The legacy-thread guard read the source in its own transaction before the
copy, so a V1 server could commit its first thread in between; the
unfiltered copy took it, prune dropped it, and the run exited 0. The check
now runs inside the copy transaction, against the same snapshot as the
schema reads and row copies, and the destination's first busy check
(whose WAL checkpoint rewrites it) moves after the copy so a refusal
still leaves the destination untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>