[ forgot to respond to this part ]
Andres Freund <andres@2ndquadrant.com> writes:
> They currently don't seem to create invalidations on the objects they
> are set upon, maybe we should change that?
No, because relcache doesn't store security labels to start with.
There's a separate catalog cache for security labels, I believe,
and invalidating entries in that ought to be sufficient.
regards, tom lane