wraparound

With 2^31 usable xids, an unfrozen row can only age so far before comparisons would invert and committed data would appear to be from the future. Postgres defends in stages: warnings at 40M xids of headroom, then a hard stop (no new write transactions) at 3M. Recovery is a vacuum of the tables holding the oldest relfrozenxid, at whatever speed the neglected table allows; the public postmortems measure it in hours to days, and two of them ended by truncating rebuildable terabyte tables instead.