test: attack eighteen arms across three parts (#1236)

CHANGELOG.md

@@ -18,6 +18,47 @@ true until the next version shipped.
 
 ### Changed
 
+- Eighteen arms across `validity_elision`, selftest part 190 and
+  `native_join_vector_agg` now carry a mutation that reddens them (#1236). No
+  test changed and no code changed: the arms were attacked and the ledger
+  records what happened.
+
+  Six mutations over three parts, each prediction written before it ran:
+
+  ```
+    veC    the elision predicate forced true              5 arms
+    b190A  pgc_build_needs_clean never asks for a clean    5 arms
+    b190B  the stamp writes an escaped literal (#898)      2 arms
+    b190C  pgc_build_needs_clean always demands a clean    2 arms
+    b190D  unknown provenance reported as a major, PG?     2 arms
+    jvaB   the dim-side uniqueness refusal disabled        2 arms
+  ```
+
+  **b190A and b190C are opposites and redden disjoint pairs.** A guard that
+  never cleans loses the five arms about when a clean is required; a guard that
+  always cleans loses exactly two -- "building the same major again needs no
+  clean" and "but a tree with no objects at all needs nothing, stamp or not".
+  Only those two can tell a correct guard from one that is merely fail-closed,
+  and a guard that cleans unconditionally would pass every other arm in the part.
+
+  **Fifteen of the eighteen are newly dated.** The other three are
+  `validity_elision` arms already dated under the inverse mutation -- the
+  predicate forced *false* rather than *true* -- so they now carry both strings.
+  An arm reddened by a predicate in either direction is stronger evidence than
+  one reddened in a single direction, and the ledger keeps both rather than
+  overwriting.
+
+  Re-derived on the merged tree rather than carried forward. All six had been
+  run once before #1240 and #1241 landed, and all six were re-run against
+  `ac80762a`, reproducing their earlier results exactly -- same names, not merely
+  the same counts, with a control showing the comparison can separate unrelated
+  sets. "The check names still exist" and "the mutation still reddens them" are
+  different claims, and only re-running tests the second.
+
+  The two C mutations ran with a forced `make clean`: PGXS here has no
+  `--enable-depend`, so a stale object after a header edit would leave `veC`
+  reddening nothing and reading exactly like a fixture fact.
+
 - Nine `index_am_support` arms now carry a mutation that reddens them (#1236).
   No test changed and no code changed.
 

test/check_ledger.tsv

@@ -400,20 +400,20 @@ harness_selftest	180-the-port-walk-must-wrap-not	premise: the real prober was re
 harness_selftest	180-the-port-walk-must-wrap-not	premise: the stub frees exactly one port, 500 past the floor	15;16;17;18;19	never	-
 harness_selftest	180-the-port-walk-must-wrap-not	premise: the stub really does refuse the top of the band	15;16;17;18;19	never	-
 harness_selftest	190-an-in-tree-build-must-not	a comment naming the call does not satisfy the arm above	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	an unknown provenance is not reported as a major	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	an unparseable stamp cleans rather than guessing	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	and an empty WANT is refused rather than compared	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	and in the other direction too	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	and it is 3 bytes, not an escaped literal	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	and it says plainly that no major was recorded	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	building a DIFFERENT major needs a clean, which is the #536 case	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	building the same major again needs no clean	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	but a tree with no objects at all needs nothing, stamp or not	15;16;17;18;19	never	-
-harness_selftest	190-an-in-tree-build-must-not	objects with NO stamp are unknown provenance and must be cleaned	15;16;17;18;19	never	-
+harness_selftest	190-an-in-tree-build-must-not	an unknown provenance is not reported as a major	15;16;17;18;19	2026-09-23	an unknown provenance is reported as a major, PG?, instead of saying none was recorded
+harness_selftest	190-an-in-tree-build-must-not	an unparseable stamp cleans rather than guessing	15;16;17;18;19	2026-09-23	pgc_build_needs_clean never asks for a clean
+harness_selftest	190-an-in-tree-build-must-not	and an empty WANT is refused rather than compared	15;16;17;18;19	2026-09-23	pgc_build_needs_clean never asks for a clean
+harness_selftest	190-an-in-tree-build-must-not	and in the other direction too	15;16;17;18;19	2026-09-23	pgc_build_needs_clean never asks for a clean
+harness_selftest	190-an-in-tree-build-must-not	and it is 3 bytes, not an escaped literal	15;16;17;18;19	2026-09-23	the build stamp writes an escaped literal, restoring the #898 bug
+harness_selftest	190-an-in-tree-build-must-not	and it says plainly that no major was recorded	15;16;17;18;19	2026-09-23	an unknown provenance is reported as a major, PG?, instead of saying none was recorded
+harness_selftest	190-an-in-tree-build-must-not	building a DIFFERENT major needs a clean, which is the #536 case	15;16;17;18;19	2026-09-23	pgc_build_needs_clean never asks for a clean
+harness_selftest	190-an-in-tree-build-must-not	building the same major again needs no clean	15;16;17;18;19	2026-09-23	pgc_build_needs_clean always demands a clean
+harness_selftest	190-an-in-tree-build-must-not	but a tree with no objects at all needs nothing, stamp or not	15;16;17;18;19	2026-09-23	pgc_build_needs_clean always demands a clean
+harness_selftest	190-an-in-tree-build-must-not	objects with NO stamp are unknown provenance and must be cleaned	15;16;17;18;19	2026-09-23	pgc_build_needs_clean never asks for a clean
 harness_selftest	190-an-in-tree-build-must-not	premise: the build-stamp decision is exposed to be judged	15;16;17;18;19	never	-
 harness_selftest	190-an-in-tree-build-must-not	premise: the stamp writer is a function that can be exercised	15;16;17;18;19	never	-
 harness_selftest	190-an-in-tree-build-must-not	the build path asks pgc_build_needs_clean rather than merely naming it	15;16;17;18;19	2026-09-23	the call replaced by a comment naming it
-harness_selftest	190-an-in-tree-build-must-not	the stamp lib.sh writes is exactly the major	15;16;17;18;19	never	-
+harness_selftest	190-an-in-tree-build-must-not	the stamp lib.sh writes is exactly the major	15;16;17;18;19	2026-09-23	the build stamp writes an escaped literal, restoring the #898 bug
 harness_selftest	200-additions-go-in-their-own-file	premise: the parts directory exists and was sourced	15;16;17;18;19	never	-
 harness_selftest	200-additions-go-in-their-own-file	the driver holds no checks; they all live in parts	15;16;17;18;19	never	-
 harness_selftest	200-additions-go-in-their-own-file	the driver sources the parts by glob, not by a list	15;16;17;18;19	never	-
@@ -1478,8 +1478,8 @@ native_join_runtime_filter	native_join_runtime_filter	scattered plan has coordin
 native_join_runtime_filter	native_join_runtime_filter	scattered still reads every group	15;16;17;18;19	never	-
 native_join_vector_agg	native_join_vector_agg	LEFT join answer equals heap	15;16;17;18;19	never	-
 native_join_vector_agg	native_join_vector_agg	LEFT join refuses the join fold	15;16;17;18;19	never	-
-native_join_vector_agg	native_join_vector_agg	duplicate dim keys answer equals heap	15;16;17;18;19	never	-
-native_join_vector_agg	native_join_vector_agg	duplicate dim keys refuse the join fold	15;16;17;18;19	never	-
+native_join_vector_agg	native_join_vector_agg	duplicate dim keys answer equals heap	15;16;17;18;19	2026-09-23	the dim-side uniqueness refusal disabled
+native_join_vector_agg	native_join_vector_agg	duplicate dim keys refuse the join fold	15;16;17;18;19	2026-09-23	the dim-side uniqueness refusal disabled
 native_join_vector_agg	native_join_vector_agg	extra join filter answer equals GUC off	15;16;17;18;19	2026-09-12	-
 native_join_vector_agg	native_join_vector_agg	extra join filter answer equals heap	15;16;17;18;19	2026-09-12	-
 native_join_vector_agg	native_join_vector_agg	extra join filter refuses the join fold	15;16;17;18;19	2026-09-12	-
@@ -1599,15 +1599,15 @@ validity_elision	validity_elision	premise: the first fixture holds no nulls at a
 validity_elision	validity_elision	premise: the join arms below reach the columnar side by index too	15;16;17;18;19	never	-
 validity_elision	validity_elision	premise: the per-chunk arm's residual was summed over chunks that exist	15;16;17;18;19	never	-
 validity_elision	validity_elision	premise: the residual was summed over chunks that exist	15;16;17;18;19	never	-
-validity_elision	validity_elision	premise: the second fixture holds nulls, so its bitmap is load-bearing	15;16;17;18;19	never	-
-validity_elision	validity_elision	single-row fetches of the null-bearing column return its nulls as nulls	15;16;17;18;19	never	-
+validity_elision	validity_elision	premise: the second fixture holds nulls, so its bitmap is load-bearing	15;16;17;18;19	2026-09-23	the validity-elision predicate forced true, so every column reads as if its bitmap were elided
+validity_elision	validity_elision	single-row fetches of the null-bearing column return its nulls as nulls	15;16;17;18;19	2026-09-23	the validity-elision predicate forced true, so every column reads as if its bitmap were elided
 validity_elision	validity_elision	single-row fetches through the elided path return the row asked for	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;reader: pgcolumnar_fetch_get_row uses the group-wide validityBytes instead of this chunk's own, which is the pre-fix defect
 validity_elision	validity_elision	the full column fetched by index matches the heap, row for row	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;reader: pgcolumnar_fetch_get_row uses the group-wide validityBytes instead of this chunk's own, which is the pre-fix defect
 validity_elision	validity_elision	the full column holds no row the heap does not	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write
 validity_elision	validity_elision	the full column preserves its null count	15;16;17;18;19	never	-
 validity_elision	validity_elision	the full column reads back exactly what the heap holds	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write
-validity_elision	validity_elision	the nulls column fetched by index matches the heap, row for row	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;reader: pgcolumnar_fetch_get_row uses the group-wide validityBytes instead of this chunk's own, which is the pre-fix defect
-validity_elision	validity_elision	the nulls column holds no row the heap does not	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write
+validity_elision	validity_elision	the nulls column fetched by index matches the heap, row for row	15;16;17;18;19	2026-09-23	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;reader: pgcolumnar_fetch_get_row uses the group-wide validityBytes instead of this chunk's own, which is the pre-fix defect;the validity-elision predicate forced true, so every column reads as if its bitmap were elided
+validity_elision	validity_elision	the nulls column holds no row the heap does not	15;16;17;18;19	2026-09-23	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;the validity-elision predicate forced true, so every column reads as if its bitmap were elided
 validity_elision	validity_elision	the nulls column preserves its null count	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write
-validity_elision	validity_elision	the nulls column reads back exactly what the heap holds	15;16;17;18;19	2026-09-18	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write
+validity_elision	validity_elision	the nulls column reads back exactly what the heap holds	15;16;17;18;19	2026-09-23	reader: PgColumnarEncdescOmitsValidity returns false, so every reader expects a bitmap the writer did not write;the validity-elision predicate forced true, so every column reads as if its bitmap were elided
 validity_elision	validity_elision	while a column with nulls still stores one, sized one bit per row	15;16;17;18;19	never	-

test/check_ledger_budget.txt

@@ -670,4 +670,55 @@ suites_not_covered 249
 #
 # The one arm left `never` is the fixture premise, whose only mutation is the
 # fixture itself. A fixture fact, in #1236's taxonomy, not an uncovered guard.
-checks_never_observed_red 1511
+#
+# 1511 -> 1496 for #1236's third, fourth and fifth batches: three parts attacked
+# with six mutations, 18 rows touched, none of them a new row. RE-DERIVED BY
+# COUNTING on the tree that carries #1244, which this branch was rebased onto:
+#
+#     awk -F'\t' '$5=="never"' test/check_ledger.tsv | wc -l   ->  1496
+#     1613 rows total, 117 not `never`,  1496 + 117 == 1613
+#
+# THIS BRANCH HAS CARRIED 1497 AND NOW 1496, and only the second describes a
+# tree that exists. The first was counted against a main without #1244. It was
+# also PREDICTED at 1496 before the rebase ran, from #1244's published
+# 1613/1511/102 plus this branch's 15 newly-dated -- which is the point of
+# publishing the population beside the number: the recount had something
+# external to disagree with rather than only itself.
+#
+# EIGHTEEN ROWS TOUCHED, FIFTEEN NEWLY DATED, and the gap is deliberate. Three
+# `validity_elision` arms were already dated 2026-09-18 under the INVERSE
+# mutation -- the elision predicate forced FALSE, so every reader expects a
+# bitmap the writer did not write. This batch forces it TRUE. Both directions
+# redden the same three arms, so those rows carry both mutation strings and the
+# later date rather than the newer observation overwriting the older. An arm
+# reddened by a predicate in either direction is better evidence than one
+# reddened in a single direction.
+#
+# THE SIX MUTATIONS, each with its prediction written before it ran:
+#
+#   veC    the elision predicate forced true              5 arms
+#   b190A  pgc_build_needs_clean never asks for a clean    5 arms
+#   b190B  the stamp writes an escaped literal (#898)      2 arms
+#   b190C  pgc_build_needs_clean always demands a clean    2 arms
+#   b190D  unknown provenance reported as a major, PG?     2 arms
+#   jvaB   the dim-side uniqueness refusal disabled        2 arms
+#
+# b190A AND b190C ARE OPPOSITES AND REDDEN DISJOINT PAIRS. Never-clean loses the
+# five arms about when a clean is required; always-clean loses exactly two --
+# "building the same major again needs no clean" and "but a tree with no objects
+# at all needs nothing, stamp or not". Only those two separate a correct guard
+# from one that is merely fail-closed: a guard that cleaned unconditionally
+# passes every other arm in that part. Checked exhaustively rather than by the
+# run alone -- part 190 has 15 arms, 5 assert "yes", 2 assert "no", and the
+# remaining 8 drive the message function, the stamp writer, static greps or
+# `type -t`, so none of them can depend on the decision's value.
+#
+# RE-DERIVED ON THE MERGED TREE, NOT CARRIED FORWARD. All six ran once before
+# #1240 and #1241 landed and were re-run against the merged tree, reproducing
+# their earlier results exactly -- same names, not merely the same counts, with
+# a control showing the comparison can separate two unrelated sets. "The check
+# names still exist" and "the mutation still reddens them" are different claims
+# and only re-running tests the second. The two C mutations ran with a forced
+# `make clean`: PGXS here has no --enable-depend, so a stale object after a
+# HEADER edit would leave veC reddening nothing and reading like a fixture fact.
+checks_never_observed_red 1496