A switch to forbid implicit materialized views

A materialized view created without TO gets a hidden inner table named .inner_id.<uuid>, and the data lives there. On a shared cluster, advice to “always use TO” does not stop anyone, so I asked for a setting, allow_implicit_materialized_view_creation, default 1, that an administrator could set to 0 in a profile to make CREATE MATERIALIZED VIEW without TO an error.

CREATE TABLE src (x UInt8) ENGINE = MergeTree ORDER BY x;
CREATE MATERIALIZED VIEW mv ENGINE = MergeTree ORDER BY x AS SELECT x FROM src;
SELECT name FROM system.tables WHERE database = currentDatabase() ORDER BY name;

.inner_id.14ddd52d-5250-424b-9a44-b629cc87113f
mv
src

The issue has two community replies and no maintainer response; it is open, labelled feature, comp-materialized-view and external, with no assignee or PR. The useful reply objected that refreshable materialized views make the implicit form convenient, since they can always be recomputed, and suggested restricting the guard to incremental views, perhaps with a separate CREATE STREAMING MATERIALIZED VIEW. That is a better design than my original.

On 26.4 no such setting exists. The enforcement has to live outside the server: review DDL, or scan system.tables for .inner_id. names. The explicit-target pattern is in Materialized views basics.