src/backend/nodes/readfuncs.c

Confirmed unreachable by any SQL/regression input.
Line 595 (local_node->varNames = NULL) is the else branch of `if (local_node->numVars > 0 && token[0] == '(')` at readfuncs.c:583. It is reached only when the serialized varNames token is the empty-list marker "<>".
That marker is written by _outRPRPattern (outfuncs.c:753-754) only when `node->numVars <= 0 || node->varNames == NULL`.
Every RPRPattern is constructed via makeRPRPattern (rpr.c:1128) which asserts numVars > 0 (rpr.c:1143) and always palloc's varNames (rpr.c:1144), or via _copyRPRPattern (copyfuncs.c:170) which asserts from->numVars > 0 (copyfuncs.c:180) and copies a non-NULL array.
The only other makeNode(RPRPattern) is inside makeRPRPattern itself.
The grammar (gram.y:17583
PATTERN '(' row_pattern ')', row_pattern:17625) cannot produce an empty pattern, and
DEFINE is required, so numVars is always >= 1. Node-read input in this build comes solely from _out* output (COPY_PARSE_PLAN_TREES / WRITE_READ_PARSE_PLAN_TREES round-trips and stored rules);
there is no SQL surface to feed an arbitrary "<>" token to the reader.
Hence _outRPRPattern never emits "<>" for a real RPRPattern and line 595's else branch never executes.
Tried to refute via copy/out/read round-trip and via deparse, but all paths guarantee numVars>0 and non-NULL varNames, so token[0]=='(' always holds at read time.

Keep read/out symmetry but document the invariant.
In _readRPRPattern, replace the else body at line 595 with an assertion that records the can't-happen condition while preserving the NULL assignment for safety:

    else
    {
        /* "<>" marker is never emitted for a real RPRPattern (numVars > 0) */
        Assert(local_node->numVars == 0);
local_node->varNames = NULL;
}

This mirrors the Assert(numVars > 0) invariants already present in makeRPRPattern (rpr.c:1143) and _copyRPRPattern (copyfuncs.c:180), marks the branch as structurally unreachable, and avoids changing behavior for the (impossible) malformed-input case.
Alternatively, leave the code unchanged: the NULL assignment is standard defensive out/read symmetry and the uncovered line is expected and harmless.

Confirmed unreachable.
Line 647 (local_node->elements = NULL) is the else branch of `if (numElements > 0 && token[0] == '(')` at readfuncs.c:601, taken only when _outRPRPattern wrote the "<>" marker (outfuncs.c:776), which happens only when node->numElements <= 0 || node->elements == NULL.
I verified the ONLY constructor of RPRPattern is makeRPRPattern (rpr.c:1128), which asserts numElements >= 2 (line 1149) and unconditionally palloc0's the elements array (line 1150). scanRPRPattern always does (*numElements)++ for the FIN marker (rpr.c:1110), and the non-empty
PATTERN grammar guarantees at least one real element. _copyRPRPattern (copyfuncs.c:171) likewise asserts numElements >= 2 and deep-copies a non-NULL array.
Thus every live RPRPattern has numElements >= 2 and non-NULL elements;
_outRPRPattern always emits the '(...)' form, never "<>";
and the reader's else branch can never execute for any node produced by the system, including under -DWRITE_READ_PARSE_PLAN_TREES which round-trips every constructed node.
I attempted to refute this by searching for any alternate makeNode(RPRPattern) construction site or any numElements=0/elements=NULL assignment outside out/read funcs;
none exist.
The only way to reach line 647 is hand-feeding a malformed serialized string with ':numElements 0' or ':elements <>' directly to the reader, which no SQL/regression path does.

Replace the unreachable NULL-assignment else with an assertion documenting the invariant, mirroring the constructor/copy/out paths.
E.g. change lines 645-648 to:
`else { Assert(false);
/* makeRPRPattern guarantees numElements >= 2 and non-NULL elements;
_outRPRPattern never emits "<>" for the :elements field */ local_node->elements = NULL;
}`.
Keeping the NULL assignment after the Assert preserves defensiveness for non-assert builds.
Alternatively, gate the populated block with Assert(local_node->numElements >= 2 && token[0] == '(') before line 601 and drop the else entirely.
Note: the existing varNames else branch (line 595) is analogously defensive but reachable status differs;
leave it unless separately measured.