XX001 — data_corrupted

Source-backed full reference for PostgreSQL SQLSTATE XX001.

XX001

At a glance

XX001 reports an integrity invariant failure. The fixed sources cover corrupted PGLZ TOAST data, impossible MultiXact/XID freeze state in heap processing, and an amcheck B-tree check that can reveal a heap/HOT-chain problem behind an apparent index mismatch.

Field	Value
SQLSTATE	`XX001`
Condition	`data_corrupted`
Status	`active`
Known present by	`7.4`
Locked snapshots	`9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3`
Macros	`ERRCODE_DATA_CORRUPTED`
Aliases	`—`

Meaning

The TOAST decompressor raises ERRCODE_DATA_CORRUPTED when PGLZ cannot decode the stored compressed datum. Heap freezing raises the same code when a MultiXact precedes relminmxid, remains running before the freeze cutoff, or carries an update XID before relfrozenxid or the removable cutoff. These are consistency checks on stored data and transaction metadata, not invalid user input.

The amcheck heapallindexed callback reports a heap tuple lacking its matching index tuple. Its source comments warn that an apparent index-scan problem can still be heap corruption, a bad HOT-safety decision, or another underlying fault; the optional hint only asks for a stronger verification call.

Messages

ERROR, SQLSTATE XX001: compressed pglz data is corrupt.
ERROR, SQLSTATE XX001: found multixact %u from before relminmxid %u.
ERROR, SQLSTATE XX001: multixact %u from before multi freeze cutoff %u found to be still running.
ERROR, SQLSTATE XX001: multixact %u contains update XID %u from before relfrozenxid %u.
ERROR, SQLSTATE XX001: multixact %u contains committed update XID %u from before removable cutoff %u.
ERROR, SQLSTATE XX001: heap tuple (%u,%u) from table "%s" lacks matching index tuple within index "%s".
- When the check was entered through bt_index_check (which takes AccessShareLock and passes readonly=false to the callback), hint: Retrying verification using the function bt_index_parent_check() might provide a more specific error. The bt_index_parent_check entry point takes ShareLock, passes readonly=true, and does not append this hint. This internal verification mode is unrelated to the SQL transaction’s transaction_read_only setting.

Diagnosis

Preserve the exact message and identifiers, relation/index names, block and page context, checksum and replica comparison, server log, and the first operation that observed the invariant. For TOAST, identify the owning table and compressed datum path. For heap messages, inspect relfrozenxid/relminmxid and MultiXact history without manually editing system catalogs. For amcheck, record whether the call used bt_index_check/AccessShareLock or bt_index_parent_check/ShareLock, and whether the hint was present; do not assume the index is the root cause.

Response

Treat these as integrity incidents. In an explicit transaction, an ERROR requires ROLLBACK or ROLLBACK TO an existing savepoint before more SQL, but rollback does not repair the stored object. Compare trusted backups, replicas, checksums and storage history using a read-only procedure; then restore or rebuild the affected table/TOAST data according to the incident plan. A REINDEX may be appropriate only after evidence shows corruption is index-local; it is not a generic repair for heap, TOAST, XID, or MultiXact invariants. If a separate FATAL or process termination occurred, use a new connection after recovery; do not induce corruption to test this code.

Versions

The locked catalogue records this condition from 7.4; fixed TOAST, heap, and amcheck source coverage is PostgreSQL 18.6. No corruption or crash runtime was run for this source-only page.

XX002, 58030, 72000