[ibrahim halatci (ihalatci)]

DESCRIPTION: Evaluates replayed object definitions in the owner's context

Layer 3 of 3, based on #8955. Ports the final merged behavior from #8946 to main, without changing the two prerequisite layers.

Expression-bearing metadata replay runs as the object owner under SECURITY_RESTRICTED_OPERATION, with identity, security context, settings, and single-statement markers restored on success or error. This covers dependency replay, node activation, partition attachment, worker name collisions, and the current object-repair path. The expression-free allowlist and warn (default), require, and off controls match the final source; the new GUCs precede metadata_sync_* alphabetically.

Main-specific adaptation preserves the existing bundled partition metadata API, activation filtering/cache flushing, and repair existence/force-recreate checks. The security module and header are identical to the final source. Regression coverage includes real tenant-owned domain repair, missing-domain activation, guarded domain-array partition bounds, cached expressions, privilege denial, single-use markers, and settings restoration on success/error. The role-change assertion uses the actual current role and checks the specific privilege error rather than catching every error.

No extension version, ACL, migration SQL, changelog, or configuration-file changes. Current-only coverage is in multi_1_create_citus_schedule, not the N-1-compatible schedule.

Validation on an isolated WSL PostgreSQL 18.6 runtime:

• ./configure --with-pgconfig="$root/pg/bin/pg_config" — passed.
• make -s -j8 and make -s install-all — passed.
• make -C src/test/regress check-minimal EXTRA_TESTS="multi_metadata_sync_domain metadata_replay_security distributed_domain propagate_foreign_servers view_propagation citus_internal_distribute_object" — 12/12 passed.
• make -C src/test/regress check-multi-1 — 210/210 passed.
• make -C src/test/regress check-multi-1-create-citus — 43/43 passed.
• make -C src/test/regress check-multi-mx — 69/69 passed.
• Branch-pinned uncrustify 0.82.0 with tools 0.8.33 configuration, include grouping, expected-output normalization, GUC alphabetical ordering, schedule coverage, Python formatting/import checks, and git diff --check — passed.

The initial WSL copy required restoring the two safeclib symlinks materialized as plain files by Windows and a clean rebuild. An initial ad hoc focused order put the sequence-sensitive domain test after node-mutating tests; running it first resolves that setup interference. Final focused and full schedules have no waived failures. Other PostgreSQL majors and hosted CI have not been run locally.

[codecov]

Codecov Report

❌ Patch coverage is 90.44586% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.82%. Comparing base (6734dfc) to head (a3ec395).

Additional details and impacted files

@@                         Coverage Diff                         @@
##           ihalatci-main-trusted-search-path    #8956    +/-   ##
===================================================================
  Coverage                              88.81%   88.82%            
===================================================================
  Files                                    290      291     +1     
  Lines                                  65512    65667   +155     
  Branches                                8261     8278    +17     
===================================================================
+ Hits                                   58185    58326   +141     
- Misses                                  4941     4949     +8     
- Partials                                2386     2392     +6     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Muhammad Usama (codeforall)]

LGTM