CLUSTER doesn't check indisvalid etc

It strikes me that CLUSTER has been broken since CREATE INDEX
CONCURRENTLY was put in, because it doesn't check whether the index
it's been asked to cluster on is valid.  If C.I.C. fails before marking
the index indisvalid, a subsequent CLUSTER would happily cluster using
only the index entries that are present, thereby losing data.

Fixing this in 8.2 seems a simple matter of checking indisvalid.
However I'm not quite sure what to do in HEAD: is it important to
honor indcheckxmin?  Offhand it seems the worst problem we could
have with a not-quite-ready index is that some recently dead tuples
might be scanned out-of-order because they'd be visited via a broken
HOT chain; and we need not worry too much about whether CLUSTER
preserves exact index ordering for such tuples.

Are there any other utility commands besides CLUSTER that should be
checking index validity?  I don't see anything in a quick look, but
maybe I missed something.

Comments?
        regards, tom lane