ARGH!

Vacuum must not advance pg_database.datvacuumxid nor truncate CLOG
unless it's processed *all* tables in the database.  Vacuums run by
unprivileged users don't count.

(Beats head against nearest convenient wall...)