src/backend/commands/explain.c

CONFIRMED unreachable.
Line 3073 (`altEnd = limit;
`) only fires when `altEnd > limit`, i.e. when rpr_alt_scope_end(idx) overshoots the inherited limit.
I traced every call site of deparse_rpr_node's ALT branch and the depth invariants from rpr.c (fillRPRPatternAlt sets ALT marker at depth d, branches at d+1;
finalizeRPRPattern puts FIN at depth 0;
rpr_alt_scope_end uses `depth <= d`, so it stops AT the first element whose depth is <= the ALT's depth and never skips a same-or-lower-depth boundary).
The three possible limits all bound the ALT's scope:
(1) top-level seq passes limit=numElements;
an ALT here is at depth 0 and its scope_end stops at FIN (depth 0) or a depth-0 sibling, index <= numElements-1 < limit.
(2) loneAlt path (line 3054) passes limit=end with the explicit guard rpr_alt_scope_end(idx+1)==end, so altEnd==limit exactly, not >.
(3) seq inside a non-loneAlt group passes limit=group END index;
the END sits at depth d_group = d_alt-1 < d_alt, so scope_end stops at or before it, altEnd <= limit.
Nested ALTs are flattened by flattenAltChildren/optimizeAltPattern and {1,1} groups are unwrapped, so no two ALTs ever share a depth boundary that could push scope past the limit.
In all cases altEnd <= limit, so `altEnd > limit` is never true.
The root-cause analysis in the finding is accurate.

Replace the silent clamp with an assertion documenting the invariant.
Change lines 3072-3073 from `if (altEnd > limit) altEnd = limit;
` to `Assert(altEnd <= limit);
`.
This removes the uncoverable assignment, documents that an ALT's depth-derived scope end never exceeds the inherited limit (guaranteed by the depth invariants in optimizer/plan/rpr.c:
ALT branches at depth d+1, FIN/END boundaries at depth <= d, and ALT flattening preventing shared boundaries), and still catches any future invariant break in assert-enabled builds.
The `limit` parameter is otherwise unused after this in the ALT branch, but it is still used by the VAR/BEGIN paths and by the Assert, so keep the parameter.
Optionally add a one-line comment:
`/* an ALT's scope end never exceeds the limit handed down (see rpr.c depth invariants) */`.

CONFIRMED defensive-unreachable.
Line 3109 is `pg_unreachable()` placed after a for-loop that always returns. rpr_match_end (explain.c:3096-3110) is called only from the RPRElemIsBegin branch (explain.c:3044).
In fillRPRPatternGroup (rpr.c:1226-1294) the BEGIN marker (lines 1233-1252) and the matching END marker (lines 1261-1291) are emitted under the IDENTICAL guard `node->min != 1 || node->max != 1` and share the same `depth` parameter.
Children recurse at depth+1, so their END markers (deeper depth) are skipped by the `e->depth == d` test, and the first same-depth END (the real partner) is always present after beginIdx.
Thus the loop (3102-3108) always returns before falling through.
Round-trip serialization (-DWRITE_READ_PARSE_PLAN_TREES) copies the elements array verbatim preserving varId/depth, so it cannot introduce an unpaired BEGIN.
No SQL/regression input or node rewrite can reach line 3109. Tried to refute via nested groups, ALT children (which emit no BEGIN/END VARID markers), and the copy/out/read round-trip;
none break the pairing invariant. pg_unreachable() is the correct idiom and is intentionally excluded from meaningful coverage.

No change needed.
The line is `pg_unreachable()`, the correct defensive idiom for a code path guaranteed unreachable by the BEGIN/END pairing invariant.
Leave as is;
it is appropriately excluded from meaningful coverage.

Confirmed defensive-unreachable.
Lines 3251-3253 are the default: arm (elog(ERROR, "unrecognized RPR nav offset kind: %d", maxKind)) of the "Nav Mark Lookback" switch over maxKind, which is of type RPRNavOffsetKind.
The enum (parsenodes.h:604-610) has exactly three values:
RPR_NAV_OFFSET_FIXED, RPR_NAV_OFFSET_NEEDS_EVAL, RPR_NAV_OFFSET_RETAIN_ALL, all three handled by the preceding case arms (lines 3241-3249). maxKind is sourced from wagg->navMaxOffsetKind or (under es->analyze) planstate->navMaxOffsetKind.
Every assignment to these fields in the backend uses one of the three valid enumerators: createplan.c:2826/7046 (FIXED), nodeWindowAgg.c:3042 (copies plan value), nodeWindowAgg.c:4194 (RETAIN_ALL), nodeWindowAgg.c:4199 (FIXED).
No code path assigns an out-of-range value, so no SQL/regression input can drive execution into the default.
Reaching it would require memory corruption or addition of a new enumerator without updating the switch.
This is a standard PostgreSQL can't-happen guard.
The original finding (no test proposed) is correct.

No action required.
The elog(ERROR) default is the established PostgreSQL convention for enum switch-default guards and should be kept for robustness against future enum additions.
Optionally it could be reduced to Assert(false) but that would weaken protection in production builds;
keeping elog(ERROR) is preferable.
Leave as-is and accept the 2 uncovered lines as defensive code.

CONFIRMED unreachable.
Lines 3265-3266 are the RPR_NAV_OFFSET_RETAIN_ALL arm of the firstKind (Nav Mark Lookahead) switch.
I traced every writer of navFirstOffsetKind in the entire tree:
(1) createplan.c:7049 copies the local value computed by compute_define_metadata, which assigns *firstKind ONLY to NEEDS_EVAL (2782), FIXED (2787), or FIXED (2794) -- never RETAIN_ALL;
RETAIN_ALL is set ONLY for *maxKind on backward-reach overflow (2762).
(2) nodeWindowAgg.c:3045 copies the plan value into exec state.
(3) nodeWindowAgg.c:4206 (eval_define_offsets, the NEEDS_EVAL late-binding path) sets navFirstOffsetKind ONLY to FIXED;
first-offset overflow is handled by clamping navFirstOffset to PG_INT64_MAX while keeping kind FIXED (4210), which is exactly why the FIXED arm at 3270-3272 prints 'infinite' instead of a RETAIN_ALL path.
The RPR authors even added Assert(winstate->navFirstOffsetKind == RPR_NAV_OFFSET_FIXED) at nodeWindowAgg.c:4405, self-documenting that the lookahead/first dimension is structurally never RETAIN_ALL.
I could not construct any SQL input (FIRST/PREV_FIRST/NEXT_FIRST with any quantifier or huge offset) that yields RETAIN_ALL for the first dimension, because overflow on that dimension clamps to FIXED+INT64_MAX rather than RETAIN_ALL.
The arm exists purely for switch completeness (its sibling default already elog(ERROR)s on unrecognized kinds).
The root-cause analysis in the finding is accurate.

Remove the dead RPR_NAV_OFFSET_RETAIN_ALL arm from the firstKind (Lookahead) switch in show_window_def.
The default arm already does elog(ERROR, "unrecognized RPR nav offset kind: %d", firstKind), so deleting lines 3265-3268 keeps behavior identical while eliminating the permanently-uncoverable lines and correctly documenting (consistent with the Assert at nodeWindowAgg.c:4405) that the lookahead/first dimension never retains-all.
If the authors prefer to keep all enum arms explicit for symmetry with the maxKind switch, add a brief comment '/* lookahead dimension never overflows to RETAIN_ALL;
see eval_define_offsets */' and accept the 2 uncovered lines, or replace the arm body with Assert(false) to make the intent explicit.
Folding into default is the cleanest.

Confirmed defensive-unreachable.
Lines 3277-3278 are the default: arm (elog(ERROR, "unrecognized RPR nav offset kind: %d", firstKind)) of the Lookahead switch over firstKind, a strongly-typed RPRNavOffsetKind.
The enum (src/include/nodes/parsenodes.h:605-609) has exactly three enumerators:
RPR_NAV_OFFSET_FIXED, RPR_NAV_OFFSET_NEEDS_EVAL, RPR_NAV_OFFSET_RETAIN_ALL, and the switch (explain.c:3261/3265/3269) explicitly handles all three. firstKind is sourced either from wagg->navFirstOffsetKind (plan node, set by compute_define_metadata in createplan.c, default FIXED) or, under EXPLAIN ANALYZE, from planstate->navFirstOffsetKind (set in nodeWindowAgg.c:3045/4206, only ever FIXED/NEEDS_EVAL/RETAIN_ALL;
an Assert at 4405 even pins it to FIXED on the eval path).
No SQL or regression input can assign a 4th value;
reaching the default would require memory corruption.
I tried to refute by tracing every producer of the field and found none that can emit an out-of-range value.
This matches the already-confirmed Lookback default at 3251-3253. Switch is additionally guarded by if (wagg->hasFirstNav) but that does not change reachability of the default within the switch.

Acceptable as the standard enum switch-default guard following PostgreSQL convention (mirrors the Lookback default at 3251-3253).
No action required.
The existing elog(ERROR, ...) is the idiomatic in-tree form for unrecognized-enum defaults, so keeping it as-is is preferable to switching to Assert(false) for consistency with the sibling switch.