index fetches will never even try to
detect that tuples it needs actually have already been pruned away.
I looked at this flavor of problem today and from what I saw:
(1) This has been a problem all the way back to 9.6.0.
(2) The behavior is correct if the index creation is skipped or if enable_indexscan is turned off in the transaction, confirming Andres' analysis.
(3) Pruning seems to happen as intended; the bug found by Peter seems to be entirely about failing to TestForOldSnapshot() where needed.