fix(persistence): fail closed on committed DO blocks that hide execution-context mutations

[seonghobae]

Finding

#576–#581 fold committed session_replication_role mutations through direct SET, PostgreSQL's set_config(...), and writable pg_settings.setting. The shared lexical authority deliberately makes dollar-quoted bodies opaque. PostgreSQL DO, however, executes its code body immediately as a transient anonymous function. A committed migration can therefore hide an execution-context mutation inside a DO body:

DO $$
BEGIN
  PERFORM set_config('session_replication_role', 'replica', false);
END
$$;

After lexical normalization the dollar body is intentionally masked, so the current execution-context fold sees only a DO statement and cannot prove that ordinary append-only/retention triggers remained enabled. With is_local=false, the set_config value is session-scoped; even transaction-local mutations can permit protected DML to commit while ordinary triggers are suppressed.

PostgreSQL 18 authority:

• DO executes an anonymous code block once and treats it as a transient function body: https://www.postgresql.org/docs/18/sql-do.html
• set_config is the function equivalent of SET, and pg_settings.setting is another equivalent surface: https://www.postgresql.org/docs/18/config-setting.html
• session_replication_role=replica prevents ordinary/default triggers and rules from firing: https://www.postgresql.org/docs/18/runtime-config-client.html#GUC-SESSION-REPLICATION-ROLE

Contract

At exported validate_migration_catalog():

• a committed top-level DO block must fail closed with MissingAppRuntimeRole until TEPP owns executable procedural-body semantics;
• DO LANGUAGE plpgsql $$...$$ and DO $$...$$ LANGUAGE plpgsql are the same execution-risk boundary;
• a DO block inside an explicit transaction that rolls back remains non-durable through fix(persistence): exclude rolled-back membership mutations from RLS safety evidence #560 committed-state projection and must not poison final validation;
• dollar-quoted text used as data (SELECT $$DO ...$$) and marker text inside comments/literals must remain inert;
• CREATE FUNCTION/PROCEDURE ... AS $$...$$ must not be rejected merely because its body is opaque: definition is not immediate execution;
• do not parse PL/pgSQL locally or introduce a second raw-SQL lexer. Reuse the shared lexical normalization: after the body is masked, a committed statement whose first structural token is exactly DO is unprovable execution context and therefore fails closed.

This is a bounded safety repair, not the architectural endpoint. The long-term execution-context aggregate should model immediately executed procedural SQL, nested dynamic SQL, configuration mutation, protected-DML ordering, privileges, and transaction outcome explicitly.

Keep open until post-#538 non-force-restack exact-head hosted Rust/Live PostgreSQL, current-topology rustdoc/coverage/security, and qualifying independent approval exist. Draft-skipped execution is not GREEN.

[seonghobae]

Ordinary-forward implementation evidence:

• Public RED 08fa13150c47c715de5b134084e45b78ad2e080e: adds migration_do_execution_context_contract.rs for committed DO (plain and both LANGUAGE plpgsql placements), rollback, dollar/comment marker opacity, and a CREATE FUNCTION ... AS $$...$$ positive control.
• Causal repair/current exact head 92a4df632986237ca4de571992be585284d9b786: after shared lexical normalization and fix(persistence): exclude rolled-back membership mutations from RLS safety evidence #560 committed-state projection, committed_replica_trigger_execution_mode() now fails closed only when a surviving normalized statement's first structural token is exactly DO. No PL/pgSQL parser, raw-SQL lexer, executable migration rewrite, workflow/gate/threshold change, skip/xfail, or coverage-denominator change was introduced.
• RED → repair compare is one production file, migration_validation.rs, with the new test remaining in the RED ancestor. Exact-head Rust Foundation run 35327771775 is completed/skipped under Draft lifecycle, so this is source-level repair only, not hosted GREEN.
• Scoped CodeRabbit review has been requested for exact 92a4df63...; no verdict is counted until it lands.

[seonghobae]

Superseding scoped source review is now available for exact 92a4df632986237ca4de571992be585284d9b786. CodeRabbit verified the requested checkout and that RED 08fa13150c47c715de5b134084e45b78ad2e080e is an ancestor, then found no source-level counterexample in the requested #582 scope. The review covered exact first-token DO, both LANGUAGE placements represented by the public RED, rollback projection, lexical opacity, and non-executed routine-definition controls. This is source review only; it is not a qualifying submitted approval and does not replace hosted Rust/Live PostgreSQL/rustdoc/coverage/security evidence.