fix(cluster): spec-5.55 Hardening v1.1 — measure side-effect + gate(3) test + GUC doc

Three post-ship review findings (all P2; no correctness / 8.A change),
re-grounded onto the landed 5.55 on main (resolver test is t/317; injection
registry was 139 after spec-5.13 H1.0.3).

  #1 MEASURE-mode TT-counter pollution.  A MEASURE-mode memo probe ran the
     side-effecting acceptance gate and then fell through to the authoritative
     scan, which ran it again -- double-bumping wrap_generation_disambiguated
     on a wrap-suspect hit.  Split the gate into a pure predicate
     (cluster_cr_resolved_scn_is_acceptable, no side effect) used by the MEASURE
     shadow probe, and a side-effecting wrapper (cluster_cr_accept_resolved_scn)
     kept byte-identical for the TRUST memo hit and the fresh scan, so gate (3)
     verdict-equivalence is preserved.

  #2 gate(3) fail-closed branch had no positive test -- and is structurally
     unreachable by the natural workload (a resolved deleter is always recent ->
     scn >= horizon -> never suspect; acceptance_failclosed stays 0 even with
     retention off).  Add injection point cluster-cr-resolver-memo-suspect;
     t/317 L5 arms it inside the pgbench script (arming is per-backend) so warm-
     memo hits are forced closed -> acceptance_failclosed climbs AND the balance
     invariant still holds (no false-visible).  The verdict LOGIC stays unit-
     tested via the pure cluster_tt_recovery_wrap_suspect gate.

  #3 GUC doc.  cluster.resolver_cache_entries said resolver_cache_measure
     "must also be on to allocate", but the code allocates on
     (enabled || measure); corrected.

Injection registry 139 -> 140; baselines updated across
t/015/017/018/020/021/022/023/024/030.

Local gate: cluster_unit 131/131, cluster_regress 11/11, cluster_tap (t/317
incl L5 verified 3x + the touched baselines), PG 219/219, clang-format v18
clean.  Disarmed injection -> production byte-identical; catversion unchanged.

Spec: spec-5.55-shared-resolver-cache.md (Hardening v1.1)

Author: SqlRush

src/backend/cluster/cluster_cr.c

@@ -1324,33 +1324,51 @@ cluster_cr_count_xmax_scan_unavail_or_no_proof(void)
 }
 
 /*
- * cluster_cr_accept_resolved_scn -- spec-4.8 D3 acceptance gate for a Source 3
- *	by-xid RESOLVED match, extracted (spec-5.55 D6) so the fresh-scan path AND a
- *	shared-resolver-cache memo hit run the PHYSICALLY SAME gate (gate (3),
- *	verdict-equivalent by construction -- they cannot drift).
+ * cluster_cr_resolved_scn_is_acceptable -- spec-4.8 D3 acceptance PREDICATE for a
+ *	Source 3 by-xid RESOLVED match: the pure verdict, with NO observability side
+ *	effect.  Extracted (spec-5.55 D6) so the fresh-scan path AND a shared-resolver-
+ *	cache memo hit reach the SAME verdict (gate (3), verdict-equivalent by
+ *	construction -- they cannot drift).
  *
  *	The durable scan runs WRAP_ANY (a recycled scratch ITL slot carries no
  *	binding wrap), so a single COMMITTED match cannot tell a genuine commit from a
  *	2^32-wrapped raw-xid collision.  When retention is unreliable AND the match is
- *	below the CURRENT horizon it is wrap-suspect -> fail closed (规则 8.A: a wrong
- *	deleter scn would false-hide a live row); the existing
- *	wrap_generation_disambiguated observability is bumped.  The reliability proof
- *	is the EXACT sticky condition (horizon enabled AND no retention-off recycle
- *	this incarnation), not an abstraction -- losing the sticky leg would re-trust
- *	a retention-off-window recycle.  Returns true to ACCEPT (RESOLVED).
+ *	below the CURRENT horizon it is wrap-suspect -> NOT acceptable (规则 8.A: a
+ *	wrong deleter scn would false-hide a live row).  The reliability proof is the
+ *	EXACT sticky condition (horizon enabled AND no retention-off recycle this
+ *	incarnation), not an abstraction -- losing the sticky leg would re-trust a
+ *	retention-off-window recycle.  Returns true to ACCEPT (RESOLVED).
  */
 static bool
-cluster_cr_accept_resolved_scn(SCN scn)
+cluster_cr_resolved_scn_is_acceptable(SCN scn)
 {
 	bool retention_reliable = cluster_undo_retention_horizon_enabled
 							  && cluster_tt_slot_retention_off_recycle_count() == 0;
 
-	if (cluster_tt_recovery_wrap_suspect(CLUSTER_TT_WRAP_ANY, scn, cluster_undo_retention_horizon(),
-										 retention_reliable)) {
-		cluster_tt_recovery_count_wrap_generation_disambiguated();
-		return false; /* suspect -> fail closed */
-	}
-	return true;
+	return !cluster_tt_recovery_wrap_suspect(CLUSTER_TT_WRAP_ANY, scn,
+											 cluster_undo_retention_horizon(), retention_reliable);
+}
+
+/*
+ * cluster_cr_accept_resolved_scn -- the AUTHORITATIVE acceptance gate: the pure
+ *	predicate above PLUS the existing wrap_generation_disambiguated observability
+ *	bump on a fail-closed verdict.  Used by the fresh-scan path and the TRUST-mode
+ *	memo hit -- both AUTHORITATIVE resolutions, so each bumps the base counter
+ *	exactly once.
+ *
+ *	The MEASURE-mode memo probe (spec-5.55 Hardening v1.1, finding #1) must NOT use
+ *	this wrapper: it is a non-authoritative shadow measurement that still falls
+ *	through to the authoritative scan, so bumping here would DOUBLE-count the base
+ *	wrap_generation_disambiguated counter on a wrap-suspect hit -- it calls the
+ *	pure predicate instead.  Returns true to ACCEPT (RESOLVED).
+ */
+static bool
+cluster_cr_accept_resolved_scn(SCN scn)
+{
+	if (cluster_cr_resolved_scn_is_acceptable(scn))
+		return true;
+	cluster_tt_recovery_count_wrap_generation_disambiguated();
+	return false; /* suspect -> fail closed */
 }
 
 /*
@@ -1445,18 +1463,50 @@ cluster_cr_resolve_xmax_commit_scn(const char *cr_page, uint8 itl_idx, Transacti
 		SCN hint_scn = InvalidScn;
 
 		if (cluster_resolver_cache_probe((uint16)cluster_node_id, cr_xmax, &hint_scn)) {
-			bool accepted = cluster_cr_accept_resolved_scn(hint_scn);
-
-			cluster_resolver_cache_count_acceptance(accepted);
 			if (cluster_resolver_cache_trust()) {
+				/*
+				 * TRUST: the memo hit IS the authoritative resolution (no fresh
+				 * scan follows), so it runs the side-effecting acceptance gate --
+				 * byte-identical to the fresh-scan path (gate (3)); its
+				 * wrap_generation_disambiguated bump replaces the fresh-scan bump.
+				 */
+				bool accepted = cluster_cr_accept_resolved_scn(hint_scn);
+
+				/*
+				 * spec-5.55 Hardening v1.1 (finding #2): the memo-path fail-closed
+				 * branch is a defensive 2^32-wrap guard the natural MVCC workload
+				 * cannot reach (a resolved deleter is always recent -> scn >=
+				 * horizon -> never suspect).  This injection forces it closed so a
+				 * TAP test proves the branch routes (count_acceptance(false) ->
+				 * INVALID_OR_AMBIGUOUS) and the 8.A invariant still holds.  It does
+				 * NOT bump the base wrap_generation_disambiguated counter (no real
+				 * wrap occurred).  Disarmed in production -> byte-identical.
+				 */
+				if (accepted
+					&& cluster_cr_injection_armed("cluster-cr-resolver-memo-suspect", NULL))
+					accepted = false;
+
+				cluster_resolver_cache_count_acceptance(accepted);
 				if (!accepted) {
 					*out_scn = InvalidScn; /* same fail-closed as the fresh-scan branch */
 					return CLUSTER_CR_XMAX_INVALID_OR_AMBIGUOUS;
 				}
 				*out_scn = hint_scn; /* gate (1): durable re-read, verdict-equivalent */
 				return CLUSTER_CR_XMAX_RESOLVED_SCN;
 			}
-			/* MEASURE: never trust the hint -- fall through to the authoritative scan. */
+
+			/*
+			 * MEASURE (spec-5.55 Hardening v1.1, finding #1): record the would-hit
+			 * acceptance outcome with the PURE predicate, NOT the side-effecting
+			 * gate.  This shadow probe falls through to the authoritative scan
+			 * below, which bumps wrap_generation_disambiguated itself; using the
+			 * wrapper here would double-count that base TT counter on a wrap-suspect
+			 * hit.  The verdict is identical (the wrapper is predicate + side
+			 * effect), so the resolver-cache acceptance counters stay accurate.
+			 */
+			cluster_resolver_cache_count_acceptance(
+				cluster_cr_resolved_scn_is_acceptable(hint_scn));
+			/* never trust the hint -- fall through to the authoritative scan. */
 		}
 	}
 

src/backend/cluster/cluster_guc.c

@@ -2628,8 +2628,9 @@ cluster_init_guc(void)
 		gettext_noop("Spec-5.55 D3/D7. Default 0 (true zero memory; the region is registered but "
 					 "reserves 0 bytes).  PGC_POSTMASTER: requires a restart.  The recommended "
 					 "non-zero default + sizing are bound to the §0.6 measure-leg value gate "
-					 "evidence (spec-5.58); resolver_cache_measure must also be on to allocate. "
-					 "Each hint slot costs a few dozen bytes of shared memory."),
+					 "evidence (spec-5.58); either resolver_cache_enabled or "
+					 "resolver_cache_measure must be on for this to allocate.  Each hint slot "
+					 "costs a few dozen bytes of shared memory."),
 		&cluster_shared_resolver_cache_entries, 0, 0, 1048576, PGC_POSTMASTER, 0, NULL, NULL, NULL);
 
 	DefineCustomIntVariable(

src/backend/cluster/cluster_inject.c

@@ -454,6 +454,18 @@ static ClusterInjectPoint cluster_injection_points[] = {
 	 */
 	{ .name = "cluster-cr-skip-epoch-bump" },
 
+	/*
+	 * spec-5.55 Hardening v1.1 (finding #2) — shared-resolver-cache memo-path
+	 * acceptance fail-closed (1 entry).  When armed, a TRUST-mode memo hit's
+	 * Source-3 acceptance verdict is forced to fail closed (gate (3)), driving
+	 * the exact production branch (count_acceptance(false) -> INVALID_OR_AMBIGUOUS).
+	 * The natural MVCC workload cannot reach it: a resolved deleter is always
+	 * recent (scn >= horizon -> never wrap-suspect), and an old entry below an
+	 * advanced horizon is never re-probed.  The fault-inject test then proves the
+	 * branch routes correctly AND the 8.A balance invariant still holds.
+	 */
+	{ .name = "cluster-cr-resolver-memo-suspect" },
+
 	/*
 	 * spec-4.1 D7 — per-thread WAL routing (2 NEW points).
 	 *

src/test/cluster_tap/t/015_inject.pl

@@ -57,8 +57,8 @@
 # ----------
 is( $node->safe_psql('postgres',
 		'SELECT count(*) FROM pg_stat_cluster_injections'),
-	'139',
-	'pg_stat_cluster_injections returns 139 rows (spec-5.13 +6 cluster-clean-leave-*; spec-5.13 Hardening v1.0.3 +1 cluster-clean-leave-survivor-suppress-preflight-ack; spec-5.53 +1 cluster-cr-skip-epoch-bump; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship; spec-5.8 +1 cluster-lmd-force-partial-round)');
+	'140',
+	'pg_stat_cluster_injections returns 140 rows (spec-5.13 +6 cluster-clean-leave-*; spec-5.13 Hardening v1.0.3 +1 cluster-clean-leave-survivor-suppress-preflight-ack; spec-5.53 +1 cluster-cr-skip-epoch-bump; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship; spec-5.8 +1 cluster-lmd-force-partial-round; spec-5.55 Hardening v1.1 +1 cluster-cr-resolver-memo-suspect)');
 
 
 # ----------
@@ -86,8 +86,8 @@
 		'postgres',
 		'SELECT string_agg(name, \',\' ORDER BY name) FROM pg_stat_cluster_injections'
 	),
-	'cluster-clean-leave-barrier-complete,cluster-clean-leave-escalate-to-failstop,cluster-clean-leave-gcs-flushed,cluster-clean-leave-ges-drained,cluster-clean-leave-quiesce-pre,cluster-clean-leave-request,cluster-clean-leave-survivor-suppress-preflight-ack,cluster-clean-xfer-stale-holder,cluster-collision-detect,cluster-conf-load-success,cluster-conf-parse-fail,cluster-conf-shmem-init,cluster-cr-skip-epoch-bump,cluster-cssd-main-loop-pre-tick,cluster-cssd-mark-peer-dead,cluster-cssd-post-spawn,cluster-cssd-pre-spawn,cluster-cssd-ready-publish,cluster-cssd-shutdown-post,cluster-cssd-shutdown-pre,cluster-debug-dump-entry,cluster-diag-main-loop-iter,cluster-diag-post-spawn,cluster-diag-pre-spawn,cluster-diag-ready-publish,cluster-diag-shutdown-post,cluster-diag-shutdown-pre,cluster-fence-post-thaw-broadcast,cluster-fence-pre-freeze-broadcast,cluster-fence-pre-self-fence-shutdown,cluster-gcs-block-drop-reply-before-send,cluster-gcs-block-evict-holder-before-ship,cluster-gcs-block-force-epoch-stale-reply,cluster-gcs-block-forward-master-side,cluster-gcs-block-invalidate-drop-broadcast,cluster-gcs-block-invalidate-stall-ack,cluster-gcs-block-stale-ship,cluster-gcs-block-starvation-force-denied,cluster-gcs-block-x-forward-master-side,cluster-grd-redeclare-skip,cluster-guc-init-pre-define,cluster-ic-mock-send-pre-enqueue,cluster-ic-tier-selected,cluster-init-post-shmem,cluster-init-pre-shmem,cluster-init-top,cluster-ko-peer-skip-ack,cluster-lck-main-loop-iter,cluster-lck-post-spawn,cluster-lck-pre-spawn,cluster-lck-ready-publish,cluster-lck-shutdown-post,cluster-lck-shutdown-pre,cluster-lmd-force-partial-round,cluster-lmon-main-loop-iter,cluster-lmon-post-spawn,cluster-lmon-pre-spawn,cluster-lmon-ready-publish,cluster-lmon-shutdown-post,cluster-lmon-shutdown-pre,cluster-pcm-acquire-entry,cluster-pcm-convert-pre,cluster-pcm-downgrade-pre,cluster-pcm-release-pre,cluster-pgstat-mirror-sync,cluster-quorum-loss-broadcast,cluster-qvotec-poll-post,cluster-qvotec-poll-pre,cluster-reconfig-broadcast-procsig-pre,cluster-reconfig-decide-coordinator,cluster-reconfig-epoch-bump-pre,cluster-reconfig-tick-entry,cluster-run-shutdown-top,cluster-run-startup-top,cluster-scn-abort-post-advance,cluster-scn-abort-pre-advance,cluster-scn-advance-post,cluster-scn-advance-pre,cluster-scn-boc-sweep-post,cluster-scn-boc-sweep-pre,cluster-scn-commit-post-advance,cluster-scn-commit-pre-advance,cluster-scn-observe-bump-pre,cluster-scn-observe-entry,cluster-scn-replay-observe-pre,cluster-scn-wal-write-pre,cluster-scn-wraparound-warning,cluster-shared-fs-backend-register,cluster-shared-fs-init-top,cluster-shared-fs-local-open,cluster-shmem-region-init-post,cluster-shmem-region-init-pre,cluster-shmem-register-region,cluster-shmem-request,cluster-shmem-views-srf-entry,cluster-shutdown-top,cluster-sinval-ack-drop-send,cluster-sinval-ack-skip-validate,cluster-sinval-broadcast-drop-send,cluster-sinval-receive-skip-validate,cluster-smgr-create-top,cluster-smgr-open-top,cluster-smgr-which-decision,cluster-startup-phase-0-enter,cluster-startup-phase-0-exit,cluster-startup-phase-0-fail,cluster-startup-phase-1-enter,cluster-startup-phase-1-exit,cluster-startup-phase-1-fail,cluster-startup-phase-2-enter,cluster-startup-phase-2-exit,cluster-startup-phase-2-fail,cluster-startup-phase-3-enter,cluster-startup-phase-3-exit,cluster-startup-phase-3-fail,cluster-startup-phase-4-enter,cluster-startup-phase-4-exit,cluster-startup-phase-4-fail,cluster-stats-main-loop-iter,cluster-stats-post-spawn,cluster-stats-pre-spawn,cluster-stats-ready-publish,cluster-stats-shutdown-post,cluster-stats-shutdown-pre,cluster-thread-recovery-drive,cluster-views-srf-entry,cluster-voting-disk-write-fail,cluster-wal-page-init-thread-id,cluster-wal-state-ensure-pre,cluster-wal-state-write-fail,cluster-wal-thread-claim-create-fail,cluster-wal-thread-validate-pre,cr_construct_delay_us,cr_corruption,cr_cross_instance,cr_force_read_scn,cr_snapshot_too_old,undo-force-wal-before-data-violation,undo-skip-checkpoint-flush-one',
-	'139 injection point names match the full registry (spec-5.13 +6 cluster-clean-leave-*; spec-5.13 Hardening v1.0.3 +1 cluster-clean-leave-survivor-suppress-preflight-ack; spec-5.53 +1 cluster-cr-skip-epoch-bump; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship; spec-5.8 +1 cluster-lmd-force-partial-round)');
+	'cluster-clean-leave-barrier-complete,cluster-clean-leave-escalate-to-failstop,cluster-clean-leave-gcs-flushed,cluster-clean-leave-ges-drained,cluster-clean-leave-quiesce-pre,cluster-clean-leave-request,cluster-clean-leave-survivor-suppress-preflight-ack,cluster-clean-xfer-stale-holder,cluster-collision-detect,cluster-conf-load-success,cluster-conf-parse-fail,cluster-conf-shmem-init,cluster-cr-resolver-memo-suspect,cluster-cr-skip-epoch-bump,cluster-cssd-main-loop-pre-tick,cluster-cssd-mark-peer-dead,cluster-cssd-post-spawn,cluster-cssd-pre-spawn,cluster-cssd-ready-publish,cluster-cssd-shutdown-post,cluster-cssd-shutdown-pre,cluster-debug-dump-entry,cluster-diag-main-loop-iter,cluster-diag-post-spawn,cluster-diag-pre-spawn,cluster-diag-ready-publish,cluster-diag-shutdown-post,cluster-diag-shutdown-pre,cluster-fence-post-thaw-broadcast,cluster-fence-pre-freeze-broadcast,cluster-fence-pre-self-fence-shutdown,cluster-gcs-block-drop-reply-before-send,cluster-gcs-block-evict-holder-before-ship,cluster-gcs-block-force-epoch-stale-reply,cluster-gcs-block-forward-master-side,cluster-gcs-block-invalidate-drop-broadcast,cluster-gcs-block-invalidate-stall-ack,cluster-gcs-block-stale-ship,cluster-gcs-block-starvation-force-denied,cluster-gcs-block-x-forward-master-side,cluster-grd-redeclare-skip,cluster-guc-init-pre-define,cluster-ic-mock-send-pre-enqueue,cluster-ic-tier-selected,cluster-init-post-shmem,cluster-init-pre-shmem,cluster-init-top,cluster-ko-peer-skip-ack,cluster-lck-main-loop-iter,cluster-lck-post-spawn,cluster-lck-pre-spawn,cluster-lck-ready-publish,cluster-lck-shutdown-post,cluster-lck-shutdown-pre,cluster-lmd-force-partial-round,cluster-lmon-main-loop-iter,cluster-lmon-post-spawn,cluster-lmon-pre-spawn,cluster-lmon-ready-publish,cluster-lmon-shutdown-post,cluster-lmon-shutdown-pre,cluster-pcm-acquire-entry,cluster-pcm-convert-pre,cluster-pcm-downgrade-pre,cluster-pcm-release-pre,cluster-pgstat-mirror-sync,cluster-quorum-loss-broadcast,cluster-qvotec-poll-post,cluster-qvotec-poll-pre,cluster-reconfig-broadcast-procsig-pre,cluster-reconfig-decide-coordinator,cluster-reconfig-epoch-bump-pre,cluster-reconfig-tick-entry,cluster-run-shutdown-top,cluster-run-startup-top,cluster-scn-abort-post-advance,cluster-scn-abort-pre-advance,cluster-scn-advance-post,cluster-scn-advance-pre,cluster-scn-boc-sweep-post,cluster-scn-boc-sweep-pre,cluster-scn-commit-post-advance,cluster-scn-commit-pre-advance,cluster-scn-observe-bump-pre,cluster-scn-observe-entry,cluster-scn-replay-observe-pre,cluster-scn-wal-write-pre,cluster-scn-wraparound-warning,cluster-shared-fs-backend-register,cluster-shared-fs-init-top,cluster-shared-fs-local-open,cluster-shmem-region-init-post,cluster-shmem-region-init-pre,cluster-shmem-register-region,cluster-shmem-request,cluster-shmem-views-srf-entry,cluster-shutdown-top,cluster-sinval-ack-drop-send,cluster-sinval-ack-skip-validate,cluster-sinval-broadcast-drop-send,cluster-sinval-receive-skip-validate,cluster-smgr-create-top,cluster-smgr-open-top,cluster-smgr-which-decision,cluster-startup-phase-0-enter,cluster-startup-phase-0-exit,cluster-startup-phase-0-fail,cluster-startup-phase-1-enter,cluster-startup-phase-1-exit,cluster-startup-phase-1-fail,cluster-startup-phase-2-enter,cluster-startup-phase-2-exit,cluster-startup-phase-2-fail,cluster-startup-phase-3-enter,cluster-startup-phase-3-exit,cluster-startup-phase-3-fail,cluster-startup-phase-4-enter,cluster-startup-phase-4-exit,cluster-startup-phase-4-fail,cluster-stats-main-loop-iter,cluster-stats-post-spawn,cluster-stats-pre-spawn,cluster-stats-ready-publish,cluster-stats-shutdown-post,cluster-stats-shutdown-pre,cluster-thread-recovery-drive,cluster-views-srf-entry,cluster-voting-disk-write-fail,cluster-wal-page-init-thread-id,cluster-wal-state-ensure-pre,cluster-wal-state-write-fail,cluster-wal-thread-claim-create-fail,cluster-wal-thread-validate-pre,cr_construct_delay_us,cr_corruption,cr_cross_instance,cr_force_read_scn,cr_snapshot_too_old,undo-force-wal-before-data-violation,undo-skip-checkpoint-flush-one',
+	'140 injection point names match the full registry (spec-5.13 +6 cluster-clean-leave-*; spec-5.13 Hardening v1.0.3 +1 cluster-clean-leave-survivor-suppress-preflight-ack; spec-5.53 +1 cluster-cr-skip-epoch-bump; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship; spec-5.8 +1 cluster-lmd-force-partial-round; spec-5.55 Hardening v1.1 +1 cluster-cr-resolver-memo-suspect)');
 
 
 # ----------

src/test/cluster_tap/t/017_debug.pl

@@ -123,15 +123,15 @@
 		'postgres',
 		q{SELECT count(*) FROM pg_cluster_state
 		   WHERE category='inject' AND key LIKE '%.fault_type'}),
-	'139',
-	'all 139 injection points have a .fault_type entry under inject category (spec-5.13 +6 cluster-clean-leave-*; spec-2.41 +1 gcs-block-stale-ship; spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2; spec-5.13 H1.0.3 +1 clean-leave-survivor-suppress-preflight-ack)');
+	'140',
+	'all 140 injection points have a .fault_type entry under inject category (spec-5.13 +6 cluster-clean-leave-*; spec-2.41 +1 gcs-block-stale-ship; spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2; spec-5.13 H1.0.3 +1 clean-leave-survivor-suppress-preflight-ack; spec-5.55 Hardening v1.1 +1 cluster-cr-resolver-memo-suspect)');
 
 is( $node->safe_psql(
 		'postgres',
 		q{SELECT count(*) FROM pg_cluster_state
 		   WHERE category='inject' AND key LIKE '%.hits'}),
-	'139',
-	'all 139 injection points have a .hits entry under inject category (spec-5.13 +6 cluster-clean-leave-*; spec-2.41 +1 gcs-block-stale-ship; spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2; spec-5.13 H1.0.3 +1 clean-leave-survivor-suppress-preflight-ack)');
+	'140',
+	'all 140 injection points have a .hits entry under inject category (spec-5.13 +6 cluster-clean-leave-*; spec-2.41 +1 gcs-block-stale-ship; spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2; spec-5.13 H1.0.3 +1 clean-leave-survivor-suppress-preflight-ack; spec-5.55 Hardening v1.1 +1 cluster-cr-resolver-memo-suspect)');
 
 
 # ----------

src/test/cluster_tap/t/018_shared_fs.pl

@@ -130,8 +130,8 @@
 is($node->safe_psql(
 		'postgres',
 		'SELECT count(*) FROM pg_stat_cluster_injections'),
-	'139',
-	'L9 total injection registry size is 139 (spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2 undo boundary guards; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship)');
+	'140',
+	'L9 total injection registry size is 140 (spec-5.2a +1 clean-xfer stale-holder; spec-4.8ab +2 undo boundary guards; spec-5.7 +1 cluster-ko-peer-skip-ack; spec-2.41 +1 cluster-gcs-block-stale-ship; spec-5.55 Hardening v1.1 +1 cluster-cr-resolver-memo-suspect)');
 
 
 # ----------