Mechanism: The dedup-by-relid guard skips ATPostAlterTypeCleanup for the AT_PASS_SET_EXPRESSION pass when AT_PASS_ALTER_TYPE already ran cleanup for the same relation. This leaves constraints/indexes registered *only* by RememberWholeRowDependentForRebuilding (and per-column dependents of the expression-changed column) un-rebuilt.

Why this is wrong: ATPostAlterTypeCleanup processes tab->changedConstraintOids, changedIndexOids, changedStatisticsOids, replicaIdentityIndex, and clusterOnIndex. These lists are *accumulated across passes*:

1. During AT_PASS_ALTER_TYPE, ATExecAlterColumnType registers

constraints/indexes dependent on the type-changed column.

1. ATPostAlterTypeCleanup runs, drops those objects via

performMultipleDeletions, and queues re-add commands. Under v1 the relid is recorded.

1. During AT_PASS_SET_EXPRESSION, ATExecSetExpression calls

RememberAllDependentForRebuilding and RememberWholeRowDependentForRebuilding (tablecmds.c:8836/:8843), registering *additional* constraints/indexes dependent on the expression-changed column — including whole-row CHECK constraints (pg_depend refobjsubid = 0) that the per-column pg_depend scan in step 1 cannot find (RememberWholeRowDependentForRebuilding has Assert(subtype == AT_SetExpression) and is called *only* from ATExecSetExpression).

1. Under v1, ATPostAlterTypeCleanup is skipped because relid is already

in relids. The newly-registered objects from step 3 are never dropped, never reparsed, and never queued for re-addition.

Empirical reproduction (coordinator-executed, disposable build):

Cross-column whole-row counter-example against the v1 worktree patch:

CREATE TABLE gtest_blocker3 (a int, z int, b int GENERATED ALWAYS AS (a*2) STORED, c text);
ALTER TABLE gtest_blocker3 ADD CONSTRAINT cc_col CHECK (z > 0);       -- per-column dep on z
ALTER TABLE gtest_blocker3 ADD CONSTRAINT cc_wr CHECK (gtest_blocker3 IS NOT NULL); -- whole-row (refobjsubid=0)
ALTER TABLE gtest_blocker3 ALTER COLUMN z SET DATA TYPE bigint, ALTER COLUMN b SET EXPRESSION AS (a*3);

Under v1: cc_col OID changed 17919 → 17922 (rebuilt by ALTER_TYPE pass), but cc_wr OID stayed 17920 → 17920 (NOT rebuilt — the SET_EXPRESSION cleanup was skipped). pg_depend for cc_wr has refobjsubid = 0, so only RememberWholeRowDependentForRebuilding (SET_EXPRESSION pass) registers it.

David Rowley's per-column counter-example (thread 623416, 2025-09-28) shows the same defect for a non-whole-row constraint on the generated column when only a *different* column's type is altered: cc check (b > 0) is not recreated.

Security relevance: CHECK constraints may silently fail to be rebuilt against the new column type/expression; replica identity and CLUSTER index markings may be lost, affecting logical replication correctness. Privilege neutral (any table owner can trigger it); the impact is catalog consistency and constraint enforcement. CWE-863 (incorrect enforcement) / catalog inconsistency.

Verification status: verified (by reproduction + pgsql-hackers thread corroboration).

Repair (v6): Revert the dedup-by-relid guard and instead reset the changed_* lists to NIL/NULL at the end of ATPostAlterTypeCleanup, after performMultipleDeletions + free_object_addresses. This allows the second cleanup call to process only objects registered by the SET_EXPRESSION pass.

Suggested code (exact postimage, overlaps the v6 repair patch):

tab->changedConstraintOids = NIL;
tab->changedConstraintDefs = NIL;
tab->changedIndexOids = NIL;
tab->changedIndexDefs = NIL;
tab->changedStatisticsOids = NIL;
tab->changedStatisticsDefs = NIL;
tab->changedStatisticsOwners = NIL;
tab->replicaIdentityIndex = NULL;
tab->clusterOnIndex = NULL;

Concrete HEAD-bound unified diff (sha256 08169af996d9855a984307f2d15235d7c6b4a7a7a418b1ff9326fd50b9f08038):

diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c
--- a/src/backend/commands/tablecmds.c
+++ b/src/backend/commands/tablecmds.c
@@ -16342,8 +16342,22 @@
 
 	/*
 	 * The objects will get recreated during subsequent passes over the work
-	 * queue.
+	 * queue.  Reset the changed-object lists so that a subsequent
+	 * ATPostAlterTypeCleanup call for this same tab (which happens when one
+	 * ALTER TABLE combines ALTER COLUMN TYPE and ALTER COLUMN SET EXPRESSION)
+	 * only processes objects registered by later passes, instead of
+	 * re-processing the already-dropped objects and ERRORing on a stale
+	 * SearchSysCache1(CONSTROID) lookup.
 	 */
+	tab->changedConstraintOids = NIL;
+	tab->changedConstraintDefs = NIL;
+	tab->changedIndexOids = NIL;
+	tab->changedIndexDefs = NIL;
+	tab->changedStatisticsOids = NIL;
+	tab->changedStatisticsDefs = NIL;
+	tab->changedStatisticsOwners = NIL;
+	tab->replicaIdentityIndex = NULL;
+	tab->clusterOnIndex = NULL;
 }

The added regression test only exercises the same-column case (ALTER TYPE + SET EXPRESSION on column b), which does not trigger SEC-1. It does not cover the cross-column case (David Rowley's counter-example) and performs no post-condition verification (\d or pg_constraint SELECT) that the constraint survived and was rebuilt. A regression that silently drops cc would pass the current test.

Verification status: cannot-verify (the test-adequacy gap is confirmed by inspection, but the concrete expected/*.out repair must be captured by running pg_regress in the author environment; hand-authoring expected output is not permitted).

Suggested test additions (the .out deltas must be generated by pg_regress):

-- cross-column counter-example (sec-1)
CREATE TABLE gtest25_dr (a0 int, z int, a int, b int GENERATED ALWAYS AS (a * 2 + a0) STORED);
ALTER TABLE gtest25_dr ADD CONSTRAINT check_z CHECK (z > 0);
ALTER TABLE gtest25_dr ADD CONSTRAINT cc_dr CHECK (b > 0);
ALTER TABLE gtest25_dr ALTER COLUMN z SET DATA TYPE numeric, ALTER COLUMN b SET EXPRESSION AS (z + 0);
\d gtest25_dr
SELECT conname, pg_get_constraintdef(oid) FROM pg_constraint WHERE conrelid = 'gtest25_dr'::regclass ORDER BY conname;

The block comment above the cleanup call was not updated. It still says "done only once if multiple columns of a table are altered", which is misleading under the v6 repair (cleanup runs once per pass, and the list reset makes the second call safe). Verification status: cannot-verify (comment-only; no runtime validation).