release: reject inverted reader windows and clarify diagnostics

[NikolayS]

Summary

• Reject inverted windows in ash.aas, timeline, top, report, chart, samples, summary, and both compare windows; anchor an until-only call to the preceding hour while retaining the bug: _at readers raise 'integer out of range' on absurd timestamps — same class as #51 #63 overflow/degenerate clamp. Closes Release blocker: until-only reader calls answer the wrong window #165.
• Correct the pg_monitor opt-out and reader re-apply documentation, and warn with the roles whose complete reader bundle is restored. Closes Bug: installer re-apply restores a revoked pg_monitor reader grant #170 and Bug: installer re-apply widens hand-narrowed reader ACLs #171.
• Document the rollup_1m-only report contract in the catalog and README and emit a NOTICE naming raw or rollup_1h alternate coverage without changing the SQL NULL return behavior. This implements C1 Option A. Closes Docs: disclose ash.report()'s rollup_1m-only coverage dependency #172; refs Decision request: define ash.report coverage and sub-day rotation contracts #167.
• Correct the pg_cron database-scoping diagnostic and distinguish unset, current-database, and alternate-database targets. Closes Bug: ash.start misreports database-scoped pg_cron as not installed #173.
• Clarify that lifecycle/admin signatures are unchanged while parameter names were de-prefixed. Closes Docs: clarify lifecycle/admin parameter-name compatibility in 2.0 #174.
• Append the user-visible changes to the release notes.

Rebase resolution

Hand-rebased onto main c28fce3. The resolution preserves #181's dynamic reader/helper grants, #182's honest rollup_1h_flat planning, and #189's logical/physical raw-retention boundary and active-slot exclusion. No new reader helper was introduced.

Validation

• Current main RED: until-only calls answered a now-relative window, and every affected reader accepted explicit inverted bounds.
• Rebased head GREEN: exact B5 defaults/errors for all readers and both compare windows; bug: _at readers raise 'integer out of range' on absurd timestamps — same class as #51 #63 horizon clamps remain intact.
• Alternate raw/hourly coverage NOTICEs occur exactly once while ash.report() remains SQL NULL; uncovered and sparse invalid-hour windows remain silent.
• Installer re-grant warning and pg_monitor behavior pass; release: fix reader privilege blockers and sample slot race #181 helper bundle remains complete.
• release: fix rollup_1h grain honesty #182 grain/source behavior and release: fix raw retention boundary #189 retention/active-slot probes pass.
• PG17 cron-off and real pg_cron-preloaded cron-on diagnostic branches pass; the postmaster-only GUC is never mutated on cron-enabled servers.
• YAML parse, documentation guards, fresh install, and git diff --check pass.
• Codex review (standing in for REV): final pass, no actionable regressions.

[NikolayS]

Pre-merge review — PASS

Codex review is standing in for REV for this merge.

Audit verdict verified: B5 requires an error for since > until, an until-only default of until - interval '1 hour', and preservation of the #63 overflow/degenerate clamp after validation. N3–N7 and C1 Option A are documentation/diagnostic contracts, not report source changes.

RED / GREEN

• RED on current main c28fce3: aas, timeline, top, report, chart, samples, summary, and both compare windows accepted explicit inversions; until-only calls used the wrong now-relative window.
• GREEN on 56b67dd: all exact function-specific errors and until-relative bounds pass, including both compare windows and the #63 edge clamps.
• ash.report() still returns SQL NULL when rollup_1m is absent. Raw-only and valid hourly-only windows produce exactly one source-naming NOTICE; no-source, excluded-slot-only, and invalid sparse-hour cases remain silent.

Hand-rebase checks

• Kept #181's dynamic reader/helper grant bundle and _admin_funcs narrowing; #180 adds no helper, and all reader-visible dependencies remain covered.
• Kept #182's numeric bucket rounding and honest rollup_1h_flat plan for incomplete minute_counts.
• Replaced the pre-B3 raw formula with #189's _raw_retention_start() and _active_slots(), preserving the logical/physical boundary and excluded-slot rule.
• Removed the duplicate pre-rebase ash.compare declaration block.

Review findings resolved

1. README lacked the explicit rollup_1m-only report contract. Added the shipped disclosure and CI guards.
2. The pg_cron hint could recommend install pg_ash in (not set) or recommend another database when the configured target was the current database. Split unset/current/alternate guidance and behaviorally tested each branch.
3. The first test fix tried to mutate preloaded pg_cron's postmaster-only cron.database_name GUC. Restricted mutable placeholder probes to the cron-off axis and verified a real pg_cron-preloaded PG17 server after DROP EXTENSION does not attempt mutation.

Final Codex re-review: no actionable regressions found. Isolated PG17 runtime gates, fresh install, YAML parse, documentation guards, and git diff --check all pass. Scratch resources were removed.