@consiliency/agent-board-schema 1.23.0 → 1.25.0

package/tests/agent_board_source_strip_helper.test.sql

@@ -0,0 +1,285 @@
+-- ===========================================================================
+-- agent_board_test.strip_sql — the shared source-text strip every positional
+-- and negative pgTAP assertion in this suite now reads through
+-- (message-board#196, message-board#199).
+--
+-- WHY THIS FILE EXISTS. The strip is now a single point of failure for ~47
+-- assertion sites across 14 files. Before it was shared, each file carried its
+-- own regex; the two most hardened copies were kept deliberately byte-identical
+-- so they could not drift, and they were both WRONG in the same way -- a nested
+-- block comment walked straight through them and left
+-- agent_board_atomic_fleet_onboarding at 52/52 and
+-- agent_board_federated_lock_order_class at 15/15 with a lock genuinely moved.
+-- A shared scanner without its own vectors would just be one wrong copy instead
+-- of two, so every escape hatch the helper's header CLAIMS to close is asserted
+-- here, and the claim is treated as falsifiable.
+--
+-- WHAT A REGEX CANNOT DO, and why this is a character scanner. Postgres block
+-- comments NEST. Nested delimiters are not a regular language, and Postgres'
+-- regex engine has no recursion, so no regular expression -- however clever --
+-- can match `/* a /* b */ c */`. Every regex-based strip in the tree stopped at
+-- the FIRST `*/` and handed back the text after it as if it were code.
+--
+-- The last three assertions are CORPUS-WIDE and catalog-derived: they run the
+-- scanner over every live agent_board function rather than over vectors, so a
+-- desync on real source (which is exactly how #199 was found) fails here.
+-- ===========================================================================
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(31);
+
+-- ---------------------------------------------------------------------------
+-- The four demonstrated masking constructs.
+-- ---------------------------------------------------------------------------
+select is(
+  agent_board_test.strip_sql(E'a -- MARKER\nb'),
+  E'a  \nb',
+  'MASK 1 (line comment): a `--` comment naming the marker is removed');
+
+select is(
+  agent_board_test.strip_sql('a /* MARKER **/ b'),
+  'a   b',
+  'MASK 2 (block comment ending in `*`): `/* … **/` is removed -- the regex form `(/\*([^*]|\*[^/])*\*/)` could not match this at all');
+
+select is(
+  agent_board_test.strip_sql(E'a /* note /* x */\nselect * into v_board from agent_board.boards b where b.id = v_inv.board_id for update;\n*/ b'),
+  'a   b',
+  'MASK 3 (NESTED block comment, message-board#199): the code after the INNER `*/` is removed too -- this is the construct that left two hardened files fully green with the lock relocated');
+
+select is(
+  agent_board_test.strip_sql($x$v_note := 'MARKER'; b$x$),
+  'v_note :=  ; b',
+  'MASK 4 (string literal): `raise debug ''…''`-style prose naming the marker is removed');
+
+-- ...and the mode that keeps literals keeps EXACTLY the literals, not the comments.
+select is(
+  agent_board_test.strip_sql(E'v_note := \'MARKER\'; -- and a comment\nb', true),
+  E'v_note := \'MARKER\';  \nb',
+  'p_keep_literals keeps the literal (for a marker that IS a literal) and still removes the comment');
+
+-- ---------------------------------------------------------------------------
+-- Desync vectors: constructs that make a two-pass or regex scanner lose its
+-- place, so that a LIVE statement afterwards is silently dropped or kept.
+-- ---------------------------------------------------------------------------
+select is(
+  agent_board_test.strip_sql($x$x 'it''s -- not a comment' y$x$),
+  'x   y',
+  'DESYNC: a doubled quote does not end the literal, and a `--` inside a literal is not a comment');
+
+select is(
+  agent_board_test.strip_sql($x$p $r$ don't /* nope $r$ q$x$),
+  'p   q',
+  'DESYNC: a dollar-quoted block with an ODD apostrophe count is consumed whole -- `mark_retention_metadata` survives a naive scanner today only because its 64 apostrophes happen to be even');
+
+select is(
+  agent_board_test.strip_sql(E'select "weird\'col" -- c\n, z'),
+  E'select "weird\'col"  \n, z',
+  'DESYNC: an apostrophe inside a "quoted identifier" does not open a literal -- the identifier is CODE and survives');
+
+-- PostgreSQL permits `$` INSIDE an unquoted identifier and consumes it greedily,
+-- so `foo$tag$danger$tag$` is ONE identifier -- live code, not a dollar-quoted
+-- string. A scanner that does not look at the preceding character reads `$tag$`
+-- as an opener and silently DELETES the rest. Confirmed against the server rather
+-- than argued: `do $do$ declare foo$tag$danger$tag$ int := 7;
+-- begin raise notice '%', foo$tag$danger$tag$; end $do$;` runs and prints 7.
+select is(
+  agent_board_test.strip_sql('select foo$tag$danger$tag$ from t'),
+  'select foo$tag$danger$tag$ from t',
+  'DESYNC: `$` inside an unquoted identifier does not open a dollar quote -- `foo$tag$danger$tag$` is one identifier and survives whole');
+
+-- The identifier grammar is NOT ASCII. PostgreSQL accepts any letter the server
+-- encoding recognises, in unquoted identifiers AND in dollar-quote tags, so an
+-- `[A-Za-z0-9_]` class (or an \x80-\xff BYTE range, which is simply wrong for
+-- multi-byte UTF-8) fails in both directions at once. Both confirmed to be legal
+-- SQL against the server, not assumed:
+--   do $do$ begin raise notice '%', $Ω$ hello $Ω$; end $do$;
+--   do $do$ declare Ω$tag$danger$tag$ int := 7; begin raise notice '%', Ω$tag$danger$tag$; end $do$;
+select is(
+  agent_board_test.strip_sql('a $Ω$ perform agent_board._lock_board_authority_ceiling(x) $Ω$ b'),
+  'a   b',
+  'DESYNC: a NON-ASCII dollar-quote tag still opens a dollar quote -- a marker planted inside `$Ω$ … $Ω$` is stripped, not handed back as code');
+
+select is(
+  agent_board_test.strip_sql('select Ω$tag$danger$tag$ from t'),
+  'select Ω$tag$danger$tag$ from t',
+  'DESYNC: an identifier STARTING with a non-ASCII letter is still an identifier -- `Ω$tag$danger$tag$` survives whole');
+
+-- ...and the identifier class must be LOCALE-INDEPENDENT, not merely non-ASCII
+-- aware. `[[:alpha:]]` is locale-sensitive: under `C` collation it does NOT match
+-- `Ω` (measured: `('Ω' collate "C") ~ '[[:alpha:]]'` is FALSE, while the default
+-- collation says TRUE). A scanner built on it passes here and fails on a runner
+-- with a different collation -- and diverges from the JS mirror in scripts/, so the
+-- two enforcement paths would disagree about the same file. These two vectors pin
+-- the behaviour under an explicitly C-collated input.
+select is(
+  agent_board_test.strip_sql(('a $Ω$ perform agent_board._lock_board_authority_ceiling(x) $Ω$ b' collate "C")),
+  'a   b',
+  'LOCALE: a non-ASCII dollar-quote tag is stripped under C collation too -- the identifier class is collation-free');
+
+select is(
+  agent_board_test.strip_sql(('select Ω$tag$danger$tag$ from t' collate "C")),
+  'select Ω$tag$danger$tag$ from t',
+  'LOCALE: a non-ASCII identifier survives under C collation too');
+
+select is(
+  agent_board_test.strip_sql('select foo$$danger$$ from t'),
+  'select foo$$danger$$ from t',
+  'DESYNC: the same holds for the untagged form -- `foo$$danger$$` is an identifier, not code plus a $$-quoted string');
+
+select is(
+  agent_board_test.strip_sql(E'select $1 + $2 -- c\nfrom t'),
+  E'select $1 + $2  \nfrom t',
+  'DESYNC: `$1` is a parameter, not a dollar quote -- a tag cannot start with a digit, and treating it as one would swallow live SQL');
+
+select is(
+  agent_board_test.strip_sql($x$a E'x\'y -- z' b$x$),
+  'a   b',
+  'DESYNC: in an E-string a backslash escapes the closing quote, so the literal ends where the E-string rules say it does');
+
+select is(
+  agent_board_test.strip_sql($x$a '/*' b '*/' c$x$, true),
+  $x$a '/*' b '*/' c$x$,
+  'DESYNC: comment OPENERS inside literals are not comment openers, even in keep-literals mode');
+
+select is(
+  agent_board_test.strip_sql('a/*x*/b'),
+  'a b',
+  'TOKENS: a stripped construct collapses to a SPACE, so `a/*x*/b` never becomes the identifier `ab`');
+
+select is(
+  agent_board_test.strip_sql(null),
+  null,
+  'NULL in, NULL out');
+
+-- ---------------------------------------------------------------------------
+-- FAIL CLOSED. An unterminated construct raises rather than returning a
+-- truncated body -- a short string silently satisfies every `!~` in the suite.
+-- ---------------------------------------------------------------------------
+select throws_ok(
+  $$ select agent_board_test.strip_sql('a /* oops') $$,
+  null, null,
+  'FAIL-CLOSED: an unterminated block comment raises instead of returning a truncated body');
+
+select throws_ok(
+  $$ select agent_board_test.strip_sql('a ''oops') $$,
+  null, null,
+  'FAIL-CLOSED: an unterminated string literal raises');
+
+select throws_ok(
+  $$ select agent_board_test.strip_sql('a $q$ oops') $$,
+  null, null,
+  'FAIL-CLOSED: an unterminated dollar-quoted string raises');
+
+select throws_ok(
+  $$ select agent_board_test.strip_sql('a "oops') $$,
+  null, null,
+  'FAIL-CLOSED: an unterminated quoted identifier raises');
+
+-- ---------------------------------------------------------------------------
+-- stripped_def: the header must survive, the body must NOT be deleted.
+-- ---------------------------------------------------------------------------
+-- pg_get_functiondef wraps the body in a dollar quote (`AS $function$ … $function$`).
+-- Handing that whole string to a dollar-quote-aware strip deletes the ENTIRE body
+-- and every negative assertion over the result passes. stripped_def() splices
+-- instead, and these two assertions are what stop that regression.
+select ok(
+  agent_board_test.stripped_def('agent_board.update_board_membership(uuid,uuid,text,jsonb)'::regprocedure)
+    ~ 'SECURITY DEFINER',
+  'stripped_def keeps the generated HEADER -- SECURITY DEFINER is still matchable');
+
+-- The token below is deliberately one that appears ONLY in the body. The first
+-- version of this assertion used `board_memberships` against
+-- _upsert_board_membership_state, whose header says `RETURNS
+-- agent_board.board_memberships` -- so it passed even with the entire body
+-- deleted, which is precisely the failure it was written to catch.
+select ok(
+  agent_board_test.stripped_def('agent_board.update_board_membership(uuid,uuid,text,jsonb)'::regprocedure)
+    ~ '_membership_consent_present',
+  'stripped_def does NOT delete the body -- a BODY-ONLY code token is still matchable');
+
+select ok(
+  length(agent_board_test.stripped_def('agent_board.mark_retention_metadata(text,timestamp with time zone,uuid,text)'::regprocedure))
+    > length(pg_get_functiondef('agent_board.mark_retention_metadata(text,timestamp with time zone,uuid,text)'::regprocedure)) / 4,
+  'stripped_def on a body containing a dollar-quoted block keeps the surrounding code rather than collapsing the definition');
+
+-- ---------------------------------------------------------------------------
+-- CORPUS (catalog-derived). The vectors above are written by hand and can only
+-- prove what their author thought of. These run the scanner over every live
+-- agent_board function: a desync leaves a comment delimiter behind, and the
+-- offender NAMES ITSELF.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(proname, ', ' order by proname), '')
+     from (
+       select p.proname, agent_board_test.stripped_body(p.oid) as b
+         from pg_proc p
+         join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = 'agent_board'
+          and p.prolang <> (select oid from pg_language where lanname = 'internal')
+     ) s
+    where b ~ '--' or b ~ '/\*' or b ~ '\*/'),
+  '',
+  'CORPUS: no agent_board function body leaves a comment delimiter behind after the default strip');
+
+select is(
+  (select coalesce(string_agg(proname, ', ' order by proname), '')
+     from (
+       select p.proname, agent_board_test.stripped_body(p.oid, true) as b
+         from pg_proc p
+         join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = 'agent_board'
+          and p.prolang <> (select oid from pg_language where lanname = 'internal')
+     ) s
+    where b ~ '--' or b ~ '/\*' or b ~ '\*/'),
+  '',
+  'CORPUS: the keep-literals mode still removes every comment form -- removing comments is its only job there');
+
+-- NON-VACUITY, both directions. The two corpus checks above would pass on a
+-- corpus with no comments in it, and they would also pass if the scanner returned
+-- the empty string for everything. Neither is true, and both are asserted rather
+-- than assumed.
+--
+-- Stated plainly because it bounds what the corpus checks prove: the live
+-- agent_board corpus contains 62 bodies with `--` comments and ZERO with a block
+-- comment, so the block-comment half of those checks is a TRIPWIRE for the day
+-- one appears, not evidence today. The block-comment and nested-block-comment
+-- behaviour is pinned by the vectors above instead, where it can be mutated.
+select cmp_ok(
+  (select count(*)::int
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and p.prosrc ~ '--'),
+  '>', 20,
+  'CORPUS NON-VACUITY: the corpus really does contain `--` comments for the strip to remove');
+select ok(
+  (select min(length(agent_board_test.stripped_body(p.oid)))
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and length(p.prosrc) > 200) > 50,
+  'CORPUS NON-VACUITY: every non-trivial body still has substance after stripping -- the corpus checks are not passing on empty strings');
+
+-- stripped_def must not be "simplified" into strip_sql(pg_get_functiondef(...)).
+-- That form deletes the whole body (it is dollar-quoted) and every negative
+-- assertion in the suite would pass on the remains. Asserted as a SIZE relation
+-- against the raw definition so the collapse cannot hide.
+select cmp_ok(
+  (select length(agent_board_test.stripped_def(p.oid))::int
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'update_board_membership'),
+  '>',
+  (select (length(pg_get_functiondef(p.oid)) / 2)::int
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'update_board_membership'),
+  'stripped_def keeps most of a real definition -- a dollar-quote-aware strip applied to the WHOLE functiondef would leave almost nothing');
+
+select * from finish();
+rollback;

package/tests/agent_board_wake_recovery.test.sql

@@ -94,14 +94,11 @@ select plan(35);
 -- Shared helpers. Both are temp objects and vanish with the rollback.
 -- ---------------------------------------------------------------------------
 
--- ONE-PASS strip of string literals, line comments, and block comments.
-create or replace function pg_temp._wr_strip(p_text text) returns text
-language sql immutable as $fn$
-  select regexp_replace(
-           coalesce($1, ''),
-           $re$'(?:[^']|'')*'|--[^\n]*|/\*(?:[^*]|\*+[^*/])*\*+/$re$,
-           ' ', 'g')
-$fn$;
+-- The one-pass strip is agent_board_test.strip_sql(), shared by the whole suite
+-- from tests/fixtures/test-prereqs.sql. The local copy this replaces was a regex,
+-- and no regex can match a NESTED block comment (message-board#199); it also had
+-- no dollar-quote alternative, so it desynced on any body whose apostrophes did
+-- not happen to pair up. Both are handled by construction now.
 
 -- A "cursor gate" is a range test against a PRE-COMMIT-ASSIGNED column.
 --
@@ -166,13 +163,6 @@ $fn$;
 -- exactly that boundary: it goes red the day a function moves to a SQL-standard
 -- body, because at that point the parse tree this file could not use becomes
 -- available and the function half can be made exhaustive too.
-create or replace function pg_temp._wr_strip(p_text text) returns text
-language sql immutable as $fn$
-  select regexp_replace(
-           coalesce($1, ''),
-           $re$'(?:[^']|'')*'|--[^\n]*|/\*(?:[^*]|\*+[^*/])*\*+/$re$,
-           ' ', 'g')
-$fn$;
 
 -- The closure, and the two derived patterns, materialised once.
 create temp table _wr_class(kind text, pattern text) on commit drop;
@@ -218,7 +208,9 @@ language sql stable as $fn$
     (select string_agg(distinct regexp_replace(m[1], '[[:space:]]+', ' ', 'g'), ' | ')
        from _wr_class c,
             regexp_matches(
-              pg_temp._wr_strip($1),
+              -- literals KEPT: this file's class members put real predicates in
+              -- dynamic SQL (see the _wr_members header). Comments are removed.
+              agent_board_test.strip_sql($1, true),
               '(\m(' || c.pattern || ')\M[^<>=]{0,40}(?:<=|>=|<|>)'
               || '|(?:<=|>=|<|>)[^<>=]{0,40}\m(' || c.pattern || ')\M'
               || '|\m(' || c.pattern || ')\M[^<>=]{0,20}\mbetween\M'
@@ -228,7 +220,28 @@ language sql stable as $fn$
     '')
 $fn$;
 
-create temp table _wr_members(name text, kind text, src text) on commit drop;
+-- `src` is the RAW definition and `body` is the STRIPPED one. Two columns rather
+-- than one because both are legitimately needed: WR-8 reads a jsonb KEY, which is
+-- a string literal and only exists in `src`.
+--
+-- `body` for a FUNCTION is agent_board_test.stripped_body(), never
+-- strip_sql(pg_get_functiondef(...)). pg_get_functiondef wraps the body in a
+-- dollar quote (`AS $function$ … $function$`), so a dollar-quote-aware strip
+-- applied to the whole definition deletes THE ENTIRE BODY and every `!~` over the
+-- result passes. stripped_def() splices the stripped body back into the generated
+-- header instead.
+--
+-- LITERALS ARE KEPT (the `true` argument), and this file is the reason that mode
+-- exists. `mark_retention_metadata` builds its entire retention sweep as DYNAMIC
+-- SQL inside `format($retention$ … $retention$, …)`, so the `created_at <` and
+-- `available_at <=` comparisons WR-7/WR-8 exist to find are CODE THAT LIVES
+-- INSIDE A STRING LITERAL. Measured with literals stripped: WR-7 and WR-8 both
+-- read the empty string -- vacuous, not passing. Comments (all forms, including
+-- the nested one of message-board#199) are still removed in this mode, which is
+-- what closes the message-board#196 masks. It is also the fail-CLOSED direction
+-- for these particular assertions: an extra gate that only exists in a message
+-- makes an exact-set claim RED, never green.
+create temp table _wr_members(name text, kind text, src text, body text) on commit drop;
 
 with recursive closure as (
   select 'agent_board.inbox_items'::regclass as oid
@@ -243,16 +256,16 @@ with recursive closure as (
      and d.refclassid = 'pg_class'::regclass
      and r.ev_class <> d.refobjid
 )
-insert into _wr_members(name, kind, src)
-select c.relname, 'view', pg_get_viewdef(c.oid)
+insert into _wr_members(name, kind, src, body)
+select c.relname, 'view', pg_get_viewdef(c.oid), agent_board_test.stripped_viewdef(c.oid, true)
   from closure cl
   join pg_class c on c.oid = cl.oid
   join pg_namespace n on n.oid = c.relnamespace
  where c.relkind in ('v', 'm')
    and n.nspname = 'agent_board';
 
-insert into _wr_members(name, kind, src)
-select p.proname, 'function', pg_get_functiondef(p.oid)
+insert into _wr_members(name, kind, src, body)
+select p.proname, 'function', pg_get_functiondef(p.oid), agent_board_test.stripped_body(p.oid, true)
   from pg_proc p
   join pg_namespace n on n.oid = p.pronamespace
  where n.nspname = 'agent_board'
@@ -339,7 +352,8 @@ select is(
   'WR-4 the wake recovery view definition references no pre-commit ordering column in a comparison -- a cursor filter in view clothing is NAMED here');
 
 select ok(
-  (select pg_get_viewdef(to_regclass('agent_board.v_agent_wake_recovery')) !~* '\morder[[:space:]]+by\M'),
+  (select agent_board_test.stripped_viewdef(to_regclass('agent_board.v_agent_wake_recovery'), true)
+            !~* '\morder[[:space:]]+by\M'),
   'WR-4 the wake recovery view carries no ORDER BY -- the unhandled set is a SET, not a cursor stream');
 
 -- ---------------------------------------------------------------------------
@@ -583,7 +597,7 @@ select is(
 select is(
   (select coalesce(string_agg(distinct name, ', ' order by name), '')
      from _wr_members
-    where pg_temp._wr_cursor_gates(src) <> ''),
+    where pg_temp._wr_cursor_gates(body) <> ''),
   'claim_callback_outbox_events, mark_retention_metadata',
   'WR-7 no member of the derived class gates on a derived pre-commit column, except the two asserted positively below -- an offender NAMES ITSELF here');
 
@@ -599,17 +613,20 @@ select is(
   'WR-8 mark_retention_metadata returns a COUNT and is not set-returning -- it hands no batch to a consumer, so its comparison cannot be a recovery cursor');
 
 select is(
-  (select pg_temp._wr_cursor_gates(src) from _wr_members where name = 'mark_retention_metadata'),
+  (select pg_temp._wr_cursor_gates(body) from _wr_members where name = 'mark_retention_metadata'),
   'created_at <',
   'WR-8 mark_retention_metadata''s ONLY pre-commit comparison is `created_at <` (an age cutoff) -- it never compares seq, and never gates on a lower bound');
 
--- Read from the RAW definition on purpose: `ops_retention_reason` is a jsonb KEY,
--- i.e. a string literal, and the one-pass strip removes it. The companion half of
--- this assertion is read from the STRIPPED definition, where the UPDATE survives
--- because it lives inside a dollar-quoted body rather than a single-quoted one.
+-- `ops_retention_reason` is a jsonb KEY -- a string literal -- so it is read from
+-- the RAW definition, which is true regardless of strip mode. The companion half
+-- is read from `body`, i.e. through the shared strip: the UPDATE it looks for is
+-- inside the `$retention$` dynamic-SQL block, which survives because this file
+-- keeps literals (see the _wr_members header) but would NOT survive the default
+-- literal-stripping mode. Restated so the next reader does not "simplify" the two
+-- halves into one column.
 select ok(
   (select src ~ 'ops_retention_reason'
-      and pg_temp._wr_strip(src) ~ 'update agent_board'
+      and body ~ 'update agent_board'
      from _wr_members where name = 'mark_retention_metadata'),
   'WR-8 mark_retention_metadata stamps retention metadata through an UPDATE sweep -- the age cutoff drives retention, not a fetch');
 
@@ -628,12 +645,12 @@ select ok(
 -- SCHEDULING predicate against now(), not a caller-supplied cursor, and the batch
 -- it hands back is bounded by STATUS (WR-9 below). Both halves are stated.
 select is(
-  (select pg_temp._wr_cursor_gates(src) from _wr_members where name = 'claim_callback_outbox_events'),
+  (select pg_temp._wr_cursor_gates(body) from _wr_members where name = 'claim_callback_outbox_events'),
   'available_at <=',
   'WR-8 claim_callback_outbox_events'' ONLY pre-commit gate is `available_at <=` -- a scheduling predicate, never a lower bound against a caller cursor');
 
 select ok(
-  (select pg_temp._wr_strip(src) !~* '\mavailable_at\M[^<>=]{0,40}(?:>=|>)'
+  (select body !~* '\mavailable_at\M[^<>=]{0,40}(?:>=|>)'
      from _wr_members where name = 'claim_callback_outbox_events'),
   'WR-8 that gate is an UPPER bound (<=) and never a lower bound -- a `available_at >` would be a cursor, and is what this distinguishes');
 
@@ -661,7 +678,7 @@ select is(
 -- WR-9 POSITIVE: the recovery-shaped members partition on STATUS.
 -- ---------------------------------------------------------------------------
 select ok(
-  (select pg_temp._wr_strip(src) ~ 'outbox_status[[:space:]]*(=|in|<>)'
+  (select body ~ 'outbox_status[[:space:]]*(=|in|<>)'
      from _wr_members where name = 'claim_callback_outbox_events'),
   'WR-9 claim_callback_outbox_events partitions the queue on outbox_status -- the lossless property #187 relies on, restated positively here');
 
@@ -683,12 +700,12 @@ select is(
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and pg_temp._wr_strip(pg_get_functiondef(p.oid)) ~ 'action_state[[:space:]]*=[[:space:]]*[^=]'
+      and agent_board_test.stripped_body(p.oid, true) ~* 'action_state[[:space:]]*=[[:space:]]*[^=]'
       -- The schema qualification is OPTIONAL on purpose (board review F3): a writer
       -- using `set search_path` plus a bare `update inbox_items` was invisible to
       -- the qualified form, and WR-10 stayed green naming only one writer. Same
       -- class as the WR-7 name filter -- two name-based enumerators in one file.
-      and pg_temp._wr_strip(pg_get_functiondef(p.oid)) ~* 'update[[:space:]]+(agent_board\.)?inbox_items\M'),
+      and agent_board_test.stripped_body(p.oid, true) ~* 'update[[:space:]]+(agent_board\.)?inbox_items\M'),
   'update_inbox_item_state',
   'WR-10 exactly ONE function writes inbox_items.action_state -- the only way out of the unhandled set');
 
@@ -696,8 +713,8 @@ select is(
 -- the intuition the comment encoded and it is false: mark_read writes read
 -- receipts, so a READ item is still unhandled and still woken for.
 select ok(
-  (select pg_temp._wr_strip(pg_get_functiondef(p.oid)) !~ 'action_state'
-      and pg_temp._wr_strip(pg_get_functiondef(p.oid)) ~ 'read_receipts'
+  (select agent_board_test.stripped_body(p.oid, true) !~* 'action_state'
+      and agent_board_test.stripped_body(p.oid, true) ~* 'read_receipts'
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace and p.proname = 'mark_read'),
   'WR-10 mark_read writes read_receipts and NEVER action_state -- marking an item read does not remove it from the recovery set');
@@ -741,11 +758,12 @@ select is(
 -- assert a falsehood. Pinning this properly needs named arguments at the call
 -- sites; until then this is a known, unpinned second exit.
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            ~ 'on conflict[^;]*do update'
+  -- CODE markers -> case-insensitive (`ON CONFLICT … DO UPDATE` is the same clause)
+  (select agent_board_test.stripped_body(p.oid, true)
+            ~* 'on conflict[^;]*do update'
       and (select m[1] !~ 'action_state'
-             from regexp_matches(regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g'),
-                                 'on conflict[^;]*do update([^;]*)', 'g') m
+             from regexp_matches(agent_board_test.stripped_body(p.oid, true),
+                                 'on conflict[^;]*do update([^;]*)', 'gi') m
             limit 1)
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace and p.proname = '_upsert_inbox_item'),