# v0.87.8 - Refresh Execution Identity

> **Status:** Planned
> **Scope:** 6 person-weeks
> **User promise:** *"Every refresh evaluates defining SQL as the stream owner."*
> **Blocked by:** [v0.87.7](v0.87.7.md)
> **Program:** [Lifecycle security reimplementation](../plans/pg_trickle_lifecycle_security_reimplementation_plan.md)

## Theme

Separate private refresh bookkeeping from SQL derived from a stream definition.
Full and differential refreshes use prepare, owner-execute, and finalize phases
inside one transaction. Initial, manual, scheduled, reinitialize, Top-K,
parallel, fused, fallback, and immediate paths obey the same identity rule.

The release preserves committed data and frontiers on every failure. Performance
may not silently fall back to full refresh or move private CDC scans into the
owner phase.

## Scope allocation

| Work package | Person-weeks |
|---|---:|
| Full-refresh phase split | 1.00 |
| Differential CDC staging and code-generation input | 1.50 |
| Remaining refresh modes and scheduler restoration | 1.25 |
| Security, correctness, failure, concurrency, and performance tests | 2.25 |
| **Total** | **6.00** |

## Items

### LSEC-4: Full refresh phases

The privileged prepare phase loads metadata, locks state, validates buffers,
and records bounds. The owner phase evaluates all defining and row-identity SQL
against owner-visible sources and writes owner-owned storage. The privileged
finalize phase advances history and frontiers only after owner execution
succeeds.

### LSEC-5: Differential delta stages

Copy the bounded CDC rows for one refresh into unique `pg_temp` staging
relations. Preserve types, operation markers, LSNs, changed-column masks, and
row identity. Grant the stream owner only the access needed for that stage.

DVM code generation receives a source-OID-to-stage map. Owner-executed SQL may
reference source relations, stream storage, the temporary stages, and trusted
catalog objects. It may not reference `pgtrickle_changes`.

### LSEC-6: Complete refresh-path coverage

Route initial, manual, scheduled, reinitialize, Top-K, parallel, fused,
fallback, and immediate expression evaluation through the same owner boundary.
Restore the scheduler backend's original identity after success and failure.

A fused execution unit may contain only streams with the same owner OID and
stored defining path. Split mixed-owner or mixed-path units before SQL
generation and retain dependency order. One SQL statement never borrows an
identity or path from a neighboring stream.

## Required tests

- Identity probes cover every refresh path and assert `current_user` equals the
  current storage owner.
- Privilege and RLS probes compare initial, full, and differential results.
- Revoked source access, injected owner errors, and stage failures leave the
  prior result, frontier, history, and private buffers unchanged.
- Deterministic barriers test manual versus scheduled contention, parallel
  workers, fused DAGs, and temporary-name isolation without timing-only sleeps.
- Mixed-owner and mixed-path DAGs prove that fusion splits before execution and
  that every resulting stream still converges.
- The complete DVM corpus, SQLancer oracle, TPC-H correctness suite, and
  supported strategy matrix report no result changes or silent fallback.
- Median differential-refresh overhead must stay within 10% on representative
  small and medium deltas. Any exception requires measured maintainer approval.

## Exit criteria

- [ ] No definition-derived expression executes as the extension owner.
- [ ] Owner execution cannot read private change-buffer relations directly.
- [ ] A failed owner phase never advances or cleans past the prior frontier.
- [ ] Temporary stages are collision-free and do not leak after errors.
- [ ] Initial, manual, scheduled, full, differential, Top-K, fused, parallel,
      fallback, and immediate tests pass.
- [ ] Correctness, performance, concurrency, and full repository CI gates pass.