Method validateControlMetadata

duckdbservice/activation.go:318–338

(meta server.WorkerControlMetadata)

		!reflect.DeepEqual(current.DuckLake, payload.DuckLake) {
		needsRefresh = s3CredentialsChanged(current.DuckLake, payload.DuckLake)
		if !needsRefresh {
			// For aws_sdk/credential_chain, the underlying IAM credentials
			// may have expired even though the payload fields haven't changed.
			provider := server.S3ProviderForConfig(payload.DuckLake)
			needsRefresh = provider == "aws_sdk" || provider == "credential_chain"
		}
	}

	// Pick the connection used to swap the secret. controlDB is a side
	// connection sharing the same DuckDB instance via *duckdb.Connector, with
	// its own independent pool — so the CREATE OR REPLACE SECRET below never
	// queues behind a long-running client query on the main DB. Fall back to
	// the activation DB only when controlDB hasn't been wired (older/test
	// paths that bypass createDBPair).
	refreshDB := p.controlDB
	if refreshDB == nil {
		refreshDB = p.activation.db
	}
	refreshFn := p.refreshS3Secret
	sem := p.duckLakeSem
	p.mu.Unlock()

	// Phase 2 (unlocked): perform the slow I/O. Holding p.mu across this is a
	// bug — RefreshS3Secret runs a CREATE OR REPLACE SECRET which can block