test: refuse to measure a binary that was not built from this source

[OffgridwithJD]

The matrix builds once per major and then runs every suite with PGC_SKIP_BUILD=1. Nothing checked that the binary those suites measured came from the tree under test. This adds that check, at the controller, so a stale .so cannot be measured and nothing has to rebuild per test.

Two failure modes, both of which have bitten this project before, and both now FATAL rather than advisory.

1. The binary was not built from this source

The controller records a fingerprint of the build inputs after a successful install. Every suite compares it, whether that suite built or skipped.

-- source: 28b66bd0ac0c matches the binary under test

Proved by removal, with controls on both sides:

arm	result
clean skip-build run	exit 0, fingerprint matches
source changed, no rebuild	exit 1
restored, re-run	exit 0, same fingerprint as the first arm

The red arm reports:

FATAL: the binary under test was not built from this source
       source now 25f824613a73, binary built from 28b66bd0ac0c
       (refusing to report checks about code that is not installed)

It names both fingerprints, because "stale" without the two values leaves the reader unable to tell a real drift from a broken fingerprint.

2. The server predates the binary

A make install does not reload anything. shared_preload_libraries maps the library at postmaster start, so a reinstall under a running server leaves the backends executing the old code while the file on disk is new. The check compares the .so mtime against pg_postmaster_start_time():

-- server: started after the binary was installed

and on the bad verdict says what to do rather than only what is wrong:

FATAL: this server was already running when the binary changed
       shared_preload_libraries maps the library at start, so the
       backends are executing older code than the file on disk.
       Restart the cluster; a reinstall alone does not reload it.

unknown is not a failure, deliberately

Someone who ran make install by hand has no stamp. Refusing would break a documented workflow, so that case prints

-- source: <fingerprint>, freshness UNVERIFIED (no stamp for major 18)

The point is that it says which question was not answered, rather than printing nothing and letting a reader assume the check passed. A silent third state is how a verdict becomes lossy.

The verdict functions are pure, and tested as such

pgc_freshness_verdict and pgc_running_binary_verdict take strings and return fresh / stale / unknown and fresh / predates / unknown. They touch no filesystem, so test/selftest/340-the-binary-must-be-built-from.sh tests them directly — 16 arms including both empty inputs, a non-numeric epoch, equal timestamps on the exact boundary, and fingerprint sensitivity to each input class.

harness_selftest goes from 261 checks to 277.

Two defects this found in itself

The stamp was written in the wrong branch first. My initial version wrote it in the skip-build path, which made the check tautological: it recomputed the fingerprint of the source it had just read and reported "matches" on edited source. My own red arm caught it. The stamp is now written only after a successful install; the verify runs always.

The controller swallowed its own failure. The stamp write was ... || true. If it failed, every suite in the batch would report freshness UNVERIFIED and the controller arm would silently stop being a controller arm — the exact state this exists to prevent, with nothing saying so. It now prints what a failure means for the run below it.

Verification

Full matrix on both majors at 0332527:

PG18   244 of 246 suites ran (2 skipped, 0 incomplete)   zero FAIL
PG19   246 of 246 suites ran (0 skipped, 0 incomplete)   zero FAIL
ALL VERSIONS PASSED

A full matrix is the right bar here and there was no shortcut available: this changes test/lib.sh, which every suite reads.

The check was observed working inside that matrix, not only in isolation. Sampling the live PG19 per-suite logs three times during the run:

47 logs   42 report fresh    0 UNVERIFIED   0 FATAL
84 logs   79 report fresh    0 UNVERIFIED   0 FATAL
173 logs  168 report fresh   0 UNVERIFIED   0 FATAL

The five that report nothing are accounted for rather than assumed: audit, bench_guards, concurrency and docs_style never call pgc_setup, and decode_interrupts is a static source-analysis suite whose only occurrence of pgc_setup is the comment "No cluster needed; pgc_setup is skipped deliberately." — my first grep -c counted that comment as a call.

.gitignore gains .pgc_source_stamp.* beside .pgc_built_for_major, which is the same kind of file for the same reason. Verified the new rule is the one matching — the file was not ignored before, and git check-ignore -v now names .gitignore:10 — rather than assuming my rule was what caught it.

[OffgridwithJD]

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uf6UoeBRZYLQZa4KxNiw8a