feat(cluster): crash-rejoin re-declare barrier (Shape A) + cold-GRD fail-closed

Closes the P0 that a crash-rejoined node with cluster.online_join=off
cold-serves its home blocks from a wiped GRD: a silent stale READ and a
silently-diverging WRITE that, after flush ordering, durably LOSES a
peer's committed rows (diagnosed 2026-07-15, both reproduced minimally on
main including the committed-write loss).

Fix 1 — the off-path counterpart of the online joiner tick.  A per-
incarnation shmem flag ClusterGrdShared.offpath_boot_decided (init 0)
makes the phase gate fence self-home blocks RECOVERING from process start
(before any LMON tick), so reads AND writes fail-closed with zero cold-
serve window.  cluster_reconfig_offpath_rejoin_tick() then classifies the
incarnation:
 - crash-rejoin  -> arm the join fence + demote self_join_admitted to 0
   (writes 53R60) and LEAVE offpath_boot_decided 0, so the boot barrier
   persists as the read fence for the incarnation.  The epoch-keyed join
   fence is a no-op on a fast rejoin (this node is still at
   CLUSTER_EPOCH_INITIAL, so the monotonic-max fence epoch cannot rise);
   the epoch-independent boot barrier carries the read fence.
 - clean cold-bootstrap / single node -> set the flag, serve normally.

The crash-rejoin signal is the prior-incarnation voting-disk self-slot's
ALIVE bit (守门裁决 07-15: ALIVE, not epoch — a fast rejoin leaves BOTH
sides at INITIAL, so an epoch test is blind; a clean shutdown clears
ALIVE via qvotec_clear_self_alive_on_clean_shutdown while a crash leaves
it set).  qvotec's startup ghost-detect latches it into
QvotecShmem.prior_unclean_death (offset 72; the convert-queue lane owns
64..71 — StaticAssert-pinned, this lane rebases after queue merges).

Fix 2 (defense in depth) — cluster_gcs_cold_grd_watermark_verdict(): an
InvalidScn master watermark under an active self-fence FAILs CLOSED
instead of SKIPping (the wiped watermark could mask a stale block),
except for a genuine extension block (never cross-node written).  Pure,
header-only, unit-tested truth table; wired into fallback_verify_refresh.

Approved semantic consequence: a full-outage crash co-boot fences every
node (53R60) — no silent auto-formation; the cluster waits for online
admission (spec-5.22 cold-formation follow-up) or a clean restart.  A
CLEAN full shutdown clears ALIVE and co-boots normally.

Tests: t/404 (crash-rejoin read/write/boot-race/full-outage/clean-restart
legs, all GREEN), fold unit truth table, t/249 grd_recovery roster
31->32 (offpath_crash_rejoin_fenced dump key).

Gates: unit clean 178/178, t/017+401+402+404 PASS, cluster_regress 13/13,
PG 219/219, format/headers/scn-cmp/ges-mode/clog all 0.  (t/249's
cooperative-rebind timeout legs L6/L3/L13 flake under mac load — confirmed
pre-existing on a binary without these changes; the roster ripple passes.)

Known-scoped-out (守门裁决): a CLEAN fast-restart of a cluster member
(without clean-leave) shares the hazard but is out of this fix's scope
(the ALIVE bit is cleared on clean shutdown); clean departures should run
clean-leave flush/handoff.

Spec: spec-5.16 (extended to online_join=off crash-rejoin); Rule 8.A.

Author: SqlRush

src/backend/cluster/cluster_debug.c

@@ -1371,6 +1371,10 @@ dump_grd_recovery(ReturnSetInfo *rsinfo)
 			 fmt_int64((int64)c.join_block_views_rebuilt));
 	emit_row(rsinfo, "grd_recovery", "join_block_recovering_failclosed",
 			 fmt_int64((int64)c.join_block_recovering_failclosed));
+	/* Shape A (crash-rejoin re-declare barrier): off-path crash-rejoin fence-arm
+	 * events (standalone counter, not part of the snapshot struct). */
+	emit_row(rsinfo, "grd_recovery", "offpath_crash_rejoin_fenced",
+			 fmt_int64((int64)cluster_grd_offpath_crash_rejoin_fenced_count()));
 }
 
 /*

src/backend/cluster/cluster_gcs_block.c

@@ -1275,9 +1275,43 @@ cluster_gcs_block_fallback_verify_refresh(BufferDesc *buf, BufferTag tag, SCN ex
 	GcsLostWriteVerdict verdict;
 	bool refreshed = false; /* S3 forensics — storage re-read happened */
 
-	if (buf == NULL || !SCN_VALID(expected_scn))
+	if (buf == NULL)
 		return;
 
+	/*
+	 * fix 2 (crash-rejoin re-declare barrier, defense in depth): an InvalidScn
+	 * master watermark normally SKIPs (not SCN-tracked / old-binary master /
+	 * holder re-ack).  But if THIS self-home block is under the off-path crash-
+	 * rejoin fence, the local GRD watermark was wiped by the restart, so an
+	 * Invalid watermark can mask a stale home block — fail-closed instead of
+	 * SKIP, except for a genuine extension block (never cross-node written).
+	 * This is a second line behind the phase-gate boot barrier, which already
+	 * fences the self-home block before the acquire reaches here.
+	 */
+	{
+		bool self_fenced
+			= (!cluster_online_join && cluster_gcs_lookup_master_static(tag) == cluster_node_id
+			   && cluster_conf_node_count() > 1 && !cluster_grd_offpath_boot_decided());
+		ClusterColdGrdVerdict cv = cluster_gcs_cold_grd_watermark_verdict(
+			SCN_VALID(expected_scn), self_fenced,
+			self_fenced && cluster_bufmgr_block_is_extension_for_gcs(tag));
+
+		if (cv == CLUSTER_COLD_GRD_SKIP)
+			return;
+		if (cv == CLUSTER_COLD_GRD_FAIL_CLOSED) {
+			pg_atomic_fetch_add_u64(&ClusterGcsBlock->fallback_scn_failclosed_count, 1);
+			ereport(ERROR,
+					(errcode(ERRCODE_CLUSTER_GCS_BLOCK_RESOURCE_RECOVERING),
+					 errmsg("crash-rejoin: cannot prove home block ownership after restart "
+							"(cold GRD watermark) for tag spc=%u db=%u rel=%u block=%u",
+							tag.spcOid, tag.dbOid, tag.relNumber, tag.blockNum),
+					 errhint("The block resource is recovering after an unclean restart; retry the "
+							 "transaction, or enable cluster.online_join for an online re-declare "
+							 "rejoin.")));
+		}
+		/* CLUSTER_COLD_GRD_PROVE: expected_scn valid — run the normal verdict. */
+	}
+
 	page_scn = cluster_bufmgr_read_block_scn_for_gcs(buf);
 	verdict = gcs_block_lost_write_verdict(expected_scn, page_scn);
 	if (verdict == GCS_LOST_WRITE_PASS) {
@@ -1466,8 +1500,8 @@ cluster_gcs_block_phase_for_tag(BufferTag tag)
 	 * Skipped for online_join=on (its admission + join fence govern) and for
 	 * a single declared node (no peer can hold a conflicting copy).
 	 */
-	if (!cluster_online_join && static_master == cluster_node_id
-		&& cluster_conf_node_count() > 1 && !cluster_grd_offpath_boot_decided()) {
+	if (!cluster_online_join && static_master == cluster_node_id && cluster_conf_node_count() > 1
+		&& !cluster_grd_offpath_boot_decided()) {
 		cluster_grd_inc_join_block_failclosed();
 		return GCS_BLOCK_RECOVERING;
 	}

src/backend/cluster/cluster_grd.c

@@ -770,6 +770,7 @@ cluster_grd_shmem_init(void)
 		pg_atomic_init_u64(&cluster_grd_state->join_shards_remastered_count, 0);
 		pg_atomic_init_u64(&cluster_grd_state->join_block_views_rebuilt_count, 0);
 		pg_atomic_init_u64(&cluster_grd_state->join_block_recovering_failclosed_count, 0);
+		pg_atomic_init_u64(&cluster_grd_state->offpath_crash_rejoin_fenced_count, 0);
 	}
 
 	/* spec-2.15 v0.4 P1.1:  entry HTAB allocation gated on GUC.  GUC=0
@@ -1831,6 +1832,23 @@ cluster_grd_set_offpath_boot_decided(void)
 		pg_atomic_write_u32(&cluster_grd_state->offpath_boot_decided, 1);
 }
 
+/* Shape A observability: count an off-path crash-rejoin fence-arm (LMON single
+ * writer; read for dump_grd + t/404). */
+void
+cluster_grd_inc_offpath_crash_rejoin_fenced(void)
+{
+	if (cluster_grd_state != NULL)
+		pg_atomic_fetch_add_u64(&cluster_grd_state->offpath_crash_rejoin_fenced_count, 1);
+}
+
+uint64
+cluster_grd_offpath_crash_rejoin_fenced_count(void)
+{
+	if (cluster_grd_state == NULL)
+		return 0;
+	return pg_atomic_read_u64(&cluster_grd_state->offpath_crash_rejoin_fenced_count);
+}
+
 /* spec-4.6 D5 — bulk counter snapshot for the dump path. */
 void
 cluster_grd_recovery_counters_snapshot(ClusterGrdRecoveryCounters *out)

src/backend/cluster/cluster_qvotec.c

@@ -140,11 +140,34 @@ typedef struct ClusterQvotecShmem {
 	pg_atomic_uint32 poll_cycle_count;
 	pg_atomic_uint32 torn_write_detect_count;
 	pg_atomic_uint32 _pad;
-	uint8 _reserved[64];
+	/*
+	 * Merge-order reservation (守门 07-15): the convert-queue lane claims
+	 * offset 64..71 for its self_incarnation (pg_atomic_uint64, commit
+	 * ee536b5bb7, StaticAssert-pinned).  Queue merges first; this lane rebases
+	 * after and drops this placeholder so self_incarnation occupies 64..71 and
+	 * prior_unclean_death stays at 72.  Keeping the byte layout identical now
+	 * makes that rebase a no-op on the wire/shmem image.
+	 */
+	uint8 _reserved_queue_self_incarnation[8]; /* offset 64..71 */
+	/*
+	 * Crash-rejoin re-declare barrier (Shape A) — set ONCE at qvotec startup
+	 * (before the READY publish), read-only thereafter: 1 iff this node's
+	 * prior-incarnation self-slot on the voting disk still had the ALIVE flag
+	 * set (a clean shutdown clears it via qvotec_clear_self_alive_on_clean_
+	 * shutdown; a crash / immediate stop does NOT), i.e. this boot follows an
+	 * UNCLEAN death.  The off-path rejoin tick fences self-home blocks +
+	 * closes the write gate on this, so a crash-rejoined node never cold-
+	 * serves stale ownership even when it restarts faster than the survivor's
+	 * dead-deadband (the epoch signal is INITIAL on both sides in that race).
+	 */
+	pg_atomic_uint32 prior_unclean_death; /* offset 72..75 */
+	uint8 _reserved[52];
 } ClusterQvotecShmem;
 
 StaticAssertDecl(sizeof(ClusterQvotecShmem) == 128,
 				 "ClusterQvotecShmem must be exactly 128 bytes (2 cache lines)");
+StaticAssertDecl(offsetof(ClusterQvotecShmem, prior_unclean_death) == 72,
+				 "prior_unclean_death must sit at offset 72 (queue lane owns 64..71)");
 
 
 static ClusterQvotecShmem *QvotecShmem = NULL;
@@ -267,6 +290,9 @@ cluster_qvotec_shmem_init(void)
 		pg_atomic_init_u32(&QvotecShmem->poll_cycle_count, 0);
 		pg_atomic_init_u32(&QvotecShmem->torn_write_detect_count, 0);
 		pg_atomic_init_u32(&QvotecShmem->_pad, 0);
+		memset(QvotecShmem->_reserved_queue_self_incarnation, 0,
+			   sizeof(QvotecShmem->_reserved_queue_self_incarnation));
+		pg_atomic_init_u32(&QvotecShmem->prior_unclean_death, 0);
 		memset(QvotecShmem->_reserved, 0, sizeof(QvotecShmem->_reserved));
 	}
 }
@@ -372,6 +398,23 @@ cluster_qvotec_get_disks_total_count(void)
 	return (int)pg_atomic_read_u32(&QvotecShmem->disks_total_count);
 }
 
+/*
+ * cluster_qvotec_prior_unclean_death -- crash-rejoin re-declare barrier
+ * (Shape A).  True iff this node's prior-incarnation self-slot on the voting
+ * disk still carried the ALIVE flag at startup (an unclean death: a crash /
+ * immediate stop that skipped the clean-shutdown ALIVE blank).  Latched once
+ * before the READY publish; stable for the incarnation.  False when qvotec is
+ * absent (no voting disks) so a diskless / single-node deployment is never
+ * fenced by this signal.
+ */
+bool
+cluster_qvotec_prior_unclean_death(void)
+{
+	if (QvotecShmem == NULL)
+		return false;
+	return pg_atomic_read_u32(&QvotecShmem->prior_unclean_death) != 0;
+}
+
 uint64
 cluster_qvotec_get_current_epoch_at_boot(void)
 {
@@ -1749,7 +1792,7 @@ ClusterQvotecMain(void)
 		bool ghost_fresh = false;
 		int d;
 
-		for (d = 0; d < qvotec_n_disks && !ghost_fresh; d++) {
+		for (d = 0; d < qvotec_n_disks; d++) {
 			ClusterVotingSlot probe;
 			ClusterVotingDiskIoState rrc;
 
@@ -1759,14 +1802,29 @@ ClusterQvotecMain(void)
 			if (probe.generation == 0)
 				continue; /* never written */
 			if (!(probe.flags & CLUSTER_VOTING_SLOT_FLAG_ALIVE))
-				continue; /* prior shutdown cleared ALIVE — ok */
+				continue; /* prior shutdown cleared ALIVE — clean death, ok */
 			if (probe.incarnation == qvotec_self_incarnation)
 				continue; /* same incarnation — impossible but defensive */
+
+			/*
+			 * Crash-rejoin re-declare barrier (Shape A) — a prior-incarnation
+			 * self-slot that still carries ALIVE means the previous postmaster
+			 * of THIS node died WITHOUT running the clean-shutdown blank
+			 * (qvotec_clear_self_alive_on_clean_shutdown), i.e. an UNCLEAN
+			 * death.  Latch it REGARDLESS of freshness: a stale ALIVE ghost is
+			 * still proof we crashed (we just crashed longer ago), and the
+			 * fence must engage on a fast rejoin where the survivor has not yet
+			 * advanced its epoch (the epoch signal is INITIAL on both sides).
+			 * Single writer, before the READY publish; read-only afterwards.
+			 */
+			if (QvotecShmem != NULL)
+				pg_atomic_write_u32(&QvotecShmem->prior_unclean_death, 1);
+
 			if (probe.heartbeat_ts_us == 0)
 				continue;
 			if (now_us > probe.heartbeat_ts_us
 				&& (now_us - probe.heartbeat_ts_us) > heartbeat_timeout_us)
-				continue; /* already stale */
+				continue; /* already stale — no fast-restart Q6 sleep needed */
 			ghost_fresh = true;
 		}
 

src/backend/cluster/cluster_reconfig.c

@@ -2191,32 +2191,64 @@ cluster_reconfig_offpath_rejoin_tick(void)
 		return;
 	}
 
-	if (cluster_reconfig_cluster_already_running()) {
+	/*
+	 * REJOIN when EITHER signal fires:
+	 *   already_running        -- a declared peer is observed past INITIAL (the
+	 *                             survivor already reconfigured; slow rejoin).
+	 *   prior_unclean_death    -- this node's prior-incarnation voting-disk
+	 *                             self-slot still carried ALIVE (an unclean
+	 *                             death).  This is the ONLY signal that fires on
+	 *                             a FAST rejoin, where the node restarts inside
+	 *                             the survivor's dead-deadband so BOTH sides are
+	 *                             still at epoch INITIAL and the epoch signal is
+	 *                             blind (守门裁决 07-15: ALIVE bit, not epoch).
+	 * The clean-shutdown blank clears ALIVE (keeps epoch), so a genuine clean
+	 * co-boot never trips prior_unclean_death.
+	 */
+	if (cluster_reconfig_cluster_already_running() || cluster_qvotec_prior_unclean_death()) {
 		uint8 self_set[CLUSTER_RECONFIG_DEAD_BITMAP_BYTES] = { 0 };
 
+		/*
+		 * Arm the epoch-keyed join fence too (belt: it engages on a SLOW
+		 * rejoin where this node adopted a peer epoch > INITIAL).  On a FAST
+		 * rejoin this node is still at CLUSTER_EPOCH_INITIAL, so the monotonic-
+		 * max fence epoch cannot rise above 0 and the join fence is a no-op —
+		 * the READ fence is therefore carried by the boot barrier below, which
+		 * is epoch-independent: we deliberately DO NOT set offpath_boot_decided,
+		 * so the phase gate keeps self-home blocks RECOVERING for the whole
+		 * incarnation (fail-closed until a clean restart / online_join).
+		 */
 		self_set[cluster_node_id >> 3] = (uint8)(1u << (cluster_node_id & 7));
 		cluster_grd_arm_join_pcm_fence(self_set); /* fence FIRST (8.A) */
 
 		LWLockAcquire(&ReconfigShmem->lock, LW_EXCLUSIVE);
 		ReconfigShmem->self_join_admitted = 0; /* then close the write gate */
 		LWLockRelease(&ReconfigShmem->lock);
 
-		cluster_grd_set_offpath_boot_decided();
+		/* NB: offpath_boot_decided stays 0 -> the boot barrier persists as the
+		 * read fence for this incarnation.  offpath_decided_local latches the
+		 * tick so it does not re-arm / re-log every cycle. */
+		cluster_grd_inc_offpath_crash_rejoin_fenced();
 		offpath_decided_local = true;
 
 		ereport(LOG,
-				(errmsg("cluster membership: node %d crash-rejoined a running cluster with "
-						"cluster.online_join=off — home blocks fenced and writes closed "
-						"(53R60) to avoid serving stale ownership",
-						cluster_node_id),
-				 errhint("Enable cluster.online_join for an online re-declare rejoin, or "
-						 "cold-restart the cluster. Reads of peer-mastered blocks and "
-						 "non-home work are unaffected.")));
+				(errmsg("cluster membership: node %d crash-rejoin detected (cluster.online_join="
+						"off%s) — home blocks fenced and writes closed (53R60) to avoid serving "
+						"stale ownership",
+						cluster_node_id,
+						cluster_qvotec_prior_unclean_death() ? ", prior unclean shutdown" : ""),
+				 errhint("Enable cluster.online_join for an online re-declare rejoin (admission "
+						 "self-heal is spec-5.22 follow-up), or cold-restart the cluster after a "
+						 "full clean shutdown. Reads of peer-mastered blocks and non-home work "
+						 "are unaffected.")));
 		return;
 	}
 
 	if (cluster_reconfig_bootstrap_quorum_at_initial()) {
-		/* Cold bootstrap: fresh cluster at INITIAL, no stale home blocks. */
+		/* Clean cold bootstrap: fresh cluster co-booting at INITIAL, ALIVE was
+		 * cleared on the prior clean shutdown (or never written) — no stale
+		 * home blocks.  The !prior_unclean_death predicate is already proven by
+		 * the REJOIN arm above (守门裁决 07-15 point 5②). */
 		cluster_grd_set_offpath_boot_decided();
 		offpath_decided_local = true;
 		return;

src/backend/storage/buffer/bufmgr.c

@@ -8149,6 +8149,29 @@ cluster_bufmgr_read_block_scn_for_gcs(BufferDesc *buf)
 	return scn;
 }
 
+/*
+ * cluster_bufmgr_block_is_extension_for_gcs -- fix 2 (crash-rejoin cold-GRD
+ * watermark) extension-block whitelist input.
+ *
+ *	True iff the tag's block number is at or beyond the relation's current
+ *	durable size, i.e. a freshly-extended block that has never been written to
+ *	shared storage (its InvalidScn watermark is correct, so the cold-GRD gate
+ *	must SKIP it, not fail-closed).  A pre-existing block (blockNum < nblocks)
+ *	returns false, so an Invalid watermark on it under a self-fence is treated
+ *	as a wiped/cold GRD watermark and fails closed.  Invalidates the cached
+ *	size first so a concurrent extension is not missed (cheap: one lseek).
+ */
+bool
+cluster_bufmgr_block_is_extension_for_gcs(BufferTag tag)
+{
+	SMgrRelation reln = smgropen(BufTagGetRelFileLocator(&tag), InvalidBackendId);
+	ForkNumber	fork = BufTagGetForkNum(&tag);
+
+	/* Drop any cached size so a concurrent extension is not missed. */
+	smgrrelease(reln);
+	return tag.blockNum >= smgrnblocks(reln, fork);
+}
+
 bool
 cluster_bufmgr_refresh_block_from_storage_for_gcs(BufferDesc *buf, SCN *out_page_scn)
 {

src/include/cluster/cluster_gcs_block.h

@@ -1118,6 +1118,51 @@ gcs_block_lost_write_verdict(SCN expected_scn, SCN shipped_scn)
 	return GCS_LOST_WRITE_PASS;
 }
 
+/*
+ * fix 2 (crash-rejoin re-declare barrier, defense in depth) — cold-GRD
+ * watermark verdict.
+ *
+ * The storage-fallback / local-master freshness gate normally SKIPs when the
+ * master pi_watermark_scn is InvalidScn (an old-binary master, a holder
+ * re-ack whose requester copy is authoritative, or a block that is simply not
+ * SCN-tracked).  But a crash-rejoined node's LOCAL GRD watermark was WIPED by
+ * the restart, so within an active self-fence an InvalidScn watermark can mask
+ * a stale home block whose peer holds a newer version — a SKIP there is a
+ * silent fail-OPEN.  This is a second line behind the phase-gate boot barrier,
+ * which already fences self-home blocks RECOVERING before the acquire reaches
+ * the freshness gate; it exists so any future path that reaches the freshness
+ * gate with a wiped watermark still fails closed.
+ *
+ * Pure truth table (header-only, unit-testable — no shmem, no I/O):
+ *	expected_scn_valid                       -> PROVE       (run the normal verdict)
+ *	!valid, no self-fence                    -> SKIP        (legit never-tracked / re-ack)
+ *	!valid, self-fence, extension block      -> SKIP        (genuine new block, never
+ *	                                                         cross-node written -> Invalid
+ *	                                                         is correct; the storage refresh
+ *	                                                         would read past EOF otherwise)
+ *	!valid, self-fence, NOT an extension     -> FAIL_CLOSED (wiped/cold GRD watermark on a
+ *	                                                         pre-existing block — ambiguous,
+ *	                                                         must not serve, Rule 8.A)
+ */
+typedef enum ClusterColdGrdVerdict {
+	CLUSTER_COLD_GRD_PROVE,		  /* watermark valid: run the lost-write verdict */
+	CLUSTER_COLD_GRD_SKIP,		  /* Invalid watermark, provably safe to keep local */
+	CLUSTER_COLD_GRD_FAIL_CLOSED, /* Invalid watermark under a self-fence: refuse */
+} ClusterColdGrdVerdict;
+
+static inline ClusterColdGrdVerdict
+cluster_gcs_cold_grd_watermark_verdict(bool expected_scn_valid, bool self_fence_active,
+									   bool is_extension_block)
+{
+	if (expected_scn_valid)
+		return CLUSTER_COLD_GRD_PROVE;
+	if (!self_fence_active)
+		return CLUSTER_COLD_GRD_SKIP;
+	if (is_extension_block)
+		return CLUSTER_COLD_GRD_SKIP;
+	return CLUSTER_COLD_GRD_FAIL_CLOSED;
+}
+
 /* PGRAC: spec-5.2 D2 — read-image intent flag carried in reserved_0[0].
  *
  *	When the master forwards an N→S read request to a node that holds the
@@ -1913,6 +1958,8 @@ extern ClusterBufmgrGcsDropResult cluster_bufmgr_invalidate_block_for_gcs(Buffer
  * local copy → PASS keep / stale → refresh + re-verdict → 53R93). */
 extern SCN cluster_bufmgr_read_block_scn_for_gcs(BufferDesc *buf);
 extern bool cluster_bufmgr_refresh_block_from_storage_for_gcs(BufferDesc *buf, SCN *out_page_scn);
+/* fix 2 (crash-rejoin cold-GRD watermark) extension-block whitelist input. */
+extern bool cluster_bufmgr_block_is_extension_for_gcs(BufferTag tag);
 extern void cluster_gcs_block_fallback_verify_refresh(BufferDesc *buf, BufferTag tag,
 													  SCN expected_scn);
 /* PGRAC: spec-5.2 D11 (writer-transfer-revoke) — by-tag local buffer drop

src/include/cluster/cluster_grd.h

@@ -419,6 +419,8 @@ typedef struct ClusterGrdShared {
 	pg_atomic_uint64 join_shards_remastered_count;			 /* GRD shards moved to joiner */
 	pg_atomic_uint64 join_block_views_rebuilt_count;		 /* joiner-home fences lifted */
 	pg_atomic_uint64 join_block_recovering_failclosed_count; /* 53R9L denied (both gates) */
+	pg_atomic_uint64 offpath_crash_rejoin_fenced_count;		 /* Shape A: off-path crash-rejoin
+															  * fence-arm events (LMON) */
 } ClusterGrdShared;
 
 /* spec-2.17 D28b — extern atomic generation alloc helper(InitProcess hook). */
@@ -685,6 +687,8 @@ extern void cluster_grd_inc_join_block_failclosed(void);
 /* Shape A (crash-rejoin re-declare barrier) — off-path boot barrier flag. */
 extern bool cluster_grd_offpath_boot_decided(void);
 extern void cluster_grd_set_offpath_boot_decided(void);
+extern void cluster_grd_inc_offpath_crash_rejoin_fenced(void);
+extern uint64 cluster_grd_offpath_crash_rejoin_fenced_count(void);
 
 /* spec-4.6 D5 — bulk snapshot of the 13 grd_recovery counters for the
  * pg_cluster_state dump (category 'grd_recovery';  one t/249 leg each). */