has its own section at its release tag: not compared ($_cl_why)"
+	note "every dated changelog section holds what its tag shipped, plus only what is recorded: not compared ($_cl_why)"
+	note "every dated changelog section still holds every entry its tag shipped: not compared ($_cl_why)"
+else
+	check "every dated changelog section has its own section at its release tag" "${_cl_nosec# }" ""
+	check "every dated changelog section holds what its tag shipped, plus only what is recorded" "${_cl_bad# }" ""
+	check "every dated changelog section still holds every entry its tag shipped" "${_cl_lost# }" ""
+fi
+$(_cl_versions < "$SRCDIR/CHANGELOG.md")
+CLEOF
 
 # The sweep is a claim. An empty one would make every arm above vanish and this
 # suite would report clean having compared no section at all.
@@ -775,7 +805,7 @@ if [ -z "$_cl_why" ]; then
 	check "no recorded post-tag entry is stale, so the allowance cannot widen silently" \
 		"$_cl_stale" ""
 else
-	note "no recorded post-tag entry is stale: not compared ($_cl_why)"
+	note "no recorded post-tag entry is stale, so the allowance cannot widen silently: not compared ($_cl_why)"
 fi
 
 
@@ -788,7 +818,10 @@ fi
 #
 # The driver without the instruction is worse than either alone -- it makes the
 # badge lie and gives nobody the reason -- so the two are asserted together.
-check "premise: CHANGELOG.md still has the union merge driver" \
+# NOT A PREMISE: it is the same repository fact as the driver check above, and removing
+# that line from .gitattributes reddens both. A premise must not go red under a change
+# to what the suite checks (#1339), so this is an ordinary check.
+check "and CHANGELOG.md still has the union merge driver those instructions are about" \
 	"$(grep -c '^CHANGELOG\.md[[:space:]]\+merge=union$' "$SRCDIR/.gitattributes")" "1"
 check "and CONTEXT.md tells a contributor what a CONFLICTING badge means" \
 	"$(grep -c 'CONFLICTING badge on CHANGELOG.md means rebase locally' "$SRCDIR/CONTEXT.md")" "1"
@@ -822,10 +855,4 @@ check "no documented query tests pg_extension while listing databases" \
 	"$(printf '%s\n' "$_xdb_stmts" | grep 'pg_database' | grep -c 'pg_extension')" "0"
 
 
-echo "checks run: $checks"
-if [ "$fail" = 0 ]; then
-	echo "docs_style.sh: PASSED"
-	exit 0
-fi
-echo "docs_style.sh: FAILED"
-exit 1
+pgc_summary
diff --git a/test/fuzz.sh b/test/fuzz.sh
index 7de7dbbdd..6d9e146ce 100755
--- a/test/fuzz.sh
+++ b/test/fuzz.sh
@@ -23,7 +23,6 @@ pgc_setup "${1:-/usr/local/pg17/bin/pg_config}"
 
 SEED="${PGC_SEED:-12345}"
 ITERS="${PGC_ITERS:-25}"
-RANDOM=$SEED
 echo "-- fuzz seed=$SEED iters=$ITERS  (reproduce a failure with PGC_SEED=$SEED)"
 
 # Uniform integer in [0, n).
@@ -43,8 +42,14 @@ echo "-- fuzz seed=$SEED iters=$ITERS  (reproduce a failure with PGC_SEED=$SEED)
 #
 # `$(( ))` is ARITHMETIC EXPANSION and runs in this shell, so the results below are
 # assigned rather than echoed and no subshell is entered at any call site.
-rnd() { _RND=$(( RANDOM % $1 )); }
-pick() { local n=$#; local i=$(( RANDOM % n )); shift "$i"; _PICK="$1"; }
+#
+# The draws come from this suite's own generator, not from $RANDOM: bash's RANDOM
+# changed algorithm in 5.1, so one seed drew different runs on different shells, and
+# the pytest twin could not draw the same run at all. A 31-bit LCG in arithmetic
+# expansion is the same sequence on every bash and in Python (#1341).
+_S=$(( SEED & 0x7fffffff ))
+rnd() { _S=$(( (_S * 1103515245 + 12345) & 0x7fffffff )); _RND=$(( (_S >> 16) % $1 )); }
+pick() { local n=$#; rnd "$n"; shift "$_RND"; _PICK="$1"; }
 # Pick one element of the argument list.
 
 CODECS="none pglz lz4 zstd"
@@ -54,6 +59,21 @@ CODECS="none pglz lz4 zstd"
 FUZZ_DEFS="id int, c_int int, c_num numeric(20,4), c_f8 double precision,
 	c_bool boolean, c_date date, c_ts timestamp, c_vc varchar(40), c_text text"
 
+# The check names are the property, not the iteration: each one is asserted once over
+# the whole run and names the iterations that broke it. Names that carried the
+# iteration's drawn parameters changed with the seed, so no ledger row or twin could
+# name them (#1341).
+bad_rows=""; bad_opts=""; its=0
+declare -A BAD
+KINDS="whole-row count minmax sumavg range-int range-date eq isnull compound"
+for k in $KINDS; do BAD[$k]=""; done
+cmp_kind() {	# kind tag query-template: record the iteration when columnar and heap differ
+	local hq hc
+	hq="$(pgc_set_hash "${3//%T/t_heap}")"; [ -z "$hq" ] && hq="HEAP_ERROR"
+	hc="$(pgc_set_hash "${3//%T/t_col}")"; [ -z "$hc" ] && hc="COL_ERROR"
+	[ "$hc" = "$hq" ] || BAD[$1]+="[$2: $hc vs $hq] "
+}
+
 for it in $(seq 1 "$ITERS"); do
 	rnd 5000; N=$(( 1 + _RND ))
 	# Occasionally snap N to a boundary of the chosen chunk-group limit.
@@ -76,6 +96,11 @@ for it in $(seq 1 "$ITERS"); do
 	q "SELECT pgcolumnar.set_options('t_col',
 		chunk_group_row_limit => $CG, stripe_row_limit => $SR,
 		compression => '$CODEC', compression_level => $LVL);" >/dev/null
+	# set_options' result was thrown away, so a call that failed or ignored an
+	# argument left the iteration on default storage and nothing said so.
+	got="$(q "SELECT chunk_group_row_limit || '/' || stripe_row_limit || '/' || compression
+		|| '/' || compression_level FROM pgcolumnar.options WHERE regclass = 't_col'::regclass;")"
+	[ "$got" = "$CG/$SR/$CODEC/$LVL" ] || bad_opts+="[$tag: read back '$got'] "
 
 	load_pair "SELECT
 		g,
@@ -89,17 +114,31 @@ for it in $(seq 1 "$ITERS"); do
 		CASE WHEN g%$NULLMOD=0 THEN NULL WHEN g%997=0 THEN repeat('q',3000) ELSE ('t'||g) END
 		FROM generate_series(1,$N) g"
 
-	check "$tag :: row count" "$(q 'SELECT count(*) FROM t_col;')" "$N"
-
-	diff_query "$tag :: whole-row"  "SELECT * FROM %T"
-	diff_query "$tag :: count"      "SELECT count(*), count(c_int), count(c_text) FROM %T"
-	diff_query "$tag :: minmax"     "SELECT min(c_int), max(c_int), min(c_vc), max(c_vc), min(c_date), max(c_date) FROM %T"
-	diff_query "$tag :: sumavg"     "SELECT sum(c_int), avg(c_num), sum(c_f8) FROM %T"
-	diff_query "$tag :: range int"  "SELECT id FROM %T WHERE c_int BETWEEN $LO AND $HI"
-	diff_query "$tag :: range date" "SELECT id FROM %T WHERE c_date >= DATE '2010-06-01'"
-	diff_query "$tag :: eq"         "SELECT id, c_vc FROM %T WHERE id = $EQ"
-	diff_query "$tag :: isnull"     "SELECT count(*) FROM %T WHERE c_text IS NULL"
-	diff_query "$tag :: compound"   "SELECT id FROM %T WHERE c_int > 0 AND c_bool AND c_num < 1000"
+	n="$(q 'SELECT count(*) FROM t_col;')"
+	[ "$n" = "$N" ] || bad_rows+="[$tag: $n rows] "
+	cmp_kind whole-row  "$tag" "SELECT * FROM %T"
+	cmp_kind count      "$tag" "SELECT count(*), count(c_int), count(c_text) FROM %T"
+	cmp_kind minmax     "$tag" "SELECT min(c_int), max(c_int), min(c_vc), max(c_vc), min(c_date), max(c_date) FROM %T"
+	cmp_kind sumavg     "$tag" "SELECT sum(c_int), avg(c_num), sum(c_f8) FROM %T"
+	cmp_kind range-int  "$tag" "SELECT id FROM %T WHERE c_int BETWEEN $LO AND $HI"
+	cmp_kind range-date "$tag" "SELECT id FROM %T WHERE c_date >= DATE '2010-06-01'"
+	cmp_kind eq         "$tag" "SELECT id, c_vc FROM %T WHERE id = $EQ"
+	cmp_kind isnull     "$tag" "SELECT count(*) FROM %T WHERE c_text IS NULL"
+	cmp_kind compound   "$tag" "SELECT id FROM %T WHERE c_int > 0 AND c_bool AND c_num < 1000"
+	its=$((its + 1))
 done
 
+check "the run covered every iteration" "$its" "$ITERS"
+check "every iteration's storage options read back as set" "${bad_opts:-none}" "none"
+check "every iteration loaded all its rows" "${bad_rows:-none}" "none"
+check "every iteration's whole rows agree with heap" "${BAD[whole-row]:-none}" "none"
+check "every iteration's counts agree with heap" "${BAD[count]:-none}" "none"
+check "every iteration's min and max agree with heap" "${BAD[minmax]:-none}" "none"
+check "every iteration's sums and averages agree with heap" "${BAD[sumavg]:-none}" "none"
+check "every iteration's integer range agrees with heap" "${BAD[range-int]:-none}" "none"
+check "every iteration's date range agrees with heap" "${BAD[range-date]:-none}" "none"
+check "every iteration's equality lookup agrees with heap" "${BAD[eq]:-none}" "none"
+check "every iteration's IS NULL count agrees with heap" "${BAD[isnull]:-none}" "none"
+check "every iteration's compound filter agrees with heap" "${BAD[compound]:-none}" "none"
+
 pgc_summary
diff --git a/test/fuzz_arrow.sh b/test/fuzz_arrow.sh
index 86bc7a9f7..f484e3d8e 100755
--- a/test/fuzz_arrow.sh
+++ b/test/fuzz_arrow.sh
@@ -64,11 +64,8 @@ echo "-- corpus: $CORPUS"
 # since Arrow has no parquet_schema equivalent to derive it from the file.
 # ---------------------------------------------------------------------------
 mapfile -t SEEDLINES < <(python3 "$PGC_SRCDIR/test/arrow_corpus.py" "$CORPUS" 2>/dev/null)
-if [ "${#SEEDLINES[@]}" -eq 0 ]; then
-	echo "FAIL  the corpus generator produced no files"
-	PGC_FAIL=1
-	pgc_summary
-fi
+check "the seed corpus generator produced files" \
+	"$([ "${#SEEDLINES[@]}" -gt 0 ] && echo yes || echo no)" "yes"
 echo "-- ${#SEEDLINES[@]} seed files"
 
 # The composite type the struct seeds name in their column list. Created once here
@@ -97,11 +94,10 @@ for line in "${SEEDLINES[@]}"; do
 done
 echo "-- ${#SEEDPATH[@]} seeds the importer accepts pristine"
 
-if [ "${#SEEDPATH[@]}" -eq 0 ]; then
-	echo "FAIL  no seed imported cleanly; the importer rejects its own corpus"
-	PGC_FAIL=1
-	pgc_summary
-fi
+# A named check, not an unnamed FAIL: a reader that rejects its own corpus is a
+# product failure, and the fuzz loop below then runs nothing at all.
+check "the importer accepts some pristine seed" \
+	"$([ "${#SEEDPATH[@]}" -gt 0 ] && echo yes || echo no)" "yes"
 
 # ---------------------------------------------------------------------------
 # Crash detection. Judged from the server log rather than psql's message: a
@@ -112,6 +108,7 @@ fi
 # ---------------------------------------------------------------------------
 LOGPOS=0
 crashes=0
+gen=0
 hangs=0
 sanitizer=0
 errors=0
@@ -230,13 +227,15 @@ log_since
 
 echo "-- fuzzing"
 nseeds="${#SEEDPATH[@]}"
-for ((i = 0; i < ITERS; i++)); do
+[ "$nseeds" -gt 0 ] || ITERS_RUN=0
+for ((i = 0; i < ${ITERS_RUN-$ITERS}; i++)); do
 	idx=$((i % nseeds))
 	sf="${SEEDPATH[$idx]}"
 	tab="${SEEDTAB[$idx]}"
 	ms=$((SEED + i))
 
 	python3 "$PGC_SRCDIR/test/arrow_mutate.py" "$sf" "$ms" "$MUT" 2>/dev/null || continue
+	gen=$((gen + 1))
 	chmod 644 "$MUT" 2>/dev/null
 
 	# Empty the target first so an accepted mutant does not accumulate rows across
@@ -258,6 +257,11 @@ echo "-- done: $ITERS mutants, ${errors} rejected with ERROR, ${clean} accepted"
 check "no mutant crashed the backend" "$crashes" "0"
 check "no mutant hung the decode" "$hangs" "0"
 check "no mutant tripped a sanitizer" "$sanitizer" "0"
+# Every mutant generated, and every statement run with an outcome. A mutate that
+# failed was skipped with `continue`, and a corpus run that generated almost nothing
+# passed: the reach check below needs only one ERROR.
+check "every mutant was generated and ran the import" \
+	"$gen/$((errors + clean + crashes + hangs + sanitizer))" "$ITERS/$((ITERS * 1))"
 
 # A corpus rejected outright teaches nothing and would make the three checks above
 # pass for the wrong reason. Some mutants must have reached the decoder and been
diff --git a/test/fuzz_avro.sh b/test/fuzz_avro.sh
index dc81336f8..ecea0d397 100755
--- a/test/fuzz_avro.sh
+++ b/test/fuzz_avro.sh
@@ -55,7 +55,7 @@ check "control: the valid manifest-list reaches the decoder (1 entry)" \
 	"$(q "$RD_LIST")" "1"
 
 LOGPOS=0
-crashes=0; hangs=0; sanitizer=0; errors=0; clean=0
+crashes=0; hangs=0; sanitizer=0; errors=0; clean=0; fresh=0; fileerr=0
 log_since() {
 	local sz
 	sz=$(stat -c %s "$PGC_LOGFILE" 2>/dev/null || echo 0)
@@ -78,7 +78,12 @@ for ((i = 0; i < ITERS; i++)); do
 	s=$((SEED + i))
 	if (( i % 2 == 0 )); then base="$BASE"; RD="$RD_MANIFEST"
 	else base="$BASE_LIST"; RD="$RD_LIST"; fi
-	python3 "$CORPUS" "$base" "$s" "$MUT"; chmod 644 "$MUT" 2>/dev/null
+	# The mutant is removed first, so a generator that writes nothing leaves no file
+	# rather than the previous one: a stale file read as a clean accept or a decoder
+	# ERROR made every check below pass with no mutant ever generated.
+	rm -f "$MUT"
+	python3 "$CORPUS" "$base" "$s" "$MUT" 2>/dev/null; chmod 644 "$MUT" 2>/dev/null
+	[ -f "$MUT" ] && fresh=$((fresh + 1))
 	log_since
 	out="$(timeout 30 env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" \
 		-U postgres -d "$PGC_DB" -v ON_ERROR_STOP=0 \
@@ -99,6 +104,8 @@ for ((i = 0; i < ITERS; i++)); do
 		crashes=$((crashes + 1)); echo "  FINDING [crash] seed=$s"; wait_for_cluster || true
 	elif grep -q '^ERROR:' <<<"$out"; then
 		errors=$((errors + 1))
+		# an ERROR opening the file never reached the decoder
+		grep -qE 'could not open|No such file|Permission denied' <<<"$out" && fileerr=$((fileerr + 1))
 	else
 		clean=$((clean + 1))
 	fi
@@ -109,7 +116,9 @@ check "no mutant crashed the backend" "$crashes" "0"
 check "no mutant hung the decoder" "$hangs" "0"
 check "no mutant tripped a sanitizer" "$sanitizer" "0"
 check "every mutant ran (errors + clean == iters)" "$((errors + clean))" "$ITERS"
+check "every iteration wrote a fresh mutant" "$fresh" "$ITERS"
+# Reached means decoded: a file the backend could not open never reached it.
 check "the corpus reached the decoder at all" \
-	"$([ "$((errors + clean))" -gt 0 ] && echo yes || echo no)" "yes"
+	"$([ "$((errors - fileerr + clean))" -gt 0 ] && echo yes || echo "no ($fileerr of $errors errors were opening the file)")" "yes"
 
 pgc_summary
diff --git a/test/fuzz_listing.sh b/test/fuzz_listing.sh
index 9636c49b7..81c7e0d74 100755
--- a/test/fuzz_listing.sh
+++ b/test/fuzz_listing.sh
@@ -84,7 +84,7 @@ check "control: a valid listing reaches the parser and reads the object" \
 	"$(q "$READ")" "3"
 
 LOGPOS=0
-crashes=0; hangs=0; sanitizer=0; errors=0; clean=0
+crashes=0; hangs=0; sanitizer=0; errors=0; clean=0; fresh=0
 log_since() {
 	local sz
 	sz=$(stat -c %s "$PGC_LOGFILE" 2>/dev/null || echo 0)
@@ -105,7 +105,12 @@ log_since
 echo "-- fuzzing $ITERS listing mutants (seed base $SEED)"
 for ((i = 0; i < ITERS; i++)); do
 	s=$((SEED + i))
-	python3 "$CORPUS" "$s" "$OVERRIDE"
+	# The override is removed first: with no override the fixture serves the real
+	# listing, so a generator that writes nothing read as a clean accept every time and
+	# every check below passed with no mutant ever generated.
+	rm -f "$OVERRIDE"
+	python3 "$CORPUS" "$s" "$OVERRIDE" 2>/dev/null
+	[ -f "$OVERRIDE" ] && fresh=$((fresh + 1))
 	log_since
 	out="$(timeout 30 env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" \
 		-U postgres -d "$PGC_DB" -v ON_ERROR_STOP=0 \
@@ -140,6 +145,7 @@ check "no mutant tripped a sanitizer" "$sanitizer" "0"
 # (the control above proved the pipeline; here the count must add up).
 check "every mutant ran (errors + clean == iters)" \
 	"$((errors + clean))" "$ITERS"
+check "every iteration wrote a fresh mutant" "$fresh" "$ITERS"
 check "the corpus reached the parser at all (some mutant errored or accepted)" \
 	"$([ "$((errors + clean))" -gt 0 ] && echo yes || echo no)" "yes"
 
diff --git a/test/fuzz_parquet.sh b/test/fuzz_parquet.sh
index 2979ab0a8..beaa9d3de 100755
--- a/test/fuzz_parquet.sh
+++ b/test/fuzz_parquet.sh
@@ -68,11 +68,8 @@ echo "-- corpus: $CORPUS"
 # Seeds. Every one is valid; see test/parquet_corpus.py for why that matters.
 # ---------------------------------------------------------------------------
 mapfile -t SEEDLINES < <(python3 "$PGC_SRCDIR/test/parquet_corpus.py" "$CORPUS" 2>/dev/null)
-if [ "${#SEEDLINES[@]}" -eq 0 ]; then
-	echo "FAIL  the corpus generator produced no files"
-	PGC_FAIL=1
-	pgc_summary
-fi
+check "the seed corpus generator produced files" \
+	"$([ "${#SEEDLINES[@]}" -gt 0 ] && echo yes || echo no)" "yes"
 echo "-- ${#SEEDLINES[@]} seed files"
 
 # The column definition list read_parquet requires, derived from each pristine
@@ -90,11 +87,10 @@ for line in "${SEEDLINES[@]}"; do
 done
 echo "-- ${#SEEDPATH[@]} seeds with a usable column list"
 
-if [ "${#SEEDPATH[@]}" -eq 0 ]; then
-	echo "FAIL  no seed produced a readable schema; the reader rejects its own corpus"
-	PGC_FAIL=1
-	pgc_summary
-fi
+# A named check, not an unnamed FAIL: a reader that rejects its own corpus is a
+# product failure, and the fuzz loop below then runs nothing at all.
+check "the reader renders some pristine seed's schema" \
+	"$([ "${#SEEDPATH[@]}" -gt 0 ] && echo yes || echo no)" "yes"
 
 # ---------------------------------------------------------------------------
 # Crash detection.
@@ -107,6 +103,7 @@ fi
 # ---------------------------------------------------------------------------
 LOGPOS=0
 crashes=0
+gen=0
 hangs=0
 sanitizer=0
 errors=0
@@ -253,13 +250,15 @@ psql_run "DROP TABLE IF EXISTS fz_target;" >/dev/null 2>&1
 
 echo "-- fuzzing"
 nseeds="${#SEEDPATH[@]}"
-for ((i = 0; i < ITERS; i++)); do
+[ "$nseeds" -gt 0 ] || ITERS_RUN=0
+for ((i = 0; i < ${ITERS_RUN-$ITERS}; i++)); do
 	idx=$((i % nseeds))
 	sf="${SEEDPATH[$idx]}"
 	cols="${SEEDCOLS[$idx]}"
 	ms=$((SEED + i))
 
 	python3 "$PGC_SRCDIR/test/parquet_mutate.py" "$sf" "$ms" "$MUT" 2>/dev/null || continue
+	gen=$((gen + 1))
 	chmod 644 "$MUT" 2>/dev/null
 
 	run_stmt "SELECT * FROM pgcolumnar.parquet_schema('$MUT');" "$sf" "$ms"
@@ -287,6 +286,11 @@ echo "-- done: $ITERS mutants, ${errors} rejected with ERROR, ${clean} accepted"
 check "no mutant crashed the backend" "$crashes" "0"
 check "no mutant hung the decode" "$hangs" "0"
 check "no mutant tripped a sanitizer" "$sanitizer" "0"
+# Every mutant generated, and every statement run with an outcome. A mutate that
+# failed was skipped with `continue`, and a corpus run that generated almost nothing
+# passed: the reach check below needs only one ERROR.
+check "every mutant was generated and ran its three statements" \
+	"$gen/$((errors + clean + crashes + hangs + sanitizer))" "$ITERS/$((ITERS * 3))"
 
 # A corpus that is rejected outright teaches nothing, and would make the three
 # checks above pass for the wrong reason. At least some mutants must have got
diff --git a/test/hilbert_curve.sh b/test/hilbert_curve.sh
index 1e814886c..7dab0744e 100755
--- a/test/hilbert_curve.sh
+++ b/test/hilbert_curve.sh
@@ -335,20 +335,13 @@ battery_arm_names() {
 }
 BATTERY_ARMS="$(battery_arm_names)"
 
-# Report a whole group of arms in one state, so a run that could not build
-# still lists what it did not measure.
-arms_unrunnable() {	# arms_unrunnable "LIST" REASON DETAIL
-	local _a
-	while IFS= read -r _a; do
-		[ -n "$_a" ] && check_unrunnable "$_a" "$2" "$3"
-	done <<< "$1"
-}
-arms_failed() {		# arms_failed "LIST" DETAIL
-	local _a
-	while IFS= read -r _a; do
-		[ -n "$_a" ] && pgc_fail "$_a" "$2"
-	done <<< "$1"
-}
+# A run that could not build reports a whole group of arms in one state, so it
+# still lists what it did not measure. The loops that do it are written out at each
+# site rather than in a helper taking the list: a helper that reaches a recorder
+# through a loop variable is a name slot compare_to_bash cannot resolve, and it
+# refused this whole suite for that (#1341). At the top level the same loop is read
+# as one unnamed call, which the grader drops, and the literal arms below are what
+# it grades.
 
 # A CC INHERITED FROM THE ENVIRONMENT IS NOT A COMPILER UNTIL IT COMPILES.
 #
@@ -376,8 +369,9 @@ if [ "$cc_usable" != yes ]; then
 		sed 's/^/  /' "$WORK/smoke.log" 2>/dev/null
 		_why="CC=$CC cannot build C"
 	fi
-	arms_unrunnable "$CONTROL_ARMS" MISSING_DEPENDENCY "$_why"
-	arms_unrunnable "$BATTERY_ARMS" MISSING_DEPENDENCY "$_why"
+	while IFS= read -r _a; do
+		[ -n "$_a" ] && check_unrunnable "$_a" MISSING_DEPENDENCY "$_why"
+	done <<< "$CONTROL_ARMS"$'\n'"$BATTERY_ARMS"
 	pgc_summary
 fi
 echo "-- compiler: $CC ($("$CC" --version 2>/dev/null | head -1))"
@@ -1178,7 +1172,9 @@ if "$CC" -O2 -Wall -I"$WORK" -o "$WORK/controls" "$WORK/controls.c" >"$CTLLOG" 2
 else
 	echo "---- the control program would not build or run ----"
 	sed 's/^/  /' "$CTLLOG"
-	arms_failed "$CONTROL_ARMS" "the control program would not build or run"
+	while IFS= read -r _a; do
+		[ -n "$_a" ] && pgc_fail "$_a" "the control program would not build or run"
+	done <<< "$CONTROL_ARMS"
 fi
 echo "-- instrument arms: $((PGC_CHECKS - _pre_checks)) reported" \
 	"($((PGC_PASSED - _pre_passed)) passed, $((PGC_FAILED - _pre_failed)) failed);" \
@@ -1214,6 +1210,22 @@ cat > "$WORK/battery.c" <<'CEOF'
 static void (*const pin_transpose) (uint64 *, int) = cluster_hilbert_transpose;
 static void (*const pin_pack) (const uint64 *, int, unsigned char *) = cluster_pack_interleave;
 
+/*
+ * Every key buffer is filled with 0xa5 before the pack writes it. A byte the pack
+ * never establishes then reads 0xa5 -- the same in every run and in the pytest
+ * twin -- rather than whatever the previous key left there, or, on the first use of
+ * a buffer, uninitialized memory. Measured: under a pack whose memset stops one
+ * byte short, which goldens went red depended on what the previous call had left
+ * in that byte. The C5 extent arms below fill their own buffers with 0x00 and 0xff
+ * on purpose and call the pack directly; nothing else does.
+ */
+static void
+pk(const uint64 *ord, int ncols, unsigned char *out)
+{
+	memset(out, 0xa5, (size_t) ncols * 8);
+	cluster_pack_interleave(ord, ncols, out);
+}
+
 /* Deterministic, so two runs of this suite compare the same points. */
 static unsigned rs = 987654321u;
 static unsigned
@@ -1332,7 +1344,7 @@ enc_hilbert(const unsigned *c, int ncols, int b, unsigned char *key)
 	for (j = 0; j < ncols; j++)
 		X[j] = (uint64) c[j] << (64 - b);
 	cluster_hilbert_transpose(X, ncols);
-	cluster_pack_interleave(X, ncols, key);
+	pk(X, ncols, key);
 }
 
 int
@@ -1431,9 +1443,9 @@ main(void)
 						Xf[j] = Xb[j] | (rnd64() & ((((uint64) 1) << (64 - b)) - 1));
 					}
 					cluster_hilbert_transpose(Xb, ncols);
-					cluster_pack_interleave(Xb, ncols, kb);
+					pk(Xb, ncols, kb);
 					cluster_hilbert_transpose(Xf, ncols);
-					cluster_pack_interleave(Xf, ncols, kf);
+					pk(Xf, ncols, kf);
 					points += 1;
 					ixf = pgc_key_index(kf, ncols, b);
 					if (pgc_key_index(kb, ncols, b) != ixf)
@@ -1494,7 +1506,7 @@ main(void)
 				untranspose(A0, ncols, 0);
 				memcpy(B, A0, sizeof(uint64) * ncols);
 				cluster_hilbert_transpose(B, ncols);
-				cluster_pack_interleave(B, ncols, kk);
+				pk(B, ncols, kk);
 				trips++;
 				ok0 = (memcmp(kk, key, (size_t) ncols * 8) == 0);
 				if (!ok0)
@@ -1505,7 +1517,7 @@ main(void)
 				untranspose(A1, ncols, 1);
 				memcpy(B, A1, sizeof(uint64) * ncols);
 				cluster_hilbert_transpose(B, ncols);
-				cluster_pack_interleave(B, ncols, kk);
+				pk(B, ncols, kk);
 				if (memcmp(kk, key, (size_t) ncols * 8) != 0)
 					mutbad++;
 
@@ -1547,7 +1559,7 @@ main(void)
 				 */
 				memcpy(B, A1, sizeof(uint64) * ncols);
 				cluster_hilbert_transpose(B, ncols);
-				cluster_pack_interleave(B, ncols, kk);
+				pk(B, ncols, kk);
 				ok1 = (memcmp(kk, key2, (size_t) ncols * 8) == 0);
 
 				adj++;
@@ -1599,7 +1611,7 @@ main(void)
 			pgc_makevec(k, ncols, X);
 			memcpy(Y, X, sizeof(uint64) * ncols);
 			cluster_hilbert_transpose(Y, ncols);
-			cluster_pack_interleave(Y, ncols, key);
+			pk(Y, ncols, key);
 			pgc_hex(key, ncols * 8, h);
 			printf("golden_n%d_%s=%s\n", ncols, pgc_vecname[k], h);
 		}
@@ -1609,12 +1621,12 @@ main(void)
 
 		v[0] = (uint64) 1 << 63;
 		v[1] = 0;
-		cluster_pack_interleave(v, 2, key);
+		pk(v, 2, key);
 		pgc_hex(key, 16, h);
 		printf("packpin_hi=%s\n", h);
 		v[0] = 0;
 		v[1] = (uint64) 1 << 63;
-		cluster_pack_interleave(v, 2, key);
+		pk(v, 2, key);
 		pgc_hex(key, 16, h);
 		printf("packpin_lo=%s\n", h);
 	}
@@ -1703,7 +1715,7 @@ main(void)
 		{
 			X[0] = vals[k];
 			cluster_hilbert_transpose(X, 1);
-			cluster_pack_interleave(X, 1, key);
+			pk(X, 1, key);
 			pgc_hex(key, 8, h);
 			printf("ident_n1_%s=%s\n", nm[k], h);
 		}
@@ -1728,9 +1740,9 @@ main(void)
 
 			X[0] = x;
 			cluster_hilbert_transpose(X, 1);
-			cluster_pack_interleave(X, 1, kh);
+			pk(X, 1, kh);
 			Y[0] = x;
-			cluster_pack_interleave(Y, 1, kz);
+			pk(Y, 1, kz);
 			for (q = 0; q < 8; q++)
 				be[q] = (unsigned char) (x >> (56 - 8 * q));
 			n6++;
@@ -1749,7 +1761,7 @@ main(void)
 		for (k = 0; k < PGC_NVEC; k++)
 		{
 			pgc_makevec(k, ncols, X);
-			cluster_pack_interleave(X, ncols, key);
+			pk(X, ncols, key);
 			pgc_hex(key, ncols * 8, h);
 			printf("zorder_n%d_%s=%s\n", ncols, pgc_vecname[k], h);
 		}
@@ -1766,7 +1778,9 @@ if [ ! -f "$CURVE_C" ] || [ ! -f "$CURVE_H" ]; then
 	[ -f "$CURVE_C" ] || _missing="$_missing src/columnar_curve.c"
 	[ -f "$CURVE_H" ] || _missing="$_missing src/columnar_curve.h"
 	echo "-- the code under test is absent:$_missing"
-	arms_failed "$BATTERY_ARMS" "the code under test is absent:$_missing"
+	while IFS= read -r _a; do
+		[ -n "$_a" ] && pgc_fail "$_a" "the code under test is absent:$_missing"
+	done <<< "$BATTERY_ARMS"
 else
 	cp "$CURVE_C" "$CURVE_H" "$WORK/"
 	if "$CC" -O2 -Wall -Werror=incompatible-pointer-types -I"$WORK" \
@@ -1777,7 +1791,9 @@ else
 	else
 		echo "---- the battery would not build or run against $CURVE_C ----"
 		sed 's/^/  /' "$BATLOG" | head -40
-		arms_failed "$BATTERY_ARMS" "the battery would not build or run; see the log above"
+		while IFS= read -r _a; do
+			[ -n "$_a" ] && pgc_fail "$_a" "the battery would not build or run; see the log above"
+		done <<< "$BATTERY_ARMS"
 	fi
 fi
 
diff --git a/test/iceberg_deletes.sh b/test/iceberg_deletes.sh
index b9e88a875..413959ea7 100755
--- a/test/iceberg_deletes.sh
+++ b/test/iceberg_deletes.sh
@@ -15,22 +15,73 @@ set -uo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 pgc_setup "${1:-/usr/local/pg17/bin/pg_config}"
 
-sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
-\\set VERBOSITY sqlstate
+# refusal SQL PHRASE -> the SQLSTATE when SQL is refused with PHRASE in its message;
+# "SQLSTATE (another refusal: MESSAGE)" when a different guard refused it; "no
+# error" when it ran; nothing when the server could not be asked. Each guard here
+# has its own message, and several share a SQLSTATE (XX001 and 22023), so an arm
+# counts only its own guard's refusal.
+refusal() {
+	local out st msg
+	await_up
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
 $1;
 SQLEOF
+)"
+	st="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	msg="$(sed -n 's/^ERROR:  [0-9A-Z]\{5\}: //p' <<<"$out" | head -1)"
+	if [ -n "$st" ]; then
+		case "$msg" in *"$2"*) echo "$st" ;; *) echo "$st (another refusal: $msg)" ;; esac
+	elif grep -q 'could not connect\|server closed the connection\|terminating connection' <<<"$out"; then
+		:
+	else
+		echo "no error"
+	fi
 }
 
 # the first ERROR message line, for telling apart same-SQLSTATE refusals
 errmsg_of() {
+	await_up
 	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
 		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  //p' | head -1
 $1;
 SQLEOF
 }
 
+# await_up -> wait, at most 60 s, until the server answers. A refusal arm that kills a
+# backend sends the server through crash recovery; without the wait, the next arms'
+# readings fail on recovery and red as collateral, more or fewer of them by timing
+# (with the partition spec's fields guard removed, the backend segfaults and two
+# later arms went red). The crash itself is still caught: survived() counts it.
+await_up() {
+	local i
+	for i in $(seq 1 120); do
+		[ "$(q 'SELECT 1')" = 1 ] && return 0
+		sleep 0.5
+	done
+}
+
+# Backends killed by a signal, from the server log: a number, or nothing when the
+# log can't be read. A fresh connection answers again after crash recovery, so
+# "SELECT 1" alone passed with a backend killed by a refusal arm: with abort() in
+# place of the null-pos refusal, or the fields guard removed (a segfault), and the
+# check run once recovery had finished. The survival checks below also require
+# that this count has not moved since their section began.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	await_up
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
+}
+
 FX="$(dirname "${BASH_SOURCE[0]}")/fixtures/iceberg"
 WHD="$FX/warehouse_del"
 [ -f "$WHD/db/t/metadata/apply.metadata.json" ] || pgc_skip fixture "delete fixture is missing"
@@ -44,7 +95,7 @@ chmod -R u+rwX "$DEST"
 MDIR="$DEST/db/t/metadata"
 
 # the full data, ignoring deletes, is 5 rows -- the baseline the delete removes from
-check "premise: the data file has 5 rows before deletes" \
+check "the data file has 5 rows before deletes" \
 	"$(q "SELECT count(*) FROM pgcolumnar.read_parquet('$DEST/db/t/data/data.parquet')
 	      AS t(id bigint, region text, amount int)")" "5"
 
@@ -55,20 +106,24 @@ o = json.load(open(sys.argv[1]))
 print("\n".join("%d|%s|%d" % (r["id"], r["region"], r["amount"]) for r in o["surviving"]))
 PY
 )"
-check "position deletes drop the listed rows (surviving == oracle)" \
+await_up
+check_text "position deletes drop the listed rows (surviving == oracle)" \
 	"$(q "SELECT id || '|' || region || '|' || amount
 	      FROM pgcolumnar.iceberg_scan('$MDIR/apply.metadata.json')
 	        AS t(id bigint, region text, amount int) ORDER BY id")" \
 	"$ORACLE"
+await_up
 check "the deleted ids (2, 4) are gone" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/apply.metadata.json')
 	      AS t(id bigint, region text, amount int) WHERE id IN (2,4)")" "0"
+await_up
 check "exactly the two deleted rows were removed (5 - 2 = 3)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/apply.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "3"
 # deletes are by row ordinal, independent of column projection: reading only one
 # column must still drop the same rows (the ordinal is the row index, not a
 # column value)
+await_up
 check "position deletes apply under column projection (id only -> 1,3,5)" \
 	"$(q "SELECT string_agg(id::text, ',' ORDER BY id)
 	      FROM pgcolumnar.iceberg_scan('$MDIR/apply.metadata.json') AS t(id bigint)")" \
@@ -79,9 +134,11 @@ check "position deletes apply under column projection (id only -> 1,3,5)" \
 # which the spec says applies (data_seq <= delete_seq) -- the boundary that a
 # strict > would wrongly exclude. This arm is the other side: a delete OLDER than
 # the data (seq 4 < data seq 5) must NOT apply, so all five rows survive.
+await_up
 check "a delete older than the data (lower seq) does not apply (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/noapply.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "5"
+await_up
 check "the would-be-deleted ids survive when the delete is older than the data" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/noapply.metadata.json')
 	      AS t(id bigint, region text, amount int) WHERE id IN (2,4)")" "2"
@@ -90,6 +147,7 @@ check "the would-be-deleted ids survive when the delete is older than the data"
 # real writers record a null entry sequence number and inherit the manifest's;
 # this variant's delete entry is null, inheriting seq 5 from the manifest, so it
 # must still apply over the seq-5 data (3 rows survive), proving inheritance.
+await_up
 check "a position delete with an inherited (null-entry) sequence number applies" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/inherit.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "3"
@@ -98,6 +156,7 @@ check "a position delete with an inherited (null-entry) sequence number applies"
 # the delete is applicable by sequence, but its rows target another data file, so
 # none of data.parquet's rows may be dropped (proves the path match excludes, not
 # just includes -- a basename-only or always-true match would wrongly delete).
+await_up
 check "a position delete naming a different data file deletes nothing (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/wrongpath.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "5"
@@ -106,24 +165,27 @@ check "a position delete naming a different data file deletes nothing (5 rows)"
 # On current main a null pos is silently dropped (the `!n1 && !n2` filter) and a
 # negative pos is cast to a huge uint64 that matches nothing: the scan returns
 # the phantom row(s) with NO error. The reader must instead refuse (XX001).
+CRASHES_BEFORE="$(crashes)"
 check "a position delete with a null pos is refused (XX001, not silently dropped)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/nullpos.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/nullpos.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has a null pos")" "XX001"
 check "...and the null-pos refusal names pos" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/nullpos.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "null pos")" "1"
-check "backend still up after the null-pos refusal" "$(q 'SELECT 1')" "1"
+check "backend still up after the null-pos refusal" "$(survived "$CRASHES_BEFORE")" "1"
 
+CRASHES_BEFORE="$(crashes)"
 check "a position delete with a negative pos is refused (XX001, not cast inert)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/negpos.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/negpos.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has a negative pos")" "XX001"
 check "...and the negative-pos refusal names the negative pos" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/negpos.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "negative pos")" "1"
-check "backend still up after the negative-pos refusal" "$(q 'SELECT 1')" "1"
+check "backend still up after the negative-pos refusal" "$(survived "$CRASHES_BEFORE")" "1"
 
 # RISK control: pos == 0 is a LEGITIMATE delete of the first row (id 1). It must
 # apply, not be rejected -- a `pos <= 0` guard would wrongly turn this red.
+await_up
 check "a position delete of ordinal 0 deletes the first row (id 1 gone, 4 remain)" \
 	"$(q "SELECT string_agg(id::text, ',' ORDER BY id)
 	      FROM pgcolumnar.iceberg_scan('$MDIR/zeropos.metadata.json')
@@ -144,50 +206,62 @@ eq_ids_of() {
 	     AS t(id bigint, region text, amount int)"
 }
 
-check "equality delete drops matching rows (survivors == oracle)" \
+CRASHES_BEFORE="$(crashes)"
+await_up
+check_text "equality delete drops matching rows (survivors == oracle)" \
 	"$(eq_ids_of eqapply)" "$(eq_oracle eqapply)"
 # THE boundary that distinguishes the equality rule (strict <) from the position
 # rule (<=): the same delete file at a sequence number EQUAL to the data's must
 # delete NOTHING (an equality delete never touches same-commit data)
-check "an equality delete at an equal sequence number does not apply" \
+await_up
+check_text "an equality delete at an equal sequence number does not apply" \
 	"$(eq_ids_of eqboundary)" "$(eq_oracle eqboundary)"
 # multi-column equality is an AND: (3,'eu') matches no row (3 is 'us'), so only
 # (4,'us') deletes
-check "multi-column equality matches all columns (AND, not OR)" \
+await_up
+check_text "multi-column equality matches all columns (AND, not OR)" \
 	"$(eq_ids_of eqmulti)" "$(eq_oracle eqmulti)"
 # only the equality_ids columns define the match; the delete file's extra amount
 # column carries a wrong value that must be ignored
-check "columns beyond equality_ids are ignored for matching" \
+await_up
+check_text "columns beyond equality_ids are ignored for matching" \
 	"$(eq_ids_of eqextra)" "$(eq_oracle eqextra)"
 # null matches null (IS NULL semantics), and ONLY null: id 6 (region NULL) goes,
 # id 7 ('eu') stays
-check "a null delete value matches only null data values" \
+await_up
+check_text "a null delete value matches only null data values" \
 	"$(eq_ids_of eqnull)" "$(eq_oracle eqnull)"
+await_up
 check "the null-region row is gone, the non-null rows remain" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/eqnull.metadata.json')
 	      AS t(id bigint, region text, amount int) WHERE region IS NULL")" "0"
 # two delete files with different equality_ids in one manifest: both apply
-check "multiple equality-delete files apply their union" \
+await_up
+check_text "multiple equality-delete files apply their union" \
 	"$(eq_ids_of eqtwo)" "$(eq_oracle eqtwo)"
 # position and equality deletes in one snapshot: the skip sets merge
-check "position and equality deletes combine" \
+await_up
+check_text "position and equality deletes combine" \
 	"$(eq_ids_of eqmixed)" "$(eq_oracle eqmixed)"
 # the delete columns come from the table schema, not the output list: a scan
 # projecting only amount must still drop the id-matched rows
+await_up
 check "equality deletes apply when the delete column is not projected" \
 	"$(q "SELECT string_agg(amount::text, ',' ORDER BY amount)
 	      FROM pgcolumnar.iceberg_scan('$MDIR/eqapply.metadata.json') AS t(amount int)")" \
 	"10,30,50"
-check "backend still up after the equality applications" "$(q 'SELECT 1')" "1"
+check "backend still up after the equality applications" "$(survived "$CRASHES_BEFORE")" "1"
 
 # ---- 4b: equality refusal and corruption arms -------------------------------
 # content=2 with null equality_ids is corrupt metadata (the spec requires it)
+CRASHES_BEFORE="$(crashes)"
 check "an equality delete without equality_ids is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnoids.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnoids.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has no equality_ids")" "XX001"
 # the pre-4b 'equality' fixture also lacks equality_ids, but its delete sits at
 # the data's own sequence number, so under the strict-< rule it can never apply
 # and is skipped before validation: the data reads untouched
+await_up
 check "a never-applicable equality delete without equality_ids is skipped (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/equality.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "5"
@@ -209,13 +283,16 @@ o = json.load(open(sys.argv[1]))
 print(",".join(str(i) for i in o["part_surviving"][sys.argv[2]]))
 PY
 }
-check "a partition-scoped equality delete applies only to its partition" \
+await_up
+check_text "a partition-scoped equality delete applies only to its partition" \
 	"$(part_ids eqpart_apply)" "$(part_oracle eqpart_apply)"
+await_up
 check "the us-partition rows survive an eu-scoped delete" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_apply.metadata.json')
 	      AS t(id bigint, region text, grp int) WHERE region = 'us'")" "3"
 # a delete scoped to a partition (region=zz) that no data file is in applies to
 # nothing -- a legitimate no-op, not an error and not a global delete
+await_up
 check "a delete scoped to an empty partition deletes nothing (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_nomatch.metadata.json')
 	      AS t(id bigint, region text, grp int)")" "5"
@@ -223,23 +300,24 @@ check "a delete scoped to an empty partition deletes nothing (5 rows)" \
 # partition-scoped delete, would silently under-delete; refuse it (the mirror
 # of the delete-side has_spec_id check)
 check "a data file lacking partition_spec_id is refused under a partitioned delete (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_datanospec.metadata.json')
-	                AS t(id bigint, region text, grp int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_datanospec.metadata.json')
+	                AS t(id bigint, region text, grp int)" "carries no partition_spec_id, which a partition-scoped")" "XX001"
 # a delete written under a partition spec no data file uses (partition
 # evolution): per the spec a partitioned delete never crosses spec ids, so it
 # applies to nothing -- a no-op, all rows survive, never a global over-delete
+await_up
 check "a cross-spec partition-scoped delete applies to nothing (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_crossspec.metadata.json')
 	      AS t(id bigint, region text, grp int)")" "5"
 # a partition tuple the reader cannot compare exactly (a double) is refused
 check "a partition-scoped delete with an uncomparable partition value is refused (0A000)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_incomparable.metadata.json')
-	                AS t(id bigint, region text, grp int)")" "0A000"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqpart_incomparable.metadata.json')
+	                AS t(id bigint, region text, grp int)" "has a partition tuple this reader cannot compare")" "0A000"
 # an equality column of a type with no supported mapping (timestamp) is refused
 # before any file is opened
 check "an equality delete on an unsupported column type is refused (0A000)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqtype.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "0A000"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqtype.metadata.json')
+	                AS t(id bigint, region text, amount int)" "is not supported")" "0A000"
 check "...and the refusal names the type" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqtype.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "type")" "1"
@@ -247,65 +325,69 @@ check "...and the refusal names the type" \
 # data file errors loudly (the reader's missing-field-id error), never silently
 # skips the delete
 check "an equality column missing from the data file errors (22023)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqmissing.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "22023"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqmissing.metadata.json')
+	                AS t(id bigint, region text, amount int)" "no Parquet column has field id")" "22023"
 # a delete-file path outside the table root is stopped by the path boundary
 # (22023 from the boundary, BEFORE the file is opened; if the boundary were
 # gone, /etc/hostname would be read and fail differently)
 check "an equality-delete path outside the table location is refused (22023)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqescape.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "22023"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqescape.metadata.json')
+	                AS t(id bigint, region text, amount int)" "is not under the table location")" "22023"
 check "...and the boundary refusal names the escape" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqescape.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "table location")" "1"
 # a path under the table root that climbs out with ".." is refused by the
 # containment (canonicalize collapses it and the re-check fails)
 check "a dotdot-escaping delete path is refused (22023)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqdotdot.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "22023"
-check "backend still up after the equality refusals" "$(q 'SELECT 1')" "1"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqdotdot.metadata.json')
+	                AS t(id bigint, region text, amount int)" "escapes the table location")" "22023"
+check "backend still up after the equality refusals" "$(survived "$CRASHES_BEFORE")" "1"
 
 # ---- 4b audit arms (multi-agent adversarial audit findings) -----------------
 # an equality_ids value beyond int32 must refuse the manifest (XX001); a silent
 # 32-bit truncation would alias field 2^32+2 onto the real field 2 and delete
 # rows the manifest never named
+CRASHES_BEFORE="$(crashes)"
 check "an equality_ids value beyond int32 refuses the manifest (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqbigid.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqbigid.metadata.json')
+	                AS t(id bigint, region text, amount int)" "corrupt Avro manifest entry")" "XX001"
 # a manifest list omitting partition_spec_id leaves an equality delete's scope
 # undecidable; defaulting it to 0 (unpartitioned) would defeat the
 # partition-scope guard, so the reader must refuse (XX001)
 check "a manifest list without partition_spec_id is refused for equality deletes (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnospec.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnospec.metadata.json')
+	                AS t(id bigint, region text, amount int)" "the manifest list carries no partition_spec_id")" "XX001"
 # a partition-specs entry matching the delete's spec id but lacking the
 # required "fields" key: treating it as unpartitioned would silently globalize
 # the delete, so it is corrupt metadata (XX001)
 check "a partition spec without its fields key is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnofields.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/eqnofields.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has no fields array")" "XX001"
 # an equality delete that can never apply (its sequence number exceeds no data
 # file's) is skipped per spec, not validated: this variant's delete has an
 # unsupported column type (field 8, timestamp) at the data's own sequence
 # number, and must NOT refuse -- all five rows read
+await_up
 check "a never-applicable equality delete is skipped, not validated (5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/eqstaletype.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "5"
 # a v1-shaped manifest (no sequence_number column in the entry schema) defaults
 # every file's sequence number to 0 per spec, even for EXISTING entries -- the
 # opposite of badseq, whose v2 schema HAS the column and carries a null
+await_up
 check "a v1 manifest without a sequence_number column reads (default 0, 5 rows)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_scan('$MDIR/v1seq.metadata.json')
 	      AS t(id bigint, region text, amount int)")" "5"
-check "backend still up after the audit arms" "$(q 'SELECT 1')" "1"
+check "backend still up after the audit arms" "$(survived "$CRASHES_BEFORE")" "1"
 
 # ---- spec: inheritance is ADDED-only; a null seq on an EXISTING entry is bad --
 # the spec inherits a null sequence number only for status-1 (ADDED) entries; an
 # EXISTING (status 0) entry with a null sequence number is corrupt, and silently
 # inheriting the too-new manifest number could keep rows a delete should remove.
+CRASHES_BEFORE="$(crashes)"
 check "an EXISTING entry with a null sequence number is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/badseq.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
-check "backend still up after the bad-sequence refusal" "$(q 'SELECT 1')" "1"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/badseq.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has no sequence number")" "XX001"
+check "backend still up after the bad-sequence refusal" "$(survived "$CRASHES_BEFORE")" "1"
 
 pgc_summary
diff --git a/test/iceberg_dv.sh b/test/iceberg_dv.sh
index d9df48ca8..5f8d80677 100755
--- a/test/iceberg_dv.sh
+++ b/test/iceberg_dv.sh
@@ -16,22 +16,71 @@ set -uo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 pgc_setup "${1:-/usr/local/pg17/bin/pg_config}"
 
-sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
-\\set VERBOSITY sqlstate
+# refusal SQL PHRASE -> the SQLSTATE when SQL is refused with PHRASE in its message;
+# "SQLSTATE (another refusal: MESSAGE)" when a different guard refused it; "no
+# error" when it ran; nothing when the server could not be asked. An arm used to
+# read the SQLSTATE alone, and several guards here raise XX001: with the
+# manifest/footer offset match removed, a later XX001 refused the same file and
+# that arm still passed.
+refusal() {
+	local out st msg
+	await_up
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
 $1;
 SQLEOF
+)"
+	st="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	msg="$(sed -n 's/^ERROR:  [0-9A-Z]\{5\}: //p' <<<"$out" | head -1)"
+	if [ -n "$st" ]; then
+		case "$msg" in *"$2"*) echo "$st" ;; *) echo "$st (another refusal: $msg)" ;; esac
+	elif grep -q 'could not connect\|server closed the connection\|terminating connection' <<<"$out"; then
+		:
+	else
+		echo "no error"
+	fi
 }
 
 # the first ERROR message line, for telling apart same-SQLSTATE refusals
 errmsg_of() {
+	await_up
 	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
 		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  //p' | head -1
 $1;
 SQLEOF
 }
 
+# await_up -> wait, at most 60 s, until the server answers. A refusal arm that kills a
+# backend sends the server through crash recovery; without the wait, the next arms'
+# readings fail on recovery and red as collateral, more or fewer of them by timing.
+# The crash itself is still caught: survived() counts it.
+await_up() {
+	local i
+	for i in $(seq 1 120); do
+		[ "$(q 'SELECT 1')" = 1 ] && return 0
+		sleep 0.5
+	done
+}
+
+# Backends killed by a signal, from the server log: a number, or nothing when the
+# log can't be read. A fresh connection answers again after crash recovery, so
+# "SELECT 1" alone passed with a backend killed by a refusal arm (no
+# referenced_data_file check: a NULL path reached strcmp); the survival checks
+# below also require that this count has not moved.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
+}
+
 FX="$(dirname "${BASH_SOURCE[0]}")/fixtures/iceberg"
 WHD="$FX/warehouse_del"
 [ -f "$WHD/db/t/metadata/dvapply.metadata.json" ] || pgc_skip fixture "deletion-vector fixtures are missing"
@@ -60,100 +109,103 @@ dv_ids_of() {
 # ---- deletion vectors are applied -------------------------------------------
 # THE <= boundary: a DV at the data file's own sequence number applies (same
 # rule as 4a position-delete files; a strict > would wrongly exclude it)
-check "a deletion vector at an equal sequence number applies (survivors == oracle)" \
+CRASHES_BEFORE="$(crashes)"
+check_text "a deletion vector at an equal sequence number applies (survivors == oracle)" \
 	"$(dv_ids_of dvapply)" "$(dv_oracle dvapply)"
 # the other side: a DV strictly older than the data applies to nothing
-check "a deletion vector older than the data does not apply" \
+check_text "a deletion vector older than the data does not apply" \
 	"$(dv_ids_of dvnoapply)" "$(dv_oracle dvnoapply)"
 # the spec's supersede rule: a position-delete FILE applies only when no DV
 # must be applied to the data file. The fixture's DV drops ordinal 1 and its
 # (also applicable) Parquet posdel names ordinals 1 and 3; a UNION would drop
 # both, supersede drops only ordinal 1.
-check "an applicable DV supersedes position-delete files for its data file" \
+check_text "an applicable DV supersedes position-delete files for its data file" \
 	"$(dv_ids_of dvsupersede)" "$(dv_oracle dvsupersede)"
 # supersede is per data file: a posdel targeting a DIFFERENT data file still
 # applies alongside the DV
-check "supersede is per data file, not global" \
+check_text "supersede is per data file, not global" \
 	"$(dv_ids_of dvother)" "$(dv_oracle dvother)"
 # roaring coverage: run-form containers plus a second 64-bit bucket
-check "a DV with run containers and a high-bucket position decodes" \
+check_text "a DV with run containers and a high-bucket position decodes" \
 	"$(dv_ids_of dvwide)" "$(dv_oracle dvwide)"
 # cookie 12347 (run containers marked in the run bitset)
-check "a run-optimized DV (cookie 12347) decodes" \
+check_text "a run-optimized DV (cookie 12347) decodes" \
 	"$(dv_ids_of dvrun)" "$(dv_oracle dvrun)"
 # a bitset container (cardinality above 4096)
-check "a bitset-container DV decodes" \
+check_text "a bitset-container DV decodes" \
 	"$(dv_ids_of dvbitset)" "$(dv_oracle dvbitset)"
 # one Puffin file carrying two DV blobs for two data files
-check "two DV blobs in one Puffin file each apply to their own data file" \
+check_text "two DV blobs in one Puffin file each apply to their own data file" \
 	"$(dv_ids_of dvtwo)" "$(dv_oracle dvtwo)"
-check "backend still up after the DV applications" "$(q 'SELECT 1')" "1"
+check "backend still up after the DV applications" "$(survived "$CRASHES_BEFORE")" "1"
 
 # ---- refusal and corruption arms --------------------------------------------
+CRASHES_BEFORE="$(crashes)"
 # two DV entries referencing one data file: the spec says scan results are
 # undefined and readers may raise; we raise rather than guess
 check "two DV entries for one data file are refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvdup.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvdup.metadata.json')
+	                AS t(id bigint, region text, amount int)" "two deletion vectors reference data file")" "XX001"
 check "a corrupted DV CRC is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadcrc.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadcrc.metadata.json')
+	                AS t(id bigint, region text, amount int)" "fails its CRC-32 check")" "XX001"
 check "a wrong DV blob magic is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadmagic.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadmagic.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has a bad magic sequence")" "XX001"
 # the manifest's content_offset must exactly match the footer's blob offset
 check "a manifest/footer offset mismatch is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvoffmismatch.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvoffmismatch.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has no blob matching the manifest's offset")" "XX001"
 # referenced_data_file is required for DVs
 check "a DV entry without referenced_data_file is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvnoref.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvnoref.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has no referenced_data_file")" "XX001"
 # record_count is defined as the DV's cardinality
 check "a record_count that disagrees with the DV cardinality is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadcount.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbadcount.metadata.json')
+	                AS t(id bigint, region text, amount int)" "positions but its manifest entry records")" "XX001"
 # deletion-vector-v1 blobs must not declare a compression codec
 check "a DV blob declaring a compression codec is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvcompressed.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvcompressed.metadata.json')
+	                AS t(id bigint, region text, amount int)" "declares a compression codec")" "XX001"
 # a compressed Puffin footer is refused loudly, never misparsed
 check "a compressed Puffin footer is refused (0A000)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvflags.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "0A000"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvflags.metadata.json')
+	                AS t(id bigint, region text, amount int)" "has a compressed Puffin footer")" "0A000"
 check "...and the refusal names the compressed footer" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvflags.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "compressed")" "1"
 # deletion vectors are v3-only
 check "a deletion vector in a format-version 2 table is refused (0A000)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvv2.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "0A000"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvv2.metadata.json')
+	                AS t(id bigint, region text, amount int)" "is a deletion vector, which format-version")" "0A000"
 check "...and the refusal names the format version" \
 	"$(errmsg_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvv2.metadata.json')
 	              AS t(id bigint, region text, amount int)" | grep -c "format-version")" "1"
 # a Puffin path outside the table root is stopped by the path boundary
 check "a Puffin path outside the table location is refused (22023)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvescape.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "22023"
-check "backend still up after the DV refusals" "$(q 'SELECT 1')" "1"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvescape.metadata.json')
+	                AS t(id bigint, region text, amount int)" "is not under the table location")" "22023"
+check "backend still up after the DV refusals" "$(survived "$CRASHES_BEFORE")" "1"
 
 # ---- audit arms (multi-agent adversarial audit findings) --------------------
+CRASHES_BEFORE="$(crashes)"
 # content_offset + content_size chosen to overflow int64: a bounds check that
 # adds the operands would wrap negative and read a wild pointer; testing each
 # operand against the file size refuses it cleanly
 check "a DV whose offset+size overflows int64 is refused, not read (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbigoff.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvbigoff.metadata.json')
+	                AS t(id bigint, region text, amount int)" "lies outside the file's blob region")" "XX001"
 # a run container whose start+length exceeds the 16-bit container range would
 # fabricate positions in a neighboring container; refuse rather than corrupt
 check "a run container overflowing its 16-bit range is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvrunoverflow.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvrunoverflow.metadata.json')
+	                AS t(id bigint, region text, amount int)" "overflows its 16-bit range")" "XX001"
 # two DV entries for one data file recorded with and without the file:// scheme:
 # the one-DV-per-file check strips the scheme, so the aliased pair is caught
 check "an aliased duplicate DV (scheme vs no scheme) is refused (XX001)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvdupscheme.metadata.json')
-	                AS t(id bigint, region text, amount int)")" "XX001"
-check "backend still up after the audit arms" "$(q 'SELECT 1')" "1"
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_scan('$MDIR/dvdupscheme.metadata.json')
+	                AS t(id bigint, region text, amount int)" "two deletion vectors reference data file")" "XX001"
+check "backend still up after the audit arms" "$(survived "$CRASHES_BEFORE")" "1"
 
 pgc_summary
diff --git a/test/iceberg_rest.sh b/test/iceberg_rest.sh
index 8383f5d34..a97ac65b2 100755
--- a/test/iceberg_rest.sh
+++ b/test/iceberg_rest.sh
@@ -41,12 +41,42 @@ rest_teardown() {
 }
 trap rest_teardown EXIT INT TERM
 
-sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
-\\set VERBOSITY sqlstate
+# refusal_of SQL PHRASE LABEL -> "<SQLSTATE><LABEL>" when SQL raised with PHRASE in its
+# message, the bare SQLSTATE when the message lacks it, or what happened instead. Two
+# guards here raise 42501: with the allow-list refusing everything and the link-local
+# guard gone, "a link-local catalog host is refused" passed on the allow-list's 42501,
+# and with every address read as link-local and the allow-list gone, "a catalog
+# endpoint off the allow-list is refused" passed on the link-local guard's. Each
+# refusal now wants its own guard's message.
+refusal_of() {
+	local out state
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
 $1;
 SQLEOF
+)"
+	state="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	if [ -z "$state" ]; then echo "no error ($(head -1 <<<"$out"))"
+	elif grep -qF "$2" <<<"$out"; then echo "$state$3"
+	else echo "$state"; fi
+}
+
+# Backends killed by a signal, from the server log: a number, or nothing when the log
+# can't be read. A fresh connection answers again after crash recovery, so "SELECT 1"
+# alone passed with a backend killed on the unknown-table arm; survival also requires
+# this count not to have moved.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
 }
 
 # restart the postmaster with a given environment prefix (the REST token lives
@@ -70,6 +100,7 @@ check "premise: rest fixture server is up" \
 	"$(grep -c READY "$PGC_WORKDIR/rest_server.out" 2>/dev/null)" "1"
 
 CAT="http://127.0.0.1:$REST_PORT"
+CRASHES_BEFORE="$(crashes)"
 
 # bring the token into the postmaster environment and allow the local endpoint
 pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$TOKEN'"
@@ -120,42 +151,48 @@ pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='wrong-token'"
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
 check "a wrong bearer token is refused (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','events')")" \
-	"28000"
+	"$(refusal_of "SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','events')" \
+	   "the REST catalog refused the request" " by the catalog")" \
+	"28000 by the catalog"
 
 pg_restart_env ""   # no token in the environment at all
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
 check "an anonymous request to a token-protected catalog is refused (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','events')")" \
-	"28000"
+	"$(refusal_of "SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','events')" \
+	   "the REST catalog refused the request" " by the catalog")" \
+	"28000 by the catalog"
 
 # restore the good token for the remaining arms
 pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$TOKEN'"
 
 # ---- the allow-list is the SSRF boundary (42501) ----------------------------
 check "a catalog endpoint off the allow-list is refused (42501)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
-	                SELECT pgcolumnar.iceberg_rest_table_location('http://127.0.0.2:$REST_PORT','db','events')")" \
-	"42501"
+	"$(refusal_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
+	                SELECT pgcolumnar.iceberg_rest_table_location('http://127.0.0.2:$REST_PORT','db','events')" \
+	   "is not in pgcolumnar.objstore_allowed_endpoints" " by the allow-list")" \
+	"42501 by the allow-list"
 
 # a link-local / instance-metadata catalog is refused even when allow-listed
 check "a link-local catalog host is refused even if allow-listed (42501)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='169.254.169.254';
-	                SELECT pgcolumnar.iceberg_rest_table_location('http://169.254.169.254/','db','events')")" \
-	"42501"
+	"$(refusal_of "SET pgcolumnar.objstore_allowed_endpoints='169.254.169.254';
+	                SELECT pgcolumnar.iceberg_rest_table_location('http://169.254.169.254/','db','events')" \
+	   "resolves into a link-local range" " by the link-local guard")" \
+	"42501 by the link-local guard"
 
 # ---- a response beyond the cap is refused (54000) ---------------------------
 check "an over-cap catalog response is refused (54000)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
-	                SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','toobig')")" \
-	"54000"
+	"$(refusal_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
+	                SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','toobig')" \
+	   "exceeded" " by the cap")" \
+	"54000 by the cap"
 
 # ---- an unknown table surfaces the catalog 404 cleanly (42P01) --------------
 check "an unknown table surfaces a clean not-found (42P01)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
-	                SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','nosuch')")" \
-	"42P01"
+	"$(refusal_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
+	                SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','nosuch')" \
+	   "the REST catalog has no such table" " by the catalog's 404")" \
+	"42P01 by the catalog's 404"
 
 # ---- a non-object /v1/config body is refused, never walked (XX001) ----------
 # an untrusted catalog whose config is a JSON array/scalar must not reach the
@@ -169,12 +206,13 @@ python3 "$(dirname "${BASH_SOURCE[0]}")/iceberg_rest_server.py" \
 BAD_PID=$!
 for _ in $(seq 1 50); do grep -q READY "$PGC_WORKDIR/badcfg.out" 2>/dev/null && break; sleep 0.1; done
 check "a non-object catalog config is refused, not walked (XX001)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
-	                SELECT pgcolumnar.iceberg_rest_table_location('http://127.0.0.1:$BAD_PORT','db','events')")" \
-	"XX001"
+	"$(refusal_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
+	                SELECT pgcolumnar.iceberg_rest_table_location('http://127.0.0.1:$BAD_PORT','db','events')" \
+	   "config response is not a JSON object" " by the config guard")" \
+	"XX001 by the config guard"
 kill "$BAD_PID" 2>/dev/null
 
 # ---- backend still healthy after the refusals -------------------------------
-check "backend still up after the REST refusals" "$(q 'SELECT 1')" "1"
+check "backend still up after the REST refusals" "$(survived "$CRASHES_BEFORE")" "1"
 
 pgc_summary
diff --git a/test/iceberg_rest_scan.sh b/test/iceberg_rest_scan.sh
index 4e7d77bc7..d5b3d1eb6 100755
--- a/test/iceberg_rest_scan.sh
+++ b/test/iceberg_rest_scan.sh
@@ -48,6 +48,23 @@ rest_teardown() {
 }
 trap rest_teardown EXIT INT TERM
 
+# Backends killed by a signal, from the server log: a number, or nothing when the log
+# can't be read. A fresh connection answers again after crash recovery, so "SELECT 1"
+# alone passed with the backend aborting on the unknown-table arm (probed 3s later);
+# survival also requires this count not to have moved.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
+}
+
 pg_restart_env() {
 	pgc_pg "pg_ctl -D '$PGC_PGDATA' stop -m fast -w" >/dev/null 2>&1
 	pgc_pg "$* pg_ctl -D '$PGC_PGDATA' -l '$PGC_LOGFILE' start -w" >/dev/null 2>&1
@@ -66,6 +83,7 @@ check "premise: rest fixture server is up" \
 	"$(grep -c READY "$PGC_WORKDIR/rest_server.out" 2>/dev/null)" "1"
 
 CAT="http://127.0.0.1:$REST_PORT"
+CRASHES_BEFORE="$(crashes)"
 pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$TOKEN'"
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
@@ -103,17 +121,27 @@ check "iceberg_rest_tables lists a namespace's tables" \
 	"events"
 
 # ---- an unknown table surfaces the catalog 404 cleanly through the read ------
-sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
-\\set VERBOSITY sqlstate
+# refusal_of SQL PHRASE LABEL -> "<SQLSTATE><LABEL>" when SQL raised with PHRASE in its
+# message, the bare SQLSTATE when the message lacks it, or what happened instead: the
+# not-found must be the catalog's 404, not any 42P01.
+refusal_of() {
+	local out state
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
 $1;
 SQLEOF
+)"
+	state="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	if [ -z "$state" ]; then echo "no error ($(head -1 <<<"$out"))"
+	elif grep -qF "$2" <<<"$out"; then echo "$state$3"
+	else echo "$state"; fi
 }
 check "iceberg_rest_scan of an unknown table is a clean not-found (42P01)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_rest_scan('$CAT','db','nosuch') AS t(id bigint)")" \
-	"42P01"
+	"$(refusal_of "SELECT * FROM pgcolumnar.iceberg_rest_scan('$CAT','db','nosuch') AS t(id bigint)" \
+	   "the REST catalog has no such table" " by the catalog's 404")" \
+	"42P01 by the catalog's 404"
 
-check "backend still up after the REST read" "$(q 'SELECT 1')" "1"
+check "backend still up after the REST read" "$(survived "$CRASHES_BEFORE")" "1"
 
 pgc_summary
diff --git a/test/iceberg_rest_server.py b/test/iceberg_rest_server.py
index d7f8c97bb..7a21beef2 100755
--- a/test/iceberg_rest_server.py
+++ b/test/iceberg_rest_server.py
@@ -190,8 +190,13 @@ def _load_table(self, ns, table):
         # storage-credentials array form (newer spec), longest-prefix selected by
         # the client. When --storage-cred-prefix is given, offer TWO entries: a
         # deliberately wrong catch-all and the correct, more specific one, so a
-        # green read proves longest-prefix selection.
+        # green read proves longest-prefix selection, and the flat config is wrong
+        # as well, so it proves the array was read at all.
         if ARGS.storage_cred_prefix and ARGS.vend_key:
+            # The flat config is wrong too: a reader that ignored the array and
+            # used the flat config would otherwise read with the right creds.
+            resp["config"] = dict(config, **{"s3.access-key-id": "WRONGFLATKEY",
+                                             "s3.secret-access-key": "wrong-flat-secret"})
             resp["storage-credentials"] = [
                 {"prefix": "s3://", "config": {
                     "s3.access-key-id": "WRONGKEY",
diff --git a/test/iceberg_rest_server.sh b/test/iceberg_rest_server.sh
index 0ca21173c..628962a54 100755
--- a/test/iceberg_rest_server.sh
+++ b/test/iceberg_rest_server.sh
@@ -29,12 +29,79 @@ SRV_PID=""
 st_teardown() { [ -n "$SRV_PID" ] && kill "$SRV_PID" 2>/dev/null; pgc_teardown; }
 trap st_teardown EXIT INT TERM
 
+# sqlstate_of SQL -> the SQLSTATE SQL failed with; "ok" when it ran; nothing when the
+# server could not be asked. "Ran" used to read as nothing too, so with the server
+# stopped the two "accepted" arms passed: a dead server and a statement that ran
+# looked the same.
 sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
+	local out rc st
+	await_up
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA -v ON_ERROR_STOP=1 2>&1 <<SQLEOF
 \\set VERBOSITY sqlstate
 $1;
 SQLEOF
+)"
+	rc=$?
+	st="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' <<<"$out" | head -1)"
+	if [ -n "$st" ]; then echo "$st"
+	elif [ "$rc" = 0 ]; then echo ok
+	fi
+}
+
+# refusal SQL PHRASE -> the SQLSTATE when SQL is refused with PHRASE in its message;
+# "SQLSTATE (another refusal: MESSAGE)" when something else refused it; "no error"
+# when it ran; nothing when the server could not be asked. 28000 and 42501 each come
+# from more than one guard here: with the endpoint allow-list removed, the link-local
+# guard still refused 169.254.169.254 with 42501, and "refused by the allow-list"
+# passed.
+refusal() {
+	local out st msg
+	await_up
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
+$1;
+SQLEOF
+)"
+	st="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	msg="$(sed -n 's/^ERROR:  [0-9A-Z]\{5\}: //p' <<<"$out" | head -1)"
+	if [ -n "$st" ]; then
+		case "$msg" in *"$2"*) echo "$st" ;; *) echo "$st (another refusal: $msg)" ;; esac
+	elif grep -q 'could not connect\|server closed the connection\|terminating connection' <<<"$out"; then
+		:
+	else
+		echo "no error"
+	fi
+}
+
+# await_up -> wait, at most 60 s, until the server answers, so an arm after a crash
+# reads the catalog rather than crash recovery (with the half-credential guard
+# removed the backend segfaults, and the next arm went red as collateral).
+await_up() {
+	local i
+	for i in $(seq 1 120); do
+		[ "$(q 'SELECT 1')" = 1 ] && return 0
+		sleep 0.5
+	done
+}
+
+# Backends killed by a signal, from the server log: a number, or nothing when the
+# log can't be read. "SELECT 1" alone answers again after crash recovery: with the
+# half-credential guard removed (a segfault), or abort() in place of the catalog's
+# 401 refusal, "backend still up" passed.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	await_up
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
 }
 pg_restart_env() {
 	pgc_pg "pg_ctl -D '$PGC_PGDATA' stop -m fast -w" >/dev/null 2>&1
@@ -56,6 +123,7 @@ CAT="http://127.0.0.1:$REST_PORT"
 pg_restart_env ""
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
+CRASHES_BEFORE="$(crashes)"
 
 q "CREATE SERVER cat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog
    OPTIONS (catalog_uri '$CAT')" >/dev/null
@@ -97,13 +165,13 @@ check "the mapping token never appears in the PG server log" \
 # ---- a wrong mapping token is refused by the catalog (28000) -----------------
 q "ALTER USER MAPPING FOR postgres SERVER cat OPTIONS (SET token 'wrong-token')" >/dev/null
 check "a wrong mapping token is refused (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('cat','db','events')")" \
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('cat','db','events')" "refused the request (HTTP 401")" \
 	"28000"
 
 # ---- no credential at all (no mapping, no env token) is refused --------------
 q "DROP USER MAPPING FOR postgres SERVER cat" >/dev/null
 check "no mapping and no env token is refused, not bypassed (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('cat','db','events')")" \
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('cat','db','events')" "refused the request (HTTP 401")" \
 	"28000"
 q "CREATE USER MAPPING FOR postgres SERVER cat OPTIONS (token '$TOKEN')" >/dev/null
 
@@ -122,8 +190,9 @@ check "a catalog_uri option on the USER MAPPING is rejected (HV00D)" \
 # multi-warehouse catalog.
 check "a warehouse option on the SERVER is accepted (not HV00D)" \
 	"$(sqlstate_of "CREATE SERVER whcat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog OPTIONS (catalog_uri '$CAT', warehouse 'wh1')")" \
-	""
+	"ok"
 q "CREATE USER MAPPING FOR postgres SERVER whcat OPTIONS (token '$TOKEN')" >/dev/null
+await_up
 check "a warehouse-configured server resolves a table location" \
 	"$(q "SELECT pgcolumnar.iceberg_rest_table_location('whcat','db','events')")" \
 	"$MDLOC"
@@ -151,6 +220,7 @@ q "CREATE SERVER ocat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog
 q "CREATE USER MAPPING FOR postgres SERVER ocat
    OPTIONS (oauth_client_id '$OCID', oauth_client_secret '$OCSEC')" >/dev/null
 
+await_up
 check "a server with an OAuth2 mapping reads by a minted bearer" \
 	"$(q "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')")" \
 	"$MDLOC"
@@ -187,15 +257,17 @@ check "the client secret never appears in the PG server log" \
 
 q "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (SET oauth_client_secret 'wrong-secret')" >/dev/null
 check "a wrong OAuth2 client secret is refused (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')")" \
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')" "refused the OAuth2")" \
 	"28000"
 q "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (DROP oauth_client_secret)" >/dev/null
+# "before any request" is counted: the fixture logs every request it gets.
+_irs_obefore="$(wc -l < "$OLOG")"
 check "a half OAuth2 credential (id, no secret) is refused before any request (28000)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')")" \
-	"28000"
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')" "incomplete OAuth2 credential")|$(( $(wc -l < "$OLOG") - _irs_obefore ))" \
+	"28000|0"
 check "oauth options are accepted on a USER MAPPING (no error)" \
 	"$(sqlstate_of "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (ADD oauth_scope 'catalog')")" \
-	""
+	"ok"
 check "an oauth option on the SERVER is rejected (HV00D)" \
 	"$(sqlstate_of "CREATE SERVER bad2 FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog OPTIONS (catalog_uri '$OCAT', oauth_client_secret 'x')")" \
 	"HV00D"
@@ -211,11 +283,11 @@ check "an oauth option on the SERVER is rejected (HV00D)" \
 q "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (ADD oauth_client_secret '$OCSEC')" >/dev/null 2>&1
 q "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (ADD oauth_token_uri 'http://169.254.169.254/v1/oauth/tokens')" >/dev/null
 check "a link-local oauth_token_uri is refused by the allow-list (42501)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')")" \
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')" "is not in pgcolumnar.objstore_allowed_endpoints")" \
 	"42501"
 q "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (SET oauth_token_uri 'http://10.11.12.13/v1/oauth/tokens')" >/dev/null
 check "an off-allow-list oauth_token_uri host is refused (42501)" \
-	"$(sqlstate_of "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')")" \
+	"$(refusal "SELECT pgcolumnar.iceberg_rest_table_location('ocat','db','events')" "is not in pgcolumnar.objstore_allowed_endpoints")" \
 	"42501"
 kill "$OSRV_PID" 2>/dev/null
 
@@ -223,6 +295,7 @@ kill "$OSRV_PID" 2>/dev/null
 pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$TOKEN'"
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
+await_up
 check "the catalog-URI form still works with the env token" \
 	"$(q "SELECT pgcolumnar.iceberg_rest_table_location('$CAT','db','events')")" \
 	"$MDLOC"
@@ -255,5 +328,5 @@ q "ALTER USER MAPPING FOR ice_r SERVER cat OPTIONS (ADD credentials_required 'fa
 check "control: with credentials_required false set by a superuser, the same role reads by the environment token" \
 	"$(as_ice_r "SELECT pgcolumnar.iceberg_rest_table_location('cat','db','events')")" "$MDLOC"
 
-check "backend still up" "$(q 'SELECT 1')" "1"
+check "backend still up" "$(survived "$CRASHES_BEFORE")" "1"
 pgc_summary
diff --git a/test/iceberg_rest_vended.sh b/test/iceberg_rest_vended.sh
index 7c26f68b4..35a712fd3 100755
--- a/test/iceberg_rest_vended.sh
+++ b/test/iceberg_rest_vended.sh
@@ -39,16 +39,63 @@ LAST_PORT=""
 vend_teardown() { for p in $PIDS; do kill "$p" 2>/dev/null; done; pgc_teardown; }
 trap vend_teardown EXIT INT TERM
 
-sqlstate_of() {
-	env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
-		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF | sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\).*/\1/p' | head -1
-\\set VERBOSITY sqlstate
+# refusal SQL PHRASE -> the SQLSTATE when SQL is refused with PHRASE in its message;
+# "SQLSTATE (another refusal: MESSAGE)" when something else refused it; "no error"
+# when it ran; nothing when the server could not be asked. The wrong-secret arm read
+# the SQLSTATE alone, and 28000 is also "no credentials": with vended credentials
+# never built at all, the read was refused for having none and the arm passed.
+refusal() {
+	local out st msg
+	await_up
+	out="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+		-d "$PGC_DB" -qtA 2>&1 <<SQLEOF
+\\set VERBOSITY verbose
 $1;
 SQLEOF
+)"
+	st="$(sed -n 's/^ERROR:  \([0-9A-Z]\{5\}\): .*/\1/p' <<<"$out" | head -1)"
+	msg="$(sed -n 's/^ERROR:  [0-9A-Z]\{5\}: //p' <<<"$out" | head -1)"
+	if [ -n "$st" ]; then
+		case "$msg" in *"$2"*) echo "$st" ;; *) echo "$st (another refusal: $msg)" ;; esac
+	elif grep -q 'could not connect\|server closed the connection\|terminating connection' <<<"$out"; then
+		:
+	else
+		echo "no error"
+	fi
+}
+
+# await_up -> wait, at most 60 s, until the server answers, so an arm after a crash
+# reads the table rather than crash recovery.
+await_up() {
+	local i
+	for i in $(seq 1 120); do
+		[ "$(q 'SELECT 1')" = 1 ] && return 0
+		sleep 0.5
+	done
+}
+
+# Backends killed by a signal, from the server log: a number, or nothing when the
+# log can't be read. "SELECT 1" alone answers again after crash recovery: with the
+# 403 refusal replaced by abort(), the survival check passed.
+crashes() {
+	local _n
+	_n="$(pgc_pg "grep -c 'terminated by signal' '$PGC_LOGFILE'" 2>/dev/null)"
+	case "$_n" in '' | *[!0-9]*) ;; *) echo "$_n" ;; esac
+}
+survived() {	# survived BEFORE -> "1" when the server answers and no backend died since
+	local _up _now
+	await_up
+	_up="$(q 'SELECT 1')"; _now="$(crashes)"
+	if ! [[ "$1" =~ ^[0-9]+$ && "$_now" =~ ^[0-9]+$ ]]; then echo "no (crash count unreadable)"
+	elif [ "$_up" = 1 ] && [ "$_now" = "$1" ]; then echo 1
+	else echo "no ([$_up], $(( _now - $1 )) backend crashes)"; fi
 }
 pg_restart_env() {
 	pgc_pg "pg_ctl -D '$PGC_PGDATA' stop -m fast -w" >/dev/null 2>&1
-	pgc_pg "$* pg_ctl -D '$PGC_PGDATA' -l '$PGC_LOGFILE' start -w" >/dev/null 2>&1
+	# Every AWS_* unset first: the vended arms prove something only while the postmaster
+	# holds no ambient credential, so none may arrive from the caller's environment or
+	# a login profile. An arm that wants ambient credentials passes them in "$@".
+	pgc_pg "unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_ENDPOINT_URL AWS_REGION AWS_DEFAULT_REGION AWS_PROFILE AWS_SHARED_CREDENTIALS_FILE AWS_CONFIG_FILE; $* pg_ctl -D '$PGC_PGDATA' -l '$PGC_LOGFILE' start -w" >/dev/null 2>&1
 	for _ in $(seq 1 30); do [ -n "$(q 'SELECT 1')" ] && return 0; sleep 0.5; done
 	echo "FATAL: cluster did not come back after env restart"; exit 1
 }
@@ -86,6 +133,7 @@ CAT="http://127.0.0.1:$LAST_PORT"
 pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$RESTTOK'"
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
+CRASHES_BEFORE="$(crashes)"
 
 # ---- CORE: vended creds sign the S3 reads (no ambient creds exist) -----------
 # apply.metadata.json drops ordinals 1,3 (id 2, id 4); survivors 1,3,5.
@@ -132,15 +180,19 @@ start_rest --token "$RESTTOK" \
 	--vend-key "$AKID" --vend-secret "wrong-vended-secret" --vend-region "$REGION" --vend-endpoint "$S3EP"
 BAD_PORT="$LAST_PORT"
 check "a wrong vended secret is refused by S3, not bypassed (28000)" \
-	"$(sqlstate_of "SELECT * FROM pgcolumnar.iceberg_rest_scan('http://127.0.0.1:$BAD_PORT','db','t')
-	                AS t(id bigint, region text, amount int)")" \
+	"$(refusal "SELECT * FROM pgcolumnar.iceberg_rest_scan('http://127.0.0.1:$BAD_PORT','db','t')
+	                AS t(id bigint, region text, amount int)" "was denied (HTTP 403")" \
 	"28000"
 
 # ---- storage-credentials: longest-prefix entry (correct) beats catch-all ----
+# The catalog's flat config vends WRONG credentials here too, so a reader that
+# ignored the storage-credentials array and used the flat config is refused. With
+# the array never read, this arm passed while the flat config was correct.
 start_rest --token "$RESTTOK" \
 	--vend-key "$AKID" --vend-secret "$SECRET" --vend-region "$REGION" --vend-endpoint "$S3EP" \
 	--storage-cred-prefix "s3://$BUCKET/db/t"
 SC_PORT="$LAST_PORT"
+await_up
 check "storage-credentials longest-prefix match selects the right creds" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_rest_scan('http://127.0.0.1:$SC_PORT','db','t')
 	      AS t(id bigint, region text, amount int)")" \
@@ -153,9 +205,9 @@ start_rest --token "$RESTTOK" \
 	--vend-endpoint "http://127.0.0.2:$S3_PORT"
 LL_PORT="$LAST_PORT"
 check "vended creds for an off-allow-list endpoint are refused (42501)" \
-	"$(sqlstate_of "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
+	"$(refusal "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1';
 	                SELECT * FROM pgcolumnar.iceberg_rest_scan('http://127.0.0.1:$LL_PORT','db','t')
-	                AS t(id bigint, region text, amount int)")" \
+	                AS t(id bigint, region text, amount int)" "is not in pgcolumnar.objstore_allowed_endpoints")" \
 	"42501"
 
 # ---- ambient still works when the catalog vends nothing ---------------------
@@ -166,11 +218,12 @@ pg_restart_env "PGCOLUMNAR_ICEBERG_REST_TOKEN='$RESTTOK'" \
 	"AWS_SECRET_ACCESS_KEY='$SECRET'" "AWS_REGION='$REGION'"
 q "ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'" >/dev/null
 q "SELECT pg_reload_conf()" >/dev/null
+await_up
 check "a table vending no creds still reads with ambient (cfg NULL path)" \
 	"$(q "SELECT count(*) FROM pgcolumnar.iceberg_rest_scan('http://127.0.0.1:$AMB_PORT','db','t')
 	      AS t(id bigint, region text, amount int)")" \
 	"3"
 
-check "backend still up after the vended-credential arms" "$(q 'SELECT 1')" "1"
+check "backend still up after the vended-credential arms" "$(survived "$CRASHES_BEFORE")" "1"
 
 pgc_summary
diff --git a/test/logical_decoding_cdc_recipe.sh b/test/logical_decoding_cdc_recipe.sh
index 830e0222b..4b7dea0c4 100755
--- a/test/logical_decoding_cdc_recipe.sh
+++ b/test/logical_decoding_cdc_recipe.sh
@@ -47,7 +47,8 @@ max_wal_senders=8"
 pgc_setup "${1:-/usr/local/pg17/bin/pg_config}"
 
 if [ ! -f "$("$PGC_PG_CONFIG" --pkglibdir)/test_decoding.so" ]; then
-	pgc_skip "test_decoding" "test_decoding.so is not in $("$PGC_PG_CONFIG" --pkglibdir); build contrib/test_decoding"
+	# The message is the check's name, so it is a literal: the twin records the same one.
+	pgc_skip "test_decoding" "test_decoding.so is not installed; build contrib/test_decoding"
 fi
 
 check "premise: the server is running at wal_level=logical" \
@@ -81,12 +82,21 @@ printf '%s\n' "$RECIPE" > "$RECIPE_FILE"
 # produced nothing.
 check "premise: the extraction is not empty" \
 	"$([ -n "$RECIPE" ] && echo nonempty || echo EMPTY)" "nonempty"
-for want in "CREATE TABLE events" "CREATE TABLE events_cdc" \
-            "CREATE FUNCTION events_capture" "CREATE TRIGGER events_cdc_t" \
-            "USING pgcolumnar" "TG_OP = 'DELETE'" "OLD.id"; do
-	check "premise: the extracted recipe contains [$want]" \
-		"$(grep -cF "$want" "$RECIPE_FILE" | awk '{print ($1>0)?"yes":"no"}')" "yes"
-done
+# Unrolled so each name is a literal the twin's grader can read.
+check "premise: the extracted recipe contains [CREATE TABLE events]" \
+	"$(grep -qF "CREATE TABLE events" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [CREATE TABLE events_cdc]" \
+	"$(grep -qF "CREATE TABLE events_cdc" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [CREATE FUNCTION events_capture]" \
+	"$(grep -qF "CREATE FUNCTION events_capture" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [CREATE TRIGGER events_cdc_t]" \
+	"$(grep -qF "CREATE TRIGGER events_cdc_t" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [USING pgcolumnar]" \
+	"$(grep -qF "USING pgcolumnar" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [TG_OP = 'DELETE']" \
+	"$(grep -qF "TG_OP = 'DELETE'" "$RECIPE_FILE" && echo yes || echo no)" "yes"
+check "premise: the extracted recipe contains [OLD.id]" \
+	"$(grep -qF "OLD.id" "$RECIPE_FILE" && echo yes || echo no)" "yes"
 check "premise: and it is the whole block, not a fragment" \
 	"$([ "$(grep -c ';' "$RECIPE_FILE")" -ge 4 ] && echo yes || echo no)" "yes"
 
@@ -111,7 +121,9 @@ check "premise: the slot exists and is logical" \
 psql_run "INSERT INTO events VALUES (1,'sale',100), (2,'refund',50), (3,'sale',75);"
 check_num "a row trigger on a COLUMNAR table fires once per inserted row" \
 	"$(q "SELECT count(*) FROM events_cdc WHERE op = 'INSERT';")" "3"
-check "and it saw the same values the table holds" \
+# check_text, not check: with the server gone both readings are empty, and "" = ""
+# passed this arm (#418).
+check_text "and it saw the same values the table holds" \
 	"$(q "SELECT string_agg(id||':'||kind||':'||amount, ',' ORDER BY id) FROM events_cdc WHERE op='INSERT';")" \
 	"$(q "SELECT string_agg(id||':'||kind||':'||amount, ',' ORDER BY id) FROM events;")"
 
@@ -142,9 +154,19 @@ check_num "and the row really is gone from the columnar table" \
 
 # ---- 3. the capture is transactional -----------------------------------------
 CAP_BEFORE="$(q "SELECT count(*) FROM events_cdc;")"
-psql_run "BEGIN;
-          INSERT INTO events VALUES (99,'rolledback',1);
-          ROLLBACK;"
+# Read INSIDE the transaction before rolling it back, so the two arms below have
+# something to undo. Without this reading, a rolled-back INSERT that never ran
+# (it failed, or was never sent) left both arms green: nothing captured, no row.
+# Measured: with the INSERT made a duplicate key, so the block stopped at it, the
+# suite passed 35/35.
+INSIDE="$(env PATH="$PGC_BINDIR:$PATH" psql -h 127.0.0.1 -p "$PGC_PORT" -U postgres \
+	-d "$PGC_DB" -qAt -v ON_ERROR_STOP=1 -c "BEGIN;" \
+	-c "INSERT INTO events VALUES (99,'rolledback',1);" \
+	-c "SELECT ((SELECT count(*) FROM events_cdc) - ${CAP_BEFORE:-0}) || ':' ||
+	           (SELECT count(*) FROM events WHERE id = 99);" \
+	-c "ROLLBACK;" 2>&1)"
+check "inside the transaction the row was captured and is in the columnar table, before the rollback" \
+	"$INSIDE" "1:1"
 check_num "a rolled-back transaction captures nothing" \
 	"$(q "SELECT count(*) FROM events_cdc;")" "$CAP_BEFORE"
 check_num "and leaves no row in the columnar table either" \
diff --git a/test/logical_decoding_source.sh b/test/logical_decoding_source.sh
index c17b4b1df..8e406bf7d 100755
--- a/test/logical_decoding_source.sh
+++ b/test/logical_decoding_source.sh
@@ -35,7 +35,8 @@ pgc_setup "${1:-/usr/local/pg17/bin/pg_config}"
 # test_decoding is stock contrib, but it is not built by default in a source
 # install. A missing dependency is an environment defect rather than a pass.
 if [ ! -f "$("$PGC_PG_CONFIG" --pkglibdir)/test_decoding.so" ]; then
-	pgc_skip "test_decoding" "test_decoding.so is not in $("$PGC_PG_CONFIG" --pkglibdir); build contrib/test_decoding"
+	# The message is the check's name, so it is a literal: the twin records the same one.
+	pgc_skip "test_decoding" "test_decoding.so is not installed; build contrib/test_decoding"
 fi
 
 check "premise: the server is running at wal_level=logical" \
@@ -100,20 +101,30 @@ check "the slot carries pgcolumnar's internal catalog instead" \
 # it useless as a change stream: it does not carry the data and it does not even
 # carry a row count. Asserted by writing 100x the rows into a second columnar
 # table and showing the record count does not follow.
+#
+# THE SECOND SLOT GETS ITS OWN HEAP CONTROL. Without one, a slot that decoded
+# nothing passed both checks below: "no decodable change" reads 0 and "not 100x
+# the records" reads 0 < anything. Measured: with pgc_754b created after the
+# insert, the slot carried 0 records and every check passed.
 psql_run "CREATE TABLE col_big (id int PRIMARY KEY, v text) USING pgcolumnar;"
+psql_run "CREATE TABLE heap_big (id int PRIMARY KEY, v text) USING heap;"
 psql_run "SELECT pg_create_logical_replication_slot('pgc_754b', 'test_decoding');"
 psql_run "INSERT INTO col_big SELECT g, 'c' || g FROM generate_series(1, 5000) g;"
+psql_run "INSERT INTO heap_big SELECT g, 'h' || g FROM generate_series(1, 5000) g;"
 psql_run "CREATE TABLE decoded_big AS
           SELECT data FROM pg_logical_slot_get_changes('pgc_754b', NULL, NULL);"
 SMALL="$(d 'table pgcolumnar.')"
 BIG="$(q "SELECT count(*) FROM decoded_big WHERE data LIKE '%table pgcolumnar.%';")"
 check "premise: the 100x table really holds 100x the rows" \
 	"$(q 'SELECT count(*) FROM col_big;')" "5000"
+check_num "CONTROL: the second slot decodes the heap table's 5000 inserts" \
+	"$(q "SELECT count(*) FROM decoded_big WHERE data LIKE '%table public.heap_big: INSERT%';")" "5000"
 check_num "and it too emits no decodable change of its own" \
 	"$(q "SELECT count(*) FROM decoded_big WHERE data LIKE '%table public.col_big:%';")" "0"
 echo "-- internal pgcolumnar records: $SMALL for 50 rows, $BIG for 5000"
 check "100x the rows does not give 100x the internal records" \
-	"$([ "$BIG" -lt $(( SMALL * 10 )) ] && echo yes || echo "no ($SMALL then $BIG)")" "yes"
+	"$([ "${BIG:-0}" -gt 0 ] 2>/dev/null && [ "$BIG" -lt $(( SMALL * 10 )) ] 2>/dev/null && echo yes ||
+	   echo "no ($SMALL then $BIG; the second slot must carry some)")" "yes"
 
 psql_run "SELECT pg_drop_replication_slot('pgc_754');"
 psql_run "SELECT pg_drop_replication_slot('pgc_754b');"
diff --git a/test/logical_subscriber.sh b/test/logical_subscriber.sh
index 40b350889..190163813 100755
--- a/test/logical_subscriber.sh
+++ b/test/logical_subscriber.sh
@@ -96,12 +96,22 @@ psql_run "INSERT INTO src SELECT g, 'v'||g FROM generate_series(11,15) g;" >/dev
 for _ in $(seq 1 30); do [ "$(SUB 'SELECT count(*) FROM src')" = "15" ] && break; sleep 1; done
 check "insert-only: streamed INSERTs applied" "$(SUB 'SELECT count(*) FROM src')" "15"
 
+# An INSERT committed after the UPDATE: once it has arrived, the UPDATE before it in the
+# stream has been processed. A fixed sleep proved nothing. With the subscription disabled
+# before the UPDATE, or with streamed INSERTs failing, both checks below used to pass:
+# nothing had been applied, so nothing had been applied wrongly.
 psql_run "UPDATE src SET v = 'changed' WHERE id = 1;" >/dev/null 2>&1
-sleep 3
+psql_run "INSERT INTO src VALUES (16, 'after the update');" >/dev/null 2>&1
+for _ in $(seq 1 30); do [ "$(SUB 'SELECT count(*) FROM src WHERE id = 16')" = "1" ] && break; sleep 1; done
+SENTINEL="$(SUB 'SELECT count(*) FROM src WHERE id = 16')"
+after_sentinel() {	# reading -> the reading, or "no reading" when the sentinel never arrived
+	if [ "$SENTINEL" = "1" ]; then echo "$1"
+	else echo "no reading (the INSERT after the UPDATE never arrived: [$SENTINEL]; reading [$1])"; fi
+}
 check "insert-only: the UPDATE is skipped by design, not applied" \
-	"$(SUB "SELECT v FROM src WHERE id = 1")" "v1"
+	"$(after_sentinel "$(SUB "SELECT v FROM src WHERE id = 1")")" "v1"
 check "insert-only: no apply errors" \
-	"$(SUB "SELECT coalesce(sum(apply_error_count),0)::text FROM pg_stat_subscription_stats" | tail -1)" "0"
+	"$(after_sentinel "$(SUB "SELECT coalesce(sum(apply_error_count),0)::text FROM pg_stat_subscription_stats" | tail -1)")" "0"
 
 # ---- 2. the wedge: a publication carrying UPDATE ----------------------------
 # Asserted from the subscriber's log, because the failure happens in the apply worker and
@@ -112,7 +122,7 @@ psql_run "CREATE TABLE upd (id int PRIMARY KEY, v text);
 SUB "CREATE TABLE upd (id int PRIMARY KEY, v text) USING pgcolumnar;" >/dev/null 2>&1
 SUB "CREATE SUBSCRIPTION s_all CONNECTION 'host=127.0.0.1 port=$PGC_PORT user=postgres dbname=$PGC_DB' PUBLICATION p_all;" >/dev/null 2>&1
 for _ in $(seq 1 30); do [ "$(SUB 'SELECT count(*) FROM upd')" = "5" ] && break; sleep 1; done
-check "premise: the second subscription synced before the UPDATE" \
+check "the second subscription synced before the UPDATE" \
 	"$(SUB 'SELECT count(*) FROM upd')" "5"
 
 psql_run "UPDATE upd SET v = 'changed' WHERE id = 1;" >/dev/null 2>&1
@@ -125,12 +135,17 @@ log_has() { pgc_pg "grep -c '$1' '$SUB_LOG' 2>/dev/null || echo 0" | tail -1; }
 
 check "the error names logical replication, not row locking" \
 	"$([ "$(log_has 'logical replication cannot apply UPDATE or DELETE')" -ge 1 ] && echo yes || echo no)" "yes"
+# Absence counts only once the replication error is there: with no UPDATE sent, an
+# unreadable log, or a wedge that never happened, this used to pass.
 check "the error does NOT say only 'row locking is not supported'" \
-	"$([ "$(log_has 'row locking is not supported')" = 0 ] && echo yes || echo no)" "yes"
+	"$(if [ "$(log_has 'logical replication cannot apply UPDATE or DELETE')" -lt 1 ]; then
+		echo "no reading (the subscriber log holds no replication error)"
+	   elif [ "$(log_has 'row locking is not supported')" = 0 ]; then echo yes; else echo no; fi)" "yes"
 check "the hint names the insert-only publication" \
 	"$([ "$(log_has 'publish = ')" -ge 1 ] && echo yes || echo no)" "yes"
+# Read as "publisher -> subscriber": with no UPDATE sent, the subscriber's v1 used to pass.
 check "the wedge is real: the row is still unchanged on the subscriber" \
-	"$(SUB "SELECT v FROM upd WHERE id = 1")" "v1"
+	"$(q "SELECT v FROM upd WHERE id = 1") -> $(SUB "SELECT v FROM upd WHERE id = 1")" "changed -> v1"
 # Unbounded is the whole point, so assert the SECOND attempt rather than a counter that
 # may not have flushed. Core re-sends the same transaction about every 5 seconds.
 for _ in $(seq 1 20); do
@@ -152,13 +167,24 @@ psql_run "CREATE TABLE lk (id int primary key, v text) USING pgcolumnar;
 	INSERT INTO lk VALUES (1, 'a');" >/dev/null 2>&1
 check "premise: the lock fixture really is columnar" \
 	"$(q "SELECT amname FROM pg_class c JOIN pg_am a ON a.oid=c.relam WHERE c.relname='lk'")" "pgcolumnar"
-for lk in "FOR UPDATE" "FOR SHARE" "FOR NO KEY UPDATE"; do
-	out=$(psql_run "SELECT * FROM lk WHERE id = 1 $lk" 2>&1)
-	check "an ordinary SELECT ... $lk keeps the generic message" \
-		"$(grep -c 'row locking is not supported' <<<"$out")" "1"
-	check "an ordinary SELECT ... $lk is not told about replication" \
-		"$(grep -c 'logical replication cannot apply' <<<"$out")" "0"
-done
+# lk_said MODE -> the error an ordinary SELECT ... MODE raised. lk_replication MODE -> how
+# often it mentions replication, but only when it raised the generic message: a statement
+# that failed some other way (a missing table, a dead server) used to pass "is not told
+# about replication" because nothing was said at all. Unrolled so each check's name is a
+# literal the twin grader can read.
+lk_said() { psql_run "SELECT * FROM lk WHERE id = 1 $1" 2>&1; }
+lk_generic() { grep -c 'row locking is not supported' <<<"$(lk_said "$1")"; }
+lk_replication() {
+	local out; out="$(lk_said "$1")"
+	if grep -q 'row locking is not supported' <<<"$out"; then grep -c 'logical replication cannot apply' <<<"$out"
+	else echo "no reading (no generic error: $(head -1 <<<"$out"))"; fi
+}
+check "an ordinary SELECT ... FOR UPDATE keeps the generic message" "$(lk_generic 'FOR UPDATE')" "1"
+check "an ordinary SELECT ... FOR UPDATE is not told about replication" "$(lk_replication 'FOR UPDATE')" "0"
+check "an ordinary SELECT ... FOR SHARE keeps the generic message" "$(lk_generic 'FOR SHARE')" "1"
+check "an ordinary SELECT ... FOR SHARE is not told about replication" "$(lk_replication 'FOR SHARE')" "0"
+check "an ordinary SELECT ... FOR NO KEY UPDATE keeps the generic message" "$(lk_generic 'FOR NO KEY UPDATE')" "1"
+check "an ordinary SELECT ... FOR NO KEY UPDATE is not told about replication" "$(lk_replication 'FOR NO KEY UPDATE')" "0"
 
 SUB "DROP SUBSCRIPTION s_ins;" >/dev/null 2>&1
 SUB "DROP SUBSCRIPTION s_all;" >/dev/null 2>&1
diff --git a/test/pytest/TESTS.md b/test/pytest/TESTS.md
index 77e562c8b..2d5cbf83e 100644
--- a/test/pytest/TESTS.md
+++ b/test/pytest/TESTS.md
@@ -313,6 +313,24 @@ behaviour, the source of that number is named.
 - [265. test_iceberg_malformed.py: the Iceberg reader refuses crafted metadata cleanly, never crashing or hanging](#265-test_iceberg_malformedpy-the-iceberg-reader-refuses-crafted-metadata-cleanly-never-crashing-or-hanging)
 - [266. test_iceberg_name_mapping.py: an Iceberg data file with no field ids binds by name mapping](#266-test_iceberg_name_mappingpy-an-iceberg-data-file-with-no-field-ids-binds-by-name-mapping)
 - [267. test_iceberg_objstore.py: Iceberg tables read over object storage](#267-test_iceberg_objstorepy-iceberg-tables-read-over-object-storage)
+- [268. test_iceberg_dv.py: Iceberg v3 deletion vectors apply, supersede, and refuse what they must](#268-test_iceberg_dvpy-iceberg-v3-deletion-vectors-apply-supersede-and-refuse-what-they-must)
+- [269. test_logical_decoding_source.py: a columnar table is not a logical decoding source](#269-test_logical_decoding_sourcepy-a-columnar-table-is-not-a-logical-decoding-source)
+- [270. test_iceberg_deletes.py: Iceberg position and equality deletes apply, scope, and refuse what they must](#270-test_iceberg_deletespy-iceberg-position-and-equality-deletes-apply-scope-and-refuse-what-they-must)
+- [271. test_logical_subscriber.py: columnar as a logical replication apply target](#271-test_logical_subscriberpy-columnar-as-a-logical-replication-apply-target)
+- [272. test_logical_decoding_cdc_recipe.py: the documented CDC recipe captures, transacts and decodes](#272-test_logical_decoding_cdc_recipepy-the-documented-cdc-recipe-captures-transacts-and-decodes)
+- [273. test_iceberg_rest.py: the Iceberg REST catalog resolves a table, keeps its token out of every log, and refuses what it must](#273-test_iceberg_restpy-the-iceberg-rest-catalog-resolves-a-table-keeps-its-token-out-of-every-log-and-refuses-what-it-must)
+- [274. test_iceberg_rest_scan.py: the Iceberg REST catalog reads a table as iceberg_scan does, lists, and refuses an unknown table](#274-test_iceberg_rest_scanpy-the-iceberg-rest-catalog-reads-a-table-as-iceberg_scan-does-lists-and-refuses-an-unknown-table)
+- [275. test_iceberg_rest_vended.py: an Iceberg REST catalog's vended credentials sign the reads, and nothing else does](#275-test_iceberg_rest_vendedpy-an-iceberg-rest-catalogs-vended-credentials-sign-the-reads-and-nothing-else-does)
+- [276. test_iceberg_rest_server.py: an Iceberg REST catalog FOREIGN SERVER authenticates by its USER MAPPING, and by nothing else](#276-test_iceberg_rest_serverpy-an-iceberg-rest-catalog-foreign-server-authenticates-by-its-user-mapping-and-by-nothing-else)
+- [277. test_hilbert_curve.py: the Hilbert clustering curve, pinned by its properties and by frozen bytes](#277-test_hilbert_curvepy-the-hilbert-clustering-curve-pinned-by-its-properties-and-by-frozen-bytes)
+- [278. test_bench_guards.py: the benchmark's own guards refuse what they must, and the report asks them](#278-test_bench_guardspy-the-benchmarks-own-guards-refuse-what-they-must-and-the-report-asks-them)
+- [279. test_docs_style.py: the documentation's measurable rules and the facts it states](#279-test_docs_stylepy-the-documentations-measurable-rules-and-the-facts-it-states)
+- [280. test_audit.py: the bug-audit regressions hold, and each refusal is its own guard's](#280-test_auditpy-the-bug-audit-regressions-hold-and-each-refusal-is-its-own-guards)
+- [281. test_fuzz.py: randomized differential runs against a heap oracle](#281-test_fuzzpy-randomized-differential-runs-against-a-heap-oracle)
+- [282. test_fuzz_avro.py: the Avro manifest decoder survives malformed input](#282-test_fuzz_avropy-the-avro-manifest-decoder-survives-malformed-input)
+- [283. test_fuzz_listing.py: the ListObjectsV2 listing parser survives malformed input](#283-test_fuzz_listingpy-the-listobjectsv2-listing-parser-survives-malformed-input)
+- [284. test_fuzz_arrow.py: the Arrow IPC decoder survives malformed input](#284-test_fuzz_arrowpy-the-arrow-ipc-decoder-survives-malformed-input)
+- [285. test_fuzz_parquet.py: the Parquet decoder survives malformed input](#285-test_fuzz_parquetpy-the-parquet-decoder-survives-malformed-input)
 
 ## 1. How to read a test in here
 
@@ -1783,8 +1801,8 @@ the population and that both buckets are occupied.
 ### `test_the_accounted_reader_takes_either_runtime_mechanism`
 
 Two runtime-observable mechanisms exist: `pgc_summary`'s accounting line, used by 239
-suites, and a suite's own `checks run:` line, which `bench_guards` and `docs_style`
-print from private counters without ever sourcing `lib.sh`. A reader that knew only the
+suites, and a suite's own `checks run:` line, which `bench_guards` prints from private
+counters without ever sourcing `lib.sh` (`docs_style` did too, until #1341 moved it onto `lib.sh`). A reader that knew only the
 first would call those two unaccounted, which is false. Both alternatives are anchored,
 and an indented or extended line of either shape is refused (#1339).
 
@@ -10396,3 +10414,637 @@ One check per test, each by the shell's name, every reading a value from a modul
 | `test_the_backend_is_still_up_after_the_s3_refusal` | backend still up after the s3 refusal |
 | `test_an_endpoint_not_on_the_allow_list_is_refused` | an endpoint not on objstore_allowed_endpoints is refused |
 | `test_the_backend_is_still_up_after_the_endpoint_refusal` | backend still up after the endpoint refusal |
+
+## 268. test_iceberg_dv.py: Iceberg v3 deletion vectors apply, supersede, and refuse what they must
+
+The twin of `test/iceberg_dv.sh`. Eight hand-crafted snapshots read the oracle's surviving ids, thirteen corrupt or unsupported ones are refused, each by its own guard, and no backend dies on the way. The warehouse is relocated into `server_dir` so its recorded root differs from where it lies.
+
+### Every test
+
+Every test makes one check under the shell's name. A refusal reads as its SQLSTATE only when the message is that guard's own (several guards raise XX001), and a failed reading is a `query_error()`. Each survival check also requires that the server log's count of backends killed by a signal has not moved since its section began, and each refusal first waits for the server to answer, so a crash reddens only its own arm and its section's survival check.
+
+| test | what it holds |
+| --- | --- |
+| `test_a_deletion_vector_at_an_equal_sequence_number_applies` | a deletion vector at an equal sequence number applies (survivors == oracle) |
+| `test_a_deletion_vector_older_than_the_data_does_not_apply` | a deletion vector older than the data does not apply |
+| `test_an_applicable_dv_supersedes_position_delete_files` | an applicable DV supersedes position-delete files for its data file |
+| `test_dv_supersede_is_per_data_file_not_global` | supersede is per data file, not global |
+| `test_a_dv_with_run_containers_and_a_high_bucket_decodes` | a DV with run containers and a high-bucket position decodes |
+| `test_a_run_optimized_dv_decodes` | a run-optimized DV (cookie 12347) decodes |
+| `test_a_bitset_container_dv_decodes` | a bitset-container DV decodes |
+| `test_two_dv_blobs_in_one_puffin_file_each_apply_to_their_own_file` | two DV blobs in one Puffin file each apply to their own data file |
+| `test_the_backend_survives_the_dv_applications` | backend still up after the DV applications |
+| `test_two_dv_entries_for_one_data_file_are_refused` | two DV entries for one data file are refused (XX001) |
+| `test_a_corrupted_dv_crc_is_refused` | a corrupted DV CRC is refused (XX001) |
+| `test_a_wrong_dv_blob_magic_is_refused` | a wrong DV blob magic is refused (XX001) |
+| `test_a_manifest_footer_offset_mismatch_is_refused` | a manifest/footer offset mismatch is refused (XX001) |
+| `test_a_dv_entry_without_referenced_data_file_is_refused` | a DV entry without referenced_data_file is refused (XX001) |
+| `test_a_record_count_disagreeing_with_the_dv_is_refused` | a record_count that disagrees with the DV cardinality is refused (XX001) |
+| `test_a_dv_blob_declaring_a_codec_is_refused` | a DV blob declaring a compression codec is refused (XX001) |
+| `test_a_compressed_puffin_footer_is_refused` | a compressed Puffin footer is refused (0A000) |
+| `test_the_footer_refusal_names_the_compressed_footer` | ...and the refusal names the compressed footer |
+| `test_a_dv_in_a_format_version_2_table_is_refused` | a deletion vector in a format-version 2 table is refused (0A000) |
+| `test_the_v2_refusal_names_the_format_version` | ...and the refusal names the format version |
+| `test_a_puffin_path_outside_the_table_is_refused` | a Puffin path outside the table location is refused (22023) |
+| `test_the_backend_survives_the_dv_refusals` | backend still up after the DV refusals |
+| `test_a_dv_whose_offset_plus_size_overflows_is_refused` | a DV whose offset+size overflows int64 is refused, not read (XX001) |
+| `test_a_run_container_overflowing_its_range_is_refused` | a run container overflowing its 16-bit range is refused (XX001) |
+| `test_an_aliased_duplicate_dv_is_refused` | an aliased duplicate DV (scheme vs no scheme) is refused (XX001) |
+| `test_the_backend_survives_the_audit_arms` | backend still up after the audit arms |
+
+## 269. test_logical_decoding_source.py: a columnar table is not a logical decoding source
+
+The twin of `test/logical_decoding_source.sh` (#754). Through test_decoding slots on a private cluster at `wal_level=logical`: a heap table's inserts decode and a columnar table's do not, although its rows are there; the slot carries pgcolumnar's own catalog writes instead; and those follow groups, not rows (5000 rows give fewer than 10x the records of 50). Each slot has a heap control written in the same window, so a dead slot cannot pass as an exclusion.
+
+### Every test
+
+One check per test, each by the shell's name, every reading a value (a failed query is a `query_error()` that fails its own check) from a module fixture on a private cluster. Without the test_decoding library both harnesses fail one check, the shell's `pgc_skip` name, and the twin's other tests decline MISSING_DEPENDENCY.
+
+| test | what it holds |
+| --- | --- |
+| `test_lds_test_decoding_is_installed` | test_decoding.so is not installed; build contrib/test_decoding |
+| `test_lds_server_runs_at_wal_level_logical` | premise: the server is running at wal_level=logical |
+| `test_lds_slot_exists_and_is_logical` | premise: the slot exists and is logical |
+| `test_lds_both_tables_hold_the_same_rows` | premise: both tables hold the same 50 rows |
+| `test_lds_slot_decoded_something` | premise: the slot decoded something at all |
+| `test_lds_heap_control_is_decoded` | CONTROL: the heap table's 50 inserts ARE decoded |
+| `test_lds_columnar_emits_no_change` | a columnar table emits no decodable change |
+| `test_lds_columnar_rows_are_there` | although the rows are there |
+| `test_lds_slot_carries_internal_catalog` | the slot carries pgcolumnar's internal catalog instead |
+| `test_lds_big_table_holds_its_rows` | premise: the 100x table really holds 100x the rows |
+| `test_lds_second_slot_heap_control_is_decoded` | CONTROL: the second slot decodes the heap table's 5000 inserts |
+| `test_lds_big_columnar_emits_no_change` | and it too emits no decodable change of its own |
+| `test_lds_internal_records_do_not_follow_rows` | 100x the rows does not give 100x the internal records |
+
+## 270. test_iceberg_deletes.py: Iceberg position and equality deletes apply, scope, and refuse what they must
+
+The twin of `test/iceberg_deletes.sh`. Hand-crafted snapshots exercise position deletes (the <= sequence rule, inheritance, per-file scoping, ordinal 0), equality deletes (the strict < rule, multi-column AND, nulls, unions, mixed with position deletes) and partition-scoped equality deletes, against the generator's oracle; thirteen corrupt or unsupported snapshots are refused, each by its own guard, and no backend dies on the way. The warehouse is relocated into `server_dir` so its recorded root differs from where it lies.
+
+### Every test
+
+Every test makes one check under the shell's name. A refusal reads as its SQLSTATE only when the message is that guard's own (XX001 and 22023 are shared), and a failed reading is a `query_error()`. Each survival check also requires that the server log's count of backends killed by a signal has not moved since its section began, and every reading first waits for the server to answer, so a crash reddens only its own arm and its section's survival check.
+
+| test | what it holds |
+| --- | --- |
+| `test_iceberg_deletes_the_data_file_has_five_rows` | the data file has 5 rows before deletes |
+| `test_position_deletes_drop_the_listed_rows` | position deletes drop the listed rows (surviving == oracle) |
+| `test_position_deleted_ids_are_gone` | the deleted ids (2, 4) are gone |
+| `test_position_deletes_remove_exactly_two_rows` | exactly the two deleted rows were removed (5 - 2 = 3) |
+| `test_position_deletes_apply_under_projection` | position deletes apply under column projection (id only -> 1,3,5) |
+| `test_a_position_delete_older_than_the_data_does_not_apply` | a delete older than the data (lower seq) does not apply (5 rows) |
+| `test_older_position_delete_leaves_its_ids` | the would-be-deleted ids survive when the delete is older than the data |
+| `test_a_position_delete_inherits_a_null_sequence_number` | a position delete with an inherited (null-entry) sequence number applies |
+| `test_a_position_delete_naming_another_file_deletes_nothing` | a position delete naming a different data file deletes nothing (5 rows) |
+| `test_a_null_pos_is_refused` | a position delete with a null pos is refused (XX001, not silently dropped) |
+| `test_the_null_pos_refusal_names_pos` | ...and the null-pos refusal names pos |
+| `test_the_backend_survives_the_null_pos_refusal` | backend still up after the null-pos refusal |
+| `test_a_negative_pos_is_refused` | a position delete with a negative pos is refused (XX001, not cast inert) |
+| `test_the_negative_pos_refusal_names_it` | ...and the negative-pos refusal names the negative pos |
+| `test_the_backend_survives_the_negative_pos_refusal` | backend still up after the negative-pos refusal |
+| `test_a_position_delete_of_ordinal_zero_deletes_the_first_row` | a position delete of ordinal 0 deletes the first row (id 1 gone, 4 remain) |
+| `test_an_equality_delete_drops_matching_rows` | equality delete drops matching rows (survivors == oracle) |
+| `test_an_equality_delete_at_an_equal_sequence_does_not_apply` | an equality delete at an equal sequence number does not apply |
+| `test_multi_column_equality_is_an_and` | multi-column equality matches all columns (AND, not OR) |
+| `test_columns_beyond_equality_ids_are_ignored` | columns beyond equality_ids are ignored for matching |
+| `test_a_null_equality_value_matches_only_nulls` | a null delete value matches only null data values |
+| `test_the_null_region_row_is_gone` | the null-region row is gone, the non-null rows remain |
+| `test_multiple_equality_delete_files_apply_their_union` | multiple equality-delete files apply their union |
+| `test_position_and_equality_deletes_combine` | position and equality deletes combine |
+| `test_equality_deletes_apply_to_an_unprojected_column` | equality deletes apply when the delete column is not projected |
+| `test_the_backend_survives_the_equality_applications` | backend still up after the equality applications |
+| `test_an_equality_delete_without_equality_ids_is_refused` | an equality delete without equality_ids is refused (XX001) |
+| `test_a_never_applicable_equality_delete_without_ids_is_skipped` | a never-applicable equality delete without equality_ids is skipped (5 rows) |
+| `test_a_partition_scoped_equality_delete_stays_in_its_partition` | a partition-scoped equality delete applies only to its partition |
+| `test_the_us_partition_survives_an_eu_scoped_delete` | the us-partition rows survive an eu-scoped delete |
+| `test_a_delete_scoped_to_an_empty_partition_deletes_nothing` | a delete scoped to an empty partition deletes nothing (5 rows) |
+| `test_a_data_file_without_partition_spec_id_is_refused` | a data file lacking partition_spec_id is refused under a partitioned delete (XX001) |
+| `test_a_cross_spec_partition_delete_applies_to_nothing` | a cross-spec partition-scoped delete applies to nothing (5 rows) |
+| `test_an_uncomparable_partition_value_is_refused` | a partition-scoped delete with an uncomparable partition value is refused (0A000) |
+| `test_an_equality_delete_on_an_unsupported_type_is_refused` | an equality delete on an unsupported column type is refused (0A000) |
+| `test_the_unsupported_type_refusal_names_the_type` | ...and the refusal names the type |
+| `test_an_equality_column_missing_from_the_data_file_errors` | an equality column missing from the data file errors (22023) |
+| `test_an_equality_delete_path_outside_the_table_is_refused` | an equality-delete path outside the table location is refused (22023) |
+| `test_the_boundary_refusal_names_the_escape` | ...and the boundary refusal names the escape |
+| `test_a_dotdot_escaping_delete_path_is_refused` | a dotdot-escaping delete path is refused (22023) |
+| `test_the_backend_survives_the_equality_refusals` | backend still up after the equality refusals |
+| `test_an_equality_id_beyond_int32_is_refused` | an equality_ids value beyond int32 refuses the manifest (XX001) |
+| `test_a_manifest_list_without_partition_spec_id_is_refused` | a manifest list without partition_spec_id is refused for equality deletes (XX001) |
+| `test_a_partition_spec_without_fields_is_refused` | a partition spec without its fields key is refused (XX001) |
+| `test_a_never_applicable_equality_delete_is_not_validated` | a never-applicable equality delete is skipped, not validated (5 rows) |
+| `test_a_v1_manifest_without_sequence_numbers_reads` | a v1 manifest without a sequence_number column reads (default 0, 5 rows) |
+| `test_the_backend_survives_the_delete_audit_arms` | backend still up after the audit arms |
+| `test_an_existing_entry_with_a_null_sequence_number_is_refused` | an EXISTING entry with a null sequence number is refused (XX001) |
+| `test_the_backend_survives_the_bad_sequence_refusal` | backend still up after the bad-sequence refusal |
+
+## 271. test_logical_subscriber.py: columnar as a logical replication apply target
+
+The twin of `test/logical_subscriber.sh` (#435). A heap publisher and a columnar subscriber, on two private clusters: an INSERT-only publication syncs and streams every row, a publication carrying UPDATE raises the extension's own error (naming logical replication and the insert-only way out) and the apply worker retries it forever, and an ordinary SELECT ... FOR UPDATE / SHARE / NO KEY UPDATE keeps the generic row-locking message.
+
+### Every test
+
+One check per test, each by the shell's name, every reading a value from a module fixture. The apply worker's error is read from the subscriber's server log. A reading that would pass on an absence (a skipped UPDATE, a message not said) is taken only once the event it depends on is observed: an INSERT after the UPDATE has arrived, the replication error is in the log, or the statement raised the generic error.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_publisher_has_logical_decoding_on` | premise: the publisher has logical decoding on |
+| `test_the_subscriber_cluster_answers` | premise: the subscriber cluster answers |
+| `test_the_subscriber_loaded_pgcolumnar` | premise: the subscriber loaded pgcolumnar |
+| `test_insert_only_initial_sync_copied_every_row` | insert-only: initial sync copied every row |
+| `test_insert_only_streamed_inserts_applied` | insert-only: streamed INSERTs applied |
+| `test_insert_only_the_update_is_skipped_by_design` | insert-only: the UPDATE is skipped by design, not applied |
+| `test_insert_only_no_apply_errors` | insert-only: no apply errors |
+| `test_the_second_subscription_synced_before_the_update` | the second subscription synced before the UPDATE |
+| `test_the_apply_error_names_logical_replication` | the error names logical replication, not row locking |
+| `test_the_apply_error_does_not_say_only_row_locking` | the error does NOT say only 'row locking is not supported' |
+| `test_the_apply_hint_names_the_insert_only_publication` | the hint names the insert-only publication |
+| `test_the_wedged_row_is_unchanged_on_the_subscriber` | the wedge is real: the row is still unchanged on the subscriber |
+| `test_the_apply_worker_retries_so_the_subscription_is_wedged` | it retries rather than giving up, so the subscription is wedged |
+| `test_the_lock_fixture_is_columnar` | premise: the lock fixture really is columnar |
+| `test_select_for_update_keeps_the_generic_message` | an ordinary SELECT ... FOR UPDATE keeps the generic message |
+| `test_select_for_update_is_not_told_about_replication` | an ordinary SELECT ... FOR UPDATE is not told about replication |
+| `test_select_for_share_keeps_the_generic_message` | an ordinary SELECT ... FOR SHARE keeps the generic message |
+| `test_select_for_share_is_not_told_about_replication` | an ordinary SELECT ... FOR SHARE is not told about replication |
+| `test_select_for_no_key_update_keeps_the_generic_message` | an ordinary SELECT ... FOR NO KEY UPDATE keeps the generic message |
+| `test_select_for_no_key_update_is_not_told_about_replication` | an ordinary SELECT ... FOR NO KEY UPDATE is not told about replication |
+
+## 272. test_logical_decoding_cdc_recipe.py: the documented CDC recipe captures, transacts and decodes
+
+The twin of `test/logical_decoding_cdc_recipe.sh` (#754). The CDC recipe is extracted from docs/user-guide.md at run time and executed on a private cluster at `wal_level=logical`: a row trigger on a columnar table fires once per row and sees the table's values; an UPDATE is captured as one UPDATE, never as the storage's delete and insert; a DELETE captures the OLD row; the capture is transactional (read inside the transaction before the rollback, so the rollback has something to undo); the capture table decodes through a test_decoding slot while the columnar table emits nothing; FOR ALL TABLES includes pgcolumnar's internal tables; and a bulk load writes one capture row per loaded row.
+
+### Every test
+
+One check per test, each by the shell's name, every reading a value (a failed query is a `query_error()` that fails its own check) from a module fixture on a private cluster. Without the test_decoding library both harnesses fail one check, the shell's `pgc_skip` name, and the twin's other tests decline MISSING_DEPENDENCY.
+
+| test | what it holds |
+| --- | --- |
+| `test_ldcr_test_decoding_is_installed` | test_decoding.so is not installed; build contrib/test_decoding |
+| `test_ldcr_server_runs_at_wal_level_logical` | premise: the server is running at wal_level=logical |
+| `test_ldcr_guide_is_where_expected` | premise: the guide is where this suite expects it |
+| `test_ldcr_extraction_is_not_empty` | premise: the extraction is not empty |
+| `test_ldcr_recipe_contains_events` | premise: the extracted recipe contains [CREATE TABLE events] |
+| `test_ldcr_recipe_contains_events_cdc` | premise: the extracted recipe contains [CREATE TABLE events_cdc] |
+| `test_ldcr_recipe_contains_capture_function` | premise: the extracted recipe contains [CREATE FUNCTION events_capture] |
+| `test_ldcr_recipe_contains_trigger` | premise: the extracted recipe contains [CREATE TRIGGER events_cdc_t] |
+| `test_ldcr_recipe_contains_using_pgcolumnar` | premise: the extracted recipe contains [USING pgcolumnar] |
+| `test_ldcr_recipe_contains_delete_branch` | premise: the extracted recipe contains [TG_OP = 'DELETE'] |
+| `test_ldcr_recipe_contains_old_id` | premise: the extracted recipe contains [OLD.id] |
+| `test_ldcr_recipe_is_the_whole_block` | premise: and it is the whole block, not a fragment |
+| `test_ldcr_events_is_columnar` | premise: events is a COLUMNAR table |
+| `test_ldcr_events_cdc_is_heap` | premise: events_cdc is a HEAP table |
+| `test_ldcr_slot_exists_and_is_logical` | premise: the slot exists and is logical |
+| `test_ldcr_trigger_fires_once_per_row` | a row trigger on a COLUMNAR table fires once per inserted row |
+| `test_ldcr_trigger_saw_the_table_values` | and it saw the same values the table holds |
+| `test_ldcr_update_captures_one_row` | an UPDATE captures exactly one row |
+| `test_ldcr_update_recorded_with_new_value` | and it is recorded as UPDATE with the NEW value |
+| `test_ldcr_update_leaks_no_delete` | the update did NOT leak the storage's internal DELETE |
+| `test_ldcr_update_leaks_no_insert` | nor the storage's internal INSERT |
+| `test_ldcr_delete_captures_old_values` | a DELETE captures the OLD values, which are gone from the table |
+| `test_ldcr_deleted_row_is_gone` | and the row really is gone from the columnar table |
+| `test_ldcr_inside_the_transaction_the_row_was_captured` | inside the transaction the row was captured and is in the columnar table, before the rollback |
+| `test_ldcr_rollback_captures_nothing` | a rolled-back transaction captures nothing |
+| `test_ldcr_rollback_leaves_no_row` | and leaves no row in the columnar table either |
+| `test_ldcr_committed_insert_captures` | premise: the identical insert COMMITTED does capture, so the arm above is real |
+| `test_ldcr_slot_decoded_something` | premise: the slot decoded something at all |
+| `test_ldcr_columnar_table_emits_nothing` | CONTROL: the columnar table itself still emits nothing |
+| `test_ldcr_capture_table_is_carried` | the capture table IS carried by the slot |
+| `test_ldcr_one_decoded_row_per_capture` | one decoded capture row per captured change |
+| `test_ldcr_rolled_back_row_not_in_stream` | and the rolled-back row is not in the stream |
+| `test_ldcr_stream_carries_update` | the decoded stream carries the UPDATE as an UPDATE |
+| `test_ldcr_stream_carries_delete` | and the DELETE as a DELETE |
+| `test_ldcr_matcher_finds_inserts` | premise: the same matcher finds the INSERTs, so a 1 above is a real match |
+| `test_ldcr_publication_includes_internal_tables` | premise: FOR ALL TABLES really does include pgcolumnar's internal tables |
+| `test_ldcr_bulk_load_one_capture_per_row` | a bulk load writes exactly one capture row per loaded row |
+
+## 273. test_iceberg_rest.py: the Iceberg REST catalog resolves a table, keeps its token out of every log, and refuses what it must
+
+The twin of `test/iceberg_rest.sh`. A private cluster is restarted with the bearer token in its postmaster environment (and with a wrong one, and with none) against the shell's own REST fixture server, which verifies the Authorization header. The table resolves to its metadata location, the token reaches neither the server log nor the catalog's request log, and each refusal comes from its own guard.
+
+### Every test
+
+Every test makes one check under the shell's name. A refusal reads as its SQLSTATE plus its guard's label only when the message is that guard's own (the allow-list and the link-local refusal both raise 42501), and a failed reading is a `query_error()`. Survival also requires that the server log's count of backends killed by a signal has not moved, and each reading first waits for the server to answer, so a crash reddens only its own arm and the survival check.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_rest_fixture_server_is_up` | premise: rest fixture server is up |
+| `test_loadtable_resolves_the_current_metadata_location` | loadTable resolves the current metadata-location |
+| `test_the_loadtable_request_carried_an_authorization_header` | the loadTable request carried an Authorization header |
+| `test_the_rest_pg_server_log_holds_lines_to_search` | premise: the PG server log holds lines to search |
+| `test_the_rest_token_never_appears_in_the_server_log` | the token never appears in the server (PG) log |
+| `test_the_rest_token_never_appears_in_the_catalog_request_log` | the token value never appears in the catalog request log |
+| `test_a_wrong_bearer_token_is_refused` | a wrong bearer token is refused (28000) |
+| `test_an_anonymous_request_to_a_token_protected_catalog_is_refused` | an anonymous request to a token-protected catalog is refused (28000) |
+| `test_a_catalog_endpoint_off_the_allow_list_is_refused` | a catalog endpoint off the allow-list is refused (42501) |
+| `test_a_link_local_catalog_host_is_refused_even_if_allow_listed` | a link-local catalog host is refused even if allow-listed (42501) |
+| `test_an_over_cap_catalog_response_is_refused` | an over-cap catalog response is refused (54000) |
+| `test_an_unknown_rest_table_surfaces_a_clean_not_found` | an unknown table surfaces a clean not-found (42P01) |
+| `test_a_non_object_catalog_config_is_refused` | a non-object catalog config is refused, not walked (XX001) |
+| `test_the_backend_is_still_up_after_the_rest_refusals` | backend still up after the REST refusals |
+
+## 274. test_iceberg_rest_scan.py: the Iceberg REST catalog reads a table as iceberg_scan does, lists, and refuses an unknown table
+
+The twin of `test/iceberg_rest_scan.sh`. A private cluster is restarted with the bearer token in its postmaster environment against the shell's own REST fixture server, which points loadTable at the committed warehouse relocated into a work directory. iceberg_rest_scan returns the rows iceberg_scan returns for the reported metadata location, projects by field id, lists namespaces and tables, and refuses an unknown table with the catalog's own 404.
+
+### Every test
+
+Every test makes one check under the shell's name. The not-found reads as 42P01 only when the message is the catalog's 404, and a failed reading is a `query_error()`. Survival also requires that the server log's count of backends killed by a signal has not moved, and each reading first waits for the server to answer.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_rest_scan_fixture_server_is_up` | premise: rest fixture server is up |
+| `test_the_catalog_reports_the_relocated_metadata_location` | the catalog reports the relocated metadata location |
+| `test_iceberg_rest_scan_returns_the_five_current_snapshot_rows` | iceberg_rest_scan returns the five current-snapshot rows |
+| `test_iceberg_rest_scan_matches_iceberg_scan_of_the_same_table` | iceberg_rest_scan matches iceberg_scan of the same table (same oracle) |
+| `test_iceberg_rest_scan_projects_and_reorders_by_field_id` | iceberg_rest_scan projects and reorders by field id (amount, id) |
+| `test_iceberg_rest_namespaces_lists_the_catalogs_namespaces` | iceberg_rest_namespaces lists the catalog's namespaces |
+| `test_iceberg_rest_tables_lists_a_namespaces_tables` | iceberg_rest_tables lists a namespace's tables |
+| `test_iceberg_rest_scan_of_an_unknown_table_is_a_clean_not_found` | iceberg_rest_scan of an unknown table is a clean not-found (42P01) |
+| `test_the_backend_is_still_up_after_the_rest_read` | backend still up after the REST read |
+
+## 275. test_iceberg_rest_vended.py: an Iceberg REST catalog's vended credentials sign the reads, and nothing else does
+
+The twin of `test/iceberg_rest_vended.sh`. A private cluster with no AWS_* in its environment reads a table through the shell's REST catalog, which vends the SigV4 S3 fixture's key; the vended secret never reaches either log, a wrong one is refused by S3's 403, the longest storage-credentials prefix wins over a wrong catch-all and a wrong flat config, an endpoint off the allow-list is refused by the allow-list, a catalog vending nothing falls back to ambient credentials, and no backend dies.
+
+### Every test
+
+Every test makes one check under the shell's name. A refusal reads as its SQLSTATE only when the message is that refusal's own (28000 is also "no credentials"), and a failed reading is a `query_error()`. The survival check also requires that the server log's count of backends killed by a signal has not moved, and every reading first waits for the server to answer.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_vended_suite_can_run_here` | premise: the SigV4 S3 fixture is up |
+| `test_a_rest_scan_reads_via_vended_credentials` | iceberg_rest_scan reads via vended credentials (no ambient creds set) |
+| `test_the_server_log_holds_lines_to_search` | premise: the PG server log holds lines to search |
+| `test_the_vended_secret_is_not_in_the_server_log` | the vended secret never appears in the PG server log |
+| `test_the_vended_secret_is_not_in_the_s3_request_log` | the vended secret never appears in the S3 request log |
+| `test_a_wrong_vended_secret_is_refused_by_s3` | a wrong vended secret is refused by S3, not bypassed (28000) |
+| `test_the_longest_storage_credentials_prefix_wins` | storage-credentials longest-prefix match selects the right creds |
+| `test_a_vended_endpoint_off_the_allow_list_is_refused` | vended creds for an off-allow-list endpoint are refused (42501) |
+| `test_a_catalog_vending_nothing_falls_back_to_ambient` | a table vending no creds still reads with ambient (cfg NULL path) |
+| `test_the_backend_survives_the_vended_arms` | backend still up after the vended-credential arms |
+
+## 276. test_iceberg_rest_server.py: an Iceberg REST catalog FOREIGN SERVER authenticates by its USER MAPPING, and by nothing else
+
+The twin of `test/iceberg_rest_server.sh`. On a private cluster with no catalog token in its environment, a server-name call reads by the USER MAPPING's token or a minted OAuth2 bearer; secrets reach neither log; wrong, missing and half credentials are each refused by their own message, the half one before any request; the validator keeps secrets off a SERVER and catalog_uri off a mapping; a hostile oauth_token_uri is refused by the endpoint allow-list; and a non-superuser borrows the environment token only when a superuser waived its credentials.
+
+### Every test
+
+Every test makes one check under the shell's name. An "accepted" arm reads `ok` only when the statement ran, a refusal reads its SQLSTATE only when the message is its own guard's, and a failed reading is a `query_error()`. Survival also requires that the server log's count of backends killed by a signal has not moved, and every reading first waits for the server to answer.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_rest_server_suite_can_run_here` | premise: rest fixture up |
+| `test_a_server_name_call_reads_via_the_mapping_token` | iceberg_rest_table_location('cat',...) reads via the mapping token |
+| `test_the_request_carried_an_authorization_header` | the request carried an Authorization header |
+| `test_the_server_log_holds_lines_for_the_mapping_token` | premise: the PG server log holds lines to search, for the mapping token |
+| `test_the_mapping_token_is_not_in_the_server_log` | the mapping token never appears in the PG server log |
+| `test_a_wrong_mapping_token_is_refused` | a wrong mapping token is refused (28000) |
+| `test_no_mapping_and_no_env_token_is_refused` | no mapping and no env token is refused, not bypassed (28000) |
+| `test_a_token_on_the_server_is_rejected` | a token option on the SERVER is rejected (HV00D) |
+| `test_a_catalog_uri_on_the_mapping_is_rejected` | a catalog_uri option on the USER MAPPING is rejected (HV00D) |
+| `test_a_warehouse_option_on_the_server_is_accepted` | a warehouse option on the SERVER is accepted (not HV00D) |
+| `test_a_warehouse_server_resolves_a_location` | a warehouse-configured server resolves a table location |
+| `test_the_warehouse_is_sent_on_get_config` | the warehouse was sent on GET /v1/config (?warehouse=wh1) |
+| `test_an_oauth_mapping_reads_by_a_minted_bearer` | a server with an OAuth2 mapping reads by a minted bearer |
+| `test_the_oauth_token_endpoint_was_called` | the OAuth2 token endpoint was called (POST /v1/oauth/tokens) |
+| `test_load_table_carried_the_minted_bearer` | loadTable then carried the minted bearer (Authorization present) |
+| `test_the_client_secret_is_not_in_the_fixture_log` | the client secret never appears in the fixture request log |
+| `test_the_server_log_holds_lines_for_the_client_secret` | premise: the PG server log holds lines to search, for the client secret |
+| `test_the_client_secret_is_not_in_the_server_log` | the client secret never appears in the PG server log |
+| `test_a_wrong_oauth_client_secret_is_refused` | a wrong OAuth2 client secret is refused (28000) |
+| `test_a_half_oauth_credential_is_refused_before_any_request` | a half OAuth2 credential (id, no secret) is refused before any request (28000) |
+| `test_oauth_options_are_accepted_on_a_mapping` | oauth options are accepted on a USER MAPPING (no error) |
+| `test_an_oauth_option_on_the_server_is_rejected` | an oauth option on the SERVER is rejected (HV00D) |
+| `test_a_link_local_token_uri_is_refused_by_the_allow_list` | a link-local oauth_token_uri is refused by the allow-list (42501) |
+| `test_an_off_list_token_uri_host_is_refused` | an off-allow-list oauth_token_uri host is refused (42501) |
+| `test_the_uri_form_works_with_the_env_token` | the catalog-URI form still works with the env token |
+| `test_a_non_superuser_does_not_borrow_the_env_token` | a non-superuser with no token mapping is refused (28000) despite the environment token, before any request |
+| `test_a_non_superuser_cannot_waive_its_own_credentials` | and it cannot mark its own mapping credentials_required false (42501) |
+| `test_a_superuser_waiver_lets_the_role_read_by_the_env_token` | control: with credentials_required false set by a superuser, the same role reads by the environment token |
+| `test_the_backend_survives_the_rest_server_arms` | backend still up |
+
+## 277. test_hilbert_curve.py: the Hilbert clustering curve, pinned by its properties and by frozen bytes
+
+The pytest twin of `test/hilbert_curve.sh` (#889, #1341). No cluster: `src/columnar_curve.c` is compiled with a small driver into a shared library and called through ctypes. The driver only encodes and counts its calls; every property is checked in Python with its own readers -- the permutation test (C1), the memcmp-order adjacency walk (C2), dyadic contiguity (C3, counted as runs per level along index order, which over a permutation is the shell's max - min + 1 == count), the production-width bridge (C4a), a Python transcription of Skilling's TransposetoAxes with a mutated twin for the round trips (C4b), the goldens and the pack's extent (C5), ncols == 1 (C6) and the frozen Z-order bytes (C7). The INSTRUMENT arms run the serpentine, Z-order and truncating control encoders through the same checkers, so a checker stuck at pass or stuck at fail is named. No compiler declines every arm as MISSING_DEPENDENCY; an absent or unbuildable code under test is a failed reading for every battery arm.
+
+### Every test
+
+Every test reads one value from a module fixture that runs the whole battery once, and asserts it under the shell's check name. The golden, extent and Z-order families are parametrised one test per member, named by the same template as the shell's loop.
+
+| test | what it holds |
+| --- | --- |
+| `test_hilbert_instrument_control_battery_covered_every_point` | INSTRUMENT C0 premise: the control battery encoded every case and every point |
+| `test_hilbert_instrument_control_encoders_called_once_per_point` | INSTRUMENT C0 premise: the control encoders were called once per point |
+| `test_hilbert_instrument_control_pack_is_the_frozen_zorder` | INSTRUMENT the control's own pack reproduces the frozen Z-order bytes |
+| `test_hilbert_instrument_serpentine_is_a_permutation` | INSTRUMENT C1 control: the serpentine is a permutation of the index range |
+| `test_hilbert_instrument_serpentine_passes_adjacency` | INSTRUMENT C2 control: the serpentine PASSES unit-step adjacency |
+| `test_hilbert_instrument_serpentine_fails_contiguity` | INSTRUMENT C3 control: the serpentine FAILS dyadic contiguity in every nested case |
+| `test_hilbert_instrument_zorder_is_a_permutation` | INSTRUMENT C1 control: Z-order is a permutation of the index range |
+| `test_hilbert_instrument_zorder_fails_adjacency` | INSTRUMENT C2 control: Z-order FAILS unit-step adjacency in every multi-column case |
+| `test_hilbert_instrument_zorder_passes_contiguity` | INSTRUMENT C3 control: Z-order PASSES dyadic contiguity |
+| `test_hilbert_instrument_truncation_fails_permutation` | INSTRUMENT C1 control: a truncating encoder FAILS the permutation test in every case |
+| `test_hilbert_battery_covered_every_point` | C0 premise: the battery encoded every case and every point |
+| `test_hilbert_encoder_called_once_per_point` | C0 premise: the encoder was called once per point |
+| `test_hilbert_index_set_is_the_contiguous_range` | C1 the Hilbert index set is exactly the contiguous range |
+| `test_hilbert_memcmp_order_is_unit_adjacent` | C2 consecutive points in memcmp key order are unit-adjacent |
+| `test_hilbert_dyadic_subcubes_are_contiguous` | C3 every dyadic sub-cube occupies a contiguous run of indices |
+| `test_hilbert_bridge_covered_every_point` | C4a premise: the bridge covered every case and every point |
+| `test_hilbert_full_width_prefix_ignores_low_bits` | C4a the full-width key prefix does not move when the low bits change |
+| `test_hilbert_full_width_prefixes_are_the_index_range` | C4a the full-width key prefixes are exactly the index range |
+| `test_hilbert_distinct_full_width_keys_round_tripped` | C4b premise: 3,000 DISTINCT full-width keys per ncols were round-tripped |
+| `test_hilbert_published_inverse_round_trips` | C4b the published inverse round-trips full-width keys |
+| `test_hilbert_mutated_inverse_breaks_every_round_trip` | C4b control: a mutated inverse breaks every round trip the clean one made |
+| `test_hilbert_consecutive_key_pairs_were_formed` | C4b premise: consecutive key pairs were formed |
+| `test_hilbert_consecutive_keys_decode_to_neighbours` | C4b consecutive keys decode to unit-adjacent points, re-encoded by the code under test |
+| `test_hilbert_golden_key` | C5 golden Hilbert keys: ncols={n} {v} (one test per member) |
+| `test_hilbert_pack_bit_order_column_zero` | C5 the pack bit order: pack(2^63, 0) starts 0x80 |
+| `test_hilbert_pack_bit_order_column_one` | C5 the pack bit order: pack(0, 2^63) starts 0x40 |
+| `test_hilbert_pack_extent` | C5 the pack establishes exactly 8*ncols bytes: ncols={n} (one test per member) |
+| `test_hilbert_pack_tail_untouched` | C5 the pack wrote nothing past the key: ncols={n} (one test per member) |
+| `test_hilbert_pack_sets_every_bit_of_all_ones` | C5 the pack sets every bit of the key for an all-ones vector: ncols={n} (one test per member) |
+| `test_hilbert_one_column_zero` | C6 ncols == 1 is the big-endian ordinal: 0 |
+| `test_hilbert_one_column_one` | C6 ncols == 1 is the big-endian ordinal: 1 |
+| `test_hilbert_one_column_top_bit` | C6 ncols == 1 is the big-endian ordinal: 2^63 |
+| `test_hilbert_one_column_all_ones` | C6 ncols == 1 is the big-endian ordinal: UINT64_MAX |
+| `test_hilbert_one_column_loop_ran` | C6 premise: the comparison loop ran 200,000 times |
+| `test_hilbert_one_column_is_big_endian_over_random_values` | C6 ncols == 1 is the big-endian ordinal over 200,000 random values |
+| `test_hilbert_one_column_agrees_with_zorder` | C6 ncols == 1 agrees with Z-order over 200,000 random values |
+| `test_hilbert_zorder_pack_unchanged` | C7 the Z-order pack is byte-for-byte what it was: ncols={n} {v} (one test per member) |
+
+## 278. test_bench_guards.py: the benchmark's own guards refuse what they must, and the report asks them
+
+The twin of `test/bench_guards.sh`, with no cluster (it is in NO_CLUSTER). Each bench runner's own assert guard is found by this file's reader and run against a stand-in pg_config that reports an assert build, a plain one, or nothing. `bench/cb_guards.sh`'s preflights, row check, cold-run tag and verdict are called through bash, as the benchmark calls them, and the report and `docs/benchmarks.md` are read as text.
+
+### Every test
+
+Every test makes one check under the shell's name; the six runner checks are parametrized over `bench/run_*.sh`, so their names are templates the grader matches against the shell's `[$_bs]` names. A guard that cannot be found whole is run as nothing, which every refusal check refuses, and nothing past the guard is ever run.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_runner_refuses_an_assert_build` | [{runner}] refuses an assert build rather than documenting the requirement |
+| `test_the_runner_offers_a_named_override` | [{runner}] and offers a named override rather than only refusing |
+| `test_the_runner_exits_non_zero_on_an_assert_build` | [{runner}] and exits non-zero rather than warning past it |
+| `test_the_runner_lets_a_plain_build_through` | [{runner}] and lets a non-assert build through |
+| `test_the_runner_refuses_when_it_cannot_tell` | [{runner}] refuses when it CANNOT TELL, rather than treating that as a pass |
+| `test_the_runner_does_not_pipe_configure_into_grep` | [{runner}] and does not decide from an unbuffered pipe into grep -c |
+| `test_every_bench_runner_was_read` | premise: every bench runner was read, not a hand-kept subset |
+| `test_the_guards_file_is_present` | premise: bench/cb_guards.sh is present to be judged |
+| `test_the_stock_zero_is_refused` | the stock 0 is refused for an 8-worker parallel arm |
+| `test_an_exact_prepared_match_is_accepted` | an exact match is accepted |
+| `test_more_than_enough_prepared_is_accepted` | more than enough is accepted |
+| `test_one_prepared_short_is_refused` | one short is refused, which is the off-by-one that would run 7 workers |
+| `test_a_serial_arm_needs_no_prepared_transactions` | a serial arm needs no prepared transactions |
+| `test_the_stock_eight_slots_are_refused` | the stock 8 is refused for an 8-worker arm, which is the case that bit us |
+| `test_n_plus_one_slots_are_refused` | N + 1 is still refused: the coordinator needs a slot too |
+| `test_n_plus_two_slots_are_accepted` | N + 2 is accepted, the measured minimum |
+| `test_more_than_enough_worker_slots_are_accepted` | more than enough worker slots are accepted |
+| `test_four_workers_need_six_slots` | the rule holds at another worker count (4 needs 6) |
+| `test_five_slots_for_four_workers_are_refused` | and one below it does not |
+| `test_a_serial_arm_needs_no_worker_slots` | a serial arm needs no worker slots |
+| `test_a_missing_slot_count_is_refused` | a missing current value is refused, not compared |
+| `test_the_slot_message_names_the_setting` | the worker-slot message names the setting |
+| `test_the_slot_message_names_the_value` | and the value it must reach, not merely the worker count |
+| `test_the_slot_message_says_restart` | and says it needs a restart |
+| `test_the_prepared_message_names_the_setting` | the message names the setting to change |
+| `test_the_prepared_message_names_the_number` | and the number it must reach |
+| `test_the_prepared_message_says_restart` | and says it needs a restart, which is why this runs first |
+| `test_a_short_load_is_refused` | a short load is refused |
+| `test_an_empty_load_is_refused` | an empty load is refused, which is what an errored parallel arm produces |
+| `test_an_exact_load_is_accepted` | an exact load is accepted |
+| `test_two_missing_row_counts_are_refused` | two missing measurements are refused, not called equal |
+| `test_a_missing_row_count_is_refused` | a missing count is refused rather than compared with the expectation |
+| `test_a_missing_row_expectation_is_refused` | and a missing expectation is refused too |
+| `test_the_cold_tag_guard_emits_a_tag` | the guard exists and emitted a tag to judge |
+| `test_a_warm_host_is_not_called_cold` | a host that could not drop the page cache is not called a cold run |
+| `test_the_warm_tag_says_warm` | and the tag says plainly that the run was warm |
+| `test_the_verdict_helpers_are_present` | the verdict helpers are present to be judged |
+| `test_a_clear_win` | a clear win is a win |
+| `test_a_clear_loss` | a clear loss is a loss |
+| `test_a_rounding_win_is_not_a_loss` | columnar ahead by 0.33 percent is not a LOSS, which is the #531 defect |
+| `test_a_gap_inside_the_band_is_a_tie` | and under a band wider than the gap it is a tie, not a win either |
+| `test_a_win_just_outside_the_band` | a gap just outside the band is still called |
+| `test_a_loss_just_outside_the_band` | and a loss just outside it likewise |
+| `test_spread_is_over_the_best` | spread is the fractional range over the best |
+| `test_spread_ignores_order_and_err` | order does not matter, and ERR tries are dropped |
+| `test_one_try_has_no_spread` | a single warm try has no measurable scatter |
+| `test_no_usable_try_has_no_spread` | no usable try yields no spread, not zero |
+| `test_a_zero_best_is_refused` | a zero best is refused rather than divided by |
+| `test_the_band_is_the_wider_arm` | the band is the wider of the two arms |
+| `test_an_unknown_arm_makes_the_band_unknown` | and is unknown if either arm is unknown |
+| `test_an_unknown_band_suppresses_the_verdict` | an unknown band suppresses the verdict, it does not strict-compare |
+| `test_an_errored_arm_has_no_verdict` | an errored arm has no verdict |
+| `test_a_zero_baseline_has_no_verdict` | and neither does a zero baseline |
+| `test_the_benchmark_script_is_present` | premise: the benchmark script is present to be judged |
+| `test_the_report_captures_ratio` | premise: the report still captures ratio() into a display variable |
+| `test_ratio_reaches_only_printf` | ratio()'s output reaches printf and nothing else |
+| `test_the_verdict_is_asked_of_cb_verdict` | and the verdict is asked of cb_verdict rather than recomputed inline |
+| `test_the_benchmark_page_is_present` | premise: the benchmark page is present to be judged |
+| `test_the_extractor_reads_wrapped_ids` | the variation-claim extractor reads ids wrapped across two lines |
+| `test_no_query_is_called_variation_without_a_tie` | no query is called run-to-run variation unless its figures are a measured tie |
+| `test_the_tuned_arm_names_its_settings` | the tuned-arm section names all four settings and the group-cap value |
+
+## 279. test_docs_style.py: the documentation's measurable rules and the facts it states
+
+The pytest twin of `test/docs_style.sh` (#291, #1341). It reads the published pages, `META.json`, the tree's scripts and the release tags as files and through `git`. It needs no server, so it runs in the guards job. Every arm that asks whether a page says something reads the page with its HTML comments removed. The nav check ignores YAML comments.
+
+### Every test
+
+Every test makes one check, by the shell's name. Readings are computed once, in a module fixture, with Python's `re` and `pathlib` rather than the shell's grep and awk. A reading that cannot be taken is a value that fails its own check, never an exception. The four changelog arms decline with UNMET_PRECONDITION in a checkout without the release tags.
+
+| test | what it holds |
+| --- | --- |
+| `test_every_user_facing_document_meets_the_plain_language_rules` | every user-facing document meets the measurable plain-language rules |
+| `test_the_plain_language_checker_examined_the_documents` | and it actually examined the documents |
+| `test_the_roadmap_is_in_the_documentation_nav` | the roadmap is in the documentation nav |
+| `test_the_roadmap_nav_entry_points_at_a_page` | and the page that nav entry points at exists |
+| `test_no_document_carries_a_merge_conflict_marker` | no document carries a merge conflict marker |
+| `test_the_how_to_keeps_its_pg_partman_heading` | the how-to keeps its pg_partman section under its own heading |
+| `test_changelog_carries_no_em_or_en_dash` | CHANGELOG.md carries no em or en dash |
+| `test_how_to_names_clustering_on_the_join_key` | how-to names clustering on the join key for the runtime filter |
+| `test_best_practices_names_clustering_on_the_join_key` | best-practices names clustering on the join key |
+| `test_configuration_states_the_1024_floor` | configuration.md states the 1024 floor where it documents the setting |
+| `test_administration_states_the_floor_beside_its_advice` | administration.md states it in the section that says to lower the setting |
+| `test_best_practices_carries_the_floor` | best-practices.md carries it with the load-sizing advice |
+| `test_the_version_file_has_a_version` | premise: the VERSION file has a version to compare against |
+| `test_some_document_cites_the_version_file` | premise: at least one document cites the VERSION file |
+| `test_every_version_citation_quotes_version` | every document citing VERSION quotes the version VERSION holds |
+| `test_the_version_badge_is_present` | premise: the version badge is present |
+| `test_the_badge_names_no_other_version` | the version badge names no version other than VERSION's |
+| `test_the_badge_names_the_version` | premise: and it names VERSION's version at all |
+| `test_the_readme_badge_alt_text_names_the_version` | README's badge alt text names the version VERSION holds |
+| `test_some_document_names_the_latest_published_pre_release` | premise: at least one document names the latest published pre-release |
+| `test_every_published_claim_is_in_a_readable_form` | every document making the claim states it in a form this rule can read |
+| `test_every_document_names_the_same_published_pre_release` | every document names the same latest published pre-release |
+| `test_the_tree_ships_upgrade_scripts` | premise: the tree ships upgrade scripts to derive the chain from |
+| `test_the_control_file_names_a_default_version` | premise: the control file names a default_version to arrive at |
+| `test_each_version_starts_one_upgrade_script` | each shipped version starts exactly one upgrade script, so the chain is a walk |
+| `test_some_version_reaches_the_default` | premise: some shipped version reaches default_version, so the walk found a chain |
+| `test_some_document_states_the_upgrade_chain` | premise: at least one document states the upgrade chain |
+| `test_every_upgrade_chain_claim_is_readable` | every document stating the upgrade chain states it in a form this rule can read |
+| `test_every_document_names_the_versions_that_reach_the_default` | every such document names the versions that reach default_version in one update |
+| `test_every_document_names_the_default_as_the_destination` | every such document names default_version as the version one UPDATE reaches |
+| `test_meta_json_parses` | premise: META.json is present and parses |
+| `test_the_pgxn_form_was_derived` | premise: the PGXN form was derived from VERSION, not empty |
+| `test_meta_json_version_is_the_version` | META.json version is the version VERSION holds, in PGXN form |
+| `test_meta_json_provides_version_is_the_version` | META.json provides.pgcolumnar.version is the version VERSION holds, in PGXN form |
+| `test_meta_json_names_a_base_script` | premise: META.json names a base install script |
+| `test_the_meta_json_script_ships` | the script META.json names is in the published distribution |
+| `test_the_tree_has_install_scripts` | premise: the tree has install scripts to check |
+| `test_every_install_script_ships` | every pgcolumnar--*.sql in the tree is in the published distribution |
+| `test_changelog_has_a_union_merge_driver` | CHANGELOG.md has a union merge driver, so two entries do not conflict |
+| `test_every_dated_section_exists_at_its_tag` | every dated changelog section has its own section at its release tag |
+| `test_every_dated_section_holds_only_what_shipped_or_is_recorded` | every dated changelog section holds what its tag shipped, plus only what is recorded |
+| `test_every_dated_section_keeps_what_shipped` | every dated changelog section still holds every entry its tag shipped |
+| `test_the_changelog_sweep_found_sections` | premise: the changelog sweep found dated release sections |
+| `test_the_post_tag_allowance_file_is_readable` | premise: the post-tag allowance file is present and readable |
+| `test_every_post_tag_entry_carries_a_reason` | every recorded post-tag entry carries a reason |
+| `test_no_post_tag_entry_is_stale` | no recorded post-tag entry is stale, so the allowance cannot widen silently |
+| `test_changelog_still_has_the_union_driver_for_the_instructions` | and CHANGELOG.md still has the union merge driver those instructions are about |
+| `test_context_explains_a_conflicting_badge` | and CONTEXT.md tells a contributor what a CONFLICTING badge means |
+| `test_context_names_the_rebase_command` | and names the command rather than only the problem |
+| `test_context_warns_against_the_update_button` | and warns against the button that reintroduces the conflict |
+| `test_context_says_why_rebasing_works` | and says WHY rebasing works where merging does not |
+| `test_the_scan_read_sql_statements` | premise: the scan read SQL statements from the documents |
+| `test_no_documented_query_tests_pg_extension_across_databases` | no documented query tests pg_extension while listing databases |
+
+## 280. test_audit.py: the bug-audit regressions hold, and each refusal is its own guard's
+
+The twin of `test/audit.sh` (#965). ADD COLUMN after data exists reads the missing value through every read path; chunk-group skipping does not use a predicate under another collation; set_options refuses out-of-range limits, a heap table and (PostgreSQL 17 and later) a partitioned parent, each with its own guard's message, and records a valid call; a parallel CREATE INDEX completes, leaks no relation reference and indexes each row once; a write buffer opened before ADD COLUMN in the same transaction keeps the values written into the new column; a same-statement duplicate against a unique index is rejected rather than spun on.
+
+### Every test
+
+One check per test, each by the shell's name, every reading a value (a failed query is a `query_error()` that fails its own check) from a module fixture on a private database. On PostgreSQL 15 and 16 the four partitioned-parent tests decline UNSUPPORTED_MAJOR under the shell's skip name.
+
+| test | what it holds |
+| --- | --- |
+| `test_audit_add_column_nullable_is_null` | add-column nullable is null |
+| `test_audit_add_column_const_default` | add-column const default |
+| `test_audit_add_column_text_default` | add-column text default |
+| `test_audit_add_column_projected_only` | add-column projected only |
+| `test_audit_add_column_mixed_rows` | add-column mixed rows |
+| `test_audit_add_column_aggregate` | add-column aggregate |
+| `test_audit_the_add_column_lookup_reads_its_index` | premise: the add-column lookup reads ac_c_idx |
+| `test_audit_add_column_index_scan` | add-column index scan |
+| `test_audit_collation_pushdown_matches_no_pushdown` | collation pushdown == no-pushdown |
+| `test_audit_collation_result_correct` | collation result correct |
+| `test_audit_same_collation_still_pushes` | same-collation still pushes |
+| `test_audit_reject_chunk_group_row_limit_0` | reject chunk_group_row_limit 0 |
+| `test_audit_reject_stripe_row_limit_5` | reject stripe_row_limit 5 |
+| `test_audit_reject_compression_level_99` | reject compression_level 99 |
+| `test_audit_reject_set_options_on_a_heap_table` | reject set_options on a heap table |
+| `test_audit_the_refusal_says_not_columnar` | the refusal says the relation is not columnar |
+| `test_audit_nothing_was_recorded_for_the_heap_table` | nothing was recorded for the heap table |
+| `test_audit_the_sqlstate_probe_reads_a_known_code` | premise: the SQLSTATE probe reads a known code |
+| `test_audit_set_options_on_a_heap_raises_42809` | set_options on a non-columnar relation raises 42809, not P0001 |
+| `test_audit_a_partitioned_parent_carries_the_am` | premise: this major really lets a partitioned parent carry the AM |
+| `test_audit_reject_set_options_on_a_partitioned_parent` | reject set_options on a partitioned parent |
+| `test_audit_nothing_was_recorded_for_the_partitioned_parent` | nothing was recorded for the partitioned parent |
+| `test_audit_the_partition_itself_is_still_accepted` | the partition itself is still accepted |
+| `test_audit_valid_options_delete_works` | valid options delete works |
+| `test_audit_the_same_call_on_a_columnar_table_is_recorded` | the same call on a columnar table is recorded |
+| `test_audit_the_parallel_create_index_completed` | the parallel CREATE INDEX completed |
+| `test_audit_create_index_no_relation_leak` | create index no relation leak |
+| `test_audit_the_indexed_once_count_reads_its_index` | the indexed-once count reads idxleak_a_idx |
+| `test_audit_create_index_rows_indexed_once` | create index rows indexed once |
+| `test_audit_add_column_mid_transaction_keeps_the_inserted_value` | add-column mid-transaction keeps the inserted value |
+| `test_audit_add_column_without_a_default_keeps_the_inserted_value` | add-column without a default keeps the inserted value |
+| `test_audit_add_column_mid_transaction_keeps_a_later_update` | add-column mid-transaction keeps a later UPDATE |
+| `test_audit_same_statement_duplicate_is_rejected` | same-statement duplicate is rejected, not spun on |
+| `test_audit_same_statement_duplicate_inserted_nothing` | same-statement duplicate inserted nothing |
+
+## 281. test_fuzz.py: randomized differential runs against a heap oracle
+
+The twin of `test/fuzz.sh`. Each iteration draws a row count, null density, chunk-group and stripe limits, a codec and level and filter bounds from the shell's own 31-bit LCG, transcribed here so one seed is one run in both harnesses; loads heap from the generator and columnar from heap; and compares a battery of queries by the shell's order-blind set hash.
+
+### Every test
+
+Every test makes one check under the shell's name. Each property is asserted once over the run and a failure names the iterations that broke it; the storage options must read back as set, and the run must cover every iteration.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_fuzz_run_covered_every_iteration` | the run covered every iteration |
+| `test_every_fuzz_iterations_storage_options_read_back` | every iteration's storage options read back as set |
+| `test_every_fuzz_iteration_loaded_all_its_rows` | every iteration loaded all its rows |
+| `test_every_fuzz_iterations_whole_rows_agree` | every iteration's whole rows agree with heap |
+| `test_every_fuzz_iterations_counts_agree` | every iteration's counts agree with heap |
+| `test_every_fuzz_iterations_min_and_max_agree` | every iteration's min and max agree with heap |
+| `test_every_fuzz_iterations_sums_and_averages_agree` | every iteration's sums and averages agree with heap |
+| `test_every_fuzz_iterations_integer_range_agrees` | every iteration's integer range agrees with heap |
+| `test_every_fuzz_iterations_date_range_agrees` | every iteration's date range agrees with heap |
+| `test_every_fuzz_iterations_equality_lookup_agrees` | every iteration's equality lookup agrees with heap |
+| `test_every_fuzz_iterations_is_null_count_agrees` | every iteration's IS NULL count agrees with heap |
+| `test_every_fuzz_iterations_compound_filter_agrees` | every iteration's compound filter agrees with heap |
+
+## 282. test_fuzz_avro.py: the Avro manifest decoder survives malformed input
+
+The twin of `test/fuzz_avro.sh`. Each iteration writes one mutant of the committed manifest or manifest list with `test/avro_corpus.py`, a pure function of one integer seed, and reads it; outcomes are classified from the server log first and the client's error second, as the shell classifies them.
+
+### Every test
+
+Every test makes one check under the shell's name, over counts the module fixture gathers in one run. Two extra tests mirror the shell's pgc_skip names.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_valid_manifest_reaches_the_avro_decoder` | control: the valid manifest reaches the decoder (2 entries) |
+| `test_the_valid_manifest_list_reaches_the_avro_decoder` | control: the valid manifest-list reaches the decoder (1 entry) |
+| `test_no_avro_mutant_crashed_the_backend` | no mutant crashed the backend |
+| `test_no_avro_mutant_hung_the_decoder` | no mutant hung the decoder |
+| `test_no_avro_mutant_tripped_a_sanitizer` | no mutant tripped a sanitizer |
+| `test_every_avro_mutant_ran` | every mutant ran (errors + clean == iters) |
+| `test_every_avro_iteration_wrote_a_fresh_mutant` | every iteration wrote a fresh mutant |
+| `test_the_avro_corpus_reached_the_decoder` | the corpus reached the decoder at all |
+| `test_the_avro_manifest_fixtures_are_present` | premise: the committed manifest-list fixture is not empty |
+| `test_python_can_hash_the_avro_corpus_seeds` | premise: hashlib digests as the corpus expects, so its mutants are the shell's |
+
+## 283. test_fuzz_listing.py: the ListObjectsV2 listing parser survives malformed input
+
+The twin of `test/fuzz_listing.sh`. A private cluster runs with AWS_* in its environment; the SigV4 fixture server serves each mutant from `test/listing_corpus.py` verbatim as the listing, so it reaches the C parser as a hostile endpoint's response would.
+
+### Every test
+
+Every test makes one check under the shell's name, over counts the module fixture gathers in one run, and declines under the shell's pgc_skip name without pyarrow.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_listing_fixture_is_up` | premise: fixture up |
+| `test_a_valid_listing_reaches_the_parser` | control: a valid listing reaches the parser and reads the object |
+| `test_no_listing_mutant_crashed_the_backend` | no mutant crashed the backend |
+| `test_no_listing_mutant_hung_the_parser` | no mutant hung the parser |
+| `test_no_listing_mutant_tripped_a_sanitizer` | no mutant tripped a sanitizer |
+| `test_every_listing_mutant_ran` | every mutant ran (errors + clean == iters) |
+| `test_every_listing_iteration_wrote_a_fresh_mutant` | every iteration wrote a fresh mutant |
+| `test_the_listing_corpus_reached_the_parser` | the corpus reached the parser at all (some mutant errored or accepted) |
+
+## 284. test_fuzz_arrow.py: the Arrow IPC decoder survives malformed input
+
+The twin of `test/fuzz_arrow.sh`. Seeds from `test/arrow_corpus.py` are kept only when `import_arrow` accepts them pristine; each iteration mutates one with `test/arrow_mutate.py` and imports it, classified from the server log first and the client's error second.
+
+### Every test
+
+Every test makes one check under the shell's name, over counts the module fixture gathers in one run, and declines under the shell's pgc_skip name without pyarrow.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_arrow_seed_corpus_generator_produced_files` | the seed corpus generator produced files |
+| `test_the_arrow_importer_accepts_some_pristine_seed` | the importer accepts some pristine seed |
+| `test_no_arrow_mutant_crashed_the_backend` | no mutant crashed the backend |
+| `test_no_arrow_mutant_hung_the_decode` | no mutant hung the decode |
+| `test_no_arrow_mutant_tripped_a_sanitizer` | no mutant tripped a sanitizer |
+| `test_every_arrow_mutant_was_generated_and_imported` | every mutant was generated and ran the import |
+| `test_the_arrow_corpus_reached_the_decoder` | the corpus reached the decoder at all |
+
+## 285. test_fuzz_parquet.py: the Parquet decoder survives malformed input
+
+The twin of `test/fuzz_parquet.sh`. Seeds from `test/parquet_corpus.py` are kept only when `parquet_schema` renders their column list; each iteration mutates one with `test/parquet_mutate.py` and feeds it to parquet_schema, read_parquet and import_parquet, classified from the server log first and the client's error second.
+
+### Every test
+
+Every test makes one check under the shell's name, over counts the module fixture gathers in one run, and declines under the shell's pgc_skip name without pyarrow.
+
+| test | what it holds |
+| --- | --- |
+| `test_the_parquet_seed_corpus_generator_produced_files` | the seed corpus generator produced files |
+| `test_the_parquet_reader_renders_some_pristine_seeds_schema` | the reader renders some pristine seed's schema |
+| `test_no_parquet_mutant_crashed_the_backend` | no mutant crashed the backend |
+| `test_no_parquet_mutant_hung_the_decode` | no mutant hung the decode |
+| `test_no_parquet_mutant_tripped_a_sanitizer` | no mutant tripped a sanitizer |
+| `test_every_parquet_mutant_was_generated_and_ran_its_statements` | every mutant was generated and ran its three statements |
+| `test_the_parquet_corpus_reached_the_decoder` | the corpus reached the decoder at all |
diff --git a/test/pytest/expected_tests.txt b/test/pytest/expected_tests.txt
index aa84b2450..ef5eef681 100644
--- a/test/pytest/expected_tests.txt
+++ b/test/pytest/expected_tests.txt
@@ -306,12 +306,18 @@
 # guard_tests 465 -> 467 for #1339's test_residual_is_counted.py :143: the new
 # test_the_tally_function_records_every_suite_that_ran_or_skipped and
 # test_every_comm_in_the_runner_pins_its_collation, by collection over NO_CLUSTER.
+# guard_tests 476 -> 660 for #1341's test_hilbert_curve.py, the twin of hilbert_curve.sh:
+# 184 tests, one per check, cluster-free, by collection over NO_CLUSTER.
+# guard_tests 660 -> 751 for #1341's test_bench_guards.py, the twin of bench_guards.sh, in NO_CLUSTER:
+# 91 checks in 91 tests (six per bench runner, parametrized), by collection over NO_CLUSTER.
+# guard_tests 751 -> 804 for #1341's test_docs_style.py, the twin of docs_style.sh: 53
+# checks in 53 tests, by collection over NO_CLUSTER (it needs no server).
 # guard_tests 467 -> 474 for #1341's test_parquet_level_width.py, the twin of parquet_level_width.sh,
 # which needs no cluster: 7 tests, by collection over NO_CLUSTER.
 # guard_tests 474 -> 476 for #1339's test_mutation_ledger.py :525 and :1002: the new
 # test_the_prior_ceiling_is_resolved_rather_than_assumed and
 # test_a_ledger_row_must_name_a_real_major, by collection over NO_CLUSTER.
-guard_tests 476
+guard_tests 804
 
 # The complement: tests that need the driver and a throwaway cluster. Until #1016 these ran
 # in no CI job at all -- a quarter of the corpus, green when somebody ran them by hand and
@@ -890,6 +896,22 @@ guard_tests 476
 # 18 tests, one per check (13 constants parametrized), by collection over the cluster files.
 # cluster_tests 1099 -> 1108 for #1341's test_write_fsst_compressed.py, the twin of write_fsst_compressed.sh:
 # 9 checks in 9 tests, by collection over the cluster files.
+# cluster_tests 2921 -> 2931 for #1341's test_iceberg_rest_vended.py, the twin of iceberg_rest_vended.sh:
+# 10 checks in 10 tests, by collection over the cluster files.
+# cluster_tests 2931 -> 2960 for #1341's test_iceberg_rest_server.py, the twin of iceberg_rest_server.sh:
+# 29 checks in 29 tests, by collection over the cluster files.
+# cluster_tests 2960 -> 2994 for #1341's test_audit.py, the twin of audit.sh:
+# 34 checks in 34 tests, by collection over the cluster files.
+# cluster_tests 2994 -> 3006 for #1341's test_fuzz.py, the twin of fuzz.sh:
+# 12 checks in 12 tests, by collection over the cluster files.
+# cluster_tests 3006 -> 3016 for #1341's test_fuzz_avro.py, the twin of fuzz_avro.sh:
+# 8 checks in 10 tests, by collection over the cluster files.
+# cluster_tests 3016 -> 3024 for #1341's test_fuzz_listing.py, the twin of fuzz_listing.sh:
+# 8 checks in 8 tests, by collection over the cluster files.
+# cluster_tests 3024 -> 3031 for #1341's test_fuzz_arrow.py, the twin of fuzz_arrow.sh:
+# 7 checks in 7 tests, by collection over the cluster files.
+# cluster_tests 3031 -> 3038 for #1341's test_fuzz_parquet.py, the twin of fuzz_parquet.sh:
+# 7 checks in 7 tests, by collection over the cluster files.
 # cluster_tests 1108 -> 1140 for #1341's test_zonemap_estimate_sample.py, the twin of zonemap_estimate_sample.sh:
 # 32 tests, one per check, by collection over the cluster files.
 # cluster_tests 1140 -> 1146 for #1341's test_arrow_nested_import.py, the twin of arrow_nested_import.sh:
@@ -906,6 +928,20 @@ guard_tests 476
 # 22 checks in 22 tests, by collection over the cluster files.
 # cluster_tests 2732 -> 2748 for #1341's test_iceberg_objstore.py, the twin of iceberg_objstore.sh:
 # 16 checks in 16 tests, by collection over the cluster files.
+# cluster_tests 2753 -> 2779 for #1341's test_iceberg_dv.py, the twin of iceberg_dv.sh:
+# 26 checks in 26 tests, by collection over the cluster files.
+# cluster_tests 2779 -> 2792 for #1341's test_logical_decoding_source.py, the twin of logical_decoding_source.sh:
+# 13 checks in 13 tests, by collection over the cluster files.
+# cluster_tests 2792 -> 2841 for #1341's test_iceberg_deletes.py, the twin of iceberg_deletes.sh:
+# 49 checks in 49 tests, by collection over the cluster files.
+# cluster_tests 2841 -> 2861 for #1341's test_logical_subscriber.py, the twin of logical_subscriber.sh:
+# 20 checks in 20 tests, by collection over the cluster files.
+# cluster_tests 2861 -> 2898 for #1341's test_logical_decoding_cdc_recipe.py, the twin of logical_decoding_cdc_recipe.sh:
+# 37 checks in 37 tests, by collection over the cluster files.
+# cluster_tests 2898 -> 2912 for #1341's test_iceberg_rest.py, the twin of iceberg_rest.sh:
+# 14 checks in 14 tests, by collection over the cluster files.
+# cluster_tests 2912 -> 2921 for #1341's test_iceberg_rest_scan.py, the twin of iceberg_rest_scan.sh:
+# 9 checks in 9 tests, by collection over the cluster files.
 # cluster_tests 1264 -> 1287 for #1341's test_vector_agg_rescan_memory.py, the twin of vector_agg_rescan_memory.sh:
 # 23 tests, one per check, by collection over the cluster files.
 # cluster_tests 1287 -> 1329 for #1341's test_analyze_stats.py, the twin of analyze_stats.sh:
@@ -1037,4 +1073,4 @@ guard_tests 476
 # cluster_tests 2670 -> 2677 for #1637's test_catalog_filter_reads.py, the twin of catalog_filter_reads.sh:
 # 7 tests, one per check, by collection over the cluster files.
 # cluster_tests 2748 -> 2753 for #1706's five timestamp-flag tests in test_native_parquet_schema.py, by collection.
-cluster_tests 2753
+cluster_tests 3038
diff --git a/test/pytest/expected_unrunnable.txt b/test/pytest/expected_unrunnable.txt
index d6ef4b9bc..0ebca301f 100644
--- a/test/pytest/expected_unrunnable.txt
+++ b/test/pytest/expected_unrunnable.txt
@@ -174,3 +174,14 @@
 18 test_pg19_vacuum_options.py::test_the_content_is_unchanged
 18 test_pg19_vacuum_options.py::test_vacuum_verbose_reports_on_heap
 18 test_pg19_vacuum_options.py::test_vacuum_verbose_is_silent_on_columnar
+
+# PostgreSQL 15 and 16 refuse PARTITION BY ... USING pgcolumnar, so audit.sh's
+# partitioned-parent arm declines there under its check_skip name (#1341).
+15 test_audit.py::test_audit_a_partitioned_parent_carries_the_am
+15 test_audit.py::test_audit_reject_set_options_on_a_partitioned_parent
+15 test_audit.py::test_audit_nothing_was_recorded_for_the_partitioned_parent
+15 test_audit.py::test_audit_the_partition_itself_is_still_accepted
+16 test_audit.py::test_audit_a_partitioned_parent_carries_the_am
+16 test_audit.py::test_audit_reject_set_options_on_a_partitioned_parent
+16 test_audit.py::test_audit_nothing_was_recorded_for_the_partitioned_parent
+16 test_audit.py::test_audit_the_partition_itself_is_still_accepted
diff --git a/test/pytest/test_audit.py b/test/pytest/test_audit.py
new file mode 100644
index 000000000..9c43da36e
--- /dev/null
+++ b/test/pytest/test_audit.py
@@ -0,0 +1,409 @@
+"""The bug-audit regressions, each a defect the audit found (#965). The pytest twin of
+`test/audit.sh`, every check by the shell's name.
+
+Six blocks, as in the shell: ADD COLUMN after data exists reads the missing value
+(NULL, or the constant default) through every read path; chunk-group skipping does
+not use a predicate under another collation; set_options refuses an out-of-range
+limit, a heap table and a partitioned parent, each with its own guard's message,
+and records a valid call; a parallel CREATE INDEX completes, leaks no relation
+reference and indexes every row once; a write buffer opened before ADD COLUMN in the
+same transaction keeps the values written into the new column; and a same-statement
+duplicate against a unique index is rejected rather than spun on.
+
+HOW A REFUSAL IS READ. As "rejected" only when the error carries the guard's own
+message: with set_options failing at entry for an unrelated reason, every one of the
+shell's refusal arms used to pass. Any other error is a failed query, which reds the
+check by name.
+
+HOW THE INDEX ARMS ARE READ. The build's own outcome is a check, and the row count is
+read only when its plan reads the index: with a parallel build participant raising
+an error, no index existed and the count was answered by a Seq Scan.
+
+THE LEAK IS READ FROM THE SHARED CLUSTER'S LOG, from the offset at which this module
+started and for the relation this module builds, so another module's warnings are
+not counted.
+
+ON A PRIVATE DATABASE. The partitioned-parent arm needs PostgreSQL 17 (a partitioned
+table carrying an access method); before it, each of its tests declines under the
+shell's skip name.
+"""
+import psycopg
+import pytest
+
+from pgc_vacuity import QUERY_ERROR, query_error
+
+DB = "pgc_audit"
+IDXONLY = ("SET enable_seqscan=off", "SET enable_bitmapscan=off", "SET pgcolumnar.enable_custom_scan=off")
+SKIP_NAME = "the partitioned-parent arm"
+
+
+def _message(exc):
+    return (exc.diag.message_primary if getattr(exc, "diag", None) and exc.diag.message_primary
+            else str(exc).splitlines()[0] if str(exc) else type(exc).__name__)
+
+
+def _run(dsn, statements):
+    """Run statements on one session; -> None, or the psycopg error that stopped them."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            for s in statements:
+                conn.execute(s)
+    except psycopg.Error as exc:
+        return exc
+    return None
+
+
+def _value(dsn, sql, settings=()):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            for s in settings:
+                conn.execute(s)
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    if row is None or row[0] is None:
+        return query_error(f"no value from {sql}")
+    return str(row[0])
+
+
+def _rows(dsn, sql):
+    """-> every row's columns joined by ':' and the rows by ' ', or a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            rows = conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return "".join(":".join("-" if v is None else str(v) for v in r) + " " for r in rows)
+
+
+def _refusal(dsn, sql, want):
+    """-> "rejected" when sql is refused with `want` in its message, "statement
+    unexpectedly succeeded" when it runs, or a query_error() naming the other reason."""
+    err = _run(dsn, [sql])
+    if err is None:
+        return "statement unexpectedly succeeded"
+    msg = _message(err)
+    if want in msg:
+        return "rejected"
+    return query_error(f"refused for another reason: {msg}")
+
+
+def _sqlstate(dsn, sql):
+    err = _run(dsn, [sql])
+    if err is None:
+        return query_error(f"no error from {sql}")
+    return err.sqlstate or query_error(f"no SQLSTATE: {_message(err)}")
+
+
+def _reads_index(dsn, index, sql):
+    """-> yes when the plan of sql, with seq scans and the custom scan off, reads index."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            for s in IDXONLY:
+                conn.execute(s)
+            plan = "\n".join(r[0] for r in conn.execute(f"EXPLAIN (COSTS OFF) {sql}"))
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    if f"Index Scan using {index} " in plan or f"Index Only Scan using {index} " in plan:
+        return "yes"
+    scan = next((l.strip() for l in plan.splitlines() if "Scan" in l), plan)
+    return f"no: {scan}"
+
+
+def _log_tail(path, offset):
+    try:
+        with open(path, "rb") as fh:
+            fh.seek(offset)
+            return fh.read().decode(errors="replace")
+    except OSError as exc:
+        return query_error(f"server log unreadable: {exc}")
+
+
+@pytest.fixture(scope="module")
+def au(pgc_cluster):
+    log = pgc_cluster.datadir / "server.log"
+    try:
+        start = log.stat().st_size
+    except OSError:
+        start = 0
+    with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    dsn = pgc_cluster.dsn(dbname=DB)
+    r = {}
+    try:
+        _run(dsn, ["CREATE EXTENSION IF NOT EXISTS pgcolumnar"])
+
+        # ---- 1. ADD COLUMN after data exists --------------------------------------
+        _run(dsn, ["CREATE TABLE ac (a int) USING pgcolumnar",
+                   "INSERT INTO ac SELECT g FROM generate_series(1,5) g",
+                   "ALTER TABLE ac ADD COLUMN b int",
+                   "ALTER TABLE ac ADD COLUMN c int DEFAULT 42",
+                   "ALTER TABLE ac ADD COLUMN d text DEFAULT 'hi'"])
+        r["ac null"] = _value(dsn, "SELECT count(*) FROM ac WHERE b IS NULL")
+        r["ac const"] = _value(dsn, "SELECT string_agg(DISTINCT c::text, ',') FROM ac")
+        r["ac text"] = _value(dsn, "SELECT string_agg(DISTINCT d, ',') FROM ac")
+        r["ac projected"] = _value(dsn, "SELECT c || '/' || d FROM ac ORDER BY a LIMIT 1")
+        _run(dsn, ["INSERT INTO ac VALUES (6, 7, 8, 'new')"])
+        r["ac mixed"] = _rows(dsn, "SELECT a, b, c, d FROM ac WHERE a IN (5,6) ORDER BY a")
+        r["ac agg"] = _value(dsn, "SELECT sum(c) || '/' || count(d) || '/' || count(b) FROM ac")
+        _run(dsn, ["CREATE INDEX ac_c_idx ON ac(c)"])
+        r["ac plan"] = _reads_index(dsn, "ac_c_idx", "SELECT count(*) FROM ac WHERE c=42")
+        r["ac index"] = _value(dsn, "SELECT count(*) FROM ac WHERE c=42", IDXONLY)
+
+        # ---- 2. chunk-group skipping and collation --------------------------------
+        _run(dsn, ["SET pgcolumnar.chunk_group_row_limit=100", "SET pgcolumnar.stripe_row_limit=1000",
+                   'CREATE TABLE col (t text COLLATE "en_US") USING pgcolumnar',
+                   "INSERT INTO col SELECT chr(65 + (g%20)) || lpad(g::text,5,'0') FROM generate_series(1,300) g"])
+        q = "SELECT count(*) FROM col WHERE t < 'a' COLLATE \"C\""
+        r["coll on"] = _value(dsn, q, ("SET pgcolumnar.enable_qual_pushdown=on",))
+        r["coll off"] = _value(dsn, q, ("SET pgcolumnar.enable_qual_pushdown=off",))
+        try:
+            with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+                plan = "\n".join(x[0] for x in conn.execute("EXPLAIN (COSTS off) SELECT t FROM col WHERE t < 'A00001'"))
+            r["pushed"] = str(sum(1 for l in plan.splitlines() if "Pushed-Down Filters: 1" in l))
+        except psycopg.Error as exc:
+            r["pushed"] = query_error(_message(exc))
+
+        # ---- 3. set_options bounds and relation kinds -----------------------------
+        _run(dsn, ["CREATE TABLE opt (a int) USING pgcolumnar", "CREATE TABLE opt_heap (a int) USING heap"])
+        r["rej chunk"] = _refusal(dsn, "SELECT pgcolumnar.set_options('opt'::regclass, chunk_group_row_limit => 0)",
+                                  "chunk_group_row_limit must be at least 100")
+        r["rej stripe"] = _refusal(dsn, "SELECT pgcolumnar.set_options('opt'::regclass, stripe_row_limit => 5)",
+                                   "stripe_row_limit must be at least 1000")
+        r["rej level"] = _refusal(dsn, "SELECT pgcolumnar.set_options('opt'::regclass, compression_level => 99)",
+                                  "compression_level must be between 1 and 22")
+        heap_call = "SELECT pgcolumnar.set_options('opt_heap'::regclass, chunk_group_row_limit => 1000)"
+        r["rej heap"] = _refusal(dsn, heap_call, "is not a columnar table")
+        err = _run(dsn, [heap_call])
+        r["heap says"] = ("yes" if err is not None and "is not a columnar table" in _message(err)
+                          else query_error(f"no [{_message(err) if err is not None else 'it ran'}]"))
+        r["heap recorded"] = _value(dsn, "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt_heap'::regclass")
+        r["probe"] = _sqlstate(dsn, "SELECT 1/0")
+        r["heap state"] = _sqlstate(dsn, heap_call)
+        _run(dsn, ["DROP TABLE opt_heap"])
+        major = _value(dsn, "SHOW server_version_num")
+        r["major"] = major
+        if isinstance(major, str) and major.isdigit() and int(major) >= 170000:
+            _run(dsn, ["CREATE TABLE opt_part (id int, v text) PARTITION BY RANGE (id) USING pgcolumnar"])
+            r["part premise"] = _value(dsn, "SELECT c.relkind::text || '/' || a.amname FROM pg_class c "
+                                            "JOIN pg_am a ON a.oid = c.relam WHERE c.relname = 'opt_part'")
+            r["rej part"] = _refusal(dsn, "SELECT pgcolumnar.set_options('opt_part'::regclass, chunk_group_row_limit => 1000)",
+                                     "is not a columnar table")
+            r["part recorded"] = _value(dsn, "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt_part'::regclass")
+            _run(dsn, ["CREATE TABLE opt_part_1 PARTITION OF opt_part FOR VALUES FROM (0) TO (100)"])
+            _run(dsn, ["SELECT pgcolumnar.set_options('opt_part_1'::regclass, chunk_group_row_limit => 1000)"])
+            r["leaf recorded"] = _value(dsn, "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt_part_1'::regclass")
+            _run(dsn, ["DROP TABLE opt_part"])
+        elif isinstance(major, str) and major.isdigit():
+            r["decline"] = f"PG{int(major) // 10000} refuses PARTITION BY ... USING pgcolumnar"
+        # One statement per call, as the shell runs them: a failed set_options must not
+        # stop the INSERT and DELETE that "valid options delete works" reads.
+        _run(dsn, ["SELECT pgcolumnar.set_options('opt'::regclass, chunk_group_row_limit => 1000, "
+                   "stripe_row_limit => 2000, compression_level => 9)"])
+        _run(dsn, ["INSERT INTO opt SELECT g FROM generate_series(1,10) g"])
+        _run(dsn, ["DELETE FROM opt WHERE a=5"])
+        r["opt delete"] = _value(dsn, "SELECT count(*) FROM opt")
+        r["opt recorded"] = _value(dsn, "SELECT count(*) FROM pgcolumnar.options WHERE regclass = 'opt'::regclass")
+
+        # ---- 4. parallel CREATE INDEX ---------------------------------------------
+        _run(dsn, ["SET pgcolumnar.stripe_row_limit=10000",
+                   "CREATE TABLE idxleak (a int, b int) USING pgcolumnar WITH (parallel_workers=2)",
+                   "INSERT INTO idxleak SELECT g, g%100 FROM generate_series(1,50000) g"])
+        err = _run(dsn, ["SET max_parallel_maintenance_workers=2", "SET min_parallel_table_scan_size=0",
+                         "CREATE INDEX idxleak_a_idx ON idxleak(a)"])
+        r["built"] = "yes" if err is None else f"no: {_message(err)}"
+        text = _log_tail(log, start)
+        r["leaks"] = (str(sum(1 for l in text.splitlines()
+                              if "resource was not closed" in l and 'relation "idxleak"' in l))
+                      if not text.startswith(QUERY_ERROR) else text)
+        r["idx plan"] = _reads_index(dsn, "idxleak_a_idx", "SELECT count(*) FROM idxleak WHERE a>0")
+        r["idx once"] = (_value(dsn, "SELECT count(*) FROM idxleak WHERE a>0", IDXONLY) if r["idx plan"] == "yes"
+                         else "not read through idxleak_a_idx")
+
+        # ---- 5. ADD COLUMN with a write buffer open in the same transaction -------
+        for t, stmts in (("wsalter", ["INSERT INTO wsalter VALUES (0,'x')",
+                                      "ALTER TABLE wsalter ADD COLUMN w int DEFAULT 7",
+                                      "INSERT INTO wsalter VALUES (1,'a',99)"]),
+                         ("wsalter2", ["INSERT INTO wsalter2 VALUES (0,'x')",
+                                       "ALTER TABLE wsalter2 ADD COLUMN w int",
+                                       "INSERT INTO wsalter2 VALUES (1,'a',99)"]),
+                         ("wsalter3", ["INSERT INTO wsalter3 VALUES (0,'x')",
+                                       "ALTER TABLE wsalter3 ADD COLUMN w int DEFAULT 7",
+                                       "UPDATE wsalter3 SET w = 55"])):
+            _run(dsn, [f"CREATE TABLE {t} (id int, v text) USING pgcolumnar", "BEGIN", *stmts, "COMMIT"])
+        r["ws default"] = _value(dsn, "SELECT string_agg(DISTINCT coalesce(w::text,'NULL'), ',' "
+                                      "ORDER BY coalesce(w::text,'NULL')) FROM wsalter")
+        r["ws nodefault"] = _value(dsn, "SELECT count(*) FROM wsalter2 WHERE w = 99")
+        r["ws update"] = _value(dsn, "SELECT string_agg(DISTINCT w::text, ',') FROM wsalter3")
+
+        # ---- 6. same-statement duplicate against a unique index -------------------
+        _run(dsn, ["CREATE TABLE ss_dup (k int) USING pgcolumnar", "CREATE UNIQUE INDEX ss_dup_uidx ON ss_dup (k)"])
+        err = _run(dsn, ["SET statement_timeout = '60s'", "INSERT INTO ss_dup SELECT 7 FROM generate_series(1,2)"])
+        if err is not None and err.sqlstate == "23505":
+            r["dup"] = "rejected"
+        elif err is not None and err.sqlstate == "57014":
+            r["dup"] = "TIMED OUT (uniqueness check did not terminate)"
+        else:
+            r["dup"] = query_error(f"not refused as a duplicate: {_message(err) if err is not None else 'it ran'}")
+        r["dup rows"] = _value(dsn, "SELECT count(*) FROM ss_dup")
+        yield r
+    finally:
+        with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def _partitioned(au, expect):
+    """False after declining on a major that refuses a partitioned parent with an AM."""
+    if "decline" in au:
+        expect.cannot_run("UNSUPPORTED_MAJOR", au["decline"], name="the partitioned-parent arm")
+        return False
+    return True
+
+
+# ---- 1 -----------------------------------------------------------------------------
+def test_audit_add_column_nullable_is_null(au, expect):
+    expect.text(au["ac null"], "5", "add-column nullable is null")
+
+
+def test_audit_add_column_const_default(au, expect):
+    expect.text(au["ac const"], "42", "add-column const default")
+
+
+def test_audit_add_column_text_default(au, expect):
+    expect.text(au["ac text"], "hi", "add-column text default")
+
+
+def test_audit_add_column_projected_only(au, expect):
+    expect.text(au["ac projected"], "42/hi", "add-column projected only")
+
+
+def test_audit_add_column_mixed_rows(au, expect):
+    expect.text(au["ac mixed"], "5:-:42:hi 6:7:8:new ", "add-column mixed rows")
+
+
+def test_audit_add_column_aggregate(au, expect):
+    expect.text(au["ac agg"], "218/6/1", "add-column aggregate")
+
+
+def test_audit_the_add_column_lookup_reads_its_index(au, expect):
+    expect.text(au["ac plan"], "yes", "premise: the add-column lookup reads ac_c_idx")
+
+
+def test_audit_add_column_index_scan(au, expect):
+    expect.text(au["ac index"], "5", "add-column index scan")
+
+
+# ---- 2 -----------------------------------------------------------------------------
+def test_audit_collation_pushdown_matches_no_pushdown(au, expect):
+    expect.text(au["coll on"], au["coll off"], "collation pushdown == no-pushdown")
+
+
+def test_audit_collation_result_correct(au, expect):
+    expect.text(au["coll on"], "300", "collation result correct")
+
+
+def test_audit_same_collation_still_pushes(au, expect):
+    expect.text(au["pushed"], "1", "same-collation still pushes")
+
+
+# ---- 3 -----------------------------------------------------------------------------
+def test_audit_reject_chunk_group_row_limit_0(au, expect):
+    expect.text(au["rej chunk"], "rejected", "reject chunk_group_row_limit 0")
+
+
+def test_audit_reject_stripe_row_limit_5(au, expect):
+    expect.text(au["rej stripe"], "rejected", "reject stripe_row_limit 5")
+
+
+def test_audit_reject_compression_level_99(au, expect):
+    expect.text(au["rej level"], "rejected", "reject compression_level 99")
+
+
+def test_audit_reject_set_options_on_a_heap_table(au, expect):
+    expect.text(au["rej heap"], "rejected", "reject set_options on a heap table")
+
+
+def test_audit_the_refusal_says_not_columnar(au, expect):
+    expect.text(au["heap says"], "yes", "the refusal says the relation is not columnar")
+
+
+def test_audit_nothing_was_recorded_for_the_heap_table(au, expect):
+    expect.text(au["heap recorded"], "0", "nothing was recorded for the heap table")
+
+
+def test_audit_the_sqlstate_probe_reads_a_known_code(au, expect):
+    expect.text(au["probe"], "22012", "premise: the SQLSTATE probe reads a known code")
+
+
+def test_audit_set_options_on_a_heap_raises_42809(au, expect):
+    expect.text(au["heap state"], "42809", "set_options on a non-columnar relation raises 42809, not P0001")
+
+
+def test_audit_a_partitioned_parent_carries_the_am(au, expect):
+    if _partitioned(au, expect):
+        expect.text(au["part premise"], "p/pgcolumnar",
+                    "premise: this major really lets a partitioned parent carry the AM")
+
+
+def test_audit_reject_set_options_on_a_partitioned_parent(au, expect):
+    if _partitioned(au, expect):
+        expect.text(au["rej part"], "rejected", "reject set_options on a partitioned parent")
+
+
+def test_audit_nothing_was_recorded_for_the_partitioned_parent(au, expect):
+    if _partitioned(au, expect):
+        expect.text(au["part recorded"], "0", "nothing was recorded for the partitioned parent")
+
+
+def test_audit_the_partition_itself_is_still_accepted(au, expect):
+    if _partitioned(au, expect):
+        expect.text(au["leaf recorded"], "1", "the partition itself is still accepted")
+
+
+def test_audit_valid_options_delete_works(au, expect):
+    expect.text(au["opt delete"], "9", "valid options delete works")
+
+
+def test_audit_the_same_call_on_a_columnar_table_is_recorded(au, expect):
+    expect.text(au["opt recorded"], "1", "the same call on a columnar table is recorded")
+
+
+# ---- 4 -----------------------------------------------------------------------------
+def test_audit_the_parallel_create_index_completed(au, expect):
+    expect.text(au["built"], "yes", "the parallel CREATE INDEX completed")
+
+
+def test_audit_create_index_no_relation_leak(au, expect):
+    expect.text(au["leaks"], "0", "create index no relation leak")
+
+
+def test_audit_the_indexed_once_count_reads_its_index(au, expect):
+    expect.text(au["idx plan"], "yes", "the indexed-once count reads idxleak_a_idx")
+
+
+def test_audit_create_index_rows_indexed_once(au, expect):
+    expect.text(au["idx once"], "50000", "create index rows indexed once")
+
+
+# ---- 5 -----------------------------------------------------------------------------
+def test_audit_add_column_mid_transaction_keeps_the_inserted_value(au, expect):
+    expect.text(au["ws default"], "7,99", "add-column mid-transaction keeps the inserted value")
+
+
+def test_audit_add_column_without_a_default_keeps_the_inserted_value(au, expect):
+    expect.text(au["ws nodefault"], "1", "add-column without a default keeps the inserted value")
+
+
+def test_audit_add_column_mid_transaction_keeps_a_later_update(au, expect):
+    expect.text(au["ws update"], "55", "add-column mid-transaction keeps a later UPDATE")
+
+
+# ---- 6 -----------------------------------------------------------------------------
+def test_audit_same_statement_duplicate_is_rejected(au, expect):
+    expect.text(au["dup"], "rejected", "same-statement duplicate is rejected, not spun on")
+
+
+def test_audit_same_statement_duplicate_inserted_nothing(au, expect):
+    expect.text(au["dup rows"], "0", "same-statement duplicate inserted nothing")
diff --git a/test/pytest/test_bench_guards.py b/test/pytest/test_bench_guards.py
new file mode 100644
index 000000000..c73792a83
--- /dev/null
+++ b/test/pytest/test_bench_guards.py
@@ -0,0 +1,445 @@
+"""The benchmark's own guards (#465). The pytest twin of `test/bench_guards.sh`, every
+check by the shell's name (#1341).
+
+bench/run_clickbench.sh publishes numbers, and a benchmark that reports a failed load as
+a fast one is worse than one that does not run. Asserted, with no cluster:
+
+1. Every bench runner refuses an assert build, offers a named override, exits non-zero,
+   lets a plain build through, and refuses when pg_config cannot tell. Each is decided
+   by RUNNING the runner's own guard against a stand-in pg_config, not by grepping for
+   its words: the greps passed with the refusal gone.
+
+2. bench/cb_guards.sh's arithmetic: the prepared-transaction and worker-slot preflights,
+   the row-count check, the cold-run tag, and the win/tie/loss verdict with its band.
+
+3. The report asks cb_verdict for its verdict, and docs/benchmarks.md calls no query
+   "run to run variation" without a measured tie.
+
+INDEPENDENT OF THE SHELL where it can be. The guard block is found by this file's own
+reader, in Python, and the source checks read the files with `re`. The cb_* functions are
+the product under test, so they are called through bash, as the benchmark calls them.
+
+NO CLUSTER. This file is in NO_CLUSTER (test_harness_deps.py).
+"""
+import pathlib
+import re
+import subprocess
+
+import pytest
+
+from pgc_vacuity import query_error
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+BENCH = ROOT / "bench"
+GUARDS = BENCH / "cb_guards.sh"
+CB = BENCH / "run_clickbench.sh"
+DOC = ROOT / "docs" / "benchmarks.md"
+RUNNERS = sorted(p.name for p in BENCH.glob("run_*.sh"))
+MODES = {"cassert": "echo \"'--prefix=/nonexistent' '--enable-cassert'\"",
+         "plain": "echo \"'--prefix=/nonexistent'\"",
+         "empty": "exit 1"}
+
+
+def _bash(script, env=None):
+    """-> (exit status, stdout and stderr) of a bash script, or (None, query_error())."""
+    try:
+        r = subprocess.run(["bash", "-c", script], capture_output=True, text=True, timeout=60, env=env)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        return None, query_error(f"bash could not run: {exc}")
+    return r.returncode, r.stdout + r.stderr
+
+
+def _sh(expr):
+    """-> what `$(expr)` gives with the guards sourced: stdout, trailing newlines dropped."""
+    try:
+        r = subprocess.run(["bash", "-c", f'. "{GUARDS}"; {expr}'], capture_output=True, text=True, timeout=60)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        return query_error(f"bash could not run: {exc}")
+    return r.stdout.rstrip("\n")
+
+
+def _ok(call):
+    """-> "ok" when the guard call succeeds, else "refused", as `call && echo ok || echo refused`."""
+    rc, _ = _bash(f'. "{GUARDS}"; {call}')
+    return "ok" if rc == 0 else "refused"
+
+
+def _lines(text, needle):
+    """-> how many lines of text contain needle, as `grep -c`."""
+    return sum(1 for l in str(text).splitlines() if needle in l)
+
+
+def _code(path):
+    """-> the file's lines with whole-line comments removed."""
+    return [l for l in path.read_text(errors="replace").splitlines() if not re.match(r"\s*#", l)]
+
+
+def _guard_of(path):
+    """-> the runner's assert guard as code: from its --configure capture through the `fi`
+    closing its ALLOW_CASSERT test, within 60 lines; "" when there is no complete guard."""
+    buf, on, seen = [], False, False
+    for line in _code(path):
+        if not on and "--configure" in line and "PG_CONFIG" in line:
+            on = True
+        if on:
+            buf.append(line)
+            seen = seen or "ALLOW_CASSERT" in line
+            if seen and line == "fi":
+                return "\n".join(buf)
+            if len(buf) > 60:
+                return ""
+    return ""
+
+
+@pytest.fixture(scope="module")
+def guards(tmp_path_factory):
+    """-> {runner: {mode: (status, output)}} from running each runner's own guard."""
+    d = tmp_path_factory.mktemp("bg_pg_config")
+    for mode, conf in MODES.items():
+        f = d / f"pg_config_{mode}"
+        f.write_text("#!/bin/sh\ncase \"$1\" in\n"
+                     f"  --configure) {conf} ;;\n"
+                     "  --bindir) echo /nonexistent/bin ;;\n"
+                     "  --version) echo \"PostgreSQL 17.0\" ;;\n"
+                     "  *) echo /nonexistent ;;\nesac\n")
+        f.chmod(0o755)
+    out = {}
+    for name in RUNNERS:
+        block = _guard_of(BENCH / name)
+        var = (re.findall(r"[A-Z_]*ALLOW_CASSERT", block) or ["NO_OVERRIDE_FOUND"])[0]
+        r = {}
+        for key, mode, allow in (("assert", "cassert", False), ("override", "cassert", True),
+                                 ("plain", "plain", False), ("none", "empty", False)):
+            env = {"PATH": "/usr/bin:/bin", "PG_CONFIG": str(d / f"pg_config_{mode}")}
+            if allow:
+                env[var] = "1"
+            r[key] = _bash("set -uo pipefail\n" + block, env)
+        r["piped"] = sum(1 for l in block.splitlines()
+                         if re.search(r'\$\("\$PG_CONFIG" --configure[^)]*\| *grep -c', l))
+        out[name] = r
+    return out
+
+
+# ---- every runner refuses an assert build, by running its own guard ---------------
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_refuses_an_assert_build(guards, runner, expect):
+    rc, out = guards[runner]["assert"]
+    expect.text("yes" if "is an --enable-cassert build" in out else f"no: {out[:200]}", "yes",
+                f"[{runner}] refuses an assert build rather than documenting the requirement")
+
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_offers_a_named_override(guards, runner, expect):
+    rc, out = guards[runner]["override"]
+    expect.text(f"rc={rc}/{_lines(out, 'WARNING')}", "rc=0/1",
+                f"[{runner}] and offers a named override rather than only refusing")
+
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_exits_non_zero_on_an_assert_build(guards, runner, expect):
+    rc, _ = guards[runner]["assert"]
+    expect.text(f"rc={rc}", "rc=1", f"[{runner}] and exits non-zero rather than warning past it")
+
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_lets_a_plain_build_through(guards, runner, expect):
+    rc, out = guards[runner]["plain"]
+    expect.text(f"rc={rc}/{_lines(out, 'FATAL')}", "rc=0/0",
+                f"[{runner}] and lets a non-assert build through")
+
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_refuses_when_it_cannot_tell(guards, runner, expect):
+    rc, out = guards[runner]["none"]
+    expect.text(f"rc={rc}/{_lines(out, 'produced no --configure output')}", "rc=1/1",
+                f"[{runner}] refuses when it CANNOT TELL, rather than treating that as a pass")
+
+
+@pytest.mark.parametrize("runner", RUNNERS)
+def test_the_runner_does_not_pipe_configure_into_grep(guards, runner, expect):
+    expect.text("yes" if guards[runner]["piped"] == 0 else "no", "yes",
+                f"[{runner}] and does not decide from an unbuffered pipe into grep -c")
+
+
+def test_every_bench_runner_was_read(expect):
+    n = len(RUNNERS)
+    expect.text("yes" if n >= 6 else f"no (found {n})", "yes",
+                "premise: every bench runner was read, not a hand-kept subset")
+
+
+def test_the_guards_file_is_present(expect):
+    expect.text("yes" if GUARDS.is_file() else "no", "yes",
+                "premise: bench/cb_guards.sh is present to be judged")
+
+
+# ---- max_prepared_transactions is preflighted -------------------------------------
+
+def test_the_stock_zero_is_refused(expect):
+    expect.text(_ok("cb_prepared_xacts_ok 0 8"), "refused", "the stock 0 is refused for an 8-worker parallel arm")
+
+
+def test_an_exact_prepared_match_is_accepted(expect):
+    expect.text(_ok("cb_prepared_xacts_ok 8 8"), "ok", "an exact match is accepted")
+
+
+def test_more_than_enough_prepared_is_accepted(expect):
+    expect.text(_ok("cb_prepared_xacts_ok 16 8"), "ok", "more than enough is accepted")
+
+
+def test_one_prepared_short_is_refused(expect):
+    expect.text(_ok("cb_prepared_xacts_ok 7 8"), "refused",
+                "one short is refused, which is the off-by-one that would run 7 workers")
+
+
+def test_a_serial_arm_needs_no_prepared_transactions(expect):
+    expect.text(_ok("cb_prepared_xacts_ok 0 0"), "ok", "a serial arm needs no prepared transactions")
+
+
+# ---- max_worker_processes is preflighted ------------------------------------------
+
+def test_the_stock_eight_slots_are_refused(expect):
+    expect.text(_ok("cb_worker_slots_ok 8 8"), "refused",
+                "the stock 8 is refused for an 8-worker arm, which is the case that bit us")
+
+
+def test_n_plus_one_slots_are_refused(expect):
+    expect.text(_ok("cb_worker_slots_ok 9 8"), "refused", "N + 1 is still refused: the coordinator needs a slot too")
+
+
+def test_n_plus_two_slots_are_accepted(expect):
+    expect.text(_ok("cb_worker_slots_ok 10 8"), "ok", "N + 2 is accepted, the measured minimum")
+
+
+def test_more_than_enough_worker_slots_are_accepted(expect):
+    expect.text(_ok("cb_worker_slots_ok 32 8"), "ok", "more than enough worker slots are accepted")
+
+
+def test_four_workers_need_six_slots(expect):
+    expect.text(_ok("cb_worker_slots_ok 6 4"), "ok", "the rule holds at another worker count (4 needs 6)")
+
+
+def test_five_slots_for_four_workers_are_refused(expect):
+    expect.text(_ok("cb_worker_slots_ok 5 4"), "refused", "and one below it does not")
+
+
+def test_a_serial_arm_needs_no_worker_slots(expect):
+    expect.text(_ok("cb_worker_slots_ok 0 0"), "ok", "a serial arm needs no worker slots")
+
+
+def test_a_missing_slot_count_is_refused(expect):
+    expect.text(_ok('cb_worker_slots_ok "" 8'), "refused", "a missing current value is refused, not compared")
+
+
+def test_the_slot_message_names_the_setting(expect):
+    m = _sh("cb_worker_slots_message 8 8")
+    expect.text("yes" if "max_worker_processes" in m else "no", "yes", "the worker-slot message names the setting")
+
+
+def test_the_slot_message_names_the_value(expect):
+    m = _sh("cb_worker_slots_message 8 8")
+    expect.text("yes" if "10" in m else "no", "yes", "and the value it must reach, not merely the worker count")
+
+
+def test_the_slot_message_says_restart(expect):
+    m = _sh("cb_worker_slots_message 8 8")
+    expect.text("yes" if "restart" in m.lower() else "no", "yes", "and says it needs a restart")
+
+
+def test_the_prepared_message_names_the_setting(expect):
+    m = _sh("cb_prepared_xacts_message 0 8")
+    expect.text("yes" if "max_prepared_transactions" in m else "no", "yes", "the message names the setting to change")
+
+
+def test_the_prepared_message_names_the_number(expect):
+    m = _sh("cb_prepared_xacts_message 0 8")
+    expect.text("yes" if "8" in m else "no", "yes", "and the number it must reach")
+
+
+def test_the_prepared_message_says_restart(expect):
+    m = _sh("cb_prepared_xacts_message 0 8")
+    expect.text("yes" if "restart" in m.lower() else "no", "yes",
+                "and says it needs a restart, which is why this runs first")
+
+
+# ---- a load that lost rows is a failure -------------------------------------------
+
+def test_a_short_load_is_refused(expect):
+    expect.text(_ok("cb_rows_ok 1999999 2000000"), "refused", "a short load is refused")
+
+
+def test_an_empty_load_is_refused(expect):
+    expect.text(_ok("cb_rows_ok 0 2000000"), "refused",
+                "an empty load is refused, which is what an errored parallel arm produces")
+
+
+def test_an_exact_load_is_accepted(expect):
+    expect.text(_ok("cb_rows_ok 2000000 2000000"), "ok", "an exact load is accepted")
+
+
+def test_two_missing_row_counts_are_refused(expect):
+    expect.text(_ok("cb_rows_ok '' ''"), "refused", "two missing measurements are refused, not called equal")
+
+
+def test_a_missing_row_count_is_refused(expect):
+    expect.text(_ok("cb_rows_ok '' 2000000"), "refused",
+                "a missing count is refused rather than compared with the expectation")
+
+
+def test_a_missing_row_expectation_is_refused(expect):
+    expect.text(_ok("cb_rows_ok 2000000 ''"), "refused", "and a missing expectation is refused too")
+
+
+# ---- a report does not claim a cold run it did not perform (#506) -----------------
+
+def test_the_cold_tag_guard_emits_a_tag(expect):
+    expect.text("yes" if _sh("cb_cold_tag none 2>/dev/null") else "no", "yes",
+                "the guard exists and emitted a tag to judge")
+
+
+def test_a_warm_host_is_not_called_cold(expect):
+    t = _sh("cb_cold_tag none 2>/dev/null")
+    expect.text("claimed" if "lukewarm-cold-run" in t.lower() else "not-claimed", "not-claimed",
+                "a host that could not drop the page cache is not called a cold run")
+
+
+def test_the_warm_tag_says_warm(expect):
+    expect.text("yes" if "WARM-RUN" in _sh("cb_cold_tag none 2>/dev/null") else "no", "yes",
+                "and the tag says plainly that the run was warm")
+
+
+# ---- a win is decided on the times (#531) -----------------------------------------
+
+def test_the_verdict_helpers_are_present(expect):
+    expect.text(_sh('echo "$(type -t cb_verdict)/$(type -t cb_warm_spread)/$(type -t cb_band)"'),
+                "function/function/function", "the verdict helpers are present to be judged")
+
+
+def test_a_clear_win(expect):
+    expect.text(_sh("cb_verdict 500 1000 0.02"), "win", "a clear win is a win")
+
+
+def test_a_clear_loss(expect):
+    expect.text(_sh("cb_verdict 2000 1000 0.02"), "loss", "a clear loss is a loss")
+
+
+def test_a_rounding_win_is_not_a_loss(expect):
+    expect.text(_sh("cb_verdict 1582.859 1588.095 0.0000"), "win",
+                "columnar ahead by 0.33 percent is not a LOSS, which is the #531 defect")
+
+
+def test_a_gap_inside_the_band_is_a_tie(expect):
+    expect.text(_sh("cb_verdict 1582.859 1588.095 0.0099"), "tie",
+                "and under a band wider than the gap it is a tie, not a win either")
+
+
+def test_a_win_just_outside_the_band(expect):
+    expect.text(_sh("cb_verdict 900 1000 0.05"), "win", "a gap just outside the band is still called")
+
+
+def test_a_loss_just_outside_the_band(expect):
+    expect.text(_sh("cb_verdict 1100 1000 0.05"), "loss", "and a loss just outside it likewise")
+
+
+def test_spread_is_over_the_best(expect):
+    expect.text(_sh("cb_warm_spread 100 103"), "0.0300", "spread is the fractional range over the best")
+
+
+def test_spread_ignores_order_and_err(expect):
+    expect.text(_sh("cb_warm_spread 103 100 ERR"), "0.0300", "order does not matter, and ERR tries are dropped")
+
+
+def test_one_try_has_no_spread(expect):
+    expect.text(_sh("cb_warm_spread 100"), "0.0000", "a single warm try has no measurable scatter")
+
+
+def test_no_usable_try_has_no_spread(expect):
+    expect.text(_sh("cb_warm_spread '' ERR"), "-", "no usable try yields no spread, not zero")
+
+
+def test_a_zero_best_is_refused(expect):
+    expect.text(_sh("cb_warm_spread 0 5"), "-", "a zero best is refused rather than divided by")
+
+
+def test_the_band_is_the_wider_arm(expect):
+    expect.text(_sh("cb_band 0.0100 0.0290"), "0.0290", "the band is the wider of the two arms")
+
+
+def test_an_unknown_arm_makes_the_band_unknown(expect):
+    expect.text(_sh("cb_band - 0.0290"), "-", "and is unknown if either arm is unknown")
+
+
+def test_an_unknown_band_suppresses_the_verdict(expect):
+    expect.text(_sh("cb_verdict 1582.859 1588.095 -"), "-",
+                "an unknown band suppresses the verdict, it does not strict-compare")
+
+
+def test_an_errored_arm_has_no_verdict(expect):
+    expect.text(_sh("cb_verdict ERR 1000 0.02"), "-", "an errored arm has no verdict")
+
+
+def test_a_zero_baseline_has_no_verdict(expect):
+    expect.text(_sh("cb_verdict 500 0 0.02"), "-", "and neither does a zero baseline")
+
+
+# ---- the report asks the guard (#531) ---------------------------------------------
+
+def test_the_benchmark_script_is_present(expect):
+    expect.text("yes" if CB.is_file() else "no", "yes", "premise: the benchmark script is present to be judged")
+
+
+def test_the_report_captures_ratio(expect):
+    text = CB.read_text(errors="replace") if CB.is_file() else ""
+    expect.text("yes" if re.search(r"(^|[^A-Za-z0-9_])r[12]=\$\(ratio", text, re.M) else "no", "yes",
+                "premise: the report still captures ratio() into a display variable")
+
+
+def test_ratio_reaches_only_printf(expect):
+    lines = CB.read_text(errors="replace").splitlines() if CB.is_file() else []
+    n = sum(1 for l in lines if re.search(r"\$r[12]", l) and "printf" not in l)
+    expect.text(str(n) if CB.is_file() else "no benchmark script", "0",
+                "ratio()'s output reaches printf and nothing else")
+
+
+def test_the_verdict_is_asked_of_cb_verdict(expect):
+    n = sum(1 for l in _code(CB) if 'cb_verdict "' in l) if CB.is_file() else 0
+    expect.text("yes" if n >= 1 else "no", "yes",
+                "and the verdict is asked of cb_verdict rather than recomputed inline")
+
+
+# ---- the accelerator claim (#565) -------------------------------------------------
+
+def test_the_benchmark_page_is_present(expect):
+    expect.text("yes" if DOC.is_file() else "no", "yes", "premise: the benchmark page is present to be judged")
+
+
+def test_the_extractor_reads_wrapped_ids(tmp_path, expect):
+    fx = tmp_path / "claim.md"
+    fx.write_text("A lead sentence naming q18 and q31 here.\ntheir rows are therefore run to\nrun variation, not an effect.\n")
+    expect.text(" ".join(_sh(f'cb_doc_variation_qids "{fx}"').split()), "q18 q31",
+                "the variation-claim extractor reads ids wrapped across two lines")
+
+
+def test_no_query_is_called_variation_without_a_tie(expect):
+    qids = _sh(f'cb_doc_variation_qids "{DOC}"').split()
+    bad = ""
+    for q in qids:
+        fig = _sh(f'cb_doc_accel_figures "{DOC}" "{q}"').split()
+        d, a = (fig + ["", ""])[:2]
+        v = _sh(f'cb_verdict "{a}" "{d}" "$(cb_band - -)"')
+        if v != "tie":
+            bad += f" {q}({d or '?'}/{a or '?'}:{v})"
+    expect.text(f"claims={len(qids)}{bad}", "claims=0",
+                "no query is called run-to-run variation unless its figures are a measured tie")
+
+
+def test_the_tuned_arm_names_its_settings(expect):
+    text = DOC.read_text(errors="replace") if DOC.is_file() else ""
+    m = re.search(r"^### The accelerations are off by default[^\n]*\n(.*?)(?=^#|\Z)", text, re.M | re.S)
+    sec = m.group(1) if m else ""
+    miss = "".join(f" {t}" for t in ("pgcolumnar.enable_group_vectorization",
+                                     "pgcolumnar.enable_ungrouped_vector_agg",
+                                     "pgcolumnar.enable_parallel_vector_agg",
+                                     "pgcolumnar.groupagg_max_groups", "200000000") if t not in sec)
+    expect.text(f"missing:{miss}", "missing:",
+                "the tuned-arm section names all four settings and the group-cap value")
diff --git a/test/pytest/test_compare_to_bash.py b/test/pytest/test_compare_to_bash.py
index 5a7aa689a..658cb3e12 100644
--- a/test/pytest/test_compare_to_bash.py
+++ b/test/pytest/test_compare_to_bash.py
@@ -87,6 +87,7 @@
 # directions for the same reason: a one-way list rots into a permanent exemption.
 COMPLETE = ["advisory_lock_class",
             "projection_rewrite",
+            "audit",
             "server_file_privilege",
             "smoke",
             "sort_status",
@@ -127,18 +128,32 @@
             "iceberg_scan",
             "iceberg_malformed",
             "iceberg_objstore",
+            "iceberg_dv",
+            "iceberg_deletes",
+            "iceberg_rest",
+            "iceberg_rest_scan",
+            "iceberg_rest_vended",
+            "iceberg_rest_server",
             "concurrency",
             "isolation",
             "index_only",
             "import_deferred",
             "import_exclusion",
             "fsst_verdict_cache",
+            "fuzz_parquet",
+            "fuzz_arrow",
+            "fuzz_listing",
+            "fuzz_avro",
+            "fuzz",
             "int8_agg_int128",
             "eager_ordering_record",
             "maintenance_due",
             "doc_parallel_premise",
             "encode_effort",
             "local_open_race_free",
+            "logical_decoding_source",
+            "logical_subscriber",
+            "logical_decoding_cdc_recipe",
             "sorted_mark_rename",
             "tablesample",
             "ungrouped_vector_agg",
@@ -148,6 +163,7 @@
             "vector_agg_tlist_shape",
             "vm_clear_on_renumber",
             "wal_envelope",
+            "docs_style",
             "zonemap_estimate_sample",
             "write_fsst_compressed",
             "write_minmax_fastpath",
@@ -182,6 +198,7 @@
             "arrow_import",
             "autovacuum_expire",
             "base_scan_io",
+            "bench_guards",
             "catalog_delete_index",
             "catalog_filter_reads",
             "catalog_plan_index",
@@ -197,6 +214,7 @@
             "format_downgrade",
             "hardening",
             "hilbert_cluster",
+            "hilbert_curve",
             "hilbert_locality",
             "iceberg_fdw",
             "import_export_privilege",
@@ -1425,7 +1443,8 @@ def test_a_composing_wrapper_is_left_alone(expect):
 
 
 def test_a_helper_whose_name_cannot_be_resolved_is_refused(expect):
-    """THE REFUSE HALF. `hilbert_curve.sh` is the whole population, and it is real:
+    """THE REFUSE HALF. `hilbert_curve.sh` was the whole population, and it was real
+    until its port (#1341) wrote these loops out at their call sites:
 
         arms_failed() {            # arms_failed "LIST" DETAIL
             while IFS= read -r _a; do
@@ -1451,8 +1470,8 @@ def test_a_helper_whose_name_cannot_be_resolved_is_refused(expect):
 
 def test_the_refusal_names_exactly_the_suites_it_refuses(expect):
     """A STATIC GUARD NEEDS A FALSE-POSITIVE BUDGET, measured over the tree before it
-    ships rather than discovered by it. One suite of 264 is refused and it is a true
-    positive; every graded pair is unchanged.
+    ships rather than discovered by it. One suite of 264 was refused and it was a
+    true positive; every graded pair was unchanged. Since #1341 none is.
 
     THE SET IS PINNED, NOT THE COUNT, and that is not a style choice.
     `checks_never_observed_red` is this repo's worked example of the other shape: a
@@ -1467,9 +1486,12 @@ def test_the_refusal_names_exactly_the_suites_it_refuses(expect):
     """
     refused = sorted(sh.name[:-3] for sh in HERE.parent.glob("*.sh")
                      if sh.name != "lib.sh" and _suite_recorders(sh.read_text())[1])
-    expect.text(", ".join(refused), "hilbert_curve",
-                "exactly these suites are refused -- `hilbert_curve`, whose helpers "
-                "take a newline-separated LIST of names in one argument")
+    # `hilbert_curve` was the one refused suite until its port (#1341) wrote the two
+    # list-taking helpers out as loops at their call sites. The refusal itself is
+    # still exercised, against a fixture, by the arm below.
+    expect.text(", ".join(refused) or "none", "none",
+                "exactly these suites are refused -- none, since `hilbert_curve` "
+                "stopped taking a newline-separated LIST of names in one argument")
     twinned = [r for r in refused if (HERE / f"test_{r}.py").exists()]
     expect.text(", ".join(twinned) or "none", "none",
                 "and none of them has a pytest twin, so the refusal grades nothing "
@@ -1515,10 +1537,20 @@ def test_the_grader_itself_refuses_the_suite_it_cannot_read(expect, tmp_path):
 
     port = tmp_path / "test_stub.py"
     port.write_text("def test_x(expect):\n    expect.num(1, 1, 'a name')\n")
+    # THE SUITE SIDE IS A FIXTURE TOO, since #1341: it was `hilbert_curve.sh`, the one
+    # real suite with these helpers, until that suite's port wrote them out as loops.
+    # These are its two helpers as they stood.
+    unreadable = tmp_path / "unreadable.sh"
+    unreadable.write_text(
+        'arms_unrunnable() {\n\tlocal _a\n\twhile IFS= read -r _a; do\n'
+        '\t\t[ -n "$_a" ] && check_unrunnable "$_a" "$2" "$3"\n\tdone <<< "$1"\n}\n'
+        'arms_failed() {\n\tlocal _a\n\twhile IFS= read -r _a; do\n'
+        '\t\t[ -n "$_a" ] && pgc_fail "$_a" "$2"\n\tdone <<< "$1"\n}\n'
+        'check "a name" "$a" "$b"\n')
 
     out = io.StringIO()
     with contextlib.redirect_stdout(out):
-        rc = main(str(HERE.parent / "hilbert_curve.sh"), str(port))
+        rc = main(str(unreadable), str(port))
     text = out.getvalue()
     expect.num(rc, 2, "the grader exits 2 -- neither a pass nor an ordinary MISSING -- "
                       "on a suite whose names it cannot fully read")
diff --git a/test/pytest/test_docs_style.py b/test/pytest/test_docs_style.py
new file mode 100644
index 000000000..fd9daacfb
--- /dev/null
+++ b/test/pytest/test_docs_style.py
@@ -0,0 +1,659 @@
+"""The measurable plain-language and documentation-fact rules (#291). The pytest twin of
+`test/docs_style.sh`, every check by the shell's name (#1341).
+
+Asserted over the repository's published pages, read as files and never through a
+server: the plain-language checker passes on every user-facing page and examined them;
+the roadmap is reachable; no page carries a merge conflict marker; the pg_partman how-to
+keeps its heading; CHANGELOG.md carries no em or en dash; the join-key and 1024-floor
+advice sit where a reader needs them; every place a version is written (the VERSION
+citations, the badge, its alt text, the latest-published claim, the upgrade chain and
+META.json) agrees with the tree; every install script ships; CHANGELOG.md's union merge
+driver and its CONTEXT.md instructions are in place; a released changelog section holds
+what its tag shipped, plus only what test/changelog_post_tag.txt records; and no
+documented query tests pg_extension while listing databases.
+
+WHAT A READER SEES. Every arm asking whether a page SAYS something reads the page with
+its HTML comments removed, and the nav check ignores YAML comments. A sentence kept only
+in `<!-- -->` or an entry commented out with `#` is not on the published page, and both
+used to pass in the shell (#1341 port, measured on main).
+
+INDEPENDENT OF THE SHELL. The shell greps, awks and seds; this reads the files with
+Python's `re` and `pathlib`. Both read the same tree, so they agree on a correct one and
+disagree only when one of them reads it wrong. The plain-language checker and `git` are
+the tools under test in both, so both call them.
+
+NO DATABASE. This file is in NO_CLUSTER and runs in the guards job, which fetches the
+release tags so the four changelog arms run there. In a checkout without them those
+arms record UNMET_PRECONDITION by name. The shell prints a note for each instead,
+because the nightly coverage job runs it from a tagless checkout and counts any
+unrunnable suite as failed.
+"""
+import collections
+import json
+import pathlib
+import re
+import subprocess
+import sys
+import tarfile
+import io
+
+import pytest
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+DOCS = ROOT / "docs"
+NONE = "none"
+UNREAD = "no reading"
+
+
+def _read(path):
+    try:
+        return path.read_text(encoding="utf-8")
+    except OSError:
+        return None
+
+
+def _rendered(path):
+    """-> the page as a reader sees it: its text without HTML comments, or None."""
+    text = _read(path)
+    return None if text is None else re.sub(r"<!--.*?-->", "", text, flags=re.S)
+
+
+def _git(*args):
+    """-> (returncode, stdout bytes) of git in the tree under test."""
+    try:
+        r = subprocess.run(["git", "-C", str(ROOT), *args], capture_output=True)
+    except OSError:
+        return 1, b""
+    return r.returncode, r.stdout
+
+
+def _corpus():
+    """CHANGELOG.md, README.md and every file under docs/, the set the shell's grep -r reads."""
+    files = [ROOT / "CHANGELOG.md", ROOT / "README.md"]
+    files += [p for p in DOCS.rglob("*") if p.is_file()]
+    return files
+
+
+def _containing(needle_re):
+    """-> sorted paths among the corpus whose raw text matches the regex."""
+    out = []
+    for p in _corpus():
+        try:
+            text = p.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if re.search(needle_re, text):
+            out.append(p)
+    return sorted(out, key=lambda p: str(p).encode())
+
+
+def _listed(items):
+    return " ".join(items) if items else NONE
+
+
+# ---- plain language -------------------------------------------------------------------
+
+def _plain():
+    docs = sorted(DOCS.glob("*.md")) + [ROOT / "README.md"]
+    try:
+        r = subprocess.run([sys.executable, str(ROOT / "test" / "plain_language_check.py"),
+                            *map(str, docs)], capture_output=True, text=True)
+    except OSError as exc:
+        return f"checker did not run: {exc}", 0
+    out = r.stdout + r.stderr
+    return str(r.returncode), sum(1 for line in out.splitlines() if line.startswith("  ok"))
+
+
+# ---- the 1024 floor and the join key ----------------------------------------------------
+
+def _floor_line(path):
+    text = _rendered(path)
+    if text is None:
+        return f"{path.name} unreadable"
+    return "yes" if any("stripe_row_limit" in l and "1024" in l for l in text.split("\n")) else "no"
+
+
+def _floor_same_section(path, advice):
+    text = _rendered(path)
+    if text is None:
+        return f"{path.name} unreadable"
+    heading, said, floor = "", set(), set()
+    for line in text.split("\n"):
+        if line.startswith("## "):
+            heading = line[3:]
+        if advice.lower() in line.lower():
+            said.add(heading)
+        if "stripe_row_limit" in line and "1024" in line:
+            floor.add(heading)
+    return "yes" if said & floor else "no"
+
+
+def _section(text, heading):
+    start = text.find(heading)
+    if start < 0:
+        return None
+    rest = text[start + len(heading):]
+    nxt = rest.find("\n## ")
+    return rest if nxt < 0 else rest[:nxt]
+
+
+# ---- versions -------------------------------------------------------------------------
+
+def _pgxn(ver):
+    """VERSION's 1.0-alpha5 -> PGXN's 1.0.0-alpha.5."""
+    num, _, suffix = ver.partition("-")
+    parts = num.split(".")
+    while len(parts) < 3:
+        parts.append("0")
+    out = ".".join(parts)
+    if suffix:
+        out += "-" + re.sub(r"(\d+)$", r".\1", suffix)
+    return out
+
+
+def _sentences(text):
+    """One sentence per item, with a column-0 list marker kept out of the split."""
+    lines = [re.sub(r"^(\d+)\. ", r"\1.@LM@", line) for line in text.split("\n")]
+    joined = " ".join(lines)
+    return [s.replace("@LM@", " ") for s in joined.replace(". ", ".\n").split("\n")]
+
+
+CLAIM = re.compile(r"previously (shipped|published) version")
+
+
+def _upgrade_claim(path):
+    text = _rendered(path) or ""
+    claims = [s for s in _sentences(text) if CLAIM.search(s)]
+    first = claims[0] if claims else ""
+    sources = sorted(set(re.findall(r"`(1\.0-[a-z0-9]+)`", re.sub(r"reaches `[^`]*`", "", first))))
+    target = sorted(set(re.findall(r"reaches `([^`]*)`", first)))
+    return len(claims), " ".join(sources), " ".join(target)
+
+
+def _upgrade_walk():
+    scripts = sorted(ROOT.glob("pgcolumnar--*--*.sql"))
+    pairs = collections.defaultdict(list)
+    for p in scripts:
+        a, b = p.name[len("pgcolumnar--"):-len(".sql")].split("--", 1)
+        pairs[a].append(b)
+    starts = sorted(pairs)
+    control = _read(ROOT / "pgcolumnar.control") or ""
+    m = re.search(r"^\s*default_version\s*=\s*'([^']*)'", control, re.M)
+    defver = m.group(1) if m else ""
+    branched = [f"{s}={len(pairs[s])}" for s in starts if len(pairs[s]) != 1]
+    reach = []
+    for s in starts:
+        cur, steps = s, 0
+        while cur != defver and steps < 50 and pairs.get(cur):
+            cur, steps = sorted(pairs[cur])[0], steps + 1
+        if cur == defver:
+            reach.append(s)
+    return starts, defver, branched, reach
+
+
+# ---- the changelog's released sections -----------------------------------------------
+
+DATED = re.compile(r"^## \[([^\]]+)\] - ", re.M)
+
+
+def _entries(text, version):
+    out, inside = [], False
+    for line in text.split("\n"):
+        if line.startswith("## ["):
+            m = re.match(r"^## \[([^\]]+)\] - ", line)
+            inside = bool(m) and m.group(1) == version
+            continue
+        if inside and line.startswith("- "):
+            out.append(line)
+    return sorted(out, key=str.encode)
+
+
+def _changelog(allow_rows):
+    """-> (why it cannot compare or "", versions seen, nosec, bad, lost, used rows)."""
+    text = _read(ROOT / "CHANGELOG.md") or ""
+    versions = DATED.findall(text)
+    rc, _ = _git("rev-parse", "--git-dir")
+    if rc != 0:
+        return "no git repository in the tree under test", versions, [], [], [], []
+    _, tags = _git("tag", "-l", "v1.0-alpha*")
+    if not tags.strip():
+        return "no release tags in this checkout", versions, [], [], [], []
+    nosec, bad, lost, used = [], [], [], []
+    for v in versions:
+        rc, shipped = _git("show", f"v{v}:CHANGELOG.md")
+        tagged = _entries(shipped.decode("utf-8", "replace"), v) if rc == 0 else []
+        if not tagged:
+            nosec.append(v)
+            continue
+        now = _entries(text, v)
+        extra = sorted((collections.Counter(now) - collections.Counter(tagged)).elements(), key=str.encode)
+        gone = sorted((collections.Counter(tagged) - collections.Counter(now)).elements(), key=str.encode)
+        allowed = sorted((r[1] for r in allow_rows if r[0] == v and r[1]), key=str.encode)
+        used += allowed
+        if extra != allowed:
+            bad.append(f"{v}: added {extra} recorded {allowed}")
+        if gone:
+            lost.append(f"{v}: {gone}")
+    return "", versions, nosec, bad, lost, used
+
+
+def _allow_rows():
+    text = _read(ROOT / "test" / "changelog_post_tag.txt")
+    if text is None:
+        return None
+    rows = []
+    for line in text.split("\n"):
+        if not line or line.startswith("#"):
+            continue
+        parts = line.split("\t")
+        rows.append((parts[0], parts[1] if len(parts) > 1 else "", parts[2] if len(parts) > 2 else ""))
+    return rows
+
+
+# ---- the readings ---------------------------------------------------------------------
+
+@pytest.fixture(scope="module")
+def ds():
+    r = {}
+    rc, n = _plain()
+    r["plain rc"], r["examined"] = rc, ("yes" if n >= 10 else f"no (examined {n})")
+
+    nav = _read(ROOT / "mkdocs.yml")
+    if nav is None:
+        r["nav"] = "mkdocs.yml unreadable"
+    else:
+        live = [re.sub(r"(^|\s)#.*", "", line) for line in nav.split("\n")]
+        r["nav"] = "yes" if any("roadmap.md" in line for line in live) else "no"
+    r["roadmap page"] = "yes" if (DOCS / "roadmap.md").is_file() else "no"
+
+    marked = []
+    for p in [q for q in DOCS.rglob("*") if q.is_file()] + sorted(ROOT.glob("*.md")):
+        try:
+            if re.search(r"^(<<<<<<< |>>>>>>> )", p.read_text(errors="replace"), re.M):
+                marked.append(p.name)
+        except OSError:
+            pass
+    r["conflicts"] = _listed(sorted(marked))
+
+    howto = _rendered(DOCS / "how-to.md")
+    if howto is None:
+        r["partman"] = "how-to.md unreadable"
+        r["rf"] = "how-to.md unreadable"
+    else:
+        lines = howto.split("\n")
+        first = ""
+        if "## Manage time partitions with pg_partman" in lines:
+            i = lines.index("## Manage time partitions with pg_partman")
+            first = next((l for l in lines[i + 1:] if l.strip()), "")
+        r["partman"] = "1" if first.startswith("pg_partman can create and drop columnar partitions") else "0"
+        sec = _section(howto, "## Skip fact-table work under a star-schema join")
+        r["rf"] = "missing-heading" if sec is None else (
+            "yes" if "cluster" in sec.lower() and "join key" in sec.lower() else "no")
+    cl = _read(ROOT / "CHANGELOG.md")
+    r["cl dashes"] = "CHANGELOG.md unreadable" if cl is None else str(
+        sum(1 for line in cl.split("\n") if "—" in line or "–" in line))
+    bp = _rendered(DOCS / "best-practices.md")
+    r["bp join"] = "best-practices.md unreadable" if bp is None else ("yes" if "join key" in bp.lower() else "no")
+    r["floor cfg"] = _floor_line(DOCS / "configuration.md")
+    r["floor admin"] = _floor_same_section(DOCS / "administration.md", "Lower this setting")
+    r["floor bp"] = _floor_line(DOCS / "best-practices.md")
+
+    ver = "".join((_read(ROOT / "VERSION") or "").split())
+    r["ver"] = "yes" if ver else "no"
+    verdocs = _containing(r"recorded in `VERSION`")
+    r["verdocs"] = "yes" if verdocs else "no"
+    r["stale"] = _listed([p.name for p in verdocs
+                          if f"`{ver}`, recorded in `VERSION`" not in (_rendered(p) or "")])
+
+    badge = _read(ROOT / "badges" / "version.svg")
+    r["badge"] = "yes" if badge is not None else "no"
+    badge = badge or ""
+    r["badge old"] = _listed(sorted(set(re.findall(r"1\.0-[a-z]+[0-9]*", badge)) - {ver}, key=str.encode))
+    r["badge hits"] = "yes" if ver and any(ver in line for line in badge.split("\n")) else "no"
+    readme = _read(ROOT / "README.md") or ""
+    r["alt"] = "\n".join(re.findall(r'alt="Version ([^"]*)"', readme)) or "no alt text"
+
+    form = re.compile(r"latest published pre-release is `(v[^`]*)`|`(v[^`]*)` is the latest published pre-release")
+    pubdocs = _containing(r"latest published pre-release")
+    r["pubdocs"] = "yes" if pubdocs else "no"
+    pubvers, unparsed = set(), []
+    for p in pubdocs:
+        found = form.findall(_rendered(p) or "")
+        if not found:
+            unparsed.append(p.name)
+        pubvers |= {a or b for a, b in found}
+    r["pub unparsed"] = _listed(unparsed)
+    vers = sorted(pubvers, key=str.encode)
+    r["pub got"] = vers[0] if len(vers) == 1 else "DISAGREE:" + ",".join(vers)
+    r["pub want"] = vers[0] if vers else "a version some document names"
+
+    starts, defver, branched, reach = _upgrade_walk()
+    r["upg scripts"] = "yes" if starts else "no"
+    r["defver"] = "yes" if defver else "no"
+    r["upg branch"] = _listed(branched)
+    r["upg reach"] = "yes" if reach else "no"
+    upgdocs = _containing(r"previously (shipped|published) version")
+    r["upg docs"] = "yes" if upgdocs else "no"
+    unread, src_got, src_want, dst_got, dst_want = [], [], [], [], []
+    for p in upgdocs:
+        n, sources, target = _upgrade_claim(p)
+        if n != 1:
+            unread.append(f"{p.name}:claims={n}")
+        if not sources:
+            unread.append(f"{p.name}:no-starting-versions")
+        if not target:
+            unread.append(f"{p.name}:no-destination")
+        src_got.append(f"{p.name}=[{sources}]")
+        src_want.append(f"{p.name}=[{' '.join(reach)}]")
+        dst_got.append(f"{p.name}=[{target}]")
+        dst_want.append(f"{p.name}=[{defver}]")
+    r["upg unread"] = _listed(unread)
+    r["upg src"] = (" ".join(src_got) or "no document", " ".join(src_want) or "a document")
+    r["upg dst"] = (" ".join(dst_got) or "no document", " ".join(dst_want) or "a document")
+
+    try:
+        meta = json.loads(_read(ROOT / "META.json") or "")
+        r["meta"] = "yes"
+    except ValueError:
+        meta, r["meta"] = {}, "no"
+    pgxn = _pgxn(ver) if ver else ""
+    r["pgxn"] = "yes" if pgxn else "no"
+    r["pgxn want"] = pgxn or "a PGXN version"
+    r["meta version"] = str(meta.get("version", "no version in META.json"))
+    prov = meta.get("provides", {}).get("pgcolumnar", {})
+    r["meta provides"] = str(prov.get("version", "no provides version in META.json"))
+    meta_file = prov.get("file", "")
+    r["meta file"] = "yes" if meta_file else "no"
+    rc, tar = _git("archive", "HEAD")
+    if rc != 0:
+        shipped = None
+    else:
+        with tarfile.open(fileobj=io.BytesIO(tar)) as t:
+            shipped = set(t.getnames())
+    r["meta shipped"] = UNREAD if shipped is None else str(int(meta_file in shipped))
+    ondisk = sorted((p.name for p in ROOT.glob("pgcolumnar--*.sql")), key=str.encode)
+    r["ondisk"] = "yes" if ondisk else "no"
+    r["all shipped"] = UNREAD if shipped is None else (
+        _listed([n for n in ondisk if n not in shipped]).replace(NONE, "all shipped"))
+
+    attrs = _read(ROOT / ".gitattributes") or ""
+    r["union"] = str(len(re.findall(r"^CHANGELOG\.md\s+merge=union$", attrs, re.M)))
+
+    rows = _allow_rows()
+    why, versions, nosec, bad, lost, used = _changelog(rows or [])
+    r["cl why"] = why
+    r["cl nosec"], r["cl bad"], r["cl lost"] = _listed(nosec), _listed(bad), _listed(lost)
+    r["cl seen"] = "yes" if len(versions) >= 3 else "no"
+    r["allow file"] = "yes" if rows is not None else "no"
+    r["no reason"] = _listed([f"{a} {b}" for a, b, c in (rows or []) if not c])
+    declared = sorted((b for a, b, c in (rows or []) if b), key=str.encode)
+    stale = sorted((collections.Counter(declared) - collections.Counter(set(used))).elements(), key=str.encode)
+    r["stale rows"] = _listed(stale)
+
+    ctx = _read(ROOT / "CONTEXT.md") or ""
+    ctx_lines = ctx.split("\n")
+    r["ctx badge"] = str(sum("CONFLICTING badge on CHANGELOG.md means rebase locally" in l for l in ctx_lines))
+    r["ctx cmd"] = str(sum("git rebase origin/main" in l for l in ctx_lines))
+    r["ctx click"] = str(sum("do not click" in l.lower() for l in ctx_lines))
+    r["ctx why"] = str(sum("merging **into**" in l for l in ctx_lines))
+
+    stmts = []
+    for p in sorted(DOCS.glob("*.md")) + [ROOT / "README.md"]:
+        inside, buf = False, []
+        for line in (_read(p) or "").split("\n"):
+            if not inside and re.match(r"^\s*```sql", line):
+                inside = True
+                continue
+            if inside and re.match(r"^\s*```", line):
+                inside = False
+                buf.append(";")
+                continue
+            if inside:
+                buf.append(line + " ")
+        stmts += "".join(buf).split(";")
+    n_select = sum("SELECT" in s for s in stmts)
+    r["sql read"] = "yes" if n_select >= 10 else f"no ({n_select} SELECT statements, want at least 10)"
+    r["xdb"] = str(sum("pg_database" in s and "pg_extension" in s for s in stmts))
+    return r
+
+
+# ---- one check per test, every name the shell's -----------------------------------------
+
+def test_every_user_facing_document_meets_the_plain_language_rules(ds, expect):
+    expect.text(ds["plain rc"], "0", "every user-facing document meets the measurable plain-language rules")
+
+
+def test_the_plain_language_checker_examined_the_documents(ds, expect):
+    expect.text(ds["examined"], "yes", "and it actually examined the documents")
+
+
+def test_the_roadmap_is_in_the_documentation_nav(ds, expect):
+    expect.text(ds["nav"], "yes", "the roadmap is in the documentation nav")
+
+
+def test_the_roadmap_nav_entry_points_at_a_page(ds, expect):
+    expect.text(ds["roadmap page"], "yes", "and the page that nav entry points at exists")
+
+
+def test_no_document_carries_a_merge_conflict_marker(ds, expect):
+    expect.text(ds["conflicts"], NONE, "no document carries a merge conflict marker")
+
+
+def test_the_how_to_keeps_its_pg_partman_heading(ds, expect):
+    expect.text(ds["partman"], "1", "the how-to keeps its pg_partman section under its own heading")
+
+
+def test_changelog_carries_no_em_or_en_dash(ds, expect):
+    expect.text(ds["cl dashes"], "0", "CHANGELOG.md carries no em or en dash")
+
+
+def test_how_to_names_clustering_on_the_join_key(ds, expect):
+    expect.text(ds["rf"], "yes", "how-to names clustering on the join key for the runtime filter")
+
+
+def test_best_practices_names_clustering_on_the_join_key(ds, expect):
+    expect.text(ds["bp join"], "yes", "best-practices names clustering on the join key")
+
+
+def test_configuration_states_the_1024_floor(ds, expect):
+    expect.text(ds["floor cfg"], "yes", "configuration.md states the 1024 floor where it documents the setting")
+
+
+def test_administration_states_the_floor_beside_its_advice(ds, expect):
+    expect.text(ds["floor admin"], "yes",
+                "administration.md states it in the section that says to lower the setting")
+
+
+def test_best_practices_carries_the_floor(ds, expect):
+    expect.text(ds["floor bp"], "yes", "best-practices.md carries it with the load-sizing advice")
+
+
+def test_the_version_file_has_a_version(ds, expect):
+    expect.text(ds["ver"], "yes", "premise: the VERSION file has a version to compare against")
+
+
+def test_some_document_cites_the_version_file(ds, expect):
+    expect.text(ds["verdocs"], "yes", "premise: at least one document cites the VERSION file")
+
+
+def test_every_version_citation_quotes_version(ds, expect):
+    expect.text(ds["stale"], NONE, "every document citing VERSION quotes the version VERSION holds")
+
+
+def test_the_version_badge_is_present(ds, expect):
+    expect.text(ds["badge"], "yes", "premise: the version badge is present")
+
+
+def test_the_badge_names_no_other_version(ds, expect):
+    expect.text(ds["badge old"], NONE, "the version badge names no version other than VERSION's")
+
+
+def test_the_badge_names_the_version(ds, expect):
+    expect.text(ds["badge hits"], "yes", "premise: and it names VERSION's version at all")
+
+
+def test_the_readme_badge_alt_text_names_the_version(ds, expect):
+    expect.text(ds["alt"], "".join((ROOT / "VERSION").read_text().split()) or "a version",
+                "README's badge alt text names the version VERSION holds")
+
+
+def test_some_document_names_the_latest_published_pre_release(ds, expect):
+    expect.text(ds["pubdocs"], "yes", "premise: at least one document names the latest published pre-release")
+
+
+def test_every_published_claim_is_in_a_readable_form(ds, expect):
+    expect.text(ds["pub unparsed"], NONE,
+                "every document making the claim states it in a form this rule can read")
+
+
+def test_every_document_names_the_same_published_pre_release(ds, expect):
+    expect.text(ds["pub got"], ds["pub want"], "every document names the same latest published pre-release")
+
+
+def test_the_tree_ships_upgrade_scripts(ds, expect):
+    expect.text(ds["upg scripts"], "yes", "premise: the tree ships upgrade scripts to derive the chain from")
+
+
+def test_the_control_file_names_a_default_version(ds, expect):
+    expect.text(ds["defver"], "yes", "premise: the control file names a default_version to arrive at")
+
+
+def test_each_version_starts_one_upgrade_script(ds, expect):
+    expect.text(ds["upg branch"], NONE,
+                "each shipped version starts exactly one upgrade script, so the chain is a walk")
+
+
+def test_some_version_reaches_the_default(ds, expect):
+    expect.text(ds["upg reach"], "yes",
+                "premise: some shipped version reaches default_version, so the walk found a chain")
+
+
+def test_some_document_states_the_upgrade_chain(ds, expect):
+    expect.text(ds["upg docs"], "yes", "premise: at least one document states the upgrade chain")
+
+
+def test_every_upgrade_chain_claim_is_readable(ds, expect):
+    expect.text(ds["upg unread"], NONE,
+                "every document stating the upgrade chain states it in a form this rule can read")
+
+
+def test_every_document_names_the_versions_that_reach_the_default(ds, expect):
+    got, want = ds["upg src"]
+    expect.text(got, want, "every such document names the versions that reach default_version in one update")
+
+
+def test_every_document_names_the_default_as_the_destination(ds, expect):
+    got, want = ds["upg dst"]
+    expect.text(got, want, "every such document names default_version as the version one UPDATE reaches")
+
+
+def test_meta_json_parses(ds, expect):
+    expect.text(ds["meta"], "yes", "premise: META.json is present and parses")
+
+
+def test_the_pgxn_form_was_derived(ds, expect):
+    expect.text(ds["pgxn"], "yes", "premise: the PGXN form was derived from VERSION, not empty")
+
+
+def test_meta_json_version_is_the_version(ds, expect):
+    expect.text(ds["meta version"], ds["pgxn want"], "META.json version is the version VERSION holds, in PGXN form")
+
+
+def test_meta_json_provides_version_is_the_version(ds, expect):
+    expect.text(ds["meta provides"], ds["pgxn want"],
+                "META.json provides.pgcolumnar.version is the version VERSION holds, in PGXN form")
+
+
+def test_meta_json_names_a_base_script(ds, expect):
+    expect.text(ds["meta file"], "yes", "premise: META.json names a base install script")
+
+
+def test_the_meta_json_script_ships(ds, expect):
+    expect.text(ds["meta shipped"], "1", "the script META.json names is in the published distribution")
+
+
+def test_the_tree_has_install_scripts(ds, expect):
+    expect.text(ds["ondisk"], "yes", "premise: the tree has install scripts to check")
+
+
+def test_every_install_script_ships(ds, expect):
+    expect.text(ds["all shipped"], "all shipped",
+                "every pgcolumnar--*.sql in the tree is in the published distribution")
+
+
+def test_changelog_has_a_union_merge_driver(ds, expect):
+    expect.text(ds["union"], "1", "CHANGELOG.md has a union merge driver, so two entries do not conflict")
+
+
+def test_every_dated_section_exists_at_its_tag(ds, expect):
+    if ds["cl why"]:
+        expect.cannot_run("UNMET_PRECONDITION", ds["cl why"],
+                          name="every dated changelog section has its own section at its release tag")
+        return
+    expect.text(ds["cl nosec"], NONE, "every dated changelog section has its own section at its release tag")
+
+
+def test_every_dated_section_holds_only_what_shipped_or_is_recorded(ds, expect):
+    if ds["cl why"]:
+        expect.cannot_run("UNMET_PRECONDITION", ds["cl why"],
+                          name="every dated changelog section holds what its tag shipped, plus only what is recorded")
+        return
+    expect.text(ds["cl bad"], NONE,
+                "every dated changelog section holds what its tag shipped, plus only what is recorded")
+
+
+def test_every_dated_section_keeps_what_shipped(ds, expect):
+    if ds["cl why"]:
+        expect.cannot_run("UNMET_PRECONDITION", ds["cl why"],
+                          name="every dated changelog section still holds every entry its tag shipped")
+        return
+    expect.text(ds["cl lost"], NONE, "every dated changelog section still holds every entry its tag shipped")
+
+
+def test_the_changelog_sweep_found_sections(ds, expect):
+    expect.text(ds["cl seen"], "yes", "premise: the changelog sweep found dated release sections")
+
+
+def test_the_post_tag_allowance_file_is_readable(ds, expect):
+    expect.text(ds["allow file"], "yes", "premise: the post-tag allowance file is present and readable")
+
+
+def test_every_post_tag_entry_carries_a_reason(ds, expect):
+    expect.text(ds["no reason"], NONE, "every recorded post-tag entry carries a reason")
+
+
+def test_no_post_tag_entry_is_stale(ds, expect):
+    if ds["cl why"]:
+        expect.cannot_run("UNMET_PRECONDITION", ds["cl why"],
+                          name="no recorded post-tag entry is stale, so the allowance cannot widen silently")
+        return
+    expect.text(ds["stale rows"], NONE,
+                "no recorded post-tag entry is stale, so the allowance cannot widen silently")
+
+
+def test_changelog_still_has_the_union_driver_for_the_instructions(ds, expect):
+    expect.text(ds["union"], "1", "and CHANGELOG.md still has the union merge driver those instructions are about")
+
+
+def test_context_explains_a_conflicting_badge(ds, expect):
+    expect.text(ds["ctx badge"], "1", "and CONTEXT.md tells a contributor what a CONFLICTING badge means")
+
+
+def test_context_names_the_rebase_command(ds, expect):
+    expect.text(ds["ctx cmd"], "1", "and names the command rather than only the problem")
+
+
+def test_context_warns_against_the_update_button(ds, expect):
+    expect.text(ds["ctx click"], "1", "and warns against the button that reintroduces the conflict")
+
+
+def test_context_says_why_rebasing_works(ds, expect):
+    expect.text(ds["ctx why"], "1", "and says WHY rebasing works where merging does not")
+
+
+def test_the_scan_read_sql_statements(ds, expect):
+    expect.text(ds["sql read"], "yes", "premise: the scan read SQL statements from the documents")
+
+
+def test_no_documented_query_tests_pg_extension_across_databases(ds, expect):
+    expect.text(ds["xdb"], "0", "no documented query tests pg_extension while listing databases")
diff --git a/test/pytest/test_fuzz.py b/test/pytest/test_fuzz.py
new file mode 100644
index 000000000..4fb72fe7b
--- /dev/null
+++ b/test/pytest/test_fuzz.py
@@ -0,0 +1,197 @@
+"""Randomized differential runs, heap as the oracle. The pytest twin of `test/fuzz.sh`,
+every check by the shell's name.
+
+Each iteration draws a row count, a null density, chunk-group and stripe limits, a codec
+and level, and filter bounds; loads a heap table from the generator and the columnar
+table from the heap; and compares a battery of queries by the shell's order-blind set
+hash. The draws come from the shell's own 31-bit LCG, transcribed here, so one seed is
+one run in both harnesses (bash's $RANDOM changed algorithm in 5.1 and could not be
+transcribed at all).
+
+The check names are the property, asserted once over the whole run; a failure names the
+iterations that broke it. Two #1341 arms: the run must cover every iteration, and every
+iteration's storage options must read back as set -- set_options' result was thrown
+away, so a call that failed or ignored an argument left the iteration on default
+storage and nothing said so.
+
+PGC_SEED and PGC_ITERS are the shell's knobs, with its defaults.
+"""
+import os
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+SEED = int(os.environ.get("PGC_SEED", "12345"))
+ITERS = int(os.environ.get("PGC_ITERS", "25"))
+DB = "pgc_fuzz"
+CODECS = ["none", "pglz", "lz4", "zstd"]
+DEFS = ("id int, c_int int, c_num numeric(20,4), c_f8 double precision, c_bool boolean, "
+        "c_date date, c_ts timestamp, c_vc varchar(40), c_text text")
+KINDS = {
+    "whole-row": "SELECT * FROM %T",
+    "count": "SELECT count(*), count(c_int), count(c_text) FROM %T",
+    "minmax": "SELECT min(c_int), max(c_int), min(c_vc), max(c_vc), min(c_date), max(c_date) FROM %T",
+    "sumavg": "SELECT sum(c_int), avg(c_num), sum(c_f8) FROM %T",
+    "range-int": "SELECT id FROM %T WHERE c_int BETWEEN {lo} AND {hi}",
+    "range-date": "SELECT id FROM %T WHERE c_date >= DATE '2010-06-01'",
+    "eq": "SELECT id, c_vc FROM %T WHERE id = {eq}",
+    "isnull": "SELECT count(*) FROM %T WHERE c_text IS NULL",
+    "compound": "SELECT id FROM %T WHERE c_int > 0 AND c_bool AND c_num < 1000",
+}
+
+
+class _Lcg:
+    """The shell's rnd/pick: S = (S * 1103515245 + 12345) mod 2^31, draw (S >> 16) mod n."""
+
+    def __init__(self, seed):
+        self.s = seed & 0x7FFFFFFF
+
+    def rnd(self, n):
+        self.s = (self.s * 1103515245 + 12345) & 0x7FFFFFFF
+        return (self.s >> 16) % n
+
+    def pick(self, items):
+        return items[self.rnd(len(items))]
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return query_error(f"no value from {sql}") if row is None or row[0] is None else str(row[0])
+
+
+def _run(dsn, sql):
+    try:
+        with psycopg.connect(dsn, autocommit=True) as conn:
+            conn.execute(sql)
+    except psycopg.Error:
+        pass
+
+
+def _set_hash(dsn, query):
+    """The shell's pgc_set_hash: md5 of the rows' text, sorted; EMPTY for no rows."""
+    return _value(dsn, "SELECT coalesce(md5(string_agg(t, chr(10) ORDER BY t)), $e$EMPTY$e$) "
+                       f"FROM (SELECT _row::text AS t FROM ( {query} ) _row) _s")
+
+
+@pytest.fixture(scope="module")
+def fz(pgc_cluster):
+    with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    try:
+        dsn = pgc_cluster.dsn(dbname=DB)
+        _run(dsn, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        g = _Lcg(SEED)
+        bad = {k: [] for k in KINDS}
+        bad_rows, bad_opts, its = [], [], 0
+        print(f"-- fuzz seed={SEED} iters={ITERS}  (reproduce a failure with PGC_SEED={SEED})")
+        for it in range(1, ITERS + 1):
+            n = 1 + g.rnd(5000)
+            nullmod = 2 + g.rnd(18)
+            cg = g.pick([100, 250, 500, 1000])
+            sr = g.pick([1000, 2000, 5000])
+            codec = g.pick(CODECS)
+            lvl = 1 + g.rnd(19)
+            span = n if n > 1 else 2
+            lo = g.rnd(span)
+            hi = lo + 1 + g.rnd(500)
+            eq = 1 + g.rnd(span)
+            tag = f"it={it} N={n} nullmod={nullmod} cg={cg} sr={sr} codec={codec} lvl={lvl}"
+            print(f"-- {tag}")
+
+            _run(dsn, "DROP TABLE IF EXISTS t_heap; DROP TABLE IF EXISTS t_col")
+            _run(dsn, f"CREATE TABLE t_heap ({DEFS}) USING heap")
+            _run(dsn, f"CREATE TABLE t_col ({DEFS}) USING pgcolumnar")
+            _run(dsn, f"SELECT pgcolumnar.set_options('t_col', chunk_group_row_limit => {cg}, "
+                      f"stripe_row_limit => {sr}, compression => '{codec}', compression_level => {lvl})")
+            got = _value(dsn, "SELECT chunk_group_row_limit || '/' || stripe_row_limit || '/' || compression "
+                              "|| '/' || compression_level FROM pgcolumnar.options WHERE regclass = 't_col'::regclass")
+            if got != f"{cg}/{sr}/{codec}/{lvl}":
+                bad_opts.append(f"[{tag}: read back '{got}']")
+            # load_pair: generated once into heap, then copied to columnar
+            _run(dsn, f"""INSERT INTO t_heap SELECT
+                g,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE (g*3 - 500) END,
+                CASE WHEN g%{nullmod + 1}=0 THEN NULL ELSE (g::numeric*0.5 - 100) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE (sqrt(g::float8) * (CASE WHEN g%2=0 THEN -1 ELSE 1 END)) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE (g%2=0) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE (DATE '2010-01-01' + g) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE (TIMESTAMP '2010-01-01' + make_interval(mins => g)) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL ELSE ('v'||lpad(g::text,6,'0')) END,
+                CASE WHEN g%{nullmod}=0 THEN NULL WHEN g%997=0 THEN repeat('q',3000) ELSE ('t'||g) END
+                FROM generate_series(1,{n}) g""")
+            _run(dsn, "INSERT INTO t_col SELECT * FROM t_heap")
+
+            rows = _value(dsn, "SELECT count(*) FROM t_col")
+            if rows != str(n):
+                bad_rows.append(f"[{tag}: {rows} rows]")
+            for kind, tmpl in KINDS.items():
+                q = tmpl.format(lo=lo, hi=hi, eq=eq)
+                hq, hc = _set_hash(dsn, q.replace("%T", "t_heap")), _set_hash(dsn, q.replace("%T", "t_col"))
+                if hc != hq:
+                    bad[kind].append(f"[{tag}: {hc} vs {hq}]")
+            its += 1
+        yield {"its": its, "opts": " ".join(bad_opts) or "none", "rows": " ".join(bad_rows) or "none",
+               **{k: " ".join(v) or "none" for k, v in bad.items()}}
+    finally:
+        with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def test_the_fuzz_run_covered_every_iteration(fz, expect):
+    expect.num(fz["its"], ITERS, "the run covered every iteration")
+
+
+def test_every_fuzz_iterations_storage_options_read_back(fz, expect):
+    expect.text(fz["opts"], "none", "every iteration's storage options read back as set")
+
+
+def test_every_fuzz_iteration_loaded_all_its_rows(fz, expect):
+    expect.text(fz["rows"], "none", "every iteration loaded all its rows")
+
+
+def test_every_fuzz_iterations_whole_rows_agree(fz, expect):
+    expect.text(fz["whole-row"], "none", "every iteration's whole rows agree with heap")
+
+
+def test_every_fuzz_iterations_counts_agree(fz, expect):
+    expect.text(fz["count"], "none", "every iteration's counts agree with heap")
+
+
+def test_every_fuzz_iterations_min_and_max_agree(fz, expect):
+    expect.text(fz["minmax"], "none", "every iteration's min and max agree with heap")
+
+
+def test_every_fuzz_iterations_sums_and_averages_agree(fz, expect):
+    expect.text(fz["sumavg"], "none", "every iteration's sums and averages agree with heap")
+
+
+def test_every_fuzz_iterations_integer_range_agrees(fz, expect):
+    expect.text(fz["range-int"], "none", "every iteration's integer range agrees with heap")
+
+
+def test_every_fuzz_iterations_date_range_agrees(fz, expect):
+    expect.text(fz["range-date"], "none", "every iteration's date range agrees with heap")
+
+
+def test_every_fuzz_iterations_equality_lookup_agrees(fz, expect):
+    expect.text(fz["eq"], "none", "every iteration's equality lookup agrees with heap")
+
+
+def test_every_fuzz_iterations_is_null_count_agrees(fz, expect):
+    expect.text(fz["isnull"], "none", "every iteration's IS NULL count agrees with heap")
+
+
+def test_every_fuzz_iterations_compound_filter_agrees(fz, expect):
+    expect.text(fz["compound"], "none", "every iteration's compound filter agrees with heap")
diff --git a/test/pytest/test_fuzz_arrow.py b/test/pytest/test_fuzz_arrow.py
new file mode 100644
index 000000000..133d95476
--- /dev/null
+++ b/test/pytest/test_fuzz_arrow.py
@@ -0,0 +1,252 @@
+"""The Arrow IPC decoder survives malformed input (#214). The pytest twin of
+`test/fuzz_arrow.sh`, every check by the shell's name.
+
+Seeds come from `test/arrow_corpus.py`; a seed is kept only if `import_arrow` accepts it
+pristine into a table of its own column list, so a mutant exercises the decode and not
+only the schema check. Each iteration mutates one seed with `test/arrow_mutate.py` --
+a pure function of (seed file, integer seed) -- and imports it. The property is the
+shell's: a malformed file makes the backend raise an ERROR, never die, hang or trip a
+sanitizer, classified from the server log first and the client's error second.
+
+Two #1341 arms: a seed corpus that is empty, or that the importer rejects outright, is
+a named check rather than an unnamed FAIL; and every mutant must be generated and
+imported, where a mutate that failed was skipped and a run that generated almost
+nothing passed.
+
+PGC_SEED and PGC_ITERS are the shell's knobs, with its defaults.
+"""
+import os
+import pathlib
+import re
+import subprocess
+import sys
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+SEED = int(os.environ.get("PGC_SEED", "20260728"))
+ITERS = int(os.environ.get("PGC_ITERS", "100"))
+
+SANITIZER = re.compile(r"AddressSanitizer|runtime error:|UndefinedBehaviorSanitizer|LeakSanitizer")
+CRASHED = re.compile(r"was terminated by signal|server process .* exited with|crashed")
+LOST = re.compile(r"server closed the connection unexpectedly|connection to server was lost|terminating connection")
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return query_error(f"no value from {sql}") if row is None or row[0] is None else str(row[0])
+
+
+class _Log:
+    """The server log read from a byte offset, so an outcome is attributed to the
+    statement that produced it and not to every statement after it."""
+
+    def __init__(self, path):
+        self.path, self.pos = path, 0
+        self.since()
+
+    def since(self):
+        try:
+            with open(self.path, "rb") as fh:
+                fh.seek(self.pos)
+                new = fh.read()
+        except OSError:
+            return ""
+        self.pos += len(new)
+        return new.decode(errors="replace")
+
+
+def _cluster_back(dsn):
+    for _ in range(60):
+        if _value(dsn, "SELECT 1") == "1":
+            return True
+        time.sleep(0.5)
+    return False
+
+
+def _outcome(dsn, log, sql):
+    """-> crash | san | hang | error | clean, or gone when the cluster did not return,
+    with the client's message. The shell's order: sanitizer and crash from the log,
+    then a timeout, then a lost connection, then an ERROR."""
+    log.since()
+    failure = None
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute("SET statement_timeout = '20s'")
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        failure = exc
+    # Classified outside the handler: the failure is kept as the exception, and its text
+    # is read only to classify it, never returned as a reading.
+    message, kind = "", "clean"
+    if isinstance(failure, psycopg.errors.QueryCanceled):
+        kind, message = "hang", _message(failure)
+    elif isinstance(failure, psycopg.OperationalError):
+        message = str(failure)
+        kind = "lost" if LOST.search(message) else "unreachable"
+    elif failure is not None:
+        kind, message = "error", _message(failure)
+    if kind == "unreachable" and not _cluster_back(dsn):
+        return "gone", message
+    new = log.since()
+    if SANITIZER.search(new):
+        _cluster_back(dsn)
+        return "san", message
+    if CRASHED.search(new):
+        _cluster_back(dsn)
+        return "crash", message
+    if kind == "hang":
+        return "hang", message
+    if kind == "lost":
+        _cluster_back(dsn)
+        return "crash", message
+    if kind in ("error", "unreachable"):
+        return "error", message
+    return "clean", message
+
+
+def _run(dsn, sql):
+    try:
+        with psycopg.connect(dsn, autocommit=True) as conn:
+            conn.execute(sql)
+        return True
+    except psycopg.Error:
+        return False
+
+
+def _seeds(kind, corpus_dir):
+    """-> the corpus generator's lines, "<name> <path> [column list]"."""
+    out = subprocess.run([sys.executable, str(TEST / f"{kind}_corpus.py"), str(corpus_dir)],
+                         capture_output=True, text=True)
+    return [l for l in out.stdout.splitlines() if l.strip()]
+
+
+def _mutate(kind, src, seed, dst):
+    dst.unlink(missing_ok=True)
+    ok = subprocess.run([sys.executable, str(TEST / f"{kind}_mutate.py"), str(src), str(seed), str(dst)],
+                        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
+    if ok and dst.exists():
+        dst.chmod(0o644)
+        return True
+    return False
+
+
+DB = "pgc_fuzz_arrow"
+
+
+@pytest.fixture(scope="module")
+def fz(pgc_cluster, server_dir):
+    with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    try:
+        dsn = pgc_cluster.dsn(dbname=DB)
+        _run(dsn, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        corpus = server_dir / "corpus"
+        corpus.mkdir(exist_ok=True)
+        corpus.chmod(0o777)
+        lines = _seeds("arrow", corpus)
+        r = {"seed files": len(lines)}
+        _run(dsn, "DROP TYPE IF EXISTS pgc_fuzz_xy CASCADE; CREATE TYPE pgc_fuzz_xy AS (x int, y text)")
+        seeds = []
+        for line in lines:
+            parts = line.split(" ", 2)
+            if len(parts) < 3 or not parts[2].strip():
+                continue
+            path, cols, tab = parts[1], parts[2], f"arrt_{len(seeds)}"
+            pathlib.Path(path).chmod(0o644)
+            if not _run(dsn, f"DROP TABLE IF EXISTS {tab}; CREATE TABLE {tab} ({cols}) USING pgcolumnar"):
+                continue
+            if _run(dsn, f"SELECT pgcolumnar.import_arrow('{tab}', '{path}')"):
+                _run(dsn, f"TRUNCATE {tab}")
+                seeds.append((path, tab))
+        r["pristine"] = len(seeds)
+
+        mut = server_dir / "mutant.arrows"
+        log = _Log(pgc_cluster.datadir / "server.log")
+        n = dict(crash=0, hang=0, san=0, error=0, clean=0, gen=0)
+        print(f"-- seed={SEED} iters={ITERS}; reproduce with PGC_SEED={SEED}")
+        for i in range(ITERS if seeds else 0):
+            path, tab = seeds[i % len(seeds)]
+            ms = SEED + i
+            if not _mutate("arrow", path, ms, mut):
+                continue
+            n["gen"] += 1
+            _run(dsn, f"TRUNCATE {tab}")
+            kind, message = _outcome(dsn, log, f"SELECT pgcolumnar.import_arrow('{tab}', '{mut}')")
+            if kind == "gone":
+                print(f"FATAL: cluster unreachable at seed={ms}")
+                break
+            if kind in ("crash", "hang", "san"):
+                print(f"  FINDING [{kind}] seed={ms} from {pathlib.Path(path).name}: {message}")
+            n[kind] += 1
+        print(f"-- done: {ITERS} mutants, {n['error']} rejected with ERROR, {n['clean']} accepted")
+        r.update(n)
+        yield r
+    finally:
+        with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def test_the_arrow_seed_corpus_generator_produced_files(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["seed files"] > 0 else "no", "yes", "the seed corpus generator produced files")
+
+
+def test_the_arrow_importer_accepts_some_pristine_seed(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["pristine"] > 0 else "no", "yes", "the importer accepts some pristine seed")
+
+
+def test_no_arrow_mutant_crashed_the_backend(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["crash"], 0, "no mutant crashed the backend")
+
+
+def test_no_arrow_mutant_hung_the_decode(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["hang"], 0, "no mutant hung the decode")
+
+
+def test_no_arrow_mutant_tripped_a_sanitizer(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["san"], 0, "no mutant tripped a sanitizer")
+
+
+def test_every_arrow_mutant_was_generated_and_imported(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    ran = fz["error"] + fz["clean"] + fz["crash"] + fz["hang"] + fz["san"]
+    expect.text(f"{fz['gen']}/{ran}", f"{ITERS}/{ITERS}", "every mutant was generated and ran the import")
+
+
+def test_the_arrow_corpus_reached_the_decoder(request, expect):
+    if expect.require_module("pyarrow.ipc", name="pyarrow not available; the Arrow fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["error"] > 0 else f"no (errors={fz['error']} clean={fz['clean']})", "yes",
+                "the corpus reached the decoder at all")
diff --git a/test/pytest/test_fuzz_avro.py b/test/pytest/test_fuzz_avro.py
new file mode 100644
index 000000000..9876c5755
--- /dev/null
+++ b/test/pytest/test_fuzz_avro.py
@@ -0,0 +1,230 @@
+"""The Avro manifest decoder survives malformed input (#388). The pytest twin of
+`test/fuzz_avro.sh`, every check by the shell's name.
+
+Each iteration writes one mutant with `test/avro_corpus.py` -- a pure function of one
+integer seed over the committed pyiceberg manifest and manifest list, alternating
+between the two by seed parity -- and reads it through `read_avro_manifest` or
+`read_manifest_list`. The property is the shell's: a malformed file makes the backend
+raise an ERROR, never die, hang or trip a sanitizer. Outcomes are classified as the
+shell classifies them, from the server log written during the statement first and the
+client's error second.
+
+Two anti-vacuity arms carry the shell's #1341 fixes. The mutant is removed before it
+is generated, so a generator that writes nothing is counted rather than read as the
+previous file; and a statement that failed opening the file did not reach the decoder.
+
+PGC_SEED and PGC_ITERS are the shell's knobs, with its defaults, and the seed is
+printed so a failure reproduces exactly.
+"""
+import os
+import pathlib
+import re
+import subprocess
+import sys
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+FX = TEST / "fixtures" / "iceberg"
+CORPUS = TEST / "avro_corpus.py"
+SEED = int(os.environ.get("PGC_SEED", "20260814"))
+ITERS = int(os.environ.get("PGC_ITERS", "300"))
+
+SANITIZER = re.compile(r"AddressSanitizer|runtime error:|UndefinedBehaviorSanitizer|LeakSanitizer")
+CRASHED = re.compile(r"was terminated by signal|server process .* exited with|crashed")
+LOST = re.compile(r"server closed the connection|connection to server was lost")
+FILE_ERROR = re.compile(r"could not open|No such file|Permission denied")
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return query_error(f"no value from {sql}") if row is None or row[0] is None else str(row[0])
+
+
+class _Log:
+    """The server log read from a byte offset, so an outcome is attributed to the
+    statement that produced it and not to every statement after it."""
+
+    def __init__(self, path):
+        self.path, self.pos = path, 0
+        self.since()
+
+    def since(self):
+        try:
+            with open(self.path, "rb") as fh:
+                fh.seek(self.pos)
+                new = fh.read()
+        except OSError:
+            return ""
+        self.pos += len(new)
+        return new.decode(errors="replace")
+
+
+def _cluster_back(dsn):
+    for _ in range(60):
+        if _value(dsn, "SELECT 1") == "1":
+            return True
+        time.sleep(0.5)
+    return False
+
+
+def _outcome(dsn, log, sql):
+    """-> crash | san | hang | error | clean, or gone when the cluster did not return,
+    with the client's message. The shell's order: sanitizer and crash from the log,
+    then a timeout, then a lost connection, then an ERROR."""
+    log.since()
+    failure = None
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute("SET statement_timeout = '20s'")
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        failure = exc
+    # Classified outside the handler: the failure is kept as the exception, and its text
+    # is read only to classify it, never returned as a reading.
+    message, kind = "", "clean"
+    if isinstance(failure, psycopg.errors.QueryCanceled):
+        kind, message = "hang", _message(failure)
+    elif isinstance(failure, psycopg.OperationalError):
+        message = str(failure)
+        kind = "lost" if LOST.search(message) else "unreachable"
+    elif failure is not None:
+        kind, message = "error", _message(failure)
+    if kind == "unreachable" and not _cluster_back(dsn):
+        return "gone", message
+    new = log.since()
+    if SANITIZER.search(new):
+        _cluster_back(dsn)
+        return "san", message
+    if CRASHED.search(new):
+        _cluster_back(dsn)
+        return "crash", message
+    if kind == "hang":
+        return "hang", message
+    if kind == "lost":
+        _cluster_back(dsn)
+        return "crash", message
+    if kind in ("error", "unreachable"):
+        return "error", message
+    return "clean", message
+
+
+@pytest.fixture(scope="module")
+def fa(pgc_cluster, server_dir):
+    dsn = pgc_cluster.dsn()
+    with psycopg.connect(dsn, autocommit=True) as conn:
+        conn.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+    mut = server_dir / "mutant.avro"
+    base, base_list = FX / "manifest-0.avro", FX / "manifest-list.avro"
+    rd_manifest = f"SELECT count(*) FROM pgcolumnar.read_avro_manifest('{mut}')"
+    rd_list = f"SELECT count(*) FROM pgcolumnar.read_manifest_list('{mut}')"
+
+    def generate(src, arg):
+        mut.unlink(missing_ok=True)
+        subprocess.run([sys.executable, str(CORPUS), str(src), str(arg), str(mut)],
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        if mut.exists():
+            mut.chmod(0o644)
+            return True
+        return False
+
+    r = {}
+    generate(base, "valid")
+    r["control manifest"] = _value(dsn, rd_manifest)
+    generate(base_list, "valid")
+    r["control list"] = _value(dsn, rd_list)
+
+    log = _Log(pgc_cluster.datadir / "server.log")
+    n = dict(crash=0, hang=0, san=0, error=0, clean=0, fresh=0, fileerr=0)
+    print(f"-- fuzzing {ITERS} Avro manifest mutants (seed base {SEED}); reproduce with PGC_SEED={SEED}")
+    for i in range(ITERS):
+        s = SEED + i
+        src, rd = (base, rd_manifest) if i % 2 == 0 else (base_list, rd_list)
+        if generate(src, s):
+            n["fresh"] += 1
+        kind, message = _outcome(dsn, log, rd)
+        if kind == "gone":
+            print(f"FATAL: cluster gone at seed={s}")
+            break
+        if kind in ("crash", "hang", "san"):
+            print(f"  FINDING [{kind}] seed={s}: {message}")
+        n[kind] += 1
+        if kind == "error" and FILE_ERROR.search(message):
+            n["fileerr"] += 1
+    print(f"-- done: {ITERS} mutants, {n['error']} rejected with ERROR, {n['clean']} accepted clean")
+    r.update(n)
+    yield r
+
+
+def _counts(fa):
+    return fa
+
+
+def test_the_valid_manifest_reaches_the_avro_decoder(fa, expect):
+    expect.text(_counts(fa)["control manifest"], "2", "control: the valid manifest reaches the decoder (2 entries)")
+
+
+def test_the_valid_manifest_list_reaches_the_avro_decoder(fa, expect):
+    expect.text(_counts(fa)["control list"], "1", "control: the valid manifest-list reaches the decoder (1 entry)")
+
+
+def test_no_avro_mutant_crashed_the_backend(fa, expect):
+    expect.num(_counts(fa)["crash"], 0, "no mutant crashed the backend")
+
+
+def test_no_avro_mutant_hung_the_decoder(fa, expect):
+    expect.num(_counts(fa)["hang"], 0, "no mutant hung the decoder")
+
+
+def test_no_avro_mutant_tripped_a_sanitizer(fa, expect):
+    expect.num(_counts(fa)["san"], 0, "no mutant tripped a sanitizer")
+
+
+def test_every_avro_mutant_ran(fa, expect):
+    c = _counts(fa)
+    expect.num(c["error"] + c["clean"], ITERS, "every mutant ran (errors + clean == iters)")
+
+
+def test_every_avro_iteration_wrote_a_fresh_mutant(fa, expect):
+    expect.num(_counts(fa)["fresh"], ITERS, "every iteration wrote a fresh mutant")
+
+
+def test_the_avro_corpus_reached_the_decoder(fa, expect):
+    c = _counts(fa)
+    reached = c["error"] - c["fileerr"] + c["clean"]
+    expect.text("yes" if reached > 0 else f"no ({c['fileerr']} of {c['error']} errors were opening the file)",
+                "yes", "the corpus reached the decoder at all")
+
+
+def test_the_avro_manifest_fixtures_are_present(expect):
+    """The shell skips the whole suite without the committed fixtures, under this name."""
+    if not (FX / "manifest-0.avro").is_file():
+        expect.cannot_run("ABSENT_FIXTURE", "the committed Iceberg manifest fixtures are not in this tree",
+                          name="iceberg manifest fixtures are missing")
+        return
+    expect.at_least((FX / "manifest-list.avro").stat().st_size, 1,
+                    "premise: the committed manifest-list fixture is not empty")
+
+
+def test_python_can_hash_the_avro_corpus_seeds(expect):
+    """The shell's other skip name: the corpus seeds its mutations through hashlib."""
+    try:
+        import hashlib as _hashlib
+    except ImportError:
+        expect.cannot_run("MISSING_DEPENDENCY", "hashlib is not importable", name="python3 is required")
+        return
+    expect.text(_hashlib.sha256(b"").hexdigest()[:8], "e3b0c442",
+                "premise: hashlib digests as the corpus expects, so its mutants are the shell's")
diff --git a/test/pytest/test_fuzz_listing.py b/test/pytest/test_fuzz_listing.py
new file mode 100644
index 000000000..e2fcd7314
--- /dev/null
+++ b/test/pytest/test_fuzz_listing.py
@@ -0,0 +1,313 @@
+"""The ListObjectsV2 listing parser survives malformed input (#619). The pytest twin
+of `test/fuzz_listing.sh`, every check by the shell's name.
+
+The SigV4 fixture server (`test/objstore_http_server.py`, the shell's own) serves its
+`__listing_override__` file verbatim as the listing, so each mutant from
+`test/listing_corpus.py` -- a pure function of one integer seed -- reaches the C
+parser exactly as a hostile endpoint's response would, through
+`read_parquet('s3://pgc-bucket/lst/')`. The property is the shell's: a malformed listing
+makes the backend raise an ERROR, never die, hang or trip a sanitizer, classified from
+the private cluster's server log first and the client's error second.
+
+The override is removed before each mutant is generated (#1341): with no override the
+fixture serves the real listing, so a generator that writes nothing read as a clean
+accept every time.
+
+A PRIVATE CLUSTER, because the postmaster runs with AWS_* in its environment. PGC_SEED
+and PGC_ITERS are the shell's knobs, with its defaults.
+"""
+import os
+import pathlib
+import re
+import subprocess
+import sys
+import tempfile
+import shutil
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+CORPUS = TEST / "listing_corpus.py"
+SEED = int(os.environ.get("PGC_SEED", "20260814"))
+ITERS = int(os.environ.get("PGC_ITERS", "200"))
+AKID, SECRET, REGION, BUCKET = "PGCTESTKEYID", "pgctest-secret", "pgc-test-1", "pgc-bucket"
+READ = f"SELECT count(*) FROM pgcolumnar.read_parquet('s3://{BUCKET}/lst/') AS t(id int8)"
+
+SANITIZER = re.compile(r"AddressSanitizer|runtime error:|UndefinedBehaviorSanitizer|LeakSanitizer")
+CRASHED = re.compile(r"was terminated by signal|server process .* exited with|crashed")
+LOST = re.compile(r"server closed the connection|connection to server was lost")
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return query_error(f"no value from {sql}") if row is None or row[0] is None else str(row[0])
+
+
+class _Log:
+    """The server log read from a byte offset, so an outcome is attributed to the
+    statement that produced it and not to every statement after it."""
+
+    def __init__(self, path):
+        self.path, self.pos = path, 0
+        self.since()
+
+    def since(self):
+        try:
+            with open(self.path, "rb") as fh:
+                fh.seek(self.pos)
+                new = fh.read()
+        except OSError:
+            return ""
+        self.pos += len(new)
+        return new.decode(errors="replace")
+
+
+def _cluster_back(dsn):
+    for _ in range(60):
+        if _value(dsn, "SELECT 1") == "1":
+            return True
+        time.sleep(0.5)
+    return False
+
+
+def _outcome(dsn, log, sql):
+    """-> crash | san | hang | error | clean, or gone when the cluster did not return,
+    with the client's message. The shell's order: sanitizer and crash from the log,
+    then a timeout, then a lost connection, then an ERROR."""
+    log.since()
+    failure = None
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute("SET statement_timeout = '20s'")
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        failure = exc
+    # Classified outside the handler: the failure is kept as the exception, and its text
+    # is read only to classify it, never returned as a reading.
+    message, kind = "", "clean"
+    if isinstance(failure, psycopg.errors.QueryCanceled):
+        kind, message = "hang", _message(failure)
+    elif isinstance(failure, psycopg.OperationalError):
+        message = str(failure)
+        kind = "lost" if LOST.search(message) else "unreachable"
+    elif failure is not None:
+        kind, message = "error", _message(failure)
+    if kind == "unreachable" and not _cluster_back(dsn):
+        return "gone", message
+    new = log.since()
+    if SANITIZER.search(new):
+        _cluster_back(dsn)
+        return "san", message
+    if CRASHED.search(new):
+        _cluster_back(dsn)
+        return "crash", message
+    if kind == "hang":
+        return "hang", message
+    if kind == "lost":
+        _cluster_back(dsn)
+        return "crash", message
+    if kind in ("error", "unreachable"):
+        return "error", message
+    return "clean", message
+
+
+def _pg_ctl(cluster, args, extra_env):
+    """pg_ctl with every AWS_* of this process removed, then `extra_env` added; dropped
+    to postgres when running as root, as the harness does."""
+    unset = [a for k in os.environ if k.startswith("AWS_") for a in ("-u", k)]
+    cmd = ["env"] + unset + [f"{k}={v}" for k, v in extra_env.items()] + \
+          [os.path.join(cluster.bindir, "pg_ctl")] + args
+    if os.geteuid() == 0:
+        cmd = ["runuser", "-u", "postgres", "--"] + cmd
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _build(pgc_cluster, pa, pq, held):
+    """Stand up the listing fixture and run the fuzz loop, with the pyarrow modules the
+    first test's require_module returned: a fixture cannot decline, so it never imports
+    pyarrow itself (main's capability guard, #1655 review). `held` keeps what teardown
+    must stop."""
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-fzlst-"))
+    held["work"] = work
+    os.chmod(work, 0o777)
+    (work / BUCKET / "lst").mkdir(parents=True)
+    pq.write_table(pa.table({"id": pa.array([7, 8, 9], pa.int64())}), work / BUCKET / "lst" / "real.parquet")
+    for p in [work / BUCKET, *(work / BUCKET).rglob("*")]:
+        p.chmod(0o777 if p.is_dir() else 0o666)
+    override = work / "__listing_override__"
+
+    s3_port = pick_port(32)
+    out = work / "s3_server.out"
+    srv = subprocess.Popen([sys.executable, str(TEST / "objstore_http_server.py"), "--dir", str(work),
+                            "--port", str(s3_port), "--log", str(work / "s3.log"),
+                            "--sigv4-key", AKID, "--sigv4-secret", SECRET, "--sigv4-region", REGION],
+                           stdout=open(out, "w"), stderr=subprocess.STDOUT)
+    held["srv"] = srv
+    for _ in range(50):
+        if out.is_file() and "READY" in out.read_text(errors="replace"):
+            break
+        time.sleep(0.1)
+
+    datadir = work / "data"
+    datadir.mkdir()
+    logpath = work / "server.log"
+    cluster = Cluster(pgc_cluster.pg_config, "fzlst", datadir, pick_port(31))
+    held["cluster"], held["datadir"] = cluster, datadir
+    r = {"fixture up": out.read_text(errors="replace").count("READY") if out.is_file() else 0}
+    cluster.initdb()
+    with open(datadir / "postgresql.conf", "a") as fh:
+        fh.write("\npgcolumnar.objstore_allowed_endpoints='127.0.0.1'\n")
+    env = {"AWS_ENDPOINT_URL": f"http://127.0.0.1:{s3_port}", "AWS_ACCESS_KEY_ID": AKID,
+           "AWS_SECRET_ACCESS_KEY": SECRET, "AWS_REGION": REGION}
+    started = _pg_ctl(cluster, ["-D", str(datadir), "-l", str(logpath), "-w", "start"], env)
+    if started.returncode != 0:
+        raise RuntimeError(f"the private cluster did not start: {started.stderr.strip()}")
+    dsn = cluster.dsn()
+    with psycopg.connect(dsn, autocommit=True) as c:
+        c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+
+    def generate(arg):
+        override.unlink(missing_ok=True)
+        subprocess.run([sys.executable, str(CORPUS), str(arg), str(override)],
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        return override.exists()
+
+    generate("valid")
+    r["control"] = _value(dsn, READ)
+
+    log = _Log(logpath)
+    n = dict(crash=0, hang=0, san=0, error=0, clean=0, fresh=0)
+    print(f"-- fuzzing {ITERS} listing mutants (seed base {SEED}); reproduce with PGC_SEED={SEED}")
+    for i in range(ITERS):
+        s = SEED + i
+        if generate(s):
+            n["fresh"] += 1
+        kind, message = _outcome(dsn, log, READ)
+        if kind == "gone":
+            print(f"FATAL: cluster gone at seed={s}")
+            break
+        if kind in ("crash", "hang", "san"):
+            print(f"  FINDING [{kind}] seed={s}: {message}")
+        n[kind] += 1
+    override.unlink(missing_ok=True)
+    print(f"-- done: {ITERS} mutants, {n['error']} rejected with ERROR, {n['clean']} accepted clean")
+    r.update(n)
+    return r
+
+
+@pytest.fixture(scope="module")
+def fl(pgc_cluster):
+    """-> run(pa, pq): builds the fixture and runs the fuzz loop once, on the first call."""
+    held = {}
+
+    def run(pa, pq):
+        if "r" not in held:
+            held["r"] = _build(pgc_cluster, pa, pq, held)
+        return held["r"]
+
+    try:
+        yield run
+    finally:
+        if "cluster" in held:
+            _pg_ctl(held["cluster"], ["-D", str(held["datadir"]), "-m", "immediate", "-w", "stop"], {})
+        if "srv" in held:
+            held["srv"].terminate()
+            held["srv"].wait()
+        if "work" in held:
+            shutil.rmtree(held["work"], ignore_errors=True)
+
+
+def _modules(expect):
+    """-> (pyarrow, pyarrow.parquet) from require_module, or None when the test declined."""
+    pa = expect.require_module("pyarrow", name="pyarrow is required to write the fixture")
+    if pa is None:
+        return None
+    return pa, expect.require_module("pyarrow.parquet", name="pyarrow is required to write the fixture")
+
+
+def test_the_listing_fixture_is_up(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["fixture up"], 1, "premise: fixture up")
+
+
+def test_a_valid_listing_reaches_the_parser(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.text(fl["control"], "3", "control: a valid listing reaches the parser and reads the object")
+
+
+def test_no_listing_mutant_crashed_the_backend(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["crash"], 0, "no mutant crashed the backend")
+
+
+def test_no_listing_mutant_hung_the_parser(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["hang"], 0, "no mutant hung the parser")
+
+
+def test_no_listing_mutant_tripped_a_sanitizer(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["san"], 0, "no mutant tripped a sanitizer")
+
+
+def test_every_listing_mutant_ran(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["error"] + fl["clean"], ITERS, "every mutant ran (errors + clean == iters)")
+
+
+def test_every_listing_iteration_wrote_a_fresh_mutant(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.num(fl["fresh"], ITERS, "every iteration wrote a fresh mutant")
+
+
+def test_the_listing_corpus_reached_the_parser(fl, expect):
+    run = fl
+    mods = _modules(expect)
+    if mods is None:
+        return
+    fl = run(*mods)
+    expect.text("yes" if fl["error"] + fl["clean"] > 0 else "no", "yes",
+                "the corpus reached the parser at all (some mutant errored or accepted)")
diff --git a/test/pytest/test_fuzz_parquet.py b/test/pytest/test_fuzz_parquet.py
new file mode 100644
index 000000000..54ec706a2
--- /dev/null
+++ b/test/pytest/test_fuzz_parquet.py
@@ -0,0 +1,259 @@
+"""The Parquet decoder survives malformed input (#214, #210). The pytest twin of
+`test/fuzz_parquet.sh`, every check by the shell's name.
+
+Seeds come from `test/parquet_corpus.py`; a seed is kept only if `parquet_schema`
+renders its column list, so a mutant exercises the decode and not only the argument
+check. Each iteration mutates one seed with `test/parquet_mutate.py` -- a pure function
+of (seed file, integer seed) -- and feeds it to every entry point that parses one:
+parquet_schema, read_parquet, and import_parquet, which also reaches the insert path. The property is the
+shell's: a malformed file makes the backend raise an ERROR, never die, hang or trip a
+sanitizer, classified from the server log first and the client's error second.
+
+Two #1341 arms: a seed corpus that is empty, or whose schemas the reader will not render, is
+a named check rather than an unnamed FAIL; and every mutant must be generated and
+run through its three statements, where a mutate that failed was skipped and a run that generated almost
+nothing passed.
+
+PGC_SEED and PGC_ITERS are the shell's knobs, with its defaults.
+"""
+import os
+import pathlib
+import re
+import subprocess
+import sys
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+SEED = int(os.environ.get("PGC_SEED", "20260728"))
+ITERS = int(os.environ.get("PGC_ITERS", "100"))
+
+SANITIZER = re.compile(r"AddressSanitizer|runtime error:|UndefinedBehaviorSanitizer|LeakSanitizer")
+CRASHED = re.compile(r"was terminated by signal|server process .* exited with|crashed")
+LOST = re.compile(r"server closed the connection unexpectedly|connection to server was lost|terminating connection")
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return query_error(f"no value from {sql}") if row is None or row[0] is None else str(row[0])
+
+
+class _Log:
+    """The server log read from a byte offset, so an outcome is attributed to the
+    statement that produced it and not to every statement after it."""
+
+    def __init__(self, path):
+        self.path, self.pos = path, 0
+        self.since()
+
+    def since(self):
+        try:
+            with open(self.path, "rb") as fh:
+                fh.seek(self.pos)
+                new = fh.read()
+        except OSError:
+            return ""
+        self.pos += len(new)
+        return new.decode(errors="replace")
+
+
+def _cluster_back(dsn):
+    for _ in range(60):
+        if _value(dsn, "SELECT 1") == "1":
+            return True
+        time.sleep(0.5)
+    return False
+
+
+def _outcome(dsn, log, sql):
+    """-> crash | san | hang | error | clean, or gone when the cluster did not return,
+    with the client's message. The shell's order: sanitizer and crash from the log,
+    then a timeout, then a lost connection, then an ERROR."""
+    log.since()
+    failure = None
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute("SET statement_timeout = '20s'")
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        failure = exc
+    # Classified outside the handler: the failure is kept as the exception, and its text
+    # is read only to classify it, never returned as a reading.
+    message, kind = "", "clean"
+    if isinstance(failure, psycopg.errors.QueryCanceled):
+        kind, message = "hang", _message(failure)
+    elif isinstance(failure, psycopg.OperationalError):
+        message = str(failure)
+        kind = "lost" if LOST.search(message) else "unreachable"
+    elif failure is not None:
+        kind, message = "error", _message(failure)
+    if kind == "unreachable" and not _cluster_back(dsn):
+        return "gone", message
+    new = log.since()
+    if SANITIZER.search(new):
+        _cluster_back(dsn)
+        return "san", message
+    if CRASHED.search(new):
+        _cluster_back(dsn)
+        return "crash", message
+    if kind == "hang":
+        return "hang", message
+    if kind == "lost":
+        _cluster_back(dsn)
+        return "crash", message
+    if kind in ("error", "unreachable"):
+        return "error", message
+    return "clean", message
+
+
+def _run(dsn, sql):
+    try:
+        with psycopg.connect(dsn, autocommit=True) as conn:
+            conn.execute(sql)
+        return True
+    except psycopg.Error:
+        return False
+
+
+def _seeds(kind, corpus_dir):
+    """-> the corpus generator's lines, "<name> <path> [column list]"."""
+    out = subprocess.run([sys.executable, str(TEST / f"{kind}_corpus.py"), str(corpus_dir)],
+                         capture_output=True, text=True)
+    return [l for l in out.stdout.splitlines() if l.strip()]
+
+
+def _mutate(kind, src, seed, dst):
+    dst.unlink(missing_ok=True)
+    ok = subprocess.run([sys.executable, str(TEST / f"{kind}_mutate.py"), str(src), str(seed), str(dst)],
+                        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
+    if ok and dst.exists():
+        dst.chmod(0o644)
+        return True
+    return False
+
+
+DB = "pgc_fuzz_parquet"
+
+
+@pytest.fixture(scope="module")
+def fz(pgc_cluster, server_dir):
+    with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    try:
+        dsn = pgc_cluster.dsn(dbname=DB)
+        _run(dsn, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        corpus = server_dir / "corpus"
+        corpus.mkdir(exist_ok=True)
+        corpus.chmod(0o777)
+        lines = _seeds("parquet", corpus)
+        r = {"seed files": len(lines)}
+        seeds = []
+        for line in lines:
+            path = line.rsplit(" ", 1)[-1]
+            pathlib.Path(path).chmod(0o644)
+            cols = _value(dsn, "SELECT string_agg(format('%I %s', column_name, data_type), ', ') "
+                               f"FROM pgcolumnar.parquet_schema('{path}')")
+            if cols.startswith("QUERY_ERROR") or not cols:
+                continue
+            seeds.append((path, cols))
+        r["rendered"] = len(seeds)
+
+        mut = server_dir / "mutant.parquet"
+        log = _Log(pgc_cluster.datadir / "server.log")
+        n = dict(crash=0, hang=0, san=0, error=0, clean=0, gen=0)
+        print(f"-- seed={SEED} iters={ITERS}; reproduce with PGC_SEED={SEED}")
+        _run(dsn, "DROP TABLE IF EXISTS fz_target")
+        gone = False
+        for i in range(ITERS if seeds else 0):
+            path, cols = seeds[i % len(seeds)]
+            ms = SEED + i
+            if not _mutate("parquet", path, ms, mut):
+                continue
+            n["gen"] += 1
+            for setup, sql in ((None, f"SELECT * FROM pgcolumnar.parquet_schema('{mut}')"),
+                               (None, f"SELECT count(*) FROM pgcolumnar.read_parquet('{mut}') AS t({cols})"),
+                               (f"DROP TABLE IF EXISTS fz_target; CREATE TABLE fz_target ({cols}) USING pgcolumnar",
+                                f"SELECT pgcolumnar.import_parquet('fz_target', '{mut}')")):
+                if setup:
+                    _run(dsn, setup)
+                kind, message = _outcome(dsn, log, sql)
+                if kind == "gone":
+                    gone = True
+                    break
+                if kind in ("crash", "hang", "san"):
+                    print(f"  FINDING [{kind}] seed={ms} from {pathlib.Path(path).name}: {message}")
+                n[kind] += 1
+            if gone:
+                print(f"FATAL: cluster unreachable at seed={ms}")
+                break
+        print(f"-- done: {ITERS} mutants, {n['error']} rejected with ERROR, {n['clean']} accepted")
+        r.update(n)
+        yield r
+    finally:
+        with psycopg.connect(pgc_cluster.dsn(), autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def test_the_parquet_seed_corpus_generator_produced_files(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["seed files"] > 0 else "no", "yes", "the seed corpus generator produced files")
+
+
+def test_the_parquet_reader_renders_some_pristine_seeds_schema(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["rendered"] > 0 else "no", "yes", "the reader renders some pristine seed's schema")
+
+
+def test_no_parquet_mutant_crashed_the_backend(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["crash"], 0, "no mutant crashed the backend")
+
+
+def test_no_parquet_mutant_hung_the_decode(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["hang"], 0, "no mutant hung the decode")
+
+
+def test_no_parquet_mutant_tripped_a_sanitizer(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.num(fz["san"], 0, "no mutant tripped a sanitizer")
+
+
+def test_every_parquet_mutant_was_generated_and_ran_its_statements(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    ran = fz["error"] + fz["clean"] + fz["crash"] + fz["hang"] + fz["san"]
+    expect.text(f"{fz['gen']}/{ran}", f"{ITERS}/{ITERS * 3}", "every mutant was generated and ran its three statements")
+
+
+def test_the_parquet_corpus_reached_the_decoder(request, expect):
+    if expect.require_module("pyarrow.parquet", name="pyarrow not available; the Parquet fuzzer needs it to build seeds") is None:
+        return
+    fz = request.getfixturevalue("fz")  # after the decline: the seeds need pyarrow
+    expect.text("yes" if fz["error"] > 0 else f"no (errors={fz['error']} clean={fz['clean']})", "yes",
+                "the corpus reached the decoder at all")
diff --git a/test/pytest/test_harness_deps.py b/test/pytest/test_harness_deps.py
index 120b198c3..ef9041091 100644
--- a/test/pytest/test_harness_deps.py
+++ b/test/pytest/test_harness_deps.py
@@ -62,6 +62,9 @@
 # that must agree fail loudly whichever of them is wrong. It is the shape
 # selftest 350 already uses for TESTS.md, for the same reason.
 NO_CLUSTER = [
+    # #1341: bench_guards.sh's twin. It runs each bench runner's guard block and
+    # bench/cb_guards.sh through bash, with a stand-in pg_config: no cluster, no driver.
+    "test_bench_guards.py",
     "test_build_refusal.py",
     "test_docs_cover_the_corpus.py",
     "test_guards_pinned.py",
@@ -150,6 +153,14 @@
     # #1341's twin of wal_envelope.sh. It reads src/*.c as text with its own Python
     # reader -- no connection, no cluster, no driver -- and the classifier agrees.
     "test_wal_envelope.py",
+    # #1341's twin of hilbert_curve.sh. It compiles src/columnar_curve.c with a small
+    # driver into a shared library and checks the curve in Python -- no connection, no
+    # cluster, no driver -- and the classifier agrees.
+    "test_hilbert_curve.py",
+    # #1341's twin of docs_style.sh. It reads the published pages, META.json and the
+    # tree's scripts as files, and asks git for the tags and the archive -- no
+    # connection, no cluster, no driver.
+    "test_docs_style.py",
     "test_parquet_level_width.py",
 ]
 
diff --git a/test/pytest/test_hilbert_curve.py b/test/pytest/test_hilbert_curve.py
new file mode 100644
index 000000000..4a1f24767
--- /dev/null
+++ b/test/pytest/test_hilbert_curve.py
@@ -0,0 +1,907 @@
+"""The Hilbert clustering curve, pinned by its properties and by frozen bytes (#889).
+The pytest twin of `test/hilbert_curve.sh`, every check by the shell's name (#1341).
+
+WHAT IS UNDER TEST. `cluster_hilbert_transpose` and `cluster_pack_interleave` in
+`src/columnar_curve.c`. The Hilbert key is ordinals -> transpose -> pack; the Z-order key
+is ordinals -> pack. Both are pure functions of ncols uint64 words, so no cluster is
+started: the file is compiled here, beside a small driver, into a shared library, and
+called through ctypes.
+
+INDEPENDENT OF THE SHELL. The shell compiles a C battery that checks the properties in
+C. Here the C side only ENCODES: the driver turns ordinal vectors into keys and counts
+its calls, and asserts nothing. Every property is checked in Python, with its own
+readers: the permutation test (C1), the memcmp-order adjacency walk (C2), the dyadic
+contiguity test (C3), the production-width bridge (C4a), a Python transcription of
+Skilling's TransposetoAxes for the round trips (C4b), and the three control encoders
+that prove the checkers discriminate. The two harnesses share only the frozen tables,
+which are records rather than code.
+
+C3 IS ASKED THE SAME QUESTION ANOTHER WAY. The shell takes each dyadic sub-cube's
+min and max index and requires max - min + 1 == count. Over a permutation that is
+exactly "each sub-cube is one run in index order", and a run boundary between two
+consecutive points sits at every level deeper than the levels they share, so one pass
+over the consecutive pairs counts the runs at every level at once. Where the encoder is
+not a permutation (C1 already red), the shell's own min/max form is computed instead,
+so the verdict is the shell's in every case.
+
+FAILS CLOSED. A compiler that cannot build a two-line program declines every arm as
+MISSING_DEPENDENCY, as the shell does. An absent or unbuildable code under test is a
+failed reading for every battery arm, not a skip. Every reading is a value or a
+query_error(), so a broken step reddens its own arms by name.
+"""
+import array
+import collections
+import ctypes
+import os
+import pathlib
+import random
+import shutil
+import subprocess
+
+import pytest
+
+from pgc_vacuity import query_error
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+CURVE_C = ROOT / "src" / "columnar_curve.c"
+CURVE_H = ROOT / "src" / "columnar_curve.h"
+VECNAMES = ["zero", "max", "topbit0", "unit", "tie", "mixed", "asym", "lowbit"]
+U64 = (1 << 64) - 1
+GUARD = 64
+CASES = [(n, b) for n in range(1, 9) for b in range(1, 21) if n * b <= 20]
+GOLDEN = [(n, v) for n in range(1, 9) for v in VECNAMES]
+NCOLS = list(range(1, 9))
+
+# Skilling's AxestoTranspose at b = 64, then the interleave loop. Generated off-tree on
+# 2026-09-08 and frozen; not produced by the code under test. The same record the shell
+# holds, as a record.
+GOLDEN_HILBERT = """
+n1 zero 0000000000000000
+n1 max ffffffffffffffff
+n1 topbit0 8000000000000000
+n1 unit 0000000000000001
+n1 tie 0000000000000004
+n1 mixed 0123456789abcdef
+n1 asym f0f0f0f0f0f0f0f0
+n1 lowbit 0000000000000001
+n2 zero 00000000000000000000000000000000
+n2 max aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+n2 topbit0 eaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+n2 unit 00000000000000000000000000000002
+n2 tie 00000000000000000000000000000023
+n2 mixed 040c9c1c868ed6d684869e36ae0e54fc
+n2 asym c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0
+n2 lowbit 00000000000000000000000000000003
+n3 zero 000000000000000000000000000000000000000000000000
+n3 max b6db6db6db6db6db6db6db6db6db6db6db6db6db6db6db6d
+n3 topbit0 f12492492492492492492492492492492492492492492492
+n3 unit 000000000000000000000000000000000000000000000005
+n3 tie 000000000000000000000000000000000000000000000146
+n3 mixed 1dc46b182507638ea95e6175bececbaa0ab100a019770fc1
+n3 asym fad4f6f2d840e3f8e2209562209562209562209562209562
+n3 lowbit 000000000000000000000000000000000000000000000001
+n4 zero 0000000000000000000000000000000000000000000000000000000000000000
+n4 max aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+n4 topbit0 f844444444444444444444444444444444444444444444444444444444444444
+n4 unit 000000000000000000000000000000000000000000000000000000000000000a
+n4 tie 0000000000000000000000000000000000000000000000000000000000000a0d
+n4 mixed 0e04480636ced888a0688e20142a7e6c2aec8ac47c481e6684c6442052ccdca6
+n4 asym fcd23edc54743ed23a947c56943e9ab83a96bc16547c56943e9ab83a96bc1654
+n4 lowbit 0000000000000000000000000000000000000000000000000000000000000003
+n5 zero 00000000000000000000000000000000000000000000000000000000000000000000000000000000
+n5 max ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5ad6b5
+n5 topbit0 fc108421084210842108421084210842108421084210842108421084210842108421084210842108
+n5 unit 00000000000000000000000000000000000000000000000000000000000000000000000000000015
+n5 tie 0000000000000000000000000000000000000000000000000000000000000000000000000000541a
+n5 mixed 0f0183c8df970eab0bf7d87586fddb2263e65e35d488645b43dd0e8c92b3c1e4652cd11ece26b677
+n5 asym fe0aab4507ecab681c836dab410fdd1f07ee0f83ff07c21c871eb26c0fdd2917692f5dff07c21c87
+n5 lowbit 00000000000000000000000000000000000000000000000000000000000000000000000000000007
+n6 zero 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n6 max aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+n6 topbit0 fe0410410410410410410410410410410410410410410410410410410410410410410410410410410410410410410410
+n6 unit 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a
+n6 tie 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a035
+n6 mixed 0b8feeda23e06c90e054366c32ef4cf08448a1f8de5255fac96f7492acee7cf85a5f54fa03c558b323c4d913d4d11546
+n6 asym ff02cac841fc1b6d7449c45003e0466a85ec0bec4859276ec04efa08ed7449c45003e0466a85ec0bec4859276ec04efa
+n6 lowbit 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f
+n7 zero 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n7 max ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5ab56ad5
+n7 topbit0 ff01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020
+n7 unit 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055
+n7 tie 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000154056
+n7 mixed 0bc7fdcdb2d089745031e34d314d2d40d88d4132f3109e562a066d7be4dcde2ad855fd67d3350272a645a26b7cc7be84bf6eb64745a4f467
+n7 asym ff80beab529757effdfd059485050fcf88edd80e1d9b6e3d83828b6937bfffc24aaa2972769ca508007fc6b55da8d8880fea14a92205027b
+n7 lowbit 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001
+n8 zero 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n8 max aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+n8 topbit0 ff804040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040
+n8 unit 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000aa
+n8 tie 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000aa00ad
+n8 mixed 0ae2feb8dae8024c920ecc1ea668dab6d2723046aeda3c1088f6b2c23894ba98ae2698b240deaa986072d688529628e60880c86ca0bc2ce422a03c40a83a5c94
+n8 asym ffc02fd4ca0a040010142aaababe8038269a56b2743ad81c16f6d6d8222a0a76a85c922ec6c4644c5696dadc02069aa4586c321ad6d432240406e222ded838e4
+n8 lowbit 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003
+"""
+
+# The interleave loop out of cluster_zorder_key in src/columnar_vacuum.c, run at commit
+# e84a5e5 on 2026-09-08 BEFORE the refactor. A frozen record of the shipped bytes.
+GOLDEN_ZORDER = """
+n1 zero 0000000000000000
+n1 max ffffffffffffffff
+n1 topbit0 8000000000000000
+n1 unit 0000000000000001
+n1 tie 0000000000000004
+n1 mixed 0123456789abcdef
+n1 asym f0f0f0f0f0f0f0f0
+n1 lowbit 0000000000000001
+n2 zero 00000000000000000000000000000000
+n2 max ffffffffffffffffffffffffffffffff
+n2 topbit0 80000000000000000000000000000000
+n2 unit 00000000000000000000000000000003
+n2 tie 00000000000000000000000000000032
+n2 mixed 0407181b3437686bc4c7d8dbf4f7a8ab
+n2 asym bf40bf40bf40bf40bf40bf40bf40bf40
+n2 lowbit 00000000000000000000000000000001
+n3 zero 000000000000000000000000000000000000000000000000
+n3 max ffffffffffffffffffffffffffffffffffffffffffffffff
+n3 topbit0 800000000000000000000000000000000000000000000000
+n3 unit 000000000000000000000000000000000000000000000007
+n3 tie 0000000000000000000000000000000000000000000001c6
+n3 mixed 0500570e80ef39039772872fe50e57ee8eefd90d9792892f
+n3 asym 9bf6409bf6409bf6409bf6409bf6409bf6409bf6409bf640
+n3 lowbit 000000000000000000000000000000000000000000000001
+n4 zero 0000000000000000000000000000000000000000000000000000000000000000
+n4 max ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+n4 topbit0 8000000000000000000000000000000000000000000000000000000000000000
+n4 unit 000000000000000000000000000000000000000000000000000000000000000f
+n4 tie 0000000000000000000000000000000000000000000000000000000000000f0e
+n4 mixed 0350035f16a016af3c503c5f79a079aff350f35fe6a0e6afcc50cc5f89a089af
+n4 asym 8cef73108cef73108cef73108cef73108cef73108cef73108cef73108cef7310
+n4 lowbit 0000000000000000000000000000000000000000000000000000000000000001
+n5 zero 00000000000000000000000000000000000000000000000000000000000000000000000000000000
+n5 max ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+n5 topbit0 80000000000000000000000000000000000000000000000000000000000000000000000000000000
+n5 unit 0000000000000000000000000000000000000000000000000000000000000000000000000000001f
+n5 tie 00000000000000000000000000000000000000000000000000000000000000000000000000007c1e
+n5 mixed 099400995f1b2a01b2bf3e5403e55f7cea07cebff1940f195fe32a0e32bfc6540c655f84ea084ebf
+n5 asym 8639e79c618639e79c618639e79c618639e79c618639e79c618639e79c618639e79c618639e79c61
+n5 lowbit 00000000000000000000000000000000000000000000000000000000000000000000000000000001
+n6 zero 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n6 max ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+n6 topbit0 800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n6 unit 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f
+n6 tie 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f03e
+n6 mixed 0cc5400cc57f1d9a801d9abf3f35403f357f7a6a807a6abff0c540f0c57fe19a80e19abfc33540c3357f866a80866abf
+n6 asym 830e3c78f1c3870e3c78f1c3870e3c78f1c3870e3c78f1c3870e3c78f1c3870e3c78f1c3870e3c78f1c3870e3c78f1c3
+n6 lowbit 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001
+n7 zero 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n7 max ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+n7 topbit0 8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n7 unit 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f
+n7 tie 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fc07e
+n7 mixed 0e655000e6557f1ecea801eceaff3d995003d9957f7932a807932afff065500f06557fe0cea80e0ceaffc399500c39957f8732a808732aff
+n7 asym 8183878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787
+n7 lowbit 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001
+n8 zero 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n8 max ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+n8 topbit0 80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+n8 unit 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff
+n8 tie 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00fe
+n8 mixed 0f3355000f3355ff1e66aa001e66aaff3ccc55003ccc55ff7899aa007899aafff0335500f03355ffe166aa00e166aaffc3cc5500c3cc55ff8799aa008799aaff
+n8 asym 80c0e0f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f87c3e1f0783c1e0f
+n8 lowbit 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001
+"""
+
+
+def _table(text):
+    return {(int(n[1:]), v): h for n, v, h in (l.split() for l in text.strip().splitlines())}
+
+
+HILBERT = _table(GOLDEN_HILBERT)
+ZORDER = _table(GOLDEN_ZORDER)
+
+# The C side: stub headers so src/columnar_curve.c compiles with no server tree, and a
+# driver that encodes and counts. It asserts nothing; the interface pin makes a changed
+# signature a build failure under -Werror=incompatible-pointer-types.
+STUB = """#ifndef PGC_STUB_POSTGRES_H
+#define PGC_STUB_POSTGRES_H
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+typedef int8_t int8; typedef uint8_t uint8; typedef int16_t int16; typedef uint16_t uint16;
+typedef int32_t int32; typedef uint32_t uint32; typedef int64_t int64; typedef uint64_t uint64;
+#define Assert(p) ((void) 0)
+#define StaticAssertDecl(c, m) extern int pgc_stub_sa_dummy
+#define palloc(sz) malloc(sz)
+#define palloc0(sz) calloc(1, (sz))
+#define pfree(p) free(p)
+#define pg_attribute_unused()
+#endif
+"""
+DRIVER = """#include "postgres.h"
+#include "columnar_curve.h"
+static void (*const pin_transpose) (uint64 *, int) = cluster_hilbert_transpose;
+static void (*const pin_pack) (const uint64 *, int, unsigned char *) = cluster_pack_interleave;
+static long calls = 0;
+long hc_calls(void) { (void) pin_transpose; (void) pin_pack; return calls; }
+/* npoints ordinal vectors of ncols words each -> npoints Hilbert keys of 8*ncols bytes */
+void hc_hilbert(const uint64 *ord, long npoints, int ncols, unsigned char *out)
+{
+	long p; uint64 X[8];
+	for (p = 0; p < npoints; p++)
+	{
+		memcpy(X, ord + p * ncols, sizeof(uint64) * ncols);
+		memset(out + p * ncols * 8, 0xa5, (size_t) ncols * 8);
+		cluster_hilbert_transpose(X, ncols);
+		cluster_pack_interleave(X, ncols, out + p * ncols * 8);
+		calls++;
+	}
+}
+void hc_pack(const uint64 *ord, int ncols, unsigned char *out) { cluster_pack_interleave(ord, ncols, out); }
+"""
+# Every key region is filled with 0xa5 before the pack writes it, as the shell's pk()
+# does, so a byte the pack never establishes reads 0xa5 in both harnesses. And every
+# buffer has GUARD bytes of slack: a pack that writes past its key must redden the C5
+# tail arms, not corrupt the heap and take the run down with no name at all.
+
+
+def _vec(which, ncols):
+    """The eight golden ordinal vectors, per ncols."""
+    out = []
+    for j in range(ncols):
+        if which == "zero":
+            out.append(0)
+        elif which == "max":
+            out.append(U64)
+        elif which == "topbit0":
+            out.append(1 << 63 if j == 0 else 0)
+        elif which == "unit":
+            out.append(1)
+        elif which == "tie":
+            out.append(4 if j == ncols - 1 else 5)
+        elif which == "mixed":
+            s, r = 0x0123456789ABCDEF, (8 * j) & 63
+            out.append(((s << r) | (s >> (64 - r))) & U64 if r else s)
+        elif which == "asym":
+            out.append(0xF0F0F0F0F0F0F0F0 >> j)
+        else:
+            out.append(1 if j == ncols - 1 else 0)
+    return out
+
+
+def _pack_py(ords):
+    """The interleave, in Python: ord[0].bit63, ord[1].bit63, ..., MSB first."""
+    v = 0
+    for r in range(63, -1, -1):
+        for o in ords:
+            v = (v << 1) | ((o >> r) & 1)
+    return v.to_bytes(8 * len(ords), "big")
+
+
+def _unpack_py(key, n):
+    """The transpose a full-width key carries: the interleave run backwards."""
+    v, X = int.from_bytes(key, "big"), [0] * n
+    for t in range(64 * n):
+        X[t % n] |= ((v >> (64 * n - 1 - t)) & 1) << (63 - t // n)
+    return X
+
+
+def _untranspose(X, n, mutate=False):
+    """Skilling's TransposetoAxes at b = 64, transcribed from the published listing,
+    not derived from the code under test. `mutate` drops the Gray-decode fold into
+    X[0]: the negative control, under which every round trip must break."""
+    X = list(X)
+    t = X[n - 1] >> 1
+    for i in range(n - 1, 0, -1):
+        X[i] ^= X[i - 1]
+    if not mutate:
+        X[0] ^= t
+    Q = 2
+    while Q != (1 << 64):
+        P = Q - 1
+        for i in range(n - 1, -1, -1):
+            if X[i] & Q:
+                X[0] ^= P
+            else:
+                t = (X[0] ^ X[i]) & P
+                X[0] ^= t
+                X[i] ^= t
+        Q <<= 1
+    return X
+
+
+# ---- the checkers, shared by the controls and the code under test ------------
+
+def _props(idx, keys, ncols, b, want=(True, True, True)):
+    """-> (c1, c2, c3) violation counts over the whole point space of one case.
+
+    idx[p] is the index point p's key carries; keys[p] is the key itself, sorted with
+    bytes comparison (memcmp) for C2. C1 counts out-of-range indices, repeats and
+    unhit indices together. C2 walks memcmp order and looks at the POINT
+    COORDINATES, which the sort cannot manufacture. C3: see the module docstring."""
+    N = 1 << (ncols * b)
+    c1 = c2 = c3 = None
+    if want[0]:
+        cnt = collections.Counter(idx)
+        inrange = sum(1 for k in cnt if k < N)
+        c1 = sum(c for k, c in cnt.items() if k >= N) + (sum(c for k, c in cnt.items() if k < N) - inrange) \
+            + (N - inrange)
+    mask = (1 << b) - 1
+    if want[1]:
+        order = sorted(range(N), key=keys.__getitem__)
+        bad = 0
+        for a, z in zip(order, order[1:]):
+            d = z - a if z > a else a - z
+            lo = a if a < z else z
+            s = d.bit_length() - 1
+            # unit-adjacent: exactly one column moved by one, with no carry out of it
+            if d != (1 << s) or s % b or ((lo >> s) & mask) == mask:
+                bad += 1
+        c2 = bad
+    if want[2]:
+        perm = c1 == 0 if c1 is not None else len(set(idx)) == N and max(idx) < N
+        if perm:
+            # one run per sub-cube at every level, counted from the levels each
+            # consecutive pair shares
+            byidx = [0] * N
+            for p, i in enumerate(idx):
+                byidx[i] = p
+            shared = collections.Counter()
+            for a, z in zip(byidx, byidx[1:]):
+                x, lv = a ^ z, b
+                for j in range(ncols):
+                    f = (x >> (j * b)) & mask
+                    if f:
+                        lv = min(lv, b - f.bit_length())
+                shared[lv] += 1
+            c3, below = 0, 0
+            for L in range(1, b + 1):
+                below += shared[L - 1]
+                c3 += (1 + below) - (1 << (ncols * L))
+        else:
+            # the shell's own form: max - min + 1 == count, per sub-cube
+            c3 = 0
+            for L in range(1, b + 1):
+                mn, mx, ct = {}, {}, collections.Counter()
+                for p, i in enumerate(idx):
+                    k = 0
+                    for j in range(ncols):
+                        k = (k << L) | (((p >> ((ncols - 1 - j) * b)) & mask) >> (b - L))
+                    mn[k] = min(mn.get(k, i), i)
+                    mx[k] = max(mx.get(k, i), i)
+                    ct[k] += 1
+                c3 += sum(1 for k in ct if mx[k] - mn[k] + 1 != ct[k])
+    return c1, c2, c3
+
+
+def _coords(p, ncols, b):
+    mask = (1 << b) - 1
+    return [(p >> ((ncols - 1 - j) * b)) & mask for j in range(ncols)]
+
+
+# ---- the controls: two wrong curves and a truncating one ---------------------
+
+def _serpentine(c, b):
+    M, idx, rev = (1 << b) - 1, 0, 0
+    for x in c:
+        v = M - x if rev else x
+        idx = (idx << b) | v
+        rev = v & 1
+    return idx
+
+
+def _zorder(c, b):
+    idx = 0
+    for r in range(b - 1, -1, -1):
+        for x in c:
+            idx = (idx << 1) | ((x >> r) & 1)
+    return idx
+
+
+def _controls():
+    """-> every reading the INSTRUMENT arms take, by the shell's arithmetic."""
+    r = collections.Counter()
+    calls = cases = points = 0
+    for ncols, b in CASES:
+        N, nb = 1 << (ncols * b), ncols * b
+        cases += 1
+        pts = [_coords(p, ncols, b) for p in range(N)]
+        points += len(pts)
+        serp = [_serpentine(c, b) for c in pts]
+        zord = [_zorder(c, b) for c in pts]
+        trunc = [i & ~1 for i in serp]
+        calls += len(serp) + len(zord) + len(trunc)
+        # the key an index-producing encoder packs to, MSB first, zeros below
+        s1, s2, s3 = _props(serp, serp, ncols, b)
+        z1, z2, z3 = _props(zord, zord, ncols, b)
+        t1, _, _ = _props(trunc, trunc, ncols, b, want=(True, False, False))
+        r["serp_c1"] += s1
+        r["serp_c2"] += s2
+        r["zord_c1"] += z1
+        r["zord_c3"] += z3
+        r["trunc_cases"] += 1
+        r["trunc_failed"] += t1 > 0
+        if ncols >= 2 and b >= 2:
+            r["serp_nested"] += 1
+            r["serp_nested_failed"] += s3 > 0
+        if ncols >= 2:
+            r["zord_multi"] += 1
+            r["zord_multi_failed"] += z2 > 0
+        del nb
+    zall = "".join(_pack_py(_vec(v, n)).hex() for n, v in GOLDEN)
+    return {
+        "INSTRUMENT C0 premise: the control battery encoded every case and every point":
+            f"{cases} cases, {points} points",
+        "INSTRUMENT C0 premise: the control encoders were called once per point": calls,
+        "INSTRUMENT the control's own pack reproduces the frozen Z-order bytes": zall,
+        "INSTRUMENT C1 control: the serpentine is a permutation of the index range": r["serp_c1"],
+        "INSTRUMENT C2 control: the serpentine PASSES unit-step adjacency": r["serp_c2"],
+        "INSTRUMENT C3 control: the serpentine FAILS dyadic contiguity in every nested case":
+            f"{r['serp_nested_failed']} of {r['serp_nested']}",
+        "INSTRUMENT C1 control: Z-order is a permutation of the index range": r["zord_c1"],
+        "INSTRUMENT C2 control: Z-order FAILS unit-step adjacency in every multi-column case":
+            f"{r['zord_multi_failed']} of {r['zord_multi']}",
+        "INSTRUMENT C3 control: Z-order PASSES dyadic contiguity": r["zord_c3"],
+        "INSTRUMENT C1 control: a truncating encoder FAILS the permutation test in every case":
+            f"{r['trunc_failed']} of {r['trunc_cases']}",
+    }
+
+
+# ---- building and calling the code under test ---------------------------------
+
+def _compiler(work):
+    """-> (cc, None) for a compiler that builds and runs a two-line program, or
+    (None, why)."""
+    cc = os.environ.get("CC") or next((c for c in ("gcc", "cc", "clang") if shutil.which(c)), None)
+    if not cc:
+        return None, "no C compiler"
+    (work / "smoke.c").write_text("int main(void){return 0;}\n")
+    try:
+        ok = subprocess.run([cc, "-o", str(work / "smoke"), str(work / "smoke.c")],
+                            capture_output=True).returncode == 0 and \
+            subprocess.run([str(work / "smoke")], capture_output=True).returncode == 0
+    except OSError:
+        ok = False
+    return (cc, None) if ok else (None, f"CC={cc} cannot build C")
+
+
+def _build(cc, work):
+    """-> the loaded library, or a query_error() saying why there is none."""
+    missing = [p.relative_to(ROOT).as_posix() for p in (CURVE_C, CURVE_H) if not p.is_file()]
+    if missing:
+        return query_error(f"the code under test is absent: {' '.join(missing)}")
+    (work / "postgres.h").write_text(STUB)
+    for h in ("c.h", "fmgr.h", "miscadmin.h", "postgres_ext.h", "utils/elog.h", "columnar.h",
+              "columnar_compat.h"):
+        (work / h).parent.mkdir(parents=True, exist_ok=True)
+        (work / h).write_text('#include "postgres.h"\n')
+    shutil.copy(CURVE_C, work)
+    shutil.copy(CURVE_H, work)
+    (work / "driver.c").write_text(DRIVER)
+    so = work / "libhc.so"
+    r = subprocess.run([cc, "-O2", "-Wall", "-Werror=incompatible-pointer-types", "-shared", "-fPIC",
+                        f"-I{work}", "-o", str(so), str(work / "driver.c"), str(work / "columnar_curve.c")],
+                       capture_output=True, text=True)
+    if r.returncode != 0:
+        return query_error(f"the battery would not build: {(r.stderr or r.stdout).strip()[:300]}")
+    try:
+        lib = ctypes.CDLL(str(so))
+    except OSError as exc:
+        return query_error(f"the battery would not load: {exc}")
+    lib.hc_calls.restype = ctypes.c_long
+    lib.hc_hilbert.argtypes = [ctypes.c_void_p, ctypes.c_long, ctypes.c_int, ctypes.c_void_p]
+    lib.hc_pack.argtypes = [ctypes.c_void_p, ctypes.c_int, ctypes.c_void_p]
+    return lib
+
+
+def _hilbert_keys(lib, ords, ncols):
+    """ords: a flat list of npoints*ncols ordinals -> the keys, one bytes per point."""
+    n = len(ords) // ncols
+    a = array.array("Q", ords)
+    out = ctypes.create_string_buffer(n * ncols * 8 + GUARD)
+    lib.hc_hilbert(a.buffer_info()[0], n, ncols, out)
+    w, raw = ncols * 8, out.raw
+    return [raw[i:i + w] for i in range(0, n * w, w)]
+
+
+def _pack(lib, ords, size=None, fill=0xa5):
+    """The pack alone, into a buffer of `size` bytes (default: the key) filled with
+    `fill`, plus GUARD bytes of slack. -> the `size` bytes."""
+    size = size or len(ords) * 8
+    a = array.array("Q", ords)
+    out = ctypes.create_string_buffer(bytes([fill]) * (size + GUARD), size + GUARD)
+    lib.hc_pack(a.buffer_info()[0], len(ords), out)
+    return out.raw[:size]
+
+
+def _battery(lib):
+    """-> every reading the battery arms take, by the shell's names."""
+    r = {}
+    rnd = random.Random(889)
+
+    # C1, C2, C3 over every case, every point
+    cases = points = c1 = c2 = c3 = 0
+    base = {}
+    for ncols, b in CASES:
+        N, nb = 1 << (ncols * b), ncols * b
+        ords = []
+        for p in range(N):
+            ords.extend(c << (64 - b) for c in _coords(p, ncols, b))
+        keys = _hilbert_keys(lib, ords, ncols)
+        cases += 1
+        points += len(keys)
+        idx = [int.from_bytes(k, "big") >> (64 * ncols - nb) for k in keys]
+        a1, a2, a3 = _props(idx, keys, ncols, b)
+        c1, c2, c3 = c1 + a1, c2 + a2, c3 + a3
+        if ncols >= 2:
+            base[(ncols, b)] = (ords, idx)
+    r["C0 premise: the battery encoded every case and every point"] = f"{cases} cases, {points} points"
+    r["C0 premise: the encoder was called once per point"] = lib.hc_calls()
+    r["C1 the Hilbert index set is exactly the contiguous range"] = c1
+    r["C2 consecutive points in memcmp key order are unit-adjacent"] = c2
+    r["C3 every dyadic sub-cube occupies a contiguous run of indices"] = c3
+
+    # C4a: the same points with the low 64-b bits filled with noise
+    mism = permbad = cases = points = 0
+    for (ncols, b), (ords, idx) in base.items():
+        N, nb, low = 1 << (ncols * b), ncols * b, (1 << (64 - b)) - 1
+        noisy = [o | (rnd.getrandbits(64) & low) for o in ords]
+        keys = _hilbert_keys(lib, noisy, ncols)
+        cases += 1
+        points += len(keys)
+        ixf = [int.from_bytes(k, "big") >> (64 * ncols - nb) for k in keys]
+        mism += sum(1 for x, y in zip(idx, ixf) if x != y)
+        permbad += _props(ixf, None, ncols, b, want=(True, False, False))[0]
+    r["C4a premise: the bridge covered every case and every point"] = f"{cases} cases, {points} points"
+    r["C4a the full-width key prefix does not move when the low bits change"] = mism
+    r["C4a the full-width key prefixes are exactly the index range"] = permbad
+
+    # C4b: 3,000 random full-width keys per ncols, through the published inverse
+    distinct = trips = tripbad = mutbad = adj = adjre = adjbad = 0
+    for ncols in NCOLS:
+        w = ncols * 8
+        ks = [rnd.randbytes(w) for _ in range(3000)]
+        distinct += len(set(ks))
+        for key in ks:
+            T = _unpack_py(key, ncols)
+            A0 = _untranspose(T, ncols)
+            trips += 1
+            ok0 = _hilbert_keys(lib, A0, ncols)[0] == key
+            tripbad += not ok0
+            mutbad += _hilbert_keys(lib, _untranspose(T, ncols, mutate=True), ncols)[0] != key
+            v = int.from_bytes(key, "big") + 1
+            if v >> (8 * w):
+                continue  # wrapped past the last index: not a pair
+            key2 = v.to_bytes(w, "big")
+            A1 = _untranspose(_unpack_py(key2, ncols), ncols)
+            ok1 = _hilbert_keys(lib, A1, ncols)[0] == key2
+            adj += 1
+            if not (ok0 and ok1):
+                continue
+            adjre += 1
+            diffs = [abs(x - y) for x, y in zip(A0, A1) if x != y]
+            adjbad += not (len(diffs) == 1 and diffs[0] == 1)
+    r["C4b premise: 3,000 DISTINCT full-width keys per ncols were round-tripped"] = distinct
+    r["C4b the published inverse round-trips full-width keys"] = tripbad
+    r["C4b control: a mutated inverse breaks every round trip the clean one made"] = \
+        f"clean {tripbad} bad, mutated {mutbad} of {trips}"
+    r["C4b premise: consecutive key pairs were formed"] = adj
+    r["C4b consecutive keys decode to unit-adjacent points, re-encoded by the code under test"] = \
+        f"{adjbad} bad over {adjre} re-encoded of {adj} pairs"
+
+    # C5: goldens, the pack's bit order, its extent and its content
+    for n, v in GOLDEN:
+        r[f"golden {n} {v}"] = _hilbert_keys(lib, _vec(v, n), n)[0].hex()
+    r["C5 the pack bit order: pack(2^63, 0) starts 0x80"] = _pack(lib, [1 << 63, 0]).hex()
+    r["C5 the pack bit order: pack(0, 2^63) starts 0x40"] = _pack(lib, [0, 1 << 63]).hex()
+    for n in NCOLS:
+        a = _pack(lib, _vec("mixed", n), 200, 0x00)
+        z = _pack(lib, _vec("mixed", n), 200, 0xff)
+        r[f"len {n}"] = next((i for i in range(200) if a[i] != z[i]), 200)
+        r[f"tail {n}"] = "intact" if a[8 * n:] == bytes(200 - 8 * n) and z[8 * n:] == b"\xff" * (200 - 8 * n) \
+            else "clobbered"
+        o = _pack(lib, _vec("max", n), 200, 0x00)
+        nff = next((i for i in range(200) if o[i] != 0xff), 200)
+        r[f"ones {n}"] = f"{nff} of {8 * n} ff, tail {'intact' if o[8 * n:] == bytes(200 - 8 * n) else 'clobbered'}"
+
+    # C6: ncols == 1 is the identity
+    for nm, x in (("0", 0), ("1", 1), ("2^63", 1 << 63), ("UINT64_MAX", U64)):
+        r[f"C6 ncols == 1 is the big-endian ordinal: {nm}"] = _hilbert_keys(lib, [x], 1)[0].hex()
+    xs = [rnd.getrandbits(64) for _ in range(200000)]
+    kh = _hilbert_keys(lib, xs, 1)
+    r["C6 premise: the comparison loop ran 200,000 times"] = len(kh)
+    r["C6 ncols == 1 is the big-endian ordinal over 200,000 random values"] = \
+        sum(1 for x, k in zip(xs, kh) if k != x.to_bytes(8, "big"))
+    r["C6 ncols == 1 agrees with Z-order over 200,000 random values"] = \
+        sum(1 for x, k in zip(xs, kh) if k != _pack(lib, [x]))
+
+    # C7: the Z-order pack
+    for n, v in GOLDEN:
+        r[f"zorder {n} {v}"] = _pack(lib, _vec(v, n)).hex()
+    return r
+
+
+@pytest.fixture(scope="module")
+def hc(tmp_path_factory):
+    work = tmp_path_factory.mktemp("hilbert")
+    cc, why = _compiler(work)
+    if cc is None:
+        return {"why": why}
+    lib = _build(cc, work)
+    out = {"why": None, "controls": _controls()}
+    if isinstance(lib, str):
+        out["failed"] = lib
+    else:
+        out["battery"] = _battery(lib)
+    return out
+
+
+def _control(hc, expect, name):
+    """-> the instrument reading, or None after declining (no compiler, as the shell)."""
+    if hc["why"]:
+        expect.cannot_run("MISSING_DEPENDENCY", hc["why"], name=name)
+        return None
+    return hc["controls"][name]
+
+
+def _reading(hc, expect, name, key=None):
+    """-> the battery reading under `key` (default: the name), a query_error() when the
+    battery could not run, or None after declining for want of a compiler."""
+    if hc["why"]:
+        expect.cannot_run("MISSING_DEPENDENCY", hc["why"], name=name)
+        return None
+    if "failed" in hc:
+        return hc["failed"]
+    return hc["battery"][key or name]
+
+
+def _skip(v):
+    return v is None
+
+
+# ---- the instrument -------------------------------------------------------------
+
+def test_hilbert_instrument_control_battery_covered_every_point(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C0 premise: the control battery encoded every case and every point")
+    if not _skip(v):
+        expect.text(v, "52 cases, 6344330 points",
+                    "INSTRUMENT C0 premise: the control battery encoded every case and every point")
+
+
+def test_hilbert_instrument_control_encoders_called_once_per_point(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C0 premise: the control encoders were called once per point")
+    if not _skip(v):
+        expect.num(v, 19032990, "INSTRUMENT C0 premise: the control encoders were called once per point")
+
+
+def test_hilbert_instrument_control_pack_is_the_frozen_zorder(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT the control's own pack reproduces the frozen Z-order bytes")
+    if not _skip(v):
+        expect.text(v, "".join(ZORDER[k] for k in GOLDEN),
+                    "INSTRUMENT the control's own pack reproduces the frozen Z-order bytes")
+
+
+def test_hilbert_instrument_serpentine_is_a_permutation(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C1 control: the serpentine is a permutation of the index range")
+    if not _skip(v):
+        expect.num(v, 0, "INSTRUMENT C1 control: the serpentine is a permutation of the index range")
+
+
+def test_hilbert_instrument_serpentine_passes_adjacency(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C2 control: the serpentine PASSES unit-step adjacency")
+    if not _skip(v):
+        expect.num(v, 0, "INSTRUMENT C2 control: the serpentine PASSES unit-step adjacency")
+
+
+def test_hilbert_instrument_serpentine_fails_contiguity(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C3 control: the serpentine FAILS dyadic contiguity in every nested case")
+    if not _skip(v):
+        expect.text(v, "25 of 25",
+                    "INSTRUMENT C3 control: the serpentine FAILS dyadic contiguity in every nested case")
+
+
+def test_hilbert_instrument_zorder_is_a_permutation(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C1 control: Z-order is a permutation of the index range")
+    if not _skip(v):
+        expect.num(v, 0, "INSTRUMENT C1 control: Z-order is a permutation of the index range")
+
+
+def test_hilbert_instrument_zorder_fails_adjacency(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C2 control: Z-order FAILS unit-step adjacency in every multi-column case")
+    if not _skip(v):
+        expect.text(v, "32 of 32",
+                    "INSTRUMENT C2 control: Z-order FAILS unit-step adjacency in every multi-column case")
+
+
+def test_hilbert_instrument_zorder_passes_contiguity(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C3 control: Z-order PASSES dyadic contiguity")
+    if not _skip(v):
+        expect.num(v, 0, "INSTRUMENT C3 control: Z-order PASSES dyadic contiguity")
+
+
+def test_hilbert_instrument_truncation_fails_permutation(hc, expect):
+    v = _control(hc, expect, "INSTRUMENT C1 control: a truncating encoder FAILS the permutation test in every case")
+    if not _skip(v):
+        expect.text(v, "52 of 52",
+                    "INSTRUMENT C1 control: a truncating encoder FAILS the permutation test in every case")
+
+
+# ---- C0 to C4 -------------------------------------------------------------------
+
+def test_hilbert_battery_covered_every_point(hc, expect):
+    v = _reading(hc, expect, "C0 premise: the battery encoded every case and every point")
+    if not _skip(v):
+        expect.text(v, "52 cases, 6344330 points", "C0 premise: the battery encoded every case and every point")
+
+
+def test_hilbert_encoder_called_once_per_point(hc, expect):
+    v = _reading(hc, expect, "C0 premise: the encoder was called once per point")
+    if not _skip(v):
+        expect.num(v, 6344330, "C0 premise: the encoder was called once per point")
+
+
+def test_hilbert_index_set_is_the_contiguous_range(hc, expect):
+    v = _reading(hc, expect, "C1 the Hilbert index set is exactly the contiguous range")
+    if not _skip(v):
+        expect.num(v, 0, "C1 the Hilbert index set is exactly the contiguous range")
+
+
+def test_hilbert_memcmp_order_is_unit_adjacent(hc, expect):
+    v = _reading(hc, expect, "C2 consecutive points in memcmp key order are unit-adjacent")
+    if not _skip(v):
+        expect.num(v, 0, "C2 consecutive points in memcmp key order are unit-adjacent")
+
+
+def test_hilbert_dyadic_subcubes_are_contiguous(hc, expect):
+    v = _reading(hc, expect, "C3 every dyadic sub-cube occupies a contiguous run of indices")
+    if not _skip(v):
+        expect.num(v, 0, "C3 every dyadic sub-cube occupies a contiguous run of indices")
+
+
+def test_hilbert_bridge_covered_every_point(hc, expect):
+    v = _reading(hc, expect, "C4a premise: the bridge covered every case and every point")
+    if not _skip(v):
+        expect.text(v, "32 cases, 4247180 points", "C4a premise: the bridge covered every case and every point")
+
+
+def test_hilbert_full_width_prefix_ignores_low_bits(hc, expect):
+    v = _reading(hc, expect, "C4a the full-width key prefix does not move when the low bits change")
+    if not _skip(v):
+        expect.num(v, 0, "C4a the full-width key prefix does not move when the low bits change")
+
+
+def test_hilbert_full_width_prefixes_are_the_index_range(hc, expect):
+    v = _reading(hc, expect, "C4a the full-width key prefixes are exactly the index range")
+    if not _skip(v):
+        expect.num(v, 0, "C4a the full-width key prefixes are exactly the index range")
+
+
+def test_hilbert_distinct_full_width_keys_round_tripped(hc, expect):
+    v = _reading(hc, expect, "C4b premise: 3,000 DISTINCT full-width keys per ncols were round-tripped")
+    if not _skip(v):
+        expect.num(v, 24000, "C4b premise: 3,000 DISTINCT full-width keys per ncols were round-tripped")
+
+
+def test_hilbert_published_inverse_round_trips(hc, expect):
+    v = _reading(hc, expect, "C4b the published inverse round-trips full-width keys")
+    if not _skip(v):
+        expect.num(v, 0, "C4b the published inverse round-trips full-width keys")
+
+
+def test_hilbert_mutated_inverse_breaks_every_round_trip(hc, expect):
+    v = _reading(hc, expect, "C4b control: a mutated inverse breaks every round trip the clean one made")
+    if not _skip(v):
+        expect.text(v, "clean 0 bad, mutated 24000 of 24000",
+                    "C4b control: a mutated inverse breaks every round trip the clean one made")
+
+
+def test_hilbert_consecutive_key_pairs_were_formed(hc, expect):
+    v = _reading(hc, expect, "C4b premise: consecutive key pairs were formed")
+    if not _skip(v):
+        expect.num(v, 24000, "C4b premise: consecutive key pairs were formed")
+
+
+def test_hilbert_consecutive_keys_decode_to_neighbours(hc, expect):
+    v = _reading(hc, expect, "C4b consecutive keys decode to unit-adjacent points, re-encoded by the code under test")
+    if not _skip(v):
+        expect.text(v, "0 bad over 24000 re-encoded of 24000 pairs",
+                    "C4b consecutive keys decode to unit-adjacent points, re-encoded by the code under test")
+
+
+# ---- C5: goldens, bit order, extent and content ----------------------------------
+
+@pytest.mark.parametrize("n,v", GOLDEN)
+def test_hilbert_golden_key(hc, expect, n, v):
+    got = _reading(hc, expect, f"C5 golden Hilbert keys: ncols={n} {v}", f"golden {n} {v}")
+    if not _skip(got):
+        expect.text(got, HILBERT[(n, v)], f"C5 golden Hilbert keys: ncols={n} {v}")
+
+
+def test_hilbert_pack_bit_order_column_zero(hc, expect):
+    v = _reading(hc, expect, "C5 the pack bit order: pack(2^63, 0) starts 0x80")
+    if not _skip(v):
+        expect.text(v, "80000000000000000000000000000000", "C5 the pack bit order: pack(2^63, 0) starts 0x80")
+
+
+def test_hilbert_pack_bit_order_column_one(hc, expect):
+    v = _reading(hc, expect, "C5 the pack bit order: pack(0, 2^63) starts 0x40")
+    if not _skip(v):
+        expect.text(v, "40000000000000000000000000000000", "C5 the pack bit order: pack(0, 2^63) starts 0x40")
+
+
+@pytest.mark.parametrize("n", NCOLS)
+def test_hilbert_pack_extent(hc, expect, n):
+    v = _reading(hc, expect, f"C5 the pack establishes exactly 8*ncols bytes: ncols={n}", f"len {n}")
+    if not _skip(v):
+        expect.num(v, 8 * n, f"C5 the pack establishes exactly 8*ncols bytes: ncols={n}")
+
+
+@pytest.mark.parametrize("n", NCOLS)
+def test_hilbert_pack_tail_untouched(hc, expect, n):
+    v = _reading(hc, expect, f"C5 the pack wrote nothing past the key: ncols={n}", f"tail {n}")
+    if not _skip(v):
+        expect.text(v, "intact", f"C5 the pack wrote nothing past the key: ncols={n}")
+
+
+@pytest.mark.parametrize("n", NCOLS)
+def test_hilbert_pack_sets_every_bit_of_all_ones(hc, expect, n):
+    v = _reading(hc, expect, f"C5 the pack sets every bit of the key for an all-ones vector: ncols={n}",
+                 f"ones {n}")
+    if not _skip(v):
+        expect.text(v, f"{8 * n} of {8 * n} ff, tail intact",
+                    f"C5 the pack sets every bit of the key for an all-ones vector: ncols={n}")
+
+
+# ---- C6: ncols == 1 ---------------------------------------------------------------
+
+def test_hilbert_one_column_zero(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 is the big-endian ordinal: 0")
+    if not _skip(v):
+        expect.text(v, "0000000000000000", "C6 ncols == 1 is the big-endian ordinal: 0")
+
+
+def test_hilbert_one_column_one(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 is the big-endian ordinal: 1")
+    if not _skip(v):
+        expect.text(v, "0000000000000001", "C6 ncols == 1 is the big-endian ordinal: 1")
+
+
+def test_hilbert_one_column_top_bit(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 is the big-endian ordinal: 2^63")
+    if not _skip(v):
+        expect.text(v, "8000000000000000", "C6 ncols == 1 is the big-endian ordinal: 2^63")
+
+
+def test_hilbert_one_column_all_ones(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 is the big-endian ordinal: UINT64_MAX")
+    if not _skip(v):
+        expect.text(v, "ffffffffffffffff", "C6 ncols == 1 is the big-endian ordinal: UINT64_MAX")
+
+
+def test_hilbert_one_column_loop_ran(hc, expect):
+    v = _reading(hc, expect, "C6 premise: the comparison loop ran 200,000 times")
+    if not _skip(v):
+        expect.num(v, 200000, "C6 premise: the comparison loop ran 200,000 times")
+
+
+def test_hilbert_one_column_is_big_endian_over_random_values(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 is the big-endian ordinal over 200,000 random values")
+    if not _skip(v):
+        expect.num(v, 0, "C6 ncols == 1 is the big-endian ordinal over 200,000 random values")
+
+
+def test_hilbert_one_column_agrees_with_zorder(hc, expect):
+    v = _reading(hc, expect, "C6 ncols == 1 agrees with Z-order over 200,000 random values")
+    if not _skip(v):
+        expect.num(v, 0, "C6 ncols == 1 agrees with Z-order over 200,000 random values")
+
+
+# ---- C7: the Z-order pack ---------------------------------------------------------
+
+@pytest.mark.parametrize("n,v", GOLDEN)
+def test_hilbert_zorder_pack_unchanged(hc, expect, n, v):
+    got = _reading(hc, expect, f"C7 the Z-order pack is byte-for-byte what it was: ncols={n} {v}",
+                   f"zorder {n} {v}")
+    if not _skip(got):
+        expect.text(got, ZORDER[(n, v)], f"C7 the Z-order pack is byte-for-byte what it was: ncols={n} {v}")
diff --git a/test/pytest/test_iceberg_deletes.py b/test/pytest/test_iceberg_deletes.py
new file mode 100644
index 000000000..532045b5e
--- /dev/null
+++ b/test/pytest/test_iceberg_deletes.py
@@ -0,0 +1,561 @@
+"""Iceberg row-level deletes (#388 phases 4a position + 4b equality, phase 5 partition
+scope): iceberg_scan reads a table whose current snapshot carries delete files and drops
+the deleted rows. The pytest twin of `test/iceberg_deletes.sh`, every check by the
+shell's name (#1341).
+
+The fixture is hand-crafted (test/fixtures/iceberg/warehouse_del): real pyarrow data
+and delete Parquet files, manifests with exact sequence numbers so both ordering rules
+(position: data_seq <= delete_seq; equality: data_seq < delete_seq) sit on testable
+boundaries, and an oracle of the surviving rows. The warehouse is relocated so its
+recorded root differs from where it lies.
+
+Asserted: position deletes, sequence ordering and inheritance, per-file scoping, the
+ordinal-0 control; equality deletes (the strict boundary, multi-column AND, extra
+columns, null matching, unions, mixed with position deletes, unprojected columns);
+partition-scoped equality deletes; thirteen corrupt or unsupported snapshots refused,
+each by its own guard; and no backend dies on the way.
+
+HOW A REFUSAL IS READ. Several guards share a SQLSTATE (XX001, 22023), so a refusal
+counts only when its message is that guard's own. A refusal reads as its SQLSTATE,
+"<SQLSTATE> (another refusal: ...)", "no error", or a query_error() when the server
+could not be asked.
+
+HOW SURVIVAL IS READ. A fresh connection answers again after crash recovery, so
+"SELECT 1" alone passed with a backend killed by a refusal arm (abort() in place of the
+null-pos refusal; the partition spec's fields guard removed, which segfaults). Each
+survival check also requires that the server log's count of backends terminated by a
+signal has not moved since its section began. Every reading first waits, bounded, for
+the server to answer, so a crash reds its own arm and its section's survival check, not
+the arms after it.
+
+ON A PRIVATE DATABASE, with the warehouse copied into `server_dir`, because the backend
+reads it. Where the fixture is missing the first test fails under the shell's pgc_skip
+message, and the rest decline.
+"""
+import json
+import pathlib
+import shutil
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+DB = "pgc_iceberg_deletes"
+FX = pathlib.Path(__file__).resolve().parents[1] / "fixtures" / "iceberg"
+WHD = FX / "warehouse_del"
+COLS = "AS t(id bigint, region text, amount int)"
+PCOLS = "AS t(id bigint, region text, grp int)"
+EQ_APPLIED = ("eqapply", "eqboundary", "eqmulti", "eqextra", "eqnull", "eqtwo", "eqmixed")
+# each refusal's own guard, by the phrase its message carries
+PHRASE = {
+    "nullpos": "has a null pos",
+    "negpos": "has a negative pos",
+    "eqnoids": "has no equality_ids",
+    "eqpart_datanospec": "carries no partition_spec_id, which a partition-scoped",
+    "eqpart_incomparable": "has a partition tuple this reader cannot compare",
+    "eqtype": "is not supported",
+    "eqmissing": "no Parquet column has field id",
+    "eqescape": "is not under the table location",
+    "eqdotdot": "escapes the table location",
+    "eqbigid": "corrupt Avro manifest entry",
+    "eqnospec": "the manifest list carries no partition_spec_id",
+    "eqnofields": "has no fields array",
+    "badseq": "has no sequence number",
+}
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return "" if row is None or row[0] is None else row[0]
+
+
+def _await_up(dsn):
+    """Wait, at most 60 s, until the server answers, as the shell's await_up: a refusal
+    that kills a backend sends the server through crash recovery, and the next readings
+    would otherwise red as collateral, by timing. _survived() still counts the crash."""
+    for _ in range(120):
+        if _value(dsn, "SELECT 1") == 1:
+            return
+        time.sleep(0.5)
+
+
+def _read(dsn, sql):
+    _await_up(dsn)
+    return _value(dsn, sql)
+
+
+def _refusal(dsn, sql, phrase):
+    """-> the SQLSTATE when sql is refused with phrase in its primary message, the
+    SQLSTATE with the other guard's message, "no error", or query_error()."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        msg = exc.diag.message_primary or ""
+        return exc.sqlstate if phrase in msg else f"{exc.sqlstate} (another refusal: {msg})"
+    return "no error"
+
+
+def _names(dsn, sql, phrase):
+    """-> "1" when sql's refusal message carries phrase, "0" when it does not, as the
+    shell's grep -c over errmsg_of; query_error() when the server could not be asked."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        return "1" if phrase in (exc.diag.message_primary or "") else "0"
+    return "0"
+
+
+def _crashes(cluster):
+    try:
+        return (cluster.datadir / "server.log").read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, cluster, before):
+    _await_up(dsn)
+    up, now = _value(dsn, "SELECT 1"), _crashes(cluster)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == 1 and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+@pytest.fixture(scope="module")
+def dl(pgc_cluster, server_dir):
+    if not (WHD / "db" / "t" / "metadata" / "apply.metadata.json").is_file():
+        yield None
+        return
+    dest = server_dir / "del"
+    shutil.copytree(WHD / "db", dest / "db")
+    for p in [dest, *dest.rglob("*")]:
+        p.chmod(0o777 if p.is_dir() else 0o666)
+    mdir = dest / "db" / "t" / "metadata"
+    oracle = json.loads((WHD / "expected_deletes.json").read_text())
+
+    def md(name):
+        return mdir / (name + ".metadata.json")
+
+    def scan(name, cols=COLS):
+        return f"SELECT * FROM pgcolumnar.iceberg_scan('{md(name)}') {cols}"
+
+    def ids(name, cols=COLS):
+        return f"SELECT string_agg(id::text, ',' ORDER BY id) FROM pgcolumnar.iceberg_scan('{md(name)}') {cols}"
+
+    def count(name, where="", cols=COLS):
+        return f"SELECT count(*) FROM pgcolumnar.iceberg_scan('{md(name)}') {cols} {where}"
+
+    admin = pgc_cluster.dsn()
+    with psycopg.connect(admin, autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    try:
+        dsn = pgc_cluster.dsn(dbname=DB)
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        r = {
+            "oracle": "\n".join("%d|%s|%d" % (o["id"], o["region"], o["amount"]) for o in oracle["surviving"]),
+            "eq oracle": {k: ",".join(str(i) for i in v) for k, v in oracle["eq_surviving"].items()},
+            "part oracle": {k: ",".join(str(i) for i in v) for k, v in oracle["part_surviving"].items()},
+        }
+        # the shell's order, section by section, each with its own crash baseline
+        r["data rows"] = _read(dsn, f"SELECT count(*) FROM pgcolumnar.read_parquet("
+                                    f"'{dest / 'db' / 't' / 'data' / 'data.parquet'}') {COLS}")
+        r["apply rows"] = _read(dsn, f"SELECT string_agg(id || '|' || region || '|' || amount, E'\\n' ORDER BY id) "
+                                     f"FROM pgcolumnar.iceberg_scan('{md('apply')}') {COLS}")
+        r["apply gone"] = _read(dsn, count("apply", "WHERE id IN (2,4)"))
+        r["apply count"] = _read(dsn, count("apply"))
+        r["apply projected"] = _read(dsn, f"SELECT string_agg(id::text, ',' ORDER BY id) "
+                                          f"FROM pgcolumnar.iceberg_scan('{md('apply')}') AS t(id bigint)")
+        r["noapply count"] = _read(dsn, count("noapply"))
+        r["noapply kept"] = _read(dsn, count("noapply", "WHERE id IN (2,4)"))
+        r["inherit count"] = _read(dsn, count("inherit"))
+        r["wrongpath count"] = _read(dsn, count("wrongpath"))
+        before = _crashes(pgc_cluster)
+        r["nullpos"] = _refusal(dsn, scan("nullpos"), PHRASE["nullpos"])
+        r["nullpos names"] = _names(dsn, scan("nullpos"), "null pos")
+        r["up after nullpos"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        r["negpos"] = _refusal(dsn, scan("negpos"), PHRASE["negpos"])
+        r["negpos names"] = _names(dsn, scan("negpos"), "negative pos")
+        r["up after negpos"] = _survived(dsn, pgc_cluster, before)
+        r["zeropos"] = _read(dsn, ids("zeropos"))
+        before = _crashes(pgc_cluster)
+        for name in EQ_APPLIED:
+            r[name] = _read(dsn, ids(name))
+            if name == "eqnull":
+                r["eqnull nulls"] = _read(dsn, count("eqnull", "WHERE region IS NULL"))
+        r["eq unprojected"] = _read(dsn, f"SELECT string_agg(amount::text, ',' ORDER BY amount) "
+                                         f"FROM pgcolumnar.iceberg_scan('{md('eqapply')}') AS t(amount int)")
+        r["up after eq applications"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        r["eqnoids"] = _refusal(dsn, scan("eqnoids"), PHRASE["eqnoids"])
+        r["equality count"] = _read(dsn, count("equality"))
+        r["eqpart_apply"] = _read(dsn, ids("eqpart_apply", PCOLS))
+        r["eqpart_apply us"] = _read(dsn, count("eqpart_apply", "WHERE region = 'us'", PCOLS))
+        r["eqpart_nomatch"] = _read(dsn, count("eqpart_nomatch", "", PCOLS))
+        r["eqpart_datanospec"] = _refusal(dsn, scan("eqpart_datanospec", PCOLS), PHRASE["eqpart_datanospec"])
+        r["eqpart_crossspec"] = _read(dsn, count("eqpart_crossspec", "", PCOLS))
+        r["eqpart_incomparable"] = _refusal(dsn, scan("eqpart_incomparable", PCOLS), PHRASE["eqpart_incomparable"])
+        r["eqtype"] = _refusal(dsn, scan("eqtype"), PHRASE["eqtype"])
+        r["eqtype names"] = _names(dsn, scan("eqtype"), "type")
+        r["eqmissing"] = _refusal(dsn, scan("eqmissing"), PHRASE["eqmissing"])
+        r["eqescape"] = _refusal(dsn, scan("eqescape"), PHRASE["eqescape"])
+        r["eqescape names"] = _names(dsn, scan("eqescape"), "table location")
+        r["eqdotdot"] = _refusal(dsn, scan("eqdotdot"), PHRASE["eqdotdot"])
+        r["up after eq refusals"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        r["eqbigid"] = _refusal(dsn, scan("eqbigid"), PHRASE["eqbigid"])
+        r["eqnospec"] = _refusal(dsn, scan("eqnospec"), PHRASE["eqnospec"])
+        r["eqnofields"] = _refusal(dsn, scan("eqnofields"), PHRASE["eqnofields"])
+        r["eqstaletype count"] = _read(dsn, count("eqstaletype"))
+        r["v1seq count"] = _read(dsn, count("v1seq"))
+        r["up after audit"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        r["badseq"] = _refusal(dsn, scan("badseq"), PHRASE["badseq"])
+        r["up after badseq"] = _survived(dsn, pgc_cluster, before)
+        yield r
+    finally:
+        with psycopg.connect(admin, autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def _declined(dl, expect):
+    if dl is not None:
+        return False
+    expect.cannot_run("ABSENT_FIXTURE", "the delete fixture is missing")
+    return True
+
+
+# ---- position deletes ------------------------------------------------------------
+
+def test_iceberg_deletes_the_data_file_has_five_rows(dl, expect):
+    if dl is None:
+        expect.text("missing", "present", "delete fixture is missing")
+        return
+    expect.require_module("json", name="python3 is needed")
+    expect.text(str(dl["data rows"]), "5", "the data file has 5 rows before deletes")
+
+
+def test_position_deletes_drop_the_listed_rows(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["apply rows"]), dl["oracle"], "position deletes drop the listed rows (surviving == oracle)")
+
+
+def test_position_deleted_ids_are_gone(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["apply gone"]), "0", "the deleted ids (2, 4) are gone")
+
+
+def test_position_deletes_remove_exactly_two_rows(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["apply count"]), "3", "exactly the two deleted rows were removed (5 - 2 = 3)")
+
+
+def test_position_deletes_apply_under_projection(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["apply projected"]), "1,3,5",
+                "position deletes apply under column projection (id only -> 1,3,5)")
+
+
+def test_a_position_delete_older_than_the_data_does_not_apply(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["noapply count"]), "5", "a delete older than the data (lower seq) does not apply (5 rows)")
+
+
+def test_older_position_delete_leaves_its_ids(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["noapply kept"]), "2",
+                "the would-be-deleted ids survive when the delete is older than the data")
+
+
+def test_a_position_delete_inherits_a_null_sequence_number(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["inherit count"]), "3",
+                "a position delete with an inherited (null-entry) sequence number applies")
+
+
+def test_a_position_delete_naming_another_file_deletes_nothing(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["wrongpath count"]), "5",
+                "a position delete naming a different data file deletes nothing (5 rows)")
+
+
+def test_a_null_pos_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["nullpos"]), "XX001", "a position delete with a null pos is refused (XX001, not silently dropped)")
+
+
+def test_the_null_pos_refusal_names_pos(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["nullpos names"]), "1", "...and the null-pos refusal names pos")
+
+
+def test_the_backend_survives_the_null_pos_refusal(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after nullpos"]), "1", "backend still up after the null-pos refusal")
+
+
+def test_a_negative_pos_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["negpos"]), "XX001", "a position delete with a negative pos is refused (XX001, not cast inert)")
+
+
+def test_the_negative_pos_refusal_names_it(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["negpos names"]), "1", "...and the negative-pos refusal names the negative pos")
+
+
+def test_the_backend_survives_the_negative_pos_refusal(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after negpos"]), "1", "backend still up after the negative-pos refusal")
+
+
+def test_a_position_delete_of_ordinal_zero_deletes_the_first_row(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["zeropos"]), "2,3,4,5",
+                "a position delete of ordinal 0 deletes the first row (id 1 gone, 4 remain)")
+
+
+# ---- equality deletes --------------------------------------------------------------
+
+def test_an_equality_delete_drops_matching_rows(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqapply"]), dl["eq oracle"]["eqapply"], "equality delete drops matching rows (survivors == oracle)")
+
+
+def test_an_equality_delete_at_an_equal_sequence_does_not_apply(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqboundary"]), dl["eq oracle"]["eqboundary"],
+                "an equality delete at an equal sequence number does not apply")
+
+
+def test_multi_column_equality_is_an_and(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqmulti"]), dl["eq oracle"]["eqmulti"], "multi-column equality matches all columns (AND, not OR)")
+
+
+def test_columns_beyond_equality_ids_are_ignored(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqextra"]), dl["eq oracle"]["eqextra"], "columns beyond equality_ids are ignored for matching")
+
+
+def test_a_null_equality_value_matches_only_nulls(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqnull"]), dl["eq oracle"]["eqnull"], "a null delete value matches only null data values")
+
+
+def test_the_null_region_row_is_gone(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqnull nulls"]), "0", "the null-region row is gone, the non-null rows remain")
+
+
+def test_multiple_equality_delete_files_apply_their_union(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqtwo"]), dl["eq oracle"]["eqtwo"], "multiple equality-delete files apply their union")
+
+
+def test_position_and_equality_deletes_combine(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqmixed"]), dl["eq oracle"]["eqmixed"], "position and equality deletes combine")
+
+
+def test_equality_deletes_apply_to_an_unprojected_column(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eq unprojected"]), "10,30,50",
+                "equality deletes apply when the delete column is not projected")
+
+
+def test_the_backend_survives_the_equality_applications(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after eq applications"]), "1", "backend still up after the equality applications")
+
+
+# ---- equality refusals and partition scope ----------------------------------------
+
+def test_an_equality_delete_without_equality_ids_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqnoids"]), "XX001", "an equality delete without equality_ids is refused (XX001)")
+
+
+def test_a_never_applicable_equality_delete_without_ids_is_skipped(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["equality count"]), "5",
+                "a never-applicable equality delete without equality_ids is skipped (5 rows)")
+
+
+def test_a_partition_scoped_equality_delete_stays_in_its_partition(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_apply"]), dl["part oracle"]["eqpart_apply"],
+                "a partition-scoped equality delete applies only to its partition")
+
+
+def test_the_us_partition_survives_an_eu_scoped_delete(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_apply us"]), "3", "the us-partition rows survive an eu-scoped delete")
+
+
+def test_a_delete_scoped_to_an_empty_partition_deletes_nothing(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_nomatch"]), "5", "a delete scoped to an empty partition deletes nothing (5 rows)")
+
+
+def test_a_data_file_without_partition_spec_id_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_datanospec"]), "XX001",
+                "a data file lacking partition_spec_id is refused under a partitioned delete (XX001)")
+
+
+def test_a_cross_spec_partition_delete_applies_to_nothing(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_crossspec"]), "5", "a cross-spec partition-scoped delete applies to nothing (5 rows)")
+
+
+def test_an_uncomparable_partition_value_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqpart_incomparable"]), "0A000",
+                "a partition-scoped delete with an uncomparable partition value is refused (0A000)")
+
+
+def test_an_equality_delete_on_an_unsupported_type_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqtype"]), "0A000", "an equality delete on an unsupported column type is refused (0A000)")
+
+
+def test_the_unsupported_type_refusal_names_the_type(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqtype names"]), "1", "...and the refusal names the type")
+
+
+def test_an_equality_column_missing_from_the_data_file_errors(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqmissing"]), "22023", "an equality column missing from the data file errors (22023)")
+
+
+def test_an_equality_delete_path_outside_the_table_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqescape"]), "22023", "an equality-delete path outside the table location is refused (22023)")
+
+
+def test_the_boundary_refusal_names_the_escape(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqescape names"]), "1", "...and the boundary refusal names the escape")
+
+
+def test_a_dotdot_escaping_delete_path_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqdotdot"]), "22023", "a dotdot-escaping delete path is refused (22023)")
+
+
+def test_the_backend_survives_the_equality_refusals(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after eq refusals"]), "1", "backend still up after the equality refusals")
+
+
+# ---- audit arms --------------------------------------------------------------------
+
+def test_an_equality_id_beyond_int32_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqbigid"]), "XX001", "an equality_ids value beyond int32 refuses the manifest (XX001)")
+
+
+def test_a_manifest_list_without_partition_spec_id_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqnospec"]), "XX001",
+                "a manifest list without partition_spec_id is refused for equality deletes (XX001)")
+
+
+def test_a_partition_spec_without_fields_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqnofields"]), "XX001", "a partition spec without its fields key is refused (XX001)")
+
+
+def test_a_never_applicable_equality_delete_is_not_validated(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["eqstaletype count"]), "5",
+                "a never-applicable equality delete is skipped, not validated (5 rows)")
+
+
+def test_a_v1_manifest_without_sequence_numbers_reads(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["v1seq count"]), "5", "a v1 manifest without a sequence_number column reads (default 0, 5 rows)")
+
+
+def test_the_backend_survives_the_delete_audit_arms(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after audit"]), "1", "backend still up after the audit arms")
+
+
+def test_an_existing_entry_with_a_null_sequence_number_is_refused(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["badseq"]), "XX001", "an EXISTING entry with a null sequence number is refused (XX001)")
+
+
+def test_the_backend_survives_the_bad_sequence_refusal(dl, expect):
+    if _declined(dl, expect):
+        return
+    expect.text(str(dl["up after badseq"]), "1", "backend still up after the bad-sequence refusal")
diff --git a/test/pytest/test_iceberg_dv.py b/test/pytest/test_iceberg_dv.py
new file mode 100644
index 000000000..795608f0c
--- /dev/null
+++ b/test/pytest/test_iceberg_dv.py
@@ -0,0 +1,344 @@
+"""Iceberg v3 deletion vectors (#388 phase 4c): iceberg_scan reads a table whose current
+snapshot carries Puffin deletion vectors and drops the rows they name. The pytest twin
+of `test/iceberg_dv.sh`, every check by the shell's name (#1341).
+
+The fixtures are hand-crafted (test/fixtures/iceberg/warehouse_del): pyroaring bitmaps
+in hand-built Puffin files, hand-encoded manifests, exact sequence numbers, and an
+oracle cross-checked against pyiceberg and DuckDB. The warehouse is relocated so its
+recorded root differs from where it lies.
+
+Asserted: eight snapshots read the oracle's surviving ids (the <= sequence boundary,
+supersede per data file, run, bitset and high-bucket containers, two blobs in one
+file); thirteen corrupt or unsupported snapshots are refused, each by its own guard;
+and no backend dies on the way.
+
+HOW A REFUSAL IS READ. Several guards raise XX001, so a refusal counts only when its
+message is that guard's own: with the manifest/footer offset match removed, a later
+XX001 refused the same file and the arm, reading the SQLSTATE alone, still passed. A
+refusal reads as its SQLSTATE, "<SQLSTATE> (another refusal: ...)", "no error", or a
+query_error() when the server could not be asked.
+
+HOW SURVIVAL IS READ. A fresh connection answers again after crash recovery, so
+"SELECT 1" alone passed with a backend killed by a refusal arm. Each survival check
+also requires that the server log's count of backends terminated by a signal has not
+moved since its section began.
+
+ON A PRIVATE DATABASE, with the warehouse copied into `server_dir`, because the backend
+reads it. Where the fixture is missing the first test fails under the shell's pgc_skip
+message, and the rest decline.
+"""
+import json
+import pathlib
+import shutil
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+DB = "pgc_iceberg_dv"
+FX = pathlib.Path(__file__).resolve().parents[1] / "fixtures" / "iceberg"
+WHD = FX / "warehouse_del"
+COLS = "AS t(id bigint, region text, amount int)"
+APPLIED = ("dvapply", "dvnoapply", "dvsupersede", "dvother", "dvwide", "dvrun", "dvbitset", "dvtwo")
+REFUSED = {
+    "dvdup": "two deletion vectors reference data file",
+    "dvbadcrc": "fails its CRC-32 check",
+    "dvbadmagic": "has a bad magic sequence",
+    "dvoffmismatch": "has no blob matching the manifest's offset",
+    "dvnoref": "has no referenced_data_file",
+    "dvbadcount": "positions but its manifest entry records",
+    "dvcompressed": "declares a compression codec",
+    "dvflags": "has a compressed Puffin footer",
+    "dvv2": "is a deletion vector, which format-version",
+    "dvescape": "is not under the table location",
+}
+AUDIT = {
+    "dvbigoff": "lies outside the file's blob region",
+    "dvrunoverflow": "overflows its 16-bit range",
+    "dvdupscheme": "two deletion vectors reference data file",
+}
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _value(dsn, sql):
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return "" if row is None or row[0] is None else row[0]
+
+
+def _await_up(dsn):
+    """Wait, at most 60 s, until the server answers, as the shell's await_up: a refusal
+    that kills a backend sends the server through crash recovery, and the next readings
+    would otherwise red as collateral, by timing. survived() still counts the crash."""
+    for _ in range(120):
+        if _value(dsn, "SELECT 1") == 1:
+            return
+        time.sleep(0.5)
+
+
+def _refusal(dsn, sql, phrase):
+    """-> the SQLSTATE when sql is refused with phrase in its primary message, the
+    SQLSTATE with the other guard's message, "no error", or query_error()."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        msg = exc.diag.message_primary or ""
+        return exc.sqlstate if phrase in msg else f"{exc.sqlstate} (another refusal: {msg})"
+    return "no error"
+
+
+def _names(dsn, sql, phrase):
+    """-> "1" when sql's refusal message carries phrase, "0" when it does not, as the
+    shell's grep -c over errmsg_of; query_error() when the server could not be asked."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        return "1" if phrase in (exc.diag.message_primary or "") else "0"
+    return "0"
+
+
+def _crashes(cluster):
+    try:
+        return (cluster.datadir / "server.log").read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, cluster, before):
+    up, now = _value(dsn, "SELECT 1"), _crashes(cluster)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == 1 and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+@pytest.fixture(scope="module")
+def dv(pgc_cluster, server_dir):
+    if not (WHD / "db" / "t" / "metadata" / "dvapply.metadata.json").is_file():
+        yield None
+        return
+    dest = server_dir / "dv"
+    shutil.copytree(WHD / "db", dest / "db")
+    for p in [dest, *dest.rglob("*")]:
+        p.chmod(0o777 if p.is_dir() else 0o666)
+    mdir = dest / "db" / "t" / "metadata"
+    oracle = json.loads((WHD / "expected_deletes.json").read_text())["dv_surviving"]
+
+    def scan(name):
+        return f"SELECT * FROM pgcolumnar.iceberg_scan('{mdir / (name + '.metadata.json')}') {COLS}"
+
+    admin = pgc_cluster.dsn()
+    with psycopg.connect(admin, autocommit=True) as a:
+        a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+        a.execute(f"CREATE DATABASE {DB}")
+    try:
+        dsn = pgc_cluster.dsn(dbname=DB)
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        r = {"oracle": {k: ",".join(str(i) for i in v) for k, v in oracle.items()}}
+        # the shell's order, section by section, each with its own crash baseline
+        before = _crashes(pgc_cluster)
+        for name in APPLIED:
+            r[name] = _value(dsn, f"SELECT string_agg(id::text, ',' ORDER BY id) FROM "
+                                  f"pgcolumnar.iceberg_scan('{mdir / (name + '.metadata.json')}') {COLS}")
+        r["up after applications"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        for name, phrase in REFUSED.items():
+            r[name] = _refusal(dsn, scan(name), phrase)
+            if name == "dvflags":
+                r["dvflags names"] = _names(dsn, scan(name), "compressed")
+            if name == "dvv2":
+                r["dvv2 names"] = _names(dsn, scan(name), "format-version")
+        r["up after refusals"] = _survived(dsn, pgc_cluster, before)
+        before = _crashes(pgc_cluster)
+        for name, phrase in AUDIT.items():
+            r[name] = _refusal(dsn, scan(name), phrase)
+        r["up after audit"] = _survived(dsn, pgc_cluster, before)
+        yield r
+    finally:
+        with psycopg.connect(admin, autocommit=True) as a:
+            a.execute(f"DROP DATABASE IF EXISTS {DB} WITH (FORCE)")
+
+
+def _declined(dv, expect):
+    if dv is not None:
+        return False
+    expect.cannot_run("ABSENT_FIXTURE", "the deletion-vector fixtures are missing")
+    return True
+
+
+def test_a_deletion_vector_at_an_equal_sequence_number_applies(dv, expect):
+    if dv is None:
+        expect.text("missing", "present", "deletion-vector fixtures are missing")
+        return
+    expect.require_module("json", name="python3 is needed")
+    expect.text(str(dv["dvapply"]), dv["oracle"]["dvapply"],
+                "a deletion vector at an equal sequence number applies (survivors == oracle)")
+
+
+def test_a_deletion_vector_older_than_the_data_does_not_apply(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvnoapply"]), dv["oracle"]["dvnoapply"], "a deletion vector older than the data does not apply")
+
+
+def test_an_applicable_dv_supersedes_position_delete_files(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvsupersede"]), dv["oracle"]["dvsupersede"],
+                "an applicable DV supersedes position-delete files for its data file")
+
+
+def test_dv_supersede_is_per_data_file_not_global(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvother"]), dv["oracle"]["dvother"], "supersede is per data file, not global")
+
+
+def test_a_dv_with_run_containers_and_a_high_bucket_decodes(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvwide"]), dv["oracle"]["dvwide"], "a DV with run containers and a high-bucket position decodes")
+
+
+def test_a_run_optimized_dv_decodes(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvrun"]), dv["oracle"]["dvrun"], "a run-optimized DV (cookie 12347) decodes")
+
+
+def test_a_bitset_container_dv_decodes(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvbitset"]), dv["oracle"]["dvbitset"], "a bitset-container DV decodes")
+
+
+def test_two_dv_blobs_in_one_puffin_file_each_apply_to_their_own_file(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvtwo"]), dv["oracle"]["dvtwo"],
+                "two DV blobs in one Puffin file each apply to their own data file")
+
+
+def test_the_backend_survives_the_dv_applications(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["up after applications"]), "1", "backend still up after the DV applications")
+
+
+def test_two_dv_entries_for_one_data_file_are_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvdup"]), "XX001", "two DV entries for one data file are refused (XX001)")
+
+
+def test_a_corrupted_dv_crc_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvbadcrc"]), "XX001", "a corrupted DV CRC is refused (XX001)")
+
+
+def test_a_wrong_dv_blob_magic_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvbadmagic"]), "XX001", "a wrong DV blob magic is refused (XX001)")
+
+
+def test_a_manifest_footer_offset_mismatch_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvoffmismatch"]), "XX001", "a manifest/footer offset mismatch is refused (XX001)")
+
+
+def test_a_dv_entry_without_referenced_data_file_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvnoref"]), "XX001", "a DV entry without referenced_data_file is refused (XX001)")
+
+
+def test_a_record_count_disagreeing_with_the_dv_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvbadcount"]), "XX001",
+                "a record_count that disagrees with the DV cardinality is refused (XX001)")
+
+
+def test_a_dv_blob_declaring_a_codec_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvcompressed"]), "XX001", "a DV blob declaring a compression codec is refused (XX001)")
+
+
+def test_a_compressed_puffin_footer_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvflags"]), "0A000", "a compressed Puffin footer is refused (0A000)")
+
+
+def test_the_footer_refusal_names_the_compressed_footer(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvflags names"]), "1", "...and the refusal names the compressed footer")
+
+
+def test_a_dv_in_a_format_version_2_table_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvv2"]), "0A000", "a deletion vector in a format-version 2 table is refused (0A000)")
+
+
+def test_the_v2_refusal_names_the_format_version(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvv2 names"]), "1", "...and the refusal names the format version")
+
+
+def test_a_puffin_path_outside_the_table_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvescape"]), "22023", "a Puffin path outside the table location is refused (22023)")
+
+
+def test_the_backend_survives_the_dv_refusals(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["up after refusals"]), "1", "backend still up after the DV refusals")
+
+
+def test_a_dv_whose_offset_plus_size_overflows_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvbigoff"]), "XX001", "a DV whose offset+size overflows int64 is refused, not read (XX001)")
+
+
+def test_a_run_container_overflowing_its_range_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvrunoverflow"]), "XX001", "a run container overflowing its 16-bit range is refused (XX001)")
+
+
+def test_an_aliased_duplicate_dv_is_refused(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["dvdupscheme"]), "XX001", "an aliased duplicate DV (scheme vs no scheme) is refused (XX001)")
+
+
+def test_the_backend_survives_the_audit_arms(dv, expect):
+    if _declined(dv, expect):
+        return
+    expect.text(str(dv["up after audit"]), "1", "backend still up after the audit arms")
diff --git a/test/pytest/test_iceberg_rest.py b/test/pytest/test_iceberg_rest.py
new file mode 100644
index 000000000..795f0f000
--- /dev/null
+++ b/test/pytest/test_iceberg_rest.py
@@ -0,0 +1,344 @@
+"""Iceberg REST Catalog client, 7a (#388 phase 7): the pytest twin of
+`test/iceberg_rest.sh`, every check by the shell's name (#1341).
+
+iceberg_rest_table_location(catalog, ns, table) resolves a table named by a REST
+catalog into its current metadata location, against the shell's own hermetic fixture
+(test/iceberg_rest_server.py), which verifies the Authorization: Bearer header. The
+token lives in the POSTMASTER ENVIRONMENT (PGCOLUMNAR_ICEBERG_REST_TOKEN), never in
+SQL, so it never reaches the server log or the catalog's request log. A wrong token
+and no token are refused 28000 by the catalog; an endpoint off the allow-list and a
+link-local host are refused 42501, each by its own guard (the message is read, since
+both raise 42501); an over-cap response is refused 54000, an unknown table 42P01 and
+a non-object config XX001, each by its own message.
+
+A BACKEND THAT DIED DOES NOT PASS AS ONE THAT SURVIVED: survival also reads the
+private cluster's server log for killed backends, and an unreadable log fails it.
+
+A PRIVATE CLUSTER, because the postmaster is restarted with the token in its
+environment, which the shared cluster cannot do. It starts with the token variable of
+this process removed. Without the object-store module the first test declines under
+the shell's pgc_skip message and the rest decline.
+"""
+import os
+import pathlib
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+TOKEN = "s3cr3t-rest-token-do-not-log"
+TOKEN_ENV = "PGCOLUMNAR_ICEBERG_REST_TOKEN"
+MDLOC = "file:///tmp/pgc_ice_rest/db/events/metadata/00001.metadata.json"
+LOC = "SELECT pgcolumnar.iceberg_rest_table_location('{}','db','{}')"
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _wait_up(dsn, seconds=30):
+    """Wait, bounded, for the server to answer, so a crash in one arm fails only that
+    arm and the survival check, not every reading taken during crash recovery."""
+    for _ in range(seconds * 2):
+        try:
+            with psycopg.connect(dsn, autocommit=True, connect_timeout=5) as conn:
+                conn.execute("SELECT 1")
+            return
+        except psycopg.Error:
+            time.sleep(0.5)
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    _wait_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    if row is None or row[0] is None:
+        return query_error(f"no value from {sql}")
+    return str(row[0])
+
+
+def _refusal(dsn, sql, phrase, label, setting=None):
+    """-> "<SQLSTATE><label>" when `sql` raised with `phrase` in its message, the bare
+    SQLSTATE when the message lacks it, or what happened instead. `setting` is SET on
+    the same session first."""
+    _wait_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            if setting:
+                conn.execute(setting)
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        return exc.sqlstate + (label if phrase in str(exc) else "")
+    return "no error"
+
+
+def _count(path, needle):
+    """-> how many lines of `path` hold `needle`, or a failed reading."""
+    try:
+        return sum(needle in line for line in pathlib.Path(path).read_text(errors="replace").splitlines())
+    except OSError as exc:
+        return query_error(f"{path} unreadable: {exc}")
+
+
+def _lines(path):
+    try:
+        return sum(1 for line in pathlib.Path(path).read_text(errors="replace").splitlines() if line)
+    except OSError as exc:
+        return query_error(f"{path} unreadable: {exc}")
+
+
+def _crashes(log):
+    try:
+        return pathlib.Path(log).read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, log, before):
+    up, now = _value(dsn, "SELECT 1"), _crashes(log)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == "1" and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+def _pg_ctl(cluster, args, extra_env):
+    """pg_ctl with an explicit environment: this process's token variable removed, then
+    `extra_env` added. Dropped to postgres when running as root, as the harness does."""
+    unset = ["-u", TOKEN_ENV] if TOKEN_ENV in os.environ else []
+    cmd = ["env"] + unset + [f"{k}={v}" for k, v in extra_env.items()] + \
+          [os.path.join(cluster.bindir, "pg_ctl")] + args
+    if os.geteuid() == 0:
+        cmd = ["runuser", "-u", "postgres", "--"] + cmd
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _restart(cluster, datadir, log, env):
+    """Restart with `env`; a start that fails is retried, as a transient port or lock
+    clash on a busy host should not read as every later arm failing. A start that never
+    succeeds leaves the readings to fail by name (connection refused)."""
+    _pg_ctl(cluster, ["-D", str(datadir), "-m", "fast", "-w", "stop"], {})
+    for _ in range(5):
+        if _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], env).returncode == 0:
+            return True
+        time.sleep(1)
+    return False
+
+
+def _rest_server(work, name, port, *args):
+    """Start the shell's REST fixture; -> (process, its READY count)."""
+    out = work / f"{name}.out"
+    proc = subprocess.Popen([sys.executable, str(TEST / "iceberg_rest_server.py"), "--port", str(port),
+                             "--log", str(work / f"{name}.log"), "--metadata-location", MDLOC, *args],
+                            stdout=open(out, "w"), stderr=subprocess.STDOUT)
+    for _ in range(50):
+        if out.is_file() and "READY" in out.read_text(errors="replace"):
+            break
+        time.sleep(0.1)
+    return proc, (out.read_text(errors="replace").count("READY") if out.is_file() else 0)
+
+
+def _objstore_installed(pg_config):
+    try:
+        lib = subprocess.run([pg_config, "--pkglibdir"], capture_output=True, text=True).stdout.strip()
+    except OSError:
+        return False
+    return bool(lib) and (pathlib.Path(lib) / "pgcolumnar_objstore.so").is_file()
+
+
+@pytest.fixture(scope="module")
+def ir(pgc_cluster):
+    if not _objstore_installed(pgc_cluster.pg_config):
+        yield None
+        return
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-icerest-"))
+    os.chmod(work, 0o777)
+    rest_port = pick_port(31)
+    srv, ready = _rest_server(work, "rest", rest_port, "--token", TOKEN,
+                              "--namespace", "db", "--table", "events")
+    cat = f"http://127.0.0.1:{rest_port}"
+    bad, bad_port = None, pick_port(32)
+    datadir = work / "data"
+    datadir.mkdir()
+    log = str(work / "server.log")
+    rest_log = str(work / "rest.log")
+    cluster = Cluster(pgc_cluster.pg_config, "icerest", datadir, pick_port(33))
+    r = {"server up": ready}
+    try:
+        cluster.initdb()
+        with open(datadir / "postgresql.conf", "a") as fh:
+            fh.write("\npgcolumnar.objstore_allowed_endpoints='127.0.0.1'\n")
+        started = _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], {})
+        if started.returncode != 0:
+            raise RuntimeError(f"the private cluster did not start: {started.stderr}")
+        dsn = cluster.dsn()
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        before = _crashes(log)
+
+        _restart(cluster, datadir, log, {TOKEN_ENV: TOKEN})
+        r["resolve"] = _value(dsn, LOC.format(cat, "events"))
+        r["auth header"] = _count(rest_log, "GET /v1/namespaces/db/tables/events AUTH=yes")
+
+        def run(*stmts):
+            _wait_up(dsn)
+            with psycopg.connect(dsn, autocommit=True) as c:
+                for s in stmts:
+                    c.execute(s)
+
+        run("ALTER SYSTEM SET log_statement='all'", "SELECT pg_reload_conf()")
+        _value(dsn, LOC.format(cat, "events"))
+        run("ALTER SYSTEM SET log_statement='none'", "SELECT pg_reload_conf()")
+        r["log lines"] = _lines(log)
+        r["token in pg log"] = _count(log, TOKEN)
+        r["token in rest log"] = _count(rest_log, TOKEN)
+
+        _restart(cluster, datadir, log, {TOKEN_ENV: "wrong-token"})
+        r["wrong token"] = _refusal(dsn, LOC.format(cat, "events"),
+                                    "the REST catalog refused the request", " by the catalog")
+        _restart(cluster, datadir, log, {})
+        r["anonymous"] = _refusal(dsn, LOC.format(cat, "events"),
+                                  "the REST catalog refused the request", " by the catalog")
+        _restart(cluster, datadir, log, {TOKEN_ENV: TOKEN})
+
+        r["off list"] = _refusal(dsn, LOC.format(f"http://127.0.0.2:{rest_port}", "events"),
+                                 "is not in pgcolumnar.objstore_allowed_endpoints", " by the allow-list",
+                                 "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1'")
+        r["link local"] = _refusal(dsn, LOC.format("http://169.254.169.254/", "events"),
+                                   "resolves into a link-local range", " by the link-local guard",
+                                   "SET pgcolumnar.objstore_allowed_endpoints='169.254.169.254'")
+        r["over cap"] = _refusal(dsn, LOC.format(cat, "toobig"), "exceeded", " by the cap",
+                                 "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1'")
+        r["unknown"] = _refusal(dsn, LOC.format(cat, "nosuch"), "the REST catalog has no such table",
+                                " by the catalog's 404", "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1'")
+        bad, _ = _rest_server(work, "badcfg", bad_port, "--bad-config")
+        r["bad config"] = _refusal(dsn, LOC.format(f"http://127.0.0.1:{bad_port}", "events"),
+                                   "config response is not a JSON object", " by the config guard",
+                                   "SET pgcolumnar.objstore_allowed_endpoints='127.0.0.1'")
+        bad.kill()
+        bad.wait()
+        bad = None
+        r["survived"] = _survived(dsn, log, before)
+        yield r
+    finally:
+        _pg_ctl(cluster, ["-D", str(datadir), "-m", "immediate", "-w", "stop"], {})
+        for p in (srv, bad):
+            if p is not None:
+                p.kill()
+                p.wait()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def _declined(ir, expect):
+    if ir is not None:
+        return False
+    expect.cannot_run("MISSING_DEPENDENCY", "the object-store module is not installed")
+    return True
+
+
+def test_the_rest_fixture_server_is_up(ir, expect):
+    """The shell skips the whole suite without python3 or the object-store module, under
+    these names."""
+    expect.require_module("json", name="python3 is needed")
+    if ir is None:
+        expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir",
+                          name="the object-store module is not installed")
+        return
+    expect.text(str(ir["server up"]), "1", "premise: rest fixture server is up")
+
+
+def test_loadtable_resolves_the_current_metadata_location(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["resolve"], MDLOC, "loadTable resolves the current metadata-location")
+
+
+def test_the_loadtable_request_carried_an_authorization_header(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(str(ir["auth header"]), "1", "the loadTable request carried an Authorization header")
+
+
+def test_the_rest_pg_server_log_holds_lines_to_search(ir, expect):
+    if _declined(ir, expect):
+        return
+    n = ir["log lines"]
+    expect.text("yes" if isinstance(n, int) and n > 0 else f"no ({n})", "yes",
+                "premise: the PG server log holds lines to search")
+
+
+def test_the_rest_token_never_appears_in_the_server_log(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(str(ir["token in pg log"]), "0", "the token never appears in the server (PG) log")
+
+
+def test_the_rest_token_never_appears_in_the_catalog_request_log(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(str(ir["token in rest log"]), "0", "the token value never appears in the catalog request log")
+
+
+def test_a_wrong_bearer_token_is_refused(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["wrong token"], "28000 by the catalog", "a wrong bearer token is refused (28000)")
+
+
+def test_an_anonymous_request_to_a_token_protected_catalog_is_refused(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["anonymous"], "28000 by the catalog",
+                "an anonymous request to a token-protected catalog is refused (28000)")
+
+
+def test_a_catalog_endpoint_off_the_allow_list_is_refused(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["off list"], "42501 by the allow-list", "a catalog endpoint off the allow-list is refused (42501)")
+
+
+def test_a_link_local_catalog_host_is_refused_even_if_allow_listed(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["link local"], "42501 by the link-local guard",
+                "a link-local catalog host is refused even if allow-listed (42501)")
+
+
+def test_an_over_cap_catalog_response_is_refused(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["over cap"], "54000 by the cap", "an over-cap catalog response is refused (54000)")
+
+
+def test_an_unknown_rest_table_surfaces_a_clean_not_found(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["unknown"], "42P01 by the catalog's 404", "an unknown table surfaces a clean not-found (42P01)")
+
+
+def test_a_non_object_catalog_config_is_refused(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["bad config"], "XX001 by the config guard",
+                "a non-object catalog config is refused, not walked (XX001)")
+
+
+def test_the_backend_is_still_up_after_the_rest_refusals(ir, expect):
+    if _declined(ir, expect):
+        return
+    expect.text(ir["survived"], "1", "backend still up after the REST refusals")
diff --git a/test/pytest/test_iceberg_rest_scan.py b/test/pytest/test_iceberg_rest_scan.py
new file mode 100644
index 000000000..7e9309936
--- /dev/null
+++ b/test/pytest/test_iceberg_rest_scan.py
@@ -0,0 +1,275 @@
+"""Iceberg REST catalog read and listing, 7b (#388 phase 7): the pytest twin of
+`test/iceberg_rest_scan.sh`, every check by the shell's name (#1341).
+
+iceberg_rest_scan(catalog, ns, table) must return the very rows iceberg_scan returns
+for the metadata location the catalog reports: the catalog changes how a table is
+NAMED, never its rows. The shell's own REST fixture (test/iceberg_rest_server.py),
+which verifies the Authorization: Bearer header, points loadTable at the committed
+warehouse, relocated into a work directory. Projection by field id flows through the
+REST path, namespaces and tables list, and an unknown table is the catalog's own 404
+(42P01, read by its message).
+
+A BACKEND THAT DIED DOES NOT PASS AS ONE THAT SURVIVED: survival also reads the
+private cluster's server log for killed backends, and an unreadable log fails it.
+
+A PRIVATE CLUSTER, because the postmaster is restarted with the bearer token in its
+environment (PGCOLUMNAR_ICEBERG_REST_TOKEN), which the shared cluster cannot do.
+Without the object-store module or the committed warehouse, the first test declines
+under the shell's pgc_skip message and the rest decline.
+"""
+import os
+import pathlib
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+WH = TEST / "fixtures" / "iceberg" / "warehouse"
+TOKEN = "rest-scan-token-shh"
+TOKEN_ENV = "PGCOLUMNAR_ICEBERG_REST_TOKEN"
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _wait_up(dsn, seconds=30):
+    """Wait, bounded, for the server to answer, so a crash in one arm fails only that
+    arm and the survival check, not every reading taken during crash recovery."""
+    for _ in range(seconds * 2):
+        try:
+            with psycopg.connect(dsn, autocommit=True, connect_timeout=5) as conn:
+                conn.execute("SELECT 1")
+            return
+        except psycopg.Error:
+            time.sleep(0.5)
+
+
+def _rows(dsn, sql):
+    """-> every row's first column joined by newlines, as the shell's q prints them, or
+    the failure as a query_error()."""
+    _wait_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            rows = conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    return "\n".join("" if r[0] is None else str(r[0]) for r in rows)
+
+
+def _refusal(dsn, sql, phrase, label):
+    """-> "<SQLSTATE><label>" when `sql` raised with `phrase` in its message, the bare
+    SQLSTATE when the message lacks it, or what happened instead."""
+    _wait_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        return exc.sqlstate + (label if phrase in str(exc) else "")
+    return "no error"
+
+
+def _crashes(log):
+    try:
+        return pathlib.Path(log).read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, log, before):
+    up, now = _rows(dsn, "SELECT 1"), _crashes(log)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == "1" and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+def _pg_ctl(cluster, args, extra_env):
+    """pg_ctl with an explicit environment: this process's token variable removed, then
+    `extra_env` added. Dropped to postgres when running as root, as the harness does."""
+    unset = ["-u", TOKEN_ENV] if TOKEN_ENV in os.environ else []
+    cmd = ["env"] + unset + [f"{k}={v}" for k, v in extra_env.items()] + \
+          [os.path.join(cluster.bindir, "pg_ctl")] + args
+    if os.geteuid() == 0:
+        cmd = ["runuser", "-u", "postgres", "--"] + cmd
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _restart(cluster, datadir, log, env):
+    """Restart with `env`; a start that fails is retried, as a transient port or lock
+    clash on a busy host should not read as every later arm failing. A start that never
+    succeeds leaves the readings to fail by name (connection refused)."""
+    _pg_ctl(cluster, ["-D", str(datadir), "-m", "fast", "-w", "stop"], {})
+    for _ in range(5):
+        if _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], env).returncode == 0:
+            return True
+        time.sleep(1)
+    return False
+
+
+def _objstore_installed(pg_config):
+    try:
+        lib = subprocess.run([pg_config, "--pkglibdir"], capture_output=True, text=True).stdout.strip()
+    except OSError:
+        return False
+    return bool(lib) and (pathlib.Path(lib) / "pgcolumnar_objstore.so").is_file()
+
+
+def _warehouse_present():
+    return any((WH / "db" / "events" / "data").glob("*/*.parquet"))
+
+
+@pytest.fixture(scope="module")
+def irs(pgc_cluster):
+    if not _objstore_installed(pgc_cluster.pg_config):
+        yield "objstore"
+        return
+    if not _warehouse_present():
+        yield "fixture"
+        return
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-icerestscan-"))
+    os.chmod(work, 0o777)
+    dest = work / "wh"
+    shutil.copytree(WH / "db", dest / "db")
+    for p in [dest, *dest.rglob("*")]:
+        p.chmod(0o777 if p.is_dir() else 0o666)
+    md = sorted((dest / "db" / "events" / "metadata").glob("*.metadata.json"))[-1]
+    mdloc = f"file://{md}"
+
+    rest_port = pick_port(34)
+    out = work / "rest_server.out"
+    srv = subprocess.Popen([sys.executable, str(TEST / "iceberg_rest_server.py"), "--port", str(rest_port),
+                            "--log", str(work / "rest.log"), "--token", TOKEN, "--namespace", "db",
+                            "--table", "events", "--metadata-location", mdloc],
+                           stdout=open(out, "w"), stderr=subprocess.STDOUT)
+    for _ in range(50):
+        if out.is_file() and "READY" in out.read_text(errors="replace"):
+            break
+        time.sleep(0.1)
+    cat = f"http://127.0.0.1:{rest_port}"
+
+    datadir = work / "data"
+    datadir.mkdir()
+    log = str(work / "server.log")
+    cluster = Cluster(pgc_cluster.pg_config, "icerestscan", datadir, pick_port(35))
+    r = {"server up": out.read_text(errors="replace").count("READY") if out.is_file() else 0, "mdloc": mdloc}
+    try:
+        cluster.initdb()
+        with open(datadir / "postgresql.conf", "a") as fh:
+            fh.write("\npgcolumnar.objstore_allowed_endpoints='127.0.0.1'\n")
+        started = _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], {})
+        if started.returncode != 0:
+            raise RuntimeError(f"the private cluster did not start: {started.stderr}")
+        dsn = cluster.dsn()
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        before = _crashes(log)
+        _restart(cluster, datadir, log, {TOKEN_ENV: TOKEN})
+
+        cols = "AS t(id bigint, region text, amount int)"
+        r["location"] = _rows(dsn, f"SELECT pgcolumnar.iceberg_rest_table_location('{cat}','db','events')")
+        r["direct"] = _rows(dsn, f"SELECT id || '|' || region || '|' || amount FROM pgcolumnar.iceberg_scan('{md}') "
+                                 f"{cols} ORDER BY id")
+        r["via rest"] = _rows(dsn, f"SELECT id || '|' || region || '|' || amount FROM "
+                                   f"pgcolumnar.iceberg_rest_scan('{cat}','db','events') {cols} ORDER BY id")
+        r["projected"] = _rows(dsn, f"SELECT amount || '|' || id FROM pgcolumnar.iceberg_rest_scan('{cat}','db','events') "
+                                    f"AS t(amount int, id bigint) ORDER BY id")
+        r["namespaces"] = _rows(dsn, f"SELECT string_agg(ns, ',' ORDER BY ns) "
+                                     f"FROM pgcolumnar.iceberg_rest_namespaces('{cat}') AS ns")
+        r["tables"] = _rows(dsn, f"SELECT string_agg(t, ',' ORDER BY t) "
+                                 f"FROM pgcolumnar.iceberg_rest_tables('{cat}','db') AS t")
+        r["unknown"] = _refusal(dsn, f"SELECT * FROM pgcolumnar.iceberg_rest_scan('{cat}','db','nosuch') AS t(id bigint)",
+                                "the REST catalog has no such table", " by the catalog's 404")
+        r["survived"] = _survived(dsn, log, before)
+        yield r
+    finally:
+        _pg_ctl(cluster, ["-D", str(datadir), "-m", "immediate", "-w", "stop"], {})
+        srv.kill()
+        srv.wait()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def _declined(irs, expect):
+    if isinstance(irs, dict):
+        return False
+    expect.cannot_run("MISSING_DEPENDENCY" if irs == "objstore" else "ABSENT_FIXTURE",
+                      "the object-store module is not installed" if irs == "objstore"
+                      else "iceberg warehouse data files are missing")
+    return True
+
+
+def test_the_rest_scan_fixture_server_is_up(irs, expect):
+    """The shell skips the whole suite without python3, the object-store module or the
+    committed warehouse, under these names."""
+    expect.require_module("json", name="python3 is needed")
+    if irs == "objstore":
+        expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir",
+                          name="the object-store module is not installed")
+        return
+    if irs == "fixture":
+        expect.cannot_run("ABSENT_FIXTURE", "the committed iceberg warehouse is not in this tree",
+                          name="iceberg warehouse data files are missing")
+        return
+    expect.text(str(irs["server up"]), "1", "premise: rest fixture server is up")
+
+
+def test_the_catalog_reports_the_relocated_metadata_location(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["location"], irs["mdloc"], "the catalog reports the relocated metadata location")
+
+
+def test_iceberg_rest_scan_returns_the_five_current_snapshot_rows(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["via rest"], "1|eu|10\n2|eu|20\n3|us|30\n4|us|40\n5|us|50",
+                "iceberg_rest_scan returns the five current-snapshot rows")
+
+
+def test_iceberg_rest_scan_matches_iceberg_scan_of_the_same_table(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["via rest"], irs["direct"],
+                "iceberg_rest_scan matches iceberg_scan of the same table (same oracle)")
+
+
+def test_iceberg_rest_scan_projects_and_reorders_by_field_id(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["projected"], "10|1\n20|2\n30|3\n40|4\n50|5",
+                "iceberg_rest_scan projects and reorders by field id (amount, id)")
+
+
+def test_iceberg_rest_namespaces_lists_the_catalogs_namespaces(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["namespaces"], "db", "iceberg_rest_namespaces lists the catalog's namespaces")
+
+
+def test_iceberg_rest_tables_lists_a_namespaces_tables(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["tables"], "events", "iceberg_rest_tables lists a namespace's tables")
+
+
+def test_iceberg_rest_scan_of_an_unknown_table_is_a_clean_not_found(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["unknown"], "42P01 by the catalog's 404",
+                "iceberg_rest_scan of an unknown table is a clean not-found (42P01)")
+
+
+def test_the_backend_is_still_up_after_the_rest_read(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["survived"], "1", "backend still up after the REST read")
diff --git a/test/pytest/test_iceberg_rest_server.py b/test/pytest/test_iceberg_rest_server.py
new file mode 100644
index 000000000..612e85bf4
--- /dev/null
+++ b/test/pytest/test_iceberg_rest_server.py
@@ -0,0 +1,538 @@
+"""Iceberg REST catalog FOREIGN SERVER and USER MAPPING credentials (#656): the pytest
+twin of `test/iceberg_rest_server.sh`, every check by the shell's name (#1341).
+
+The iceberg_rest_* functions accept a FOREIGN SERVER name in place of a catalog URI:
+the server holds catalog_uri (and optionally a warehouse, sent on GET /v1/config), and
+the current role's USER MAPPING holds the bearer token or an OAuth2 client credential,
+role-private and never a SQL argument or a log line. Against the shell's own REST
+fixture (test/iceberg_rest_server.py), which 401s a wrong or absent token and logs every
+request: a server-name call authenticates with the mapping token and with no token in
+the environment; the token and the OAuth2 client secret never reach the server log; a
+wrong token, a missing one, and a wrong OAuth2 secret are each refused by their own
+message; a half OAuth2 credential is refused before any request; secrets are rejected
+on a SERVER and catalog_uri on a USER MAPPING; an oauth_token_uri off the endpoint
+allow-list (link-local or any other host) is refused by the allow-list itself; the URI
+form works with the environment token; and a non-superuser never borrows the
+environment token unless a superuser marked its mapping credentials_required 'false'.
+
+A STATEMENT THAT RAN IS NOT A SERVER THAT DIDN'T ANSWER: an "accepted" arm reads "ok"
+only when the statement ran, and a failed connection fails it.
+
+A BACKEND THAT DIED DOES NOT PASS AS ONE THAT SURVIVED: survival also reads the private
+cluster's server log for killed backends, and every reading first waits for the server.
+
+A PRIVATE CLUSTER, because the postmaster is restarted without and then with the token
+in its environment, which the shared cluster cannot do; its roles and servers are its
+own. Every AWS_* variable of this process is removed before each start.
+"""
+import os
+import pathlib
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+TOKEN = "s3cr3t-mapping-token-xyz"
+MDLOC = "file:///tmp/pgc_rest/db/events/metadata/00001.metadata.json"
+OCID, OCSEC, OATOKEN = "client-abc", "s3cr3t-oauth-secret", "minted-bearer-777"
+LOCATE = "SELECT pgcolumnar.iceberg_rest_table_location('{}','db','events')"
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _dsn_as(dsn, role):
+    return dsn.replace("user=postgres", f"user={role}")
+
+
+def _await_up(dsn):
+    """Wait, at most 60 s, until the server answers, so a reading after a crash reads the
+    catalog rather than crash recovery. The crash itself is still caught: _survived counts it."""
+    for _ in range(120):
+        try:
+            with psycopg.connect(dsn, autocommit=True, connect_timeout=5) as conn:
+                conn.execute("SELECT 1")
+            return
+        except psycopg.Error:
+            time.sleep(0.5)
+
+
+def _value(dsn, sql):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    if row is None or row[0] is None:
+        return query_error(f"no value from {sql}")
+    return str(row[0])
+
+
+def _run(dsn, sql):
+    """Run a setup statement; a failure here shows in the readings that depend on it."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql)
+    except psycopg.Error:
+        pass
+
+
+def _sqlstate(dsn, sql):
+    """-> the SQLSTATE `sql` failed with, "ok" when it ran, or a query_error() when the
+    server could not be asked: a dead server is not a statement that was accepted."""
+    _await_up(dsn)
+    try:
+        conn = psycopg.connect(dsn, autocommit=True, connect_timeout=10)
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    try:
+        with conn:
+            conn.execute(sql)
+    except psycopg.Error as exc:
+        return exc.sqlstate or query_error(_message(exc))
+    return "ok"
+
+
+def _refusal(dsn, sql, phrase):
+    """-> the SQLSTATE when `sql` is refused with `phrase` in its message, "SQLSTATE
+    (another refusal: MESSAGE)" when something else refused it, or what happened instead.
+    28000 and 42501 each come from more than one guard here."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        msg = exc.diag.message_primary or ""
+        return exc.sqlstate if phrase in msg else f"{exc.sqlstate} (another refusal: {msg})"
+    return "no error"
+
+
+def _lines(path):
+    """-> the non-empty lines of `path`, or a query_error() when it can't be read."""
+    try:
+        return [l for l in pathlib.Path(path).read_text(errors="replace").splitlines() if l]
+    except OSError as exc:
+        return query_error(f"{path} unreadable: {exc}")
+
+
+def _count_in(path, needle):
+    lines = _lines(path)
+    return lines if isinstance(lines, str) else str(sum(1 for l in lines if needle in l))
+
+
+def _has_lines(path):
+    lines = _lines(path)
+    return lines if isinstance(lines, str) else ("yes" if lines else "no")
+
+
+def _nlines(path):
+    lines = _lines(path)
+    return lines if isinstance(lines, str) else len(lines)
+
+
+def _crashes(log):
+    try:
+        return pathlib.Path(log).read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, log, before):
+    up, now = _value(dsn, "SELECT 1"), _crashes(log)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == "1" and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+def _pg_ctl(cluster, args, extra_env):
+    """pg_ctl with an explicit environment: every AWS_* of this process removed, then
+    `extra_env` added. Dropped to postgres when running as root, as the harness does."""
+    unset = [a for k in os.environ if k.startswith("AWS_") for a in ("-u", k)]
+    unset += ["-u", "PGCOLUMNAR_ICEBERG_REST_TOKEN"]
+    cmd = ["env"] + unset + [f"{k}={v}" for k, v in extra_env.items()] + \
+          [os.path.join(cluster.bindir, "pg_ctl")] + args
+    if os.geteuid() == 0:
+        cmd = ["runuser", "-u", "postgres", "--"] + cmd
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _restart(cluster, datadir, log, env):
+    _pg_ctl(cluster, ["-D", str(datadir), "-m", "fast", "-w", "stop"], {})
+    return _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], env).returncode == 0
+
+
+def _ready(out):
+    for _ in range(50):
+        if out.is_file() and "READY" in out.read_text(errors="replace"):
+            return
+        time.sleep(0.1)
+
+
+def _module_installed(pg_config):
+    try:
+        lib = subprocess.run([pg_config, "--pkglibdir"], capture_output=True, text=True).stdout.strip()
+    except OSError:
+        return False
+    return (pathlib.Path(lib) / "pgcolumnar_objstore.so").is_file()
+
+
+def _set_log_statement(dsn, value):
+    with psycopg.connect(dsn, autocommit=True) as c:
+        c.execute(f"ALTER SYSTEM SET log_statement = '{value}'")
+        c.execute("SELECT pg_reload_conf()")
+
+
+@pytest.fixture(scope="module")
+def irs(pgc_cluster):
+    if not _module_installed(pgc_cluster.pg_config):
+        yield None
+        return
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-icesrv-"))
+    os.chmod(work, 0o777)
+    procs = []
+
+    def start_rest(log, *extra):
+        port = pick_port(33)
+        out = work / f"rest_{port}.out"
+        procs.append(subprocess.Popen(
+            [sys.executable, str(TEST / "iceberg_rest_server.py"), "--port", str(port), "--log", str(log),
+             "--namespace", "db", "--table", "events", "--metadata-location", MDLOC, *extra],
+            stdout=open(out, "w"), stderr=subprocess.STDOUT))
+        _ready(out)
+        return port, out
+
+    rest_log = work / "rest.log"
+    port, rest_out = start_rest(rest_log, "--token", TOKEN)
+    cat = f"http://127.0.0.1:{port}"
+    datadir = work / "data"
+    datadir.mkdir()
+    log = str(work / "server.log")
+    cluster = Cluster(pgc_cluster.pg_config, "icesrv", datadir, pick_port(34))
+    r = {"rest up": rest_out.read_text(errors="replace").count("READY") if rest_out.is_file() else 0}
+    try:
+        cluster.initdb()
+        # NO token in the environment: only a USER MAPPING can authenticate.
+        started = _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], {})
+        if started.returncode != 0:
+            try:
+                tail = "".join(pathlib.Path(log).read_text(errors="replace").splitlines(True)[-20:])
+            except OSError as exc:
+                tail = f"(server log unreadable: {exc})"
+            raise RuntimeError(f"the private cluster did not start: {started.stderr}\n{tail}")
+        dsn = cluster.dsn()
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+            c.execute("ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'")
+            c.execute("SELECT pg_reload_conf()")
+            c.execute(f"CREATE SERVER cat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog"
+                      f" OPTIONS (catalog_uri '{cat}')")
+            c.execute(f"CREATE USER MAPPING FOR postgres SERVER cat OPTIONS (token '{TOKEN}')")
+        before = _crashes(log)
+
+        # ---- a server-name call authenticates with the mapping token
+        r["mapping"] = _value(dsn, LOCATE.format("cat"))
+        r["auth header"] = _count_in(rest_log, "GET /v1/namespaces/db/tables/events AUTH=yes")
+
+        # ---- the mapping token never appears in the server log
+        _set_log_statement(dsn, "all")
+        _value(dsn, LOCATE.format("cat"))
+        _set_log_statement(dsn, "none")
+        r["log lines token"] = _has_lines(log)
+        r["token in log"] = _count_in(log, TOKEN)
+
+        # ---- a wrong mapping token, then none at all
+        _run(dsn, "ALTER USER MAPPING FOR postgres SERVER cat OPTIONS (SET token 'wrong-token')")
+        r["wrong token"] = _refusal(dsn, LOCATE.format("cat"), "refused the request (HTTP 401")
+        _run(dsn, "DROP USER MAPPING FOR postgres SERVER cat")
+        r["no token"] = _refusal(dsn, LOCATE.format("cat"), "refused the request (HTTP 401")
+        _run(dsn, f"CREATE USER MAPPING FOR postgres SERVER cat OPTIONS (token '{TOKEN}')")
+
+        # ---- validator: secrets only on a user mapping, uri only on a server
+        r["token on server"] = _sqlstate(dsn, "CREATE SERVER bad1 FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog"
+                                              f" OPTIONS (catalog_uri '{cat}', token 'x')")
+        r["uri on mapping"] = _sqlstate(dsn, "ALTER USER MAPPING FOR postgres SERVER cat OPTIONS (ADD catalog_uri 'x')")
+
+        # ---- #656: a warehouse server option is accepted and sent on GET /v1/config
+        r["warehouse"] = _sqlstate(dsn, "CREATE SERVER whcat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog"
+                                        f" OPTIONS (catalog_uri '{cat}', warehouse 'wh1')")
+        _run(dsn, f"CREATE USER MAPPING FOR postgres SERVER whcat OPTIONS (token '{TOKEN}')")
+        r["warehouse location"] = _value(dsn, LOCATE.format("whcat"))
+        r["warehouse sent"] = _count_in(rest_log, "GET /v1/config?warehouse=wh1 ")
+
+        # ---- OAuth2 client-credentials: mint a bearer, then use it
+        olog = work / "orest.log"
+        oport, _ = start_rest(olog, "--token", OATOKEN, "--oauth-client-id", OCID, "--oauth-client-secret", OCSEC)
+        ocat = f"http://127.0.0.1:{oport}"
+        _run(dsn, f"CREATE SERVER ocat FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog OPTIONS (catalog_uri '{ocat}')")
+        _run(dsn, f"CREATE USER MAPPING FOR postgres SERVER ocat"
+                  f" OPTIONS (oauth_client_id '{OCID}', oauth_client_secret '{OCSEC}')")
+        r["oauth read"] = _value(dsn, LOCATE.format("ocat"))
+        r["oauth post"] = _count_in(olog, "POST /v1/oauth/tokens")
+        r["oauth bearer"] = _count_in(olog, "GET /v1/namespaces/db/tables/events AUTH=yes")
+        r["secret in fixture log"] = _count_in(olog, OCSEC)
+        _set_log_statement(dsn, "all")
+        _value(dsn, LOCATE.format("ocat"))
+        _set_log_statement(dsn, "none")
+        r["log lines secret"] = _has_lines(log)
+        r["secret in log"] = _count_in(log, OCSEC)
+
+        _run(dsn, "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (SET oauth_client_secret 'wrong-secret')")
+        r["wrong secret"] = _refusal(dsn, LOCATE.format("ocat"), "refused the OAuth2")
+        _run(dsn, "ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (DROP oauth_client_secret)")
+        # "before any request" is counted: the fixture logs every request it gets
+        n0 = _nlines(olog)
+        half = _refusal(dsn, LOCATE.format("ocat"), "incomplete OAuth2 credential")
+        n1 = _nlines(olog)
+        r["half"] = f"{half}|{n1 - n0}" if isinstance(n0, int) and isinstance(n1, int) else query_error(
+            f"fixture log unreadable: {n0} / {n1}")
+        r["oauth on mapping"] = _sqlstate(dsn, "ALTER USER MAPPING FOR postgres SERVER ocat"
+                                               " OPTIONS (ADD oauth_scope 'catalog')")
+        r["oauth on server"] = _sqlstate(dsn, "CREATE SERVER bad2 FOREIGN DATA WRAPPER pgcolumnar_iceberg_catalog"
+                                              f" OPTIONS (catalog_uri '{ocat}', oauth_client_secret 'x')")
+
+        # ---- SSRF: a hostile oauth_token_uri is refused by the endpoint allow-list
+        _run(dsn, f"ALTER USER MAPPING FOR postgres SERVER ocat OPTIONS (ADD oauth_client_secret '{OCSEC}')")
+        _run(dsn, "ALTER USER MAPPING FOR postgres SERVER ocat"
+                  " OPTIONS (ADD oauth_token_uri 'http://169.254.169.254/v1/oauth/tokens')")
+        r["link-local"] = _refusal(dsn, LOCATE.format("ocat"), "is not in pgcolumnar.objstore_allowed_endpoints")
+        _run(dsn, "ALTER USER MAPPING FOR postgres SERVER ocat"
+                  " OPTIONS (SET oauth_token_uri 'http://10.11.12.13/v1/oauth/tokens')")
+        r["off list"] = _refusal(dsn, LOCATE.format("ocat"), "is not in pgcolumnar.objstore_allowed_endpoints")
+
+        # ---- the URI form still works when the environment token is present
+        _restart(cluster, datadir, log, {"PGCOLUMNAR_ICEBERG_REST_TOKEN": TOKEN})
+        _await_up(dsn)
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'")
+            c.execute("SELECT pg_reload_conf()")
+        r["uri form"] = _value(dsn, LOCATE.format(cat))
+
+        # ---- a non-superuser does not borrow the server's environment token
+        _run(dsn, "CREATE ROLE ice_r LOGIN NOSUPERUSER")
+        for g in ("GRANT pg_read_server_files TO ice_r", "GRANT USAGE ON SCHEMA pgcolumnar TO ice_r",
+                  "GRANT USAGE ON FOREIGN SERVER cat TO ice_r"):
+            _run(dsn, g)
+        ice = _dsn_as(dsn, "ice_r")
+        n0 = _nlines(rest_log)
+        refused = _sqlstate(ice, LOCATE.format("cat"))
+        n1 = _nlines(rest_log)
+        r["ice_r refused"] = f"{refused}|{n1 - n0}" if isinstance(n0, int) and isinstance(n1, int) else query_error(
+            f"fixture log unreadable: {n0} / {n1}")
+        _run(dsn, "CREATE USER MAPPING FOR ice_r SERVER cat")
+        r["ice_r own flag"] = _sqlstate(ice, "ALTER USER MAPPING FOR ice_r SERVER cat"
+                                             " OPTIONS (ADD credentials_required 'false')")
+        _run(dsn, "ALTER USER MAPPING FOR ice_r SERVER cat OPTIONS (ADD credentials_required 'false')")
+        r["ice_r control"] = _value(ice, LOCATE.format("cat"))
+
+        r["survived"] = _survived(dsn, log, before)
+        yield r
+    finally:
+        _pg_ctl(cluster, ["-D", str(datadir), "-m", "immediate", "-w", "stop"], {})
+        for p in procs:
+            p.kill()
+            p.wait()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def _declined(irs, expect):
+    if irs is not None:
+        return False
+    expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir")
+    return True
+
+
+def test_the_rest_server_suite_can_run_here(irs, expect):
+    """The shell skips the whole suite under each of these names."""
+    expect.require_module("json", name="python3 is needed")
+    if irs is None:
+        expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir",
+                          name="the object-store module is not installed")
+        return
+    expect.text(str(irs["rest up"]), "1", "premise: rest fixture up")
+
+
+def test_a_server_name_call_reads_via_the_mapping_token(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["mapping"], MDLOC, "iceberg_rest_table_location('cat',...) reads via the mapping token")
+
+
+def test_the_request_carried_an_authorization_header(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["auth header"], "1", "the request carried an Authorization header")
+
+
+def test_the_server_log_holds_lines_for_the_mapping_token(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["log lines token"], "yes", "premise: the PG server log holds lines to search, for the mapping token")
+
+
+def test_the_mapping_token_is_not_in_the_server_log(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["token in log"], "0", "the mapping token never appears in the PG server log")
+
+
+def test_a_wrong_mapping_token_is_refused(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["wrong token"], "28000", "a wrong mapping token is refused (28000)")
+
+
+def test_no_mapping_and_no_env_token_is_refused(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["no token"], "28000", "no mapping and no env token is refused, not bypassed (28000)")
+
+
+def test_a_token_on_the_server_is_rejected(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["token on server"], "HV00D", "a token option on the SERVER is rejected (HV00D)")
+
+
+def test_a_catalog_uri_on_the_mapping_is_rejected(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["uri on mapping"], "HV00D", "a catalog_uri option on the USER MAPPING is rejected (HV00D)")
+
+
+def test_a_warehouse_option_on_the_server_is_accepted(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["warehouse"], "ok", "a warehouse option on the SERVER is accepted (not HV00D)")
+
+
+def test_a_warehouse_server_resolves_a_location(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["warehouse location"], MDLOC, "a warehouse-configured server resolves a table location")
+
+
+def test_the_warehouse_is_sent_on_get_config(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["warehouse sent"], "1", "the warehouse was sent on GET /v1/config (?warehouse=wh1)")
+
+
+def test_an_oauth_mapping_reads_by_a_minted_bearer(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["oauth read"], MDLOC, "a server with an OAuth2 mapping reads by a minted bearer")
+
+
+def test_the_oauth_token_endpoint_was_called(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["oauth post"], "1", "the OAuth2 token endpoint was called (POST /v1/oauth/tokens)")
+
+
+def test_load_table_carried_the_minted_bearer(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["oauth bearer"], "1", "loadTable then carried the minted bearer (Authorization present)")
+
+
+def test_the_client_secret_is_not_in_the_fixture_log(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["secret in fixture log"], "0", "the client secret never appears in the fixture request log")
+
+
+def test_the_server_log_holds_lines_for_the_client_secret(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["log lines secret"], "yes", "premise: the PG server log holds lines to search, for the client secret")
+
+
+def test_the_client_secret_is_not_in_the_server_log(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["secret in log"], "0", "the client secret never appears in the PG server log")
+
+
+def test_a_wrong_oauth_client_secret_is_refused(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["wrong secret"], "28000", "a wrong OAuth2 client secret is refused (28000)")
+
+
+def test_a_half_oauth_credential_is_refused_before_any_request(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["half"], "28000|0",
+                "a half OAuth2 credential (id, no secret) is refused before any request (28000)")
+
+
+def test_oauth_options_are_accepted_on_a_mapping(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["oauth on mapping"], "ok", "oauth options are accepted on a USER MAPPING (no error)")
+
+
+def test_an_oauth_option_on_the_server_is_rejected(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["oauth on server"], "HV00D", "an oauth option on the SERVER is rejected (HV00D)")
+
+
+def test_a_link_local_token_uri_is_refused_by_the_allow_list(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["link-local"], "42501", "a link-local oauth_token_uri is refused by the allow-list (42501)")
+
+
+def test_an_off_list_token_uri_host_is_refused(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["off list"], "42501", "an off-allow-list oauth_token_uri host is refused (42501)")
+
+
+def test_the_uri_form_works_with_the_env_token(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["uri form"], MDLOC, "the catalog-URI form still works with the env token")
+
+
+def test_a_non_superuser_does_not_borrow_the_env_token(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["ice_r refused"], "28000|0",
+                "a non-superuser with no token mapping is refused (28000) despite the environment token, before any request")
+
+
+def test_a_non_superuser_cannot_waive_its_own_credentials(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["ice_r own flag"], "42501",
+                "and it cannot mark its own mapping credentials_required false (42501)")
+
+
+def test_a_superuser_waiver_lets_the_role_read_by_the_env_token(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["ice_r control"], MDLOC,
+                "control: with credentials_required false set by a superuser, the same role reads by the environment token")
+
+
+def test_the_backend_survives_the_rest_server_arms(irs, expect):
+    if _declined(irs, expect):
+        return
+    expect.text(irs["survived"], "1", "backend still up")
diff --git a/test/pytest/test_iceberg_rest_vended.py b/test/pytest/test_iceberg_rest_vended.py
new file mode 100644
index 000000000..aa99f6c3e
--- /dev/null
+++ b/test/pytest/test_iceberg_rest_vended.py
@@ -0,0 +1,338 @@
+"""Iceberg REST catalog VENDED credentials (#656): the pytest twin of
+`test/iceberg_rest_vended.sh`, every check by the shell's name (#1341).
+
+A REST catalog returns, in its loadTable reply, short-lived scoped storage credentials,
+and the reader must sign its S3 reads with THOSE, never with an ambient environment
+credential. The postmaster holds no AWS_* credential, the warehouse is served by the
+SigV4-verifying S3 fixture (test/objstore_http_server.py, the shell's own), and the
+catalog (test/iceberg_rest_server.py, the shell's own) vends that fixture's key, so a
+green read can only be a read signed with the vended credentials. Asserted: the vended
+read returns the table's survivors; the vended secret appears in neither the server log
+(read under log_statement = 'all') nor the S3 request log; a WRONG vended secret is
+refused by S3 with its own 403 message, not by "no credentials"; of two
+storage-credentials entries the longest matching prefix wins, and the flat config is
+wrong too, so the array must have been read; a vended endpoint off the allow-list is
+refused by the allow-list itself; a catalog that vends nothing falls back to ambient
+credentials; and no backend died on the way.
+
+A BACKEND THAT DIED DOES NOT PASS AS ONE THAT SURVIVED: survival also reads the private
+cluster's server log for killed backends, and an unreadable log fails it.
+
+A PRIVATE CLUSTER, because the postmaster is restarted with the catalog token and, for
+the ambient arm, AWS_* in its environment, which the shared cluster cannot do. Every
+AWS_* variable of this process is removed before each start.
+"""
+import os
+import pathlib
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+TEST = pathlib.Path(__file__).resolve().parents[1]
+FX = TEST / "fixtures" / "iceberg"
+AKID, SECRET, REGION, BUCKET = "VENDEDKEYID", "vended-secret-shh", "pgc-test-1", "pgc-bucket"
+RESTTOK = "rest-token-vend"
+COLS = "AS t(id bigint, region text, amount int)"
+
+
+def _message(exc):
+    return str(exc).splitlines()[0] if str(exc) else type(exc).__name__
+
+
+def _await_up(dsn):
+    """Wait, at most 60 s, until the server answers, so a reading after a crash reads the
+    table rather than crash recovery. The crash itself is still caught: _survived counts it."""
+    for _ in range(120):
+        try:
+            with psycopg.connect(dsn, autocommit=True, connect_timeout=5) as conn:
+                conn.execute("SELECT 1")
+            return
+        except psycopg.Error:
+            time.sleep(0.5)
+
+
+def _value(dsn, sql, setup=()):
+    """-> the first column of the first row as text, or the failure as a query_error()."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            for s in setup:
+                conn.execute(s)
+            row = conn.execute(sql).fetchone()
+    except psycopg.Error as exc:
+        return query_error(_message(exc))
+    if row is None or row[0] is None:
+        return query_error(f"no value from {sql}")
+    return str(row[0])
+
+
+def _refusal(dsn, sql, phrase, setup=()):
+    """-> the SQLSTATE when `sql` is refused with `phrase` in its message, "SQLSTATE
+    (another refusal: MESSAGE)" when something else refused it, or what happened instead.
+    28000 is also "no credentials", so the wrong-secret arm counts only the 403."""
+    _await_up(dsn)
+    try:
+        with psycopg.connect(dsn, autocommit=True, connect_timeout=10) as conn:
+            for s in setup:
+                conn.execute(s)
+            conn.execute(sql).fetchall()
+    except psycopg.Error as exc:
+        if not exc.sqlstate:
+            return query_error(_message(exc))
+        msg = exc.diag.message_primary or ""
+        return exc.sqlstate if phrase in msg else f"{exc.sqlstate} (another refusal: {msg})"
+    return "no error"
+
+
+def _count_in(path, needle):
+    """-> how many lines of `path` hold `needle`, or a query_error() when it can't be read."""
+    try:
+        return str(sum(1 for line in pathlib.Path(path).read_text(errors="replace").splitlines()
+                       if line and needle in line))
+    except OSError as exc:
+        return query_error(f"{path} unreadable: {exc}")
+
+
+def _crashes(log):
+    try:
+        return pathlib.Path(log).read_text(errors="replace").count("terminated by signal")
+    except OSError as exc:
+        return query_error(f"crash count unreadable: {exc}")
+
+
+def _survived(dsn, log, before):
+    up, now = _value(dsn, "SELECT 1"), _crashes(log)
+    if not isinstance(before, int) or not isinstance(now, int):
+        return query_error(f"crash count unreadable: {before} / {now}")
+    return "1" if up == "1" and now == before else f"no ([{up}], {now - before} backend crashes)"
+
+
+def _pg_ctl(cluster, args, extra_env):
+    """pg_ctl with an explicit environment: every AWS_* of this process removed, then
+    `extra_env` added. Dropped to postgres when running as root, as the harness does."""
+    unset = [a for k in os.environ if k.startswith("AWS_") for a in ("-u", k)]
+    cmd = ["env"] + unset + [f"{k}={v}" for k, v in extra_env.items()] + \
+          [os.path.join(cluster.bindir, "pg_ctl")] + args
+    if os.geteuid() == 0:
+        cmd = ["runuser", "-u", "postgres", "--"] + cmd
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _restart(cluster, datadir, log, env):
+    _pg_ctl(cluster, ["-D", str(datadir), "-m", "fast", "-w", "stop"], {})
+    return _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], env).returncode == 0
+
+
+def _ready(out):
+    for _ in range(50):
+        if out.is_file() and "READY" in out.read_text(errors="replace"):
+            return
+        time.sleep(0.1)
+
+
+def _module_installed(pg_config):
+    try:
+        lib = subprocess.run([pg_config, "--pkglibdir"], capture_output=True, text=True).stdout.strip()
+    except OSError:
+        return False
+    return (pathlib.Path(lib) / "pgcolumnar_objstore.so").is_file()
+
+
+@pytest.fixture(scope="module")
+def irv(pgc_cluster):
+    if not (FX / "warehouse_del" / "db" / "t" / "metadata" / "apply.metadata.json").is_file():
+        yield "fixture"
+        return
+    if not _module_installed(pgc_cluster.pg_config):
+        yield "objstore"
+        return
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-icevend-"))
+    os.chmod(work, 0o777)
+    bucket = work / BUCKET
+    shutil.copytree(FX / "warehouse_del" / "db", bucket / "db")
+    for p in [bucket, *bucket.rglob("*")]:
+        p.chmod(0o777 if p.is_dir() else 0o666)
+    procs = []
+
+    s3_port = pick_port(30)
+    s3out = work / "s3.out"
+    procs.append(subprocess.Popen(
+        [sys.executable, str(TEST / "objstore_http_server.py"), "--dir", str(work),
+         "--port", str(s3_port), "--log", str(work / "s3.log"),
+         "--sigv4-key", AKID, "--sigv4-secret", SECRET, "--sigv4-region", REGION],
+        stdout=open(s3out, "w"), stderr=subprocess.STDOUT))
+    _ready(s3out)
+    s3ep = f"http://127.0.0.1:{s3_port}"
+
+    def start_rest(*extra):
+        """-> the catalog URI of a fresh REST catalog, picked only after the last one bound."""
+        port = pick_port(32)
+        out = work / f"rest_{port}.out"
+        procs.append(subprocess.Popen(
+            [sys.executable, str(TEST / "iceberg_rest_server.py"), "--port", str(port),
+             "--log", str(work / f"rest_{port}.log"), "--namespace", "db", "--table", "t",
+             "--metadata-location", f"s3://{BUCKET}/db/t/metadata/apply.metadata.json", *extra],
+            stdout=open(out, "w"), stderr=subprocess.STDOUT))
+        _ready(out)
+        return f"http://127.0.0.1:{port}"
+
+    def scan(cat, cols=COLS):
+        return f"pgcolumnar.iceberg_rest_scan('{cat}','db','t') {cols}"
+
+    vend = ["--token", RESTTOK, "--vend-key", AKID, "--vend-region", REGION]
+    datadir = work / "data"
+    datadir.mkdir()
+    log = str(work / "server.log")
+    cluster = Cluster(pgc_cluster.pg_config, "icevend", datadir, pick_port(31))
+    r = {"s3 up": s3out.read_text(errors="replace").count("READY") if s3out.is_file() else 0}
+    try:
+        cluster.initdb()
+        tok = {"PGCOLUMNAR_ICEBERG_REST_TOKEN": RESTTOK}
+        started = _pg_ctl(cluster, ["-D", str(datadir), "-l", log, "-w", "start"], tok)
+        if started.returncode != 0:
+            try:
+                tail = "".join(pathlib.Path(log).read_text(errors="replace").splitlines(True)[-20:])
+            except OSError as exc:
+                tail = f"(server log unreadable: {exc})"
+            raise RuntimeError(f"the private cluster did not start: {started.stderr}\n{tail}")
+        dsn = cluster.dsn()
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+            c.execute("ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'")
+            c.execute("SELECT pg_reload_conf()")
+        before = _crashes(log)
+
+        cat = start_rest(*vend, "--vend-secret", SECRET, "--vend-endpoint", s3ep)
+        r["core"] = _value(dsn, "SELECT string_agg(id || '|' || region || '|' || amount, E'\\n' ORDER BY id)"
+                                f" FROM {scan(cat)}")
+
+        # the secret is only a SigV4 signing seed, never a SQL argument: read under
+        # log_statement = 'all', then look for it
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("ALTER SYSTEM SET log_statement = 'all'")
+            c.execute("SELECT pg_reload_conf()")
+        _value(dsn, f"SELECT count(*) FROM {scan(cat)}")
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("ALTER SYSTEM SET log_statement = 'none'")
+            c.execute("SELECT pg_reload_conf()")
+        lines = _count_in(log, "")
+        r["log lines"] = ("yes" if int(lines) > 0 else "no") if lines.isdigit() else lines
+        r["secret pg"] = _count_in(log, SECRET)
+        r["secret s3"] = _count_in(work / "s3.log", SECRET)
+
+        bad = start_rest(*vend, "--vend-secret", "wrong-vended-secret", "--vend-endpoint", s3ep)
+        r["wrong"] = _refusal(dsn, f"SELECT * FROM {scan(bad)}", "was denied (HTTP 403")
+
+        sc = start_rest(*vend, "--vend-secret", SECRET, "--vend-endpoint", s3ep,
+                        "--storage-cred-prefix", f"s3://{BUCKET}/db/t")
+        r["prefix"] = _value(dsn, f"SELECT count(*) FROM {scan(sc)}")
+
+        off = start_rest(*vend, "--vend-secret", SECRET, "--vend-endpoint", f"http://127.0.0.2:{s3_port}")
+        r["off list"] = _refusal(dsn, f"SELECT * FROM {scan(off)}",
+                                 "is not in pgcolumnar.objstore_allowed_endpoints",
+                                 setup=("SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'",))
+
+        amb = start_rest("--token", RESTTOK)
+        _restart(cluster, datadir, log, dict(tok, AWS_ENDPOINT_URL=s3ep, AWS_ACCESS_KEY_ID=AKID,
+                                             AWS_SECRET_ACCESS_KEY=SECRET, AWS_REGION=REGION))
+        _await_up(dsn)
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute("ALTER SYSTEM SET pgcolumnar.objstore_allowed_endpoints = '127.0.0.1'")
+            c.execute("SELECT pg_reload_conf()")
+        r["ambient"] = _value(dsn, f"SELECT count(*) FROM {scan(amb)}")
+        r["survived"] = _survived(dsn, log, before)
+        yield r
+    finally:
+        _pg_ctl(cluster, ["-D", str(datadir), "-m", "immediate", "-w", "stop"], {})
+        for p in procs:
+            p.kill()
+            p.wait()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def _declined(irv, expect):
+    if isinstance(irv, dict):
+        return False
+    if irv == "fixture":
+        expect.cannot_run("ABSENT_FIXTURE", "the committed iceberg fixtures are missing")
+    else:
+        expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir")
+    return True
+
+
+def test_the_vended_suite_can_run_here(irv, expect):
+    """The shell skips the whole suite under each of these names."""
+    expect.require_module("json", name="python3 is needed")
+    if irv == "objstore":
+        expect.cannot_run("MISSING_DEPENDENCY", "pgcolumnar_objstore.so is not in the pkglibdir",
+                          name="the object-store module is not installed")
+        return
+    if irv == "fixture":
+        expect.cannot_run("ABSENT_FIXTURE", "the committed iceberg fixtures are not in this tree",
+                          name="iceberg fixtures are missing")
+        return
+    expect.text(str(irv["s3 up"]), "1", "premise: the SigV4 S3 fixture is up")
+
+
+def test_a_rest_scan_reads_via_vended_credentials(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["core"], "1|eu|10\n3|us|30\n5|us|50",
+                "iceberg_rest_scan reads via vended credentials (no ambient creds set)")
+
+
+def test_the_server_log_holds_lines_to_search(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["log lines"], "yes", "premise: the PG server log holds lines to search")
+
+
+def test_the_vended_secret_is_not_in_the_server_log(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["secret pg"], "0", "the vended secret never appears in the PG server log")
+
+
+def test_the_vended_secret_is_not_in_the_s3_request_log(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["secret s3"], "0", "the vended secret never appears in the S3 request log")
+
+
+def test_a_wrong_vended_secret_is_refused_by_s3(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["wrong"], "28000", "a wrong vended secret is refused by S3, not bypassed (28000)")
+
+
+def test_the_longest_storage_credentials_prefix_wins(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["prefix"], "3", "storage-credentials longest-prefix match selects the right creds")
+
+
+def test_a_vended_endpoint_off_the_allow_list_is_refused(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["off list"], "42501", "vended creds for an off-allow-list endpoint are refused (42501)")
+
+
+def test_a_catalog_vending_nothing_falls_back_to_ambient(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["ambient"], "3", "a table vending no creds still reads with ambient (cfg NULL path)")
+
+
+def test_the_backend_survives_the_vended_arms(irv, expect):
+    if _declined(irv, expect):
+        return
+    expect.text(irv["survived"], "1", "backend still up after the vended-credential arms")
diff --git a/test/pytest/test_logical_decoding_cdc_recipe.py b/test/pytest/test_logical_decoding_cdc_recipe.py
new file mode 100644
index 000000000..6a44a6c9d
--- /dev/null
+++ b/test/pytest/test_logical_decoding_cdc_recipe.py
@@ -0,0 +1,400 @@
+"""The documented CDC recipe works (#754). The pytest twin of
+`test/logical_decoding_cdc_recipe.sh`, every check by the shell's name.
+
+docs/user-guide.md offers a workaround for "a columnar table is not a logical decoding
+source": capture rows into a heap table with a row trigger, and decode that. The
+recipe's SQL is EXTRACTED FROM THE GUIDE AT RUN TIME and executed, so the guide is the
+thing under test; premises assert what the extraction contains, not merely that it ran.
+
+Asserted: the trigger fires on a columnar table and sees the table's values; an UPDATE
+is captured as one UPDATE, never as the storage's delete and insert; a DELETE captures
+the OLD row; the capture is transactional, read inside the transaction before it is
+rolled back so the rollback has something to undo; the capture table decodes through a
+slot while the columnar table emits nothing; a publication FOR ALL TABLES includes
+pgcolumnar's internal tables; and a bulk load writes one capture row per loaded row.
+
+A PRIVATE CLUSTER at wal_level=logical: the level cannot be raised without a restart,
+and the shared cluster runs at the default.
+"""
+import pathlib
+import re
+import shutil
+import tempfile
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+GUIDE = pathlib.Path(__file__).resolve().parents[2] / "docs" / "user-guide.md"
+SLOT = "pgc_cdc"
+
+
+def _err(exc):
+    return query_error(str(exc).splitlines()[0] if str(exc) else type(exc).__name__)
+
+
+def _q(dsn, sql, params=None):
+    """-> the first column of the first row as text, or query_error() carrying the failure."""
+    try:
+        with psycopg.connect(dsn, autocommit=True) as c:
+            row = c.execute(sql, params).fetchone()
+            return "" if row is None or row[0] is None else str(row[0])
+    except psycopg.Error as exc:
+        return _err(exc)
+
+
+def _run(dsn, sql):
+    """-> None, or query_error() when the statement failed (the next reading then fails by name)."""
+    try:
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute(sql)
+        return None
+    except psycopg.Error as exc:
+        return _err(exc)
+
+
+def _int(v):
+    return int(v) if isinstance(v, str) and re.fullmatch(r"-?\d+", v) else v
+
+
+def _extract(text):
+    """The first ```sql fence inside the CDC section, as the shell's awk reads it."""
+    out, in_sec, in_sql, seen = [], False, False, False
+    for line in text.splitlines():
+        if not in_sec:
+            in_sec = line.startswith("## Capture changes for replication or CDC")
+            continue
+        if not in_sql and line.startswith("## "):
+            break
+        if not in_sql and not seen and line == "```sql":
+            in_sql = seen = True
+            continue
+        if in_sql and line == "```":
+            break
+        if in_sql:
+            out.append(line)
+    return "\n".join(out)
+
+
+@pytest.fixture(scope="module")
+def cdc(pgc_cluster):
+    from pgc_cluster import Cluster, pick_port
+
+    if not (pathlib.Path(pgc_cluster.libdir) / "test_decoding.so").is_file():
+        yield {"missing": f"test_decoding.so is not in {pgc_cluster.libdir}"}
+        return
+    r = {"guide": "found" if GUIDE.is_file() else f"missing ({GUIDE})"}
+    recipe = _extract(GUIDE.read_text()) if GUIDE.is_file() else ""
+    r["recipe"] = recipe
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-ldcr-"))
+    work.chmod(0o777)
+    datadir = work / "data"
+    datadir.mkdir()
+    cluster = Cluster(pgc_cluster.pg_config, "ldcr", datadir, pick_port(27))
+    try:
+        cluster.initdb()
+        with open(datadir / "postgresql.conf", "a") as fh:
+            fh.write("\nwal_level=logical\nmax_replication_slots=8\nmax_wal_senders=8\n")
+        cluster.start()
+        dsn = cluster.dsn()
+        _run(dsn, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        r["wal_level"] = _q(dsn, "SHOW wal_level")
+        # The guide's own SQL, as the shell's psql -f runs it: statement errors do not stop it.
+        if recipe:
+            _run(dsn, recipe)
+        am = "SELECT am.amname FROM pg_class c JOIN pg_am am ON am.oid = c.relam WHERE c.relname = %s"
+        r["events am"] = _q(dsn, am, ("events",))
+        r["cdc am"] = _q(dsn, am, ("events_cdc",))
+        _run(dsn, f"SELECT pg_create_logical_replication_slot('{SLOT}', 'test_decoding')")
+        r["slot type"] = _q(dsn, f"SELECT slot_type FROM pg_replication_slots WHERE slot_name = '{SLOT}'")
+
+        def n(sql):
+            return _int(_q(dsn, sql))
+
+        # 1. the trigger fires on a columnar table
+        _run(dsn, "INSERT INTO events VALUES (1,'sale',100), (2,'refund',50), (3,'sale',75)")
+        r["inserted"] = n("SELECT count(*) FROM events_cdc WHERE op = 'INSERT'")
+        r["seen"] = _q(dsn, "SELECT string_agg(id||':'||kind||':'||amount, ',' ORDER BY id) "
+                            "FROM events_cdc WHERE op='INSERT'")
+        r["held"] = _q(dsn, "SELECT string_agg(id||':'||kind||':'||amount, ',' ORDER BY id) FROM events")
+        # 2. an UPDATE arrives as one UPDATE
+        before_ins = n("SELECT count(*) FROM events_cdc WHERE op='INSERT'")
+        before_del = n("SELECT count(*) FROM events_cdc WHERE op='DELETE'")
+        _run(dsn, "UPDATE events SET amount = 150 WHERE id = 1")
+        r["updates"] = n("SELECT count(*) FROM events_cdc WHERE op='UPDATE'")
+        r["update row"] = _q(dsn, "SELECT op||':'||id||':'||amount FROM events_cdc WHERE op='UPDATE'")
+        r["dels after update"] = (n("SELECT count(*) FROM events_cdc WHERE op='DELETE'"), before_del)
+        r["ins after update"] = (n("SELECT count(*) FROM events_cdc WHERE op='INSERT'"), before_ins)
+        # a DELETE captures the OLD row
+        _run(dsn, "DELETE FROM events WHERE id = 2")
+        r["delete row"] = _q(dsn, "SELECT op||':'||id||':'||kind||':'||amount FROM events_cdc WHERE op='DELETE'")
+        r["gone"] = n("SELECT count(*) FROM events WHERE id = 2")
+        # 3. the capture is transactional: read inside the transaction, then roll back
+        cap_before = n("SELECT count(*) FROM events_cdc")
+        try:
+            with psycopg.connect(dsn) as c:
+                c.execute("INSERT INTO events VALUES (99,'rolledback',1)")
+                row = c.execute("SELECT ((SELECT count(*) FROM events_cdc) - %s) || ':' || "
+                                "(SELECT count(*) FROM events WHERE id = 99)",
+                                (cap_before if isinstance(cap_before, int) else 0,)).fetchone()
+                r["inside"] = str(row[0])
+                c.rollback()
+        except psycopg.Error as exc:
+            r["inside"] = _err(exc)
+        r["after rollback"] = (n("SELECT count(*) FROM events_cdc"), cap_before)
+        r["row 99"] = n("SELECT count(*) FROM events WHERE id = 99")
+        _run(dsn, "INSERT INTO events VALUES (98,'committed',1)")
+        r["after commit"] = (n("SELECT count(*) FROM events_cdc"),
+                             cap_before + 1 if isinstance(cap_before, int) else cap_before)
+        # 4. the capture table decodes, and the columnar table still does not
+        _run(dsn, f"CREATE TABLE decoded AS SELECT data FROM pg_logical_slot_get_changes('{SLOT}', NULL, NULL)")
+
+        def d(pattern):  # LIKE, as the shell's d()
+            return _int(_q(dsn, "SELECT count(*) FROM decoded WHERE data LIKE %s", (f"%{pattern}%",)))
+
+        def dq(text):  # strpos, as the shell's dq()
+            return _int(_q(dsn, "SELECT count(*) FROM decoded WHERE strpos(data, %s) > 0", (text,)))
+
+        r["decoded"] = n("SELECT count(*) FROM decoded")
+        r["col decoded"] = d("table public.events:")
+        r["cdc decoded"] = d("table public.events_cdc: INSERT")
+        r["captured"] = n("SELECT count(*) FROM events_cdc")
+        r["rolledback decoded"] = d("rolledback")
+        r["op update"] = dq("op[text]:'UPDATE'")
+        r["op delete"] = dq("op[text]:'DELETE'")
+        r["op insert"] = dq("op[text]:'INSERT'")
+        # the guide's warning about the pgcolumnar schema
+        _run(dsn, "CREATE PUBLICATION pgc_all FOR ALL TABLES")
+        r["pub internal"] = n("SELECT count(*) FROM pg_publication_tables "
+                              "WHERE pubname='pgc_all' AND schemaname='pgcolumnar'")
+        _run(dsn, "DROP PUBLICATION pgc_all")
+        # the guide's cost claim
+        bulk_before = n("SELECT count(*) FROM events_cdc")
+        _run(dsn, "INSERT INTO events SELECT g, 'bulk', g FROM generate_series(1000, 6000) g")
+        bulk_after = n("SELECT count(*) FROM events_cdc")
+        r["bulk"] = (bulk_after - bulk_before if isinstance(bulk_after, int) and isinstance(bulk_before, int)
+                     else f"no reading ({bulk_before} then {bulk_after})")
+        _run(dsn, f"SELECT pg_drop_replication_slot('{SLOT}')")
+        yield r
+    finally:
+        cluster.stop()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def test_ldcr_test_decoding_is_installed(cdc, expect):
+    # The shell's pgc_skip records a FAIL under this name when the plugin is missing, and
+    # nothing when it is there. Here the same name passes when it is there.
+    expect.text("missing" if "missing" in cdc else "installed", "installed",
+                "test_decoding.so is not installed; build contrib/test_decoding")
+
+
+def _declined(cdc, expect):
+    if "missing" in cdc:
+        expect.cannot_run("MISSING_DEPENDENCY", cdc["missing"])
+        return True
+    return False
+
+
+def _has(cdc, text):
+    return "yes" if text in cdc["recipe"] else "no"
+
+
+def _gt(v, floor):
+    return "yes" if isinstance(v, int) and v > floor else f"no ({v})"
+
+
+def test_ldcr_server_runs_at_wal_level_logical(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["wal_level"], "logical", "premise: the server is running at wal_level=logical")
+
+
+def test_ldcr_guide_is_where_expected(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["guide"], "found", "premise: the guide is where this suite expects it")
+
+
+def test_ldcr_extraction_is_not_empty(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text("nonempty" if cdc["recipe"] else "EMPTY", "nonempty", "premise: the extraction is not empty")
+
+
+def test_ldcr_recipe_contains_events(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "CREATE TABLE events"), "yes",
+                    "premise: the extracted recipe contains [CREATE TABLE events]")
+
+
+def test_ldcr_recipe_contains_events_cdc(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "CREATE TABLE events_cdc"), "yes",
+                    "premise: the extracted recipe contains [CREATE TABLE events_cdc]")
+
+
+def test_ldcr_recipe_contains_capture_function(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "CREATE FUNCTION events_capture"), "yes",
+                    "premise: the extracted recipe contains [CREATE FUNCTION events_capture]")
+
+
+def test_ldcr_recipe_contains_trigger(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "CREATE TRIGGER events_cdc_t"), "yes",
+                    "premise: the extracted recipe contains [CREATE TRIGGER events_cdc_t]")
+
+
+def test_ldcr_recipe_contains_using_pgcolumnar(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "USING pgcolumnar"), "yes",
+                    "premise: the extracted recipe contains [USING pgcolumnar]")
+
+
+def test_ldcr_recipe_contains_delete_branch(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "TG_OP = 'DELETE'"), "yes",
+                    "premise: the extracted recipe contains [TG_OP = 'DELETE']")
+
+
+def test_ldcr_recipe_contains_old_id(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_has(cdc, "OLD.id"), "yes", "premise: the extracted recipe contains [OLD.id]")
+
+
+def test_ldcr_recipe_is_the_whole_block(cdc, expect):
+    if not _declined(cdc, expect):
+        n = cdc["recipe"].count(";")
+        expect.text("yes" if n >= 4 else f"no ({n} statements)", "yes",
+                    "premise: and it is the whole block, not a fragment")
+
+
+def test_ldcr_events_is_columnar(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["events am"], "pgcolumnar", "premise: events is a COLUMNAR table")
+
+
+def test_ldcr_events_cdc_is_heap(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["cdc am"], "heap", "premise: events_cdc is a HEAP table")
+
+
+def test_ldcr_slot_exists_and_is_logical(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["slot type"], "logical", "premise: the slot exists and is logical")
+
+
+def test_ldcr_trigger_fires_once_per_row(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["inserted"], 3, "a row trigger on a COLUMNAR table fires once per inserted row")
+
+
+def test_ldcr_trigger_saw_the_table_values(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["seen"], cdc["held"], "and it saw the same values the table holds")
+
+
+def test_ldcr_update_captures_one_row(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["updates"], 1, "an UPDATE captures exactly one row")
+
+
+def test_ldcr_update_recorded_with_new_value(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["update row"], "UPDATE:1:150", "and it is recorded as UPDATE with the NEW value")
+
+
+def test_ldcr_update_leaks_no_delete(cdc, expect):
+    if not _declined(cdc, expect):
+        got, want = cdc["dels after update"]
+        expect.num(got, want, "the update did NOT leak the storage's internal DELETE")
+
+
+def test_ldcr_update_leaks_no_insert(cdc, expect):
+    if not _declined(cdc, expect):
+        got, want = cdc["ins after update"]
+        expect.num(got, want, "nor the storage's internal INSERT")
+
+
+def test_ldcr_delete_captures_old_values(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["delete row"], "DELETE:2:refund:50",
+                    "a DELETE captures the OLD values, which are gone from the table")
+
+
+def test_ldcr_deleted_row_is_gone(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["gone"], 0, "and the row really is gone from the columnar table")
+
+
+def test_ldcr_inside_the_transaction_the_row_was_captured(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(cdc["inside"], "1:1",
+                    "inside the transaction the row was captured and is in the columnar table, before the rollback")
+
+
+def test_ldcr_rollback_captures_nothing(cdc, expect):
+    if not _declined(cdc, expect):
+        got, want = cdc["after rollback"]
+        expect.num(got, want, "a rolled-back transaction captures nothing")
+
+
+def test_ldcr_rollback_leaves_no_row(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["row 99"], 0, "and leaves no row in the columnar table either")
+
+
+def test_ldcr_committed_insert_captures(cdc, expect):
+    if not _declined(cdc, expect):
+        got, want = cdc["after commit"]
+        expect.num(got, want, "premise: the identical insert COMMITTED does capture, so the arm above is real")
+
+
+def test_ldcr_slot_decoded_something(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_gt(cdc["decoded"], 0), "yes", "premise: the slot decoded something at all")
+
+
+def test_ldcr_columnar_table_emits_nothing(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["col decoded"], 0, "CONTROL: the columnar table itself still emits nothing")
+
+
+def test_ldcr_capture_table_is_carried(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_gt(cdc["cdc decoded"], 0), "yes", "the capture table IS carried by the slot")
+
+
+def test_ldcr_one_decoded_row_per_capture(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["cdc decoded"], cdc["captured"], "one decoded capture row per captured change")
+
+
+def test_ldcr_rolled_back_row_not_in_stream(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(str(cdc["rolledback decoded"]), "0", "and the rolled-back row is not in the stream")
+
+
+def test_ldcr_stream_carries_update(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["op update"], 1, "the decoded stream carries the UPDATE as an UPDATE")
+
+
+def test_ldcr_stream_carries_delete(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["op delete"], 1, "and the DELETE as a DELETE")
+
+
+def test_ldcr_matcher_finds_inserts(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_gt(cdc["op insert"], 1), "yes",
+                    "premise: the same matcher finds the INSERTs, so a 1 above is a real match")
+
+
+def test_ldcr_publication_includes_internal_tables(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.text(_gt(cdc["pub internal"], 0), "yes",
+                    "premise: FOR ALL TABLES really does include pgcolumnar's internal tables")
+
+
+def test_ldcr_bulk_load_one_capture_per_row(cdc, expect):
+    if not _declined(cdc, expect):
+        expect.num(cdc["bulk"], 5001, "a bulk load writes exactly one capture row per loaded row")
diff --git a/test/pytest/test_logical_decoding_source.py b/test/pytest/test_logical_decoding_source.py
new file mode 100644
index 000000000..d8e6a09db
--- /dev/null
+++ b/test/pytest/test_logical_decoding_source.py
@@ -0,0 +1,189 @@
+"""pgColumnar is not a logical decoding source (#754). The pytest twin of
+`test/logical_decoding_source.sh`, every check by the shell's name.
+
+Logical decoding reads the WAL records of heap tuples. Columnar data reaches WAL as
+full-page images, which carry no tuple structure, so no change to a columnar table is
+emitted. A slot on a database holding columnar tables is not silent either: it carries
+pgcolumnar's own catalog writes, which follow groups and not rows.
+
+"Zero changes decoded" is also what a dead slot looks like, so each slot gets a heap
+CONTROL written in the same window and asserted to decode. The second slot had none,
+and with it created after the insert it carried nothing and every check passed.
+
+A PRIVATE CLUSTER at wal_level=logical: the level cannot be raised without a restart,
+and the shared cluster runs at the default.
+"""
+import pathlib
+import shutil
+import tempfile
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+SLOT, SLOT_B = "pgc_754", "pgc_754b"
+
+
+def _q(dsn, sql):
+    """-> the first column of the first row as text, or query_error() carrying the failure."""
+    try:
+        with psycopg.connect(dsn, autocommit=True) as c:
+            row = c.execute(sql).fetchone()
+            return "" if row is None or row[0] is None else str(row[0])
+    except psycopg.Error as exc:
+        return query_error(str(exc).splitlines()[0] if str(exc) else type(exc).__name__)
+
+
+def _run(dsn, sql):
+    """-> None, or query_error() when the statement failed (the next reading then fails by name)."""
+    try:
+        with psycopg.connect(dsn, autocommit=True) as c:
+            c.execute(sql)
+        return None
+    except psycopg.Error as exc:
+        return query_error(str(exc).splitlines()[0] if str(exc) else type(exc).__name__)
+
+
+def _int(v):
+    return int(v) if isinstance(v, str) and v.isdigit() else v
+
+
+@pytest.fixture(scope="module")
+def lds(pgc_cluster):
+    from pgc_cluster import Cluster, pick_port
+
+    if not (pathlib.Path(pgc_cluster.libdir) / "test_decoding.so").is_file():
+        yield {"missing": f"test_decoding.so is not in {pgc_cluster.libdir}"}
+        return
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-lds-"))
+    work.chmod(0o777)
+    datadir = work / "data"
+    datadir.mkdir()
+    cluster = Cluster(pgc_cluster.pg_config, "lds", datadir, pick_port(26))
+    try:
+        cluster.initdb()
+        with open(datadir / "postgresql.conf", "a") as fh:
+            fh.write("\nwal_level=logical\nmax_replication_slots=8\nmax_wal_senders=8\n")
+        cluster.start()
+        dsn = cluster.dsn()
+        r = {}
+        _run(dsn, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+        r["wal_level"] = _q(dsn, "SHOW wal_level")
+        _run(dsn, "CREATE TABLE heap_t (id int PRIMARY KEY, v text) USING heap")
+        _run(dsn, "CREATE TABLE col_t (id int PRIMARY KEY, v text) USING pgcolumnar")
+        # The slot is created before any row is written: a slot only carries later changes.
+        _run(dsn, f"SELECT pg_create_logical_replication_slot('{SLOT}', 'test_decoding')")
+        r["slot type"] = _q(dsn, f"SELECT slot_type FROM pg_replication_slots WHERE slot_name = '{SLOT}'")
+        _run(dsn, "INSERT INTO heap_t SELECT g, 'h' || g FROM generate_series(1, 50) g")
+        _run(dsn, "INSERT INTO col_t SELECT g, 'c' || g FROM generate_series(1, 50) g")
+        r["heap rows"] = _int(_q(dsn, "SELECT count(*) FROM heap_t"))
+        r["col rows"] = _int(_q(dsn, "SELECT count(*) FROM col_t"))
+        # Drained once, so every count reads the same snapshot of the slot.
+        _run(dsn, f"CREATE TABLE decoded AS SELECT data FROM pg_logical_slot_get_changes('{SLOT}', NULL, NULL)")
+
+        def d(table, pattern):
+            return _int(_q(dsn, f"SELECT count(*) FROM {table} WHERE data LIKE '%{pattern}%'"))
+
+        r["decoded"] = _int(_q(dsn, "SELECT count(*) FROM decoded"))
+        r["heap decoded"] = d("decoded", "table public.heap_t: INSERT")
+        r["col decoded"] = d("decoded", "table public.col_t:")
+        r["internal small"] = d("decoded", "table pgcolumnar.")
+        # The second slot, with its own heap control in the same window.
+        _run(dsn, "CREATE TABLE col_big (id int PRIMARY KEY, v text) USING pgcolumnar")
+        _run(dsn, "CREATE TABLE heap_big (id int PRIMARY KEY, v text) USING heap")
+        _run(dsn, f"SELECT pg_create_logical_replication_slot('{SLOT_B}', 'test_decoding')")
+        _run(dsn, "INSERT INTO col_big SELECT g, 'c' || g FROM generate_series(1, 5000) g")
+        _run(dsn, "INSERT INTO heap_big SELECT g, 'h' || g FROM generate_series(1, 5000) g")
+        _run(dsn, f"CREATE TABLE decoded_big AS SELECT data FROM pg_logical_slot_get_changes('{SLOT_B}', NULL, NULL)")
+        r["big rows"] = _q(dsn, "SELECT count(*) FROM col_big")
+        r["heap big decoded"] = d("decoded_big", "table public.heap_big: INSERT")
+        r["col big decoded"] = d("decoded_big", "table public.col_big:")
+        r["internal big"] = d("decoded_big", "table pgcolumnar.")
+        _run(dsn, f"SELECT pg_drop_replication_slot('{SLOT}')")
+        _run(dsn, f"SELECT pg_drop_replication_slot('{SLOT_B}')")
+        yield r
+    finally:
+        cluster.stop()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def test_lds_test_decoding_is_installed(lds, expect):
+    # The shell's pgc_skip records a FAIL under this name when the plugin is missing, and
+    # nothing when it is there. Here the same name passes when it is there.
+    expect.text("missing" if "missing" in lds else "installed", "installed",
+                "test_decoding.so is not installed; build contrib/test_decoding")
+
+
+def _declined(lds, expect):
+    if "missing" in lds:
+        expect.cannot_run("MISSING_DEPENDENCY", lds["missing"])
+        return True
+    return False
+
+
+def test_lds_server_runs_at_wal_level_logical(lds, expect):
+    if not _declined(lds, expect):
+        expect.text(lds["wal_level"], "logical", "premise: the server is running at wal_level=logical")
+
+
+def test_lds_slot_exists_and_is_logical(lds, expect):
+    if not _declined(lds, expect):
+        expect.text(lds["slot type"], "logical", "premise: the slot exists and is logical")
+
+
+def test_lds_both_tables_hold_the_same_rows(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["heap rows"], lds["col rows"], "premise: both tables hold the same 50 rows")
+
+
+def test_lds_slot_decoded_something(lds, expect):
+    if not _declined(lds, expect):
+        n = lds["decoded"]
+        expect.text("yes" if isinstance(n, int) and n > 0 else f"no ({n})", "yes",
+                    "premise: the slot decoded something at all")
+
+
+def test_lds_heap_control_is_decoded(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["heap decoded"], 50, "CONTROL: the heap table's 50 inserts ARE decoded")
+
+
+def test_lds_columnar_emits_no_change(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["col decoded"], 0, "a columnar table emits no decodable change")
+
+
+def test_lds_columnar_rows_are_there(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["col rows"], 50, "although the rows are there")
+
+
+def test_lds_slot_carries_internal_catalog(lds, expect):
+    if not _declined(lds, expect):
+        n = lds["internal small"]
+        expect.text("yes" if isinstance(n, int) and n > 0 else f"no ({n})", "yes",
+                    "the slot carries pgcolumnar's internal catalog instead")
+
+
+def test_lds_big_table_holds_its_rows(lds, expect):
+    if not _declined(lds, expect):
+        expect.text(lds["big rows"], "5000", "premise: the 100x table really holds 100x the rows")
+
+
+def test_lds_second_slot_heap_control_is_decoded(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["heap big decoded"], 5000, "CONTROL: the second slot decodes the heap table's 5000 inserts")
+
+
+def test_lds_big_columnar_emits_no_change(lds, expect):
+    if not _declined(lds, expect):
+        expect.num(lds["col big decoded"], 0, "and it too emits no decodable change of its own")
+
+
+def test_lds_internal_records_do_not_follow_rows(lds, expect):
+    if not _declined(lds, expect):
+        small, big = lds["internal small"], lds["internal big"]
+        ok = isinstance(small, int) and isinstance(big, int) and 0 < big < small * 10
+        expect.text("yes" if ok else f"no ({small} then {big}; the second slot must carry some)", "yes",
+                    "100x the rows does not give 100x the internal records")
diff --git a/test/pytest/test_logical_subscriber.py b/test/pytest/test_logical_subscriber.py
new file mode 100644
index 000000000..006b852bd
--- /dev/null
+++ b/test/pytest/test_logical_subscriber.py
@@ -0,0 +1,333 @@
+"""Columnar as a logical replication APPLY TARGET (#435, #1341). The pytest twin of
+`test/logical_subscriber.sh`, every check by the shell's name.
+
+A heap table on a publisher, a columnar mirror on a subscriber. Two facts are pinned:
+an INSERT-only publication works end to end (initial sync and streamed INSERTs take no
+tuple lock), and a publication that carries UPDATE raises OUR error, which names logical
+replication and the way out, retried by the apply worker forever. An ordinary
+SELECT ... FOR UPDATE / SHARE / NO KEY UPDATE on a columnar table keeps the generic
+row-locking message: the replication one is gated on the apply worker.
+
+HOW THE READINGS ARE MADE FAIL-CLOSED, as in the shell:
+- an INSERT committed after the insert-only UPDATE must arrive before "skipped by design"
+  and "no apply errors" are read, so a subscription that applied nothing cannot pass them;
+- "does NOT say only 'row locking'" is read only once the replication error is in the
+  subscriber's log, and "is not told about replication" only once the statement raised
+  the generic error, so an absence that is no evidence cannot pass;
+- the wedge reads "publisher -> subscriber", so an UPDATE never sent cannot pass as one
+  never applied.
+
+PRIVATE CLUSTERS, two of them: the publisher at wal_level=logical, and a subscriber whose
+server log holds the apply worker's error, which never reaches a client.
+"""
+import pathlib
+import shutil
+import tempfile
+import time
+
+import psycopg
+import pytest
+
+from pgc_vacuity import query_error
+
+ROUND_TRIP = "the logical subscriber round trip"
+REPL_ERR = "logical replication cannot apply UPDATE or DELETE"
+GENERIC = "row locking is not supported"
+
+
+def _q(cluster, sql):
+    """-> the first column of the last statement's first row, as text; or query_error()."""
+    try:
+        with psycopg.connect(cluster.dsn(), autocommit=True, connect_timeout=5) as c:
+            cur = None
+            for stmt in [s for s in sql.split(";") if s.strip()]:
+                cur = c.execute(stmt)
+            row = cur.fetchone() if cur is not None and cur.description else None
+            return "" if row is None or row[0] is None else str(row[0])
+    except psycopg.Error as exc:
+        return query_error(str(exc).splitlines()[0] if str(exc) else type(exc).__name__)
+
+
+def _run(cluster, *sqls):
+    """Setup statements, as the shell runs them with their output dropped. A failure is
+    left for the readings after it to report by name."""
+    try:
+        with psycopg.connect(cluster.dsn(), autocommit=True, connect_timeout=5) as c:
+            for sql in sqls:
+                c.execute(sql)
+    except psycopg.Error:
+        pass
+
+
+def _as_psql(exc):
+    """-> a raised error's lines as psql prints them, so the shell's grep -c counts match."""
+    d = exc.diag
+    lines = [f"ERROR:  {d.message_primary or str(exc)}"]
+    if d.message_detail:
+        lines.append(f"DETAIL:  {d.message_detail}")
+    if d.message_hint:
+        lines.append(f"HINT:  {d.message_hint}")
+    return "\n".join(lines)
+
+
+def _said(cluster, sql):
+    """-> the error a statement raised, as psql prints it, or "" when it raised nothing.
+    Compared only with fixed counts, never with another reading."""
+    try:
+        with psycopg.connect(cluster.dsn(), autocommit=True, connect_timeout=5) as c:
+            c.execute(sql).fetchall()
+            return ""
+    except psycopg.Error as exc:
+        raised = exc
+    return _as_psql(raised)
+
+
+def _lines(text, needle):
+    return sum(1 for line in text.splitlines() if needle in line)
+
+
+def _log_has(log, needle):
+    """-> how many lines of the subscriber's log hold `needle`, or query_error()."""
+    try:
+        return _lines(log.read_text(errors="replace"), needle)
+    except OSError as exc:
+        return query_error(f"subscriber log unreadable: {exc}")
+
+
+def _wait(cluster, sql, want, tries=30):
+    for _ in range(tries):
+        if _q(cluster, sql) == want:
+            break
+        time.sleep(1)
+    return _q(cluster, sql)
+
+
+def _conf(datadir, *lines):
+    with open(datadir / "postgresql.conf", "a") as fh:
+        fh.write("\n" + "\n".join(lines) + "\n")
+
+
+def _yes_if(n, at_least):
+    return "yes" if isinstance(n, int) and n >= at_least else f"no ({n})"
+
+
+def _lock_readings(pub, mode):
+    out = _said(pub, f"SELECT * FROM lk WHERE id = 1 {mode}")
+    generic = _lines(out, GENERIC)
+    told = (_lines(out, "logical replication cannot apply") if generic
+            else f"no reading (no generic error: {out.splitlines()[0] if out else 'the statement raised nothing'})")
+    return generic, told
+
+
+@pytest.fixture(scope="module")
+def ls(pgc_cluster):
+    from pgc_cluster import Cluster, pick_port
+
+    work = pathlib.Path(tempfile.mkdtemp(prefix="pgc-lsub-"))
+    work.chmod(0o777)
+    pub = sub = None
+    r = {}
+    try:
+        try:
+            pub_port, sub_port = pick_port(26), pick_port(27)
+        except RuntimeError as exc:
+            yield {"no port": f"no free port for the subscriber cluster ({exc})"}
+            return
+        (work / "pub").mkdir()
+        (work / "sub").mkdir()
+        pub = Cluster(pgc_cluster.pg_config, "lsub-pub", work / "pub", pub_port)
+        pub.initdb()
+        _conf(work / "pub", "wal_level=logical", "max_wal_senders=10", "max_replication_slots=10",
+              "max_locks_per_transaction=256")
+        pub.start()
+        sub = Cluster(pgc_cluster.pg_config, "lsub-sub", work / "sub", sub_port)
+        sub.initdb()
+        _conf(work / "sub", "wal_level=logical", "max_locks_per_transaction=256")
+        try:
+            sub.start()
+        except RuntimeError:
+            pass        # the premise below reports it by name
+        log = work / "sub" / "server.log"
+        conninfo = f"host=127.0.0.1 port={pub.port} user=postgres dbname=postgres"
+
+        r["wal_level"] = _q(pub, "SHOW wal_level")
+        r["sub answers"] = _q(sub, "SELECT 1")
+        r["sub loaded"] = _q(sub, "CREATE EXTENSION IF NOT EXISTS pgcolumnar; "
+                                  "SELECT count(*) FROM pg_extension WHERE extname='pgcolumnar'")
+        _run(pub, "CREATE EXTENSION IF NOT EXISTS pgcolumnar")
+
+        # ---- 1. the working pattern: publish inserts only ----
+        _run(pub, "CREATE TABLE src (id int PRIMARY KEY, v text)",
+             "INSERT INTO src SELECT g, 'v'||g FROM generate_series(1,10) g",
+             "CREATE PUBLICATION p_ins FOR TABLE src WITH (publish = 'insert')")
+        _run(sub, "CREATE TABLE src (id int PRIMARY KEY, v text) USING pgcolumnar")
+        _run(sub, f"CREATE SUBSCRIPTION s_ins CONNECTION '{conninfo}' PUBLICATION p_ins")
+        r["initial sync"] = _wait(sub, "SELECT count(*) FROM src", "10")
+        _run(pub, "INSERT INTO src SELECT g, 'v'||g FROM generate_series(11,15) g")
+        r["streamed"] = _wait(sub, "SELECT count(*) FROM src", "15")
+        # the INSERT after the UPDATE proves the UPDATE before it was processed
+        _run(pub, "UPDATE src SET v = 'changed' WHERE id = 1")
+        _run(pub, "INSERT INTO src VALUES (16, 'after the update')")
+        sentinel = _wait(sub, "SELECT count(*) FROM src WHERE id = 16", "1")
+
+        def after_sentinel(reading):
+            return reading if sentinel == "1" else \
+                f"no reading (the INSERT after the UPDATE never arrived: [{sentinel}]; reading [{reading}])"
+        r["skipped"] = after_sentinel(_q(sub, "SELECT v FROM src WHERE id = 1"))
+        r["apply errors"] = after_sentinel(
+            _q(sub, "SELECT coalesce(sum(apply_error_count),0)::text FROM pg_stat_subscription_stats"))
+
+        # ---- 2. the wedge: a publication carrying UPDATE ----
+        _run(pub, "CREATE TABLE upd (id int PRIMARY KEY, v text)",
+             "INSERT INTO upd SELECT g, 'v'||g FROM generate_series(1,5) g",
+             "CREATE PUBLICATION p_all FOR TABLE upd")
+        _run(sub, "CREATE TABLE upd (id int PRIMARY KEY, v text) USING pgcolumnar")
+        _run(sub, f"CREATE SUBSCRIPTION s_all CONNECTION '{conninfo}' PUBLICATION p_all")
+        r["second synced"] = _wait(sub, "SELECT count(*) FROM upd", "5")
+        _run(pub, "UPDATE upd SET v = 'changed' WHERE id = 1")
+        for _ in range(25):
+            if isinstance(_log_has(log, REPL_ERR), int) and _log_has(log, REPL_ERR) >= 1:
+                break
+            time.sleep(1)
+        repl = _log_has(log, REPL_ERR)
+        r["names replication"] = _yes_if(repl, 1)
+        if not (isinstance(repl, int) and repl >= 1):
+            r["not only generic"] = "no reading (the subscriber log holds no replication error)"
+        else:
+            g = _log_has(log, GENERIC)
+            r["not only generic"] = "yes" if g == 0 else f"no ({g})"
+        r["hint"] = _yes_if(_log_has(log, "publish = "), 1)
+        r["wedge"] = f"{_q(pub, 'SELECT v FROM upd WHERE id = 1')} -> {_q(sub, 'SELECT v FROM upd WHERE id = 1')}"
+        for _ in range(20):
+            n = _log_has(log, REPL_ERR)
+            if isinstance(n, int) and n >= 2:
+                break
+            time.sleep(2)
+        r["retries"] = _yes_if(_log_has(log, REPL_ERR), 2)
+
+        # ---- 3. the gate must not widen ----
+        _run(pub, "CREATE TABLE lk (id int primary key, v text) USING pgcolumnar",
+             "INSERT INTO lk VALUES (1, 'a')")
+        r["lk am"] = _q(pub, "SELECT amname FROM pg_class c JOIN pg_am a ON a.oid=c.relam WHERE c.relname='lk'")
+        for mode in ("FOR UPDATE", "FOR SHARE", "FOR NO KEY UPDATE"):
+            r[mode] = _lock_readings(pub, mode)
+
+        _run(sub, "DROP SUBSCRIPTION s_ins")
+        _run(sub, "DROP SUBSCRIPTION s_all")
+        yield r
+    finally:
+        for c in (sub, pub):
+            if c is not None:
+                c.stop()
+        shutil.rmtree(work, ignore_errors=True)
+
+
+def _runnable(ls, expect):
+    if "no port" in ls:
+        expect.cannot_run("UNAVAILABLE_ENDPOINT", ls["no port"], name="the logical subscriber round trip")
+        return False
+    return True
+
+
+def test_the_publisher_has_logical_decoding_on(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["wal_level"], "logical", "premise: the publisher has logical decoding on")
+
+
+def test_the_subscriber_cluster_answers(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["sub answers"], "1", "premise: the subscriber cluster answers")
+
+
+def test_the_subscriber_loaded_pgcolumnar(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["sub loaded"], "1", "premise: the subscriber loaded pgcolumnar")
+
+
+def test_insert_only_initial_sync_copied_every_row(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["initial sync"], "10", "insert-only: initial sync copied every row")
+
+
+def test_insert_only_streamed_inserts_applied(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["streamed"], "15", "insert-only: streamed INSERTs applied")
+
+
+def test_insert_only_the_update_is_skipped_by_design(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["skipped"], "v1", "insert-only: the UPDATE is skipped by design, not applied")
+
+
+def test_insert_only_no_apply_errors(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["apply errors"], "0", "insert-only: no apply errors")
+
+
+def test_the_second_subscription_synced_before_the_update(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["second synced"], "5", "the second subscription synced before the UPDATE")
+
+
+def test_the_apply_error_names_logical_replication(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["names replication"], "yes", "the error names logical replication, not row locking")
+
+
+def test_the_apply_error_does_not_say_only_row_locking(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["not only generic"], "yes", "the error does NOT say only 'row locking is not supported'")
+
+
+def test_the_apply_hint_names_the_insert_only_publication(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["hint"], "yes", "the hint names the insert-only publication")
+
+
+def test_the_wedged_row_is_unchanged_on_the_subscriber(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["wedge"], "changed -> v1", "the wedge is real: the row is still unchanged on the subscriber")
+
+
+def test_the_apply_worker_retries_so_the_subscription_is_wedged(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["retries"], "yes", "it retries rather than giving up, so the subscription is wedged")
+
+
+def test_the_lock_fixture_is_columnar(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(ls["lk am"], "pgcolumnar", "premise: the lock fixture really is columnar")
+
+
+def test_select_for_update_keeps_the_generic_message(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR UPDATE"][0]), "1", "an ordinary SELECT ... FOR UPDATE keeps the generic message")
+
+
+def test_select_for_update_is_not_told_about_replication(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR UPDATE"][1]), "0",
+                    "an ordinary SELECT ... FOR UPDATE is not told about replication")
+
+
+def test_select_for_share_keeps_the_generic_message(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR SHARE"][0]), "1", "an ordinary SELECT ... FOR SHARE keeps the generic message")
+
+
+def test_select_for_share_is_not_told_about_replication(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR SHARE"][1]), "0",
+                    "an ordinary SELECT ... FOR SHARE is not told about replication")
+
+
+def test_select_for_no_key_update_keeps_the_generic_message(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR NO KEY UPDATE"][0]), "1",
+                    "an ordinary SELECT ... FOR NO KEY UPDATE keeps the generic message")
+
+
+def test_select_for_no_key_update_is_not_told_about_replication(ls, expect):
+    if _runnable(ls, expect):
+        expect.text(str(ls["FOR NO KEY UPDATE"][1]), "0",
+                    "an ordinary SELECT ... FOR NO KEY UPDATE is not told about replication")
diff --git a/test/pytest/unported_suites.txt b/test/pytest/unported_suites.txt
index 9a22f4629..e74645c4d 100644
--- a/test/pytest/unported_suites.txt
+++ b/test/pytest/unported_suites.txt
@@ -6,28 +6,10 @@
 # in that file. A port PR removes its own line, so two ports never conflict here.
 #
 # The parity goal (#432) is this file empty.
-audit
-bench_guards
 cancel_decode
 decode_interrupts
 decode_skip_interrupts
-docs_style
-fuzz
-fuzz_arrow
-fuzz_avro
-fuzz_listing
-fuzz_parquet
 harness_selftest
-hilbert_curve
-iceberg_deletes
-iceberg_dv
-iceberg_rest
-iceberg_rest_scan
-iceberg_rest_server
-iceberg_rest_vended
-logical_decoding_cdc_recipe
-logical_decoding_source
-logical_subscriber
 native_agg_deletes
 native_cancel
 native_cluster
diff --git a/test/run_all_versions.sh b/test/run_all_versions.sh
index 5d912e05a..30dfb4f11 100755
--- a/test/run_all_versions.sh
+++ b/test/run_all_versions.sh
@@ -1228,7 +1228,7 @@ pgc_accounted_among() {	# pgc_accounted_among NAMEFILE WIDEFILE -> names
 #
 # A STATIC RULE CANNOT DO THIS JOB, and two attempts got it wrong in different
 # directions before this reader existed. "Does this suite record?" is a RUNTIME
-# property: `audit.sh` defines its own `check()` whose body calls `pgc_record`, so a
+# property: `phase2.sh` defines its own `check()` whose body calls `pgc_record`, so a
 # rule keyed on defining a local check() misses it; `objstore_stash_recovery.sh`
 # uses lib.sh's check() directly, so the string `pgc_record` never appears in the
 # file at all and a rule keyed on that misses it too. And a third, excluding files
@@ -1245,7 +1245,7 @@ pgc_log_shows_any_accounting() {	# pgc_log_shows_any_accounting LOGFILE -> yes|n
 	# Did this suite count its checks AT RUNTIME, by any mechanism the log shows?
 	#
 	# Two exist in the tree. lib.sh's pgc_summary prints the accounting line, and
-	# 239 suites use it. bench_guards and docs_style keep private counters and
+	# 239 suites use it. bench_guards keeps private counters (docs_style did until #1341) and
 	# print their own `checks run: N`; they never source lib.sh, so the first
 	# reader cannot see them, and calling them unaccounted would be false.
 	#
@@ -1882,6 +1882,7 @@ pgc_tally_suite() {	# pgc_tally_suite NAME VERDICT LOGFILE
 	# suite that prints its own `checks run:` line. Measured on this tree: twelve
 	# registered suites never call `pgc_summary`, and of those exactly two --
 	# `bench_guards` and `docs_style` -- emit a tally of their own, which is the 2.
+	# (#1341 moved docs_style onto lib.sh, so today it is bench_guards alone.)
 	# The other ten keep no tally at all and are the real debt.
 	#
 	# THE NAMES ARE PRINTED, NOT COUNTED, so nothing here can go stale: the two are
@@ -1934,7 +1935,7 @@ pgc_tally_suite() {	# pgc_tally_suite NAME VERDICT LOGFILE
 		# their own `checks run:` instead. That is a statement about the ACCOUNTING
 		# LINE and nothing else: measured over all twelve of them, ten emit RESULT
 		# records perfectly well (audit 31, phase4 38, unique_conc 31, ...) and only
-		# bench_guards and docs_style emit none -- which is the pair the comment on
+		# bench_guards and docs_style emitted none (docs_style records since #1341) -- the pair the comment on
 		# pgc_log_shows_any_accounting already names, for the real reason: those two
 		# never source lib.sh at all.
 		echo "    $_acc_ran printed lib.sh's accounting line; these printed their own \`checks run:\` instead (a different accounting LINE, not a missing RESULT record):${_acc_own% }"
diff --git a/test/selftest/320-a-check-that-could-not-run.sh b/test/selftest/320-a-check-that-could-not-run.sh
index c8eb57b92..b18693d4a 100644
--- a/test/selftest/320-a-check-that-could-not-run.sh
+++ b/test/selftest/320-a-check-that-could-not-run.sh
@@ -208,8 +208,15 @@ done < <(grep -rn 'PGC_CHECKS=\$((PGC_CHECKS' "$_cnt_dir"/*.sh "$_cnt_dir"/selft
 #
 # It now asserts the sweep read something, and the classifier is proven on a
 # FIXTURE below rather than on whatever the corpus happens to contain.
-check "premise: the sweep read the corpus and found sites to classify" \
-	"$([ "${#_cnt_sites[@]}" -ge 1 ] && echo yes || echo "no (${#_cnt_sites[@]})")" "yes"
+#
+# "Read something" is the FILES scanned, not the sites found (#1341). The same
+# mistake one level down: requiring one site went red when bench_guards.sh, the
+# last suite keeping its own tally, moved onto lib.sh's accounting -- zero sites
+# is the state the rules below exist to reach. A sweep pointed at the wrong
+# directory reads no files, which this still refuses.
+_cnt_files="$(ls "$_cnt_dir"/*.sh "$_cnt_dir"/selftest/*.sh 2>/dev/null | grep -c .)"
+check "premise: the sweep read the corpus" \
+	"$([ "${_cnt_files:-0}" -ge 100 ] && echo yes || echo "no (${_cnt_files:-0} files)")" "yes"
 
 # A file that keeps its OWN counters and never calls pgc_summary is not bound by
 # this invariant, because nothing reconciles it. Asserted rather than assumed:
diff --git a/test/selftest/390-a-registered-suite-must-account.sh b/test/selftest/390-a-registered-suite-must-account.sh
index ed627eb94..bcbad7816 100644
--- a/test/selftest/390-a-registered-suite-must-account.sh
+++ b/test/selftest/390-a-registered-suite-must-account.sh
@@ -521,7 +521,7 @@ check "and it agrees with the real reader on a SHORT file, which is why it survi
 # So the population is its own check, over its own four buckets. A suite is
 # ACCOUNTED when its log carries evidence it counted its checks -- either
 # lib.sh's accounting line, or its own `checks run:` line, which is what
-# bench_guards and docs_style print from private counters. Runtime-observable in
+# bench_guards prints from private counters (docs_style did until #1341). Runtime-observable in
 # both cases, and derived rather than declared, so a suite that adopts either
 # mechanism leaves the debt bucket on its own.
 
@@ -656,6 +656,7 @@ check "the debt file is in the tree" \
 # that prints its own `checks run:` line. Measured on this tree: of the twelve
 # registered suites that never call `pgc_summary`, exactly two emit a tally of their own
 # -- `bench_guards` and `docs_style` -- and the other ten keep none. The two are the 2.
+# (#1341 moved docs_style onto lib.sh; the run prints whoever remains.)
 #
 # THE NAMES ARE PRINTED BY THE RUN, not counted here: a third suite adopting its own
 # mechanism appears without anyone editing a number.
diff --git a/test/selftest/480-an-unrunnable-record-names-its-check.sh b/test/selftest/480-an-unrunnable-record-names-its-check.sh
index 244352daa..8962fadf7 100644
--- a/test/selftest/480-an-unrunnable-record-names-its-check.sh
+++ b/test/selftest/480-an-unrunnable-record-names-its-check.sh
@@ -56,11 +56,12 @@ check "premise: and it compared them rather than writing them all off as dynamic
 # regression test rather than a restatement of the code.
 #
 # The refusal set decides what gets swept. A new refusal emitter must be looked at
-# rather than silently sweep or silently not sweep; `arms_unrunnable` is here
-# because it wraps `check_unrunnable` and reads its names from a list, so it must
-# be recognised as a refusal and must NOT be offered as a twin.
-check_text "the refusal emitters are the two the tree defines" \
-	"$_un_ref" "arms_unrunnable:None check_unrunnable:1"
+# rather than silently sweep or silently not sweep. `arms_unrunnable` was here,
+# wrapping `check_unrunnable` and reading its names from a list, until hilbert_curve's
+# port (#1341) wrote it out as loops at its call sites; `check_unrunnable` is now the
+# only one, and a new list-taking wrapper reddens this arm by name.
+check_text "the refusal emitters are the ones the tree defines" \
+	"$_un_ref" "check_unrunnable:1"
 
 # pgc_skip records `pgc_record FAIL "$2"`: its first quoted argument is the
 # CAPABILITY, not the name. Reading argument one takes `arrow` where the check is