What a read replica may do to itself, and what it must refuse and send to the primary.
Two allow-lists and no deny-list: a table is authoritative unless named local, a statement is a
write unless proven a read, a capability is mutating unless named safe. A deny-list misses the
write nobody thought of, which a replica would commit silently. enforceReadOnly walks the
capabilities installed on the module, not CROSSING_NAMES, which has drifted (cfwOidcClaims
and cfwTcp mutate and never joined it).
What a read replica may do to itself, and what it must refuse and send to the primary.
Two allow-lists and no deny-list: a table is authoritative unless named local, a statement is a write unless proven a read, a capability is mutating unless named safe. A deny-list misses the write nobody thought of, which a replica would commit silently. enforceReadOnly walks the capabilities installed on the module, not
CROSSING_NAMES, which has drifted (cfwOidcClaimsandcfwTcpmutate and never joined it).