The invariant "everything redo touches is registered in the WAL record" was silently violated for years by heap VM-bit clears (ed62d26): unregistered blocks are invisible to the WAL summarizer, silently corrupting incremental backups. Add a debug-build (assert-enabled) cross-check that tracks every buffer dirtied inside a WAL-emitting critical section before XLogInsert time and verifies each is either registered with the record or explicitly CLASSIFIED as a legitimate non-registration case: buffers of non-WAL-logged relations, pure hint-bit / FSM changes, and records that legitimately carry no block references. Deliberately avoid a permissive "curated whitelist" of exempt call sites — a whitelist fossilizes exactly the bugs this is meant to catch (it would have hidden ed62d26). Validate the check by reintroducing the ed62d26 defect locally and confirming the assertion fires. Run the full regression suite under it and report every violation found — each is a candidate incremental-backup corruption bug.
The invariant "everything redo touches is registered in the WAL record" was silently violated for years by heap VM-bit clears (ed62d26): unregistered blocks are invisible to the WAL summarizer, silently corrupting incremental backups. Add a debug-build (assert-enabled) cross-check that tracks every buffer dirtied inside a WAL-emitting critical section before XLogInsert time and verifies each is either registered with the record or explicitly CLASSIFIED as a legitimate non-registration case: buffers of non-WAL-logged relations, pure hint-bit / FSM changes, and records that legitimately carry no block references. Deliberately avoid a permissive "curated whitelist" of exempt call sites — a whitelist fossilizes exactly the bugs this is meant to catch (it would have hidden ed62d26). Validate the check by reintroducing the ed62d26 defect locally and confirming the assertion fires. Run the full regression suite under it and report every violation found — each is a candidate incremental-backup corruption bug.