Allowlist validation for Postgres identifiers replicant interpolates into slot and publication SQL (Critical Rule 2). A failure carries the invalid-SHAPE fact only, never the offending string — it may be attacker-controlled.

Mirrors arcadic's Identifier, tightened to the Postgres unquoted-identifier rule: lowercase letters, digits, underscore; first character a letter or underscore; at most 63 characters (NAMEDATALEN - 1). Postgres folds unquoted identifiers to lowercase and rejects the rest, so the allowlist accepts only what Postgres accepts without quoting — nothing that can break out of the identifier position.