These are great examples, thanks. I wasn't aware it was that easy to chain config overwrite and crash/restart from plain SQL.
Taken together, that makes it clear this GUC buys less than I'd hoped, and is probably not worth the extra complexity on its own.
Please consider this patch withdrawn for now. I'll go back and think about a more comprehensive approach (e.g. a single control over superuser features), and if something useful comes out of that I'll post a separate proposal. I'll also play with the panic cases you mentioned as part of that.
