@consiliency/agent-board-schema 1.48.0 → 1.50.0

package/tests/agent_board_claimpolicy_race.test.sql

@@ -0,0 +1,1374 @@
+-- #405 — the stale-policy race family: the CATALOG half.
+--
+-- WHAT THIS FILE CAN AND CANNOT SEE, said first because the division is the whole point. A pgTAP
+-- file runs in ONE rolled-back transaction, so it cannot produce the interleaving this issue is
+-- about, and it cannot change its own isolation level (that must be the transaction's first
+-- statement). Every BEHAVIOURAL claim about the race — that a reader waits, that it re-reads the
+-- committed policy, that a REPEATABLE READ caller is refused, that two boards do not serialise
+-- against each other — lives in the isolation specs:
+--
+--   claimpolicy_acquire_revert_race.spec    the advisory-SKIP path, the one a "lock before the
+--                                           agent lock" placement never reaches
+--   claimpolicy_renew_revert_race.spec      the re-read AND the claim-state revalidation
+--   claimpolicy_board_scope.spec            the twins: a different board does not serialise
+--   claimpolicy_isolation_refusal.spec      REPEATABLE READ is refused, by name
+--   claimpolicy_writer_keyshare.spec        the writer-side KEY SHARE cycle, measured both ways
+--   claimpolicy_claimrow_lock_order.spec   reclaim_fleet_machine against the policy writer, and
+--                                          the claim-row -> board-lock inversion CONSTRUCTED by
+--                                          hand, so the quiet permutation is evidence about the
+--                                          code rather than about the probe
+--
+-- WHAT THIS FILE PINS is the part a spec cannot: that the CLASS is complete and comes from the
+-- catalog, that each exemption is asserted positively rather than by absence, and that the two
+-- premises the advisory lock rests on — `set_board_claim_policy` is the sole writer of
+-- `boards.claim_policy`, and `threads.board_id` never moves once set — are still true.
+--
+-- WHAT AN ALL-GREEN RUN OF THIS FILE ESTABLISHES, AND WHAT IT DOES NOT. Read this before citing a
+-- green as evidence. Most assertions here are TRIPWIRES over source text and catalog state, and a
+-- tripwire that fails OPEN is green for the same reason a correct one is: 35/35 here, 124/124 for
+-- the suite and 34/34 for the isolation goldens are all consistent with a pattern that silently
+-- matches nothing. Six review rounds found exactly that six times — a window too small for a real
+-- upsert, an alternation with no path to `for key share`, a complement keyed by name so an overload
+-- escaped it. Each was green until someone injected the shape and watched. So: a green run means no
+-- assertion's expected value changed; it does NOT mean the properties are held. Only a MUTATION
+-- that produces a NAMED failure establishes that a given property is pinned at all.
+--
+-- WHAT LIVES ONLY IN THE ISOLATION SUITE, so nobody reads this file as the whole gate: the race
+-- itself (a reader waits and then observes the COMMITTED policy, including acquire's advisory-skip
+-- path), renew's claim revalidation after the wait, the 0A000 refusal by name at three isolation
+-- levels, cross-board non-serialisation, and the writer-side KEY SHARE vs FOR UPDATE
+-- discrimination. Nothing here replaces claimpolicy_board_scope.spec. ISOLATION IS NOT OPTIONAL CI
+-- FOR THIS FEATURE — a green pgTAP run with the isolation suite skipped establishes none of those.
+--
+-- THE MATCHERS' BEHAVIOUR TABLE lives in tests/fixtures/test-prereqs.sql beside the functions, and
+-- its ACCEPT rows are the cheap half. Four defects shipped in a matcher whose accept rows all
+-- passed: a literal space inside a multiword verb (so `INSERT\nINTO` evaded), a raw lower-case
+-- column token (so `SET CLAIM_POLICY` evaded), `$` missing from the identifier class (so a DISTINCT
+-- function `x$_claimgate_lock_board_policy` was credited as the protected helper), and a caller
+-- passing `'i'` (so `"AGENT_BOARD"."claims"` folded onto `agent_board.claims`). Every one is a
+-- REJECT row, and none was derivable from the spellings this file happens to contain — the corpus
+-- uses single-space `INSERT INTO` and unquoted `agent_board`, so a green suite said nothing about
+-- any of them. Reject rows must come from PostgreSQL's identifier and keyword rules, not from the
+-- current bodies; a matcher's whole job is discrimination, so most of its table is what it refuses.
+--
+-- THREE LITERAL `agent_board\.` SPELLINGS SURVIVE ON PURPOSE, named here so "every site uses the
+-- shared matcher" is not read as "no literal exists" — it is 67 matcher invocations across 41 lines
+-- PLUS these three. They are PROBES OF ONE KNOWN BODY rather than population derivations, which is
+-- a different instrument: a population matcher that misses a spelling drops a member SILENTLY,
+-- while a probe that misses its target returns 0 or false and takes its assertion RED. Both were
+-- mutation-checked rather than argued:
+--   * CPR-12's first-board-wins guard — rewriting the guarded writer as `update "agent_board"."threads"`
+--     makes the label fall to UNGUARDED and CPR-12 fails.
+--   * CPR-3c's two position probes — rewriting renew's post-lock re-read as unqualified `from claims`
+--     makes the probe return 0 and CPR-3c fails.
+-- Converting them would be harmless but would not buy anything, and the exemption is cheaper to
+-- audit written down than rediscovered.
+--
+-- ONE AXIS THAT HAS BEEN WRONG IN BOTH DIRECTIONS, called out because it keeps recurring: whether an
+-- assertion should key on proname or on OID/signature depends on the question it asks, and there is
+-- no safe default. A property of the NAME ("nothing called X is executable by a non-owner", CPR-22)
+-- needs the name scan, and pinning a signature there lets an overload carry the grant. A property of
+-- a SPECIFIC function (CPR-25a's guard shape, CPR-23/24's ACLs) needs to_regprocedure, and scanning
+-- by name there returns multiple rows — which for a scalar subquery ABORTS the file and emits no
+-- `not ok` at all. A set-membership test (CPR-14b) must compare OIDs, or one censused overload
+-- excludes a same-named sibling from the complement. All three were live defects, not hypotheticals.
+--
+-- CPR-1 IS THE ONE THIS FILE EXISTS FOR. An advisory lock only excludes callers that also take it.
+-- So "which functions resolve a board's claim policy" is not a documentation question here, it is
+-- the soundness question, and a list written by hand is exactly what this repo's rule 1 forbids.
+-- The set is derived from `pg_proc` + `pg_get_viewdef` on every run; a fifth resolver fails CPR-1
+-- and NAMES ITSELF instead of silently inheriting an exemption nobody decided.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(41);
+
+-- ---------------------------------------------------------------------------
+-- Fixture: one board, one thread on it, one thread with NO board (the constitutive-'inherit'
+-- case that CPR-19/20 pin the composition against).
+-- ---------------------------------------------------------------------------
+create temp table _cpr (board uuid, thread uuid, free_thread uuid, board_b uuid) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner uuid := gen_random_uuid();
+  v_owner_user uuid;
+  v_board uuid;
+  v_thread uuid := gen_random_uuid();
+  v_free uuid := gen_random_uuid();
+  -- A SECOND board, existing only for CPR-22a. It must not be the board CPR-25 locks: the whole
+  -- pgTAP file is ONE transaction, `pg_advisory_xact_lock` holds to the end of it, and re-taking a
+  -- key already held adds no pg_locks row. Sharing a board would make CPR-22a's state check pass on
+  -- CPR-25's lock no matter what CPR-22a itself did — measured, not feared: with the helper call
+  -- deleted from set_board_claim_policy, the shared-board version of CPR-22a and its state check
+  -- both stayed GREEN.
+  v_board_b uuid;
+begin
+  v_owner_user := public.ensure_github_user('cpr-own-' || v_sfx, 'cpr-own-' || v_sfx || '@example.test',
+                                            'cpr-own-' || v_sfx, 'CPR Owner');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_owner, 'agent', 'cpr-own-' || v_sfx, 'CPR Owner', 'active', v_owner_user, v_owner_user);
+
+  -- create_board seeds the creator's owner membership (ROOMOWN), which is what
+  -- set_board_claim_policy's gate tests.
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_owner_user::text, true);
+  select board_id into v_board
+    from agent_board.create_board(v_owner, 'cpr-' || v_sfx, 'CPR Board', 'claim policy race', '{}'::jsonb, 'private');
+  -- Opted out by direct UPDATE rather than through the RPC. Deliberate: the RPC now takes the
+  -- lock helper, so a MUTATION of that helper would abort this file in its FIXTURE and emit no
+  -- `not ok` at all -- rule 3's exact failure shape. Set the column directly and CPR-25 fails
+  -- BY NAME instead. The RPC's own transitions are BCP-11..21's subject, not this file's.
+  update agent_board.boards set claim_policy = 'advisory' where id = v_board;
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values (v_thread, 'coordination', v_owner, 'CPR board thread', v_board),
+         (v_free,   'coordination', v_owner, 'CPR boardless thread', null);
+
+  select board_id into v_board_b
+    from agent_board.create_board(v_owner, 'cpr-b-' || v_sfx, 'CPR Board B', 'claim policy race (CPR-22a)', '{}'::jsonb, 'private');
+  update agent_board.boards set claim_policy = 'advisory' where id = v_board_b;
+
+  insert into _cpr(board, thread, free_thread, board_b) values (v_board, v_thread, v_free, v_board_b);
+end $$;
+
+-- ===========================================================================
+-- THE CLASS (rule 1). Catalog-derived on every run.
+-- ===========================================================================
+
+-- CPR-1. Everything in `agent_board` whose COMMENT-STRIPPED body (or view definition) mentions
+-- `claim_policy` at all. Seven names, and the split between them is CPR-2/CPR-5's job — this
+-- assertion's only claim is that there are no OTHERS.
+--
+-- STRIPPED, and that is not a stylistic preference: run the same query over RAW `prosrc` on this
+-- schema and `set_board_claim_policy` also appears as a caller of `_claimgate_board_claim_policy`,
+-- because its PROSE mentions the helper. A scan that counts a comment as code has already shipped
+-- in this repository once.
+select is(
+  (select string_agg(nm, ', ' order by nm) from (
+     select p.proname as nm
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and agent_board_test.stripped_body(p.oid, true) ~ 'claim_policy'
+     union
+     select c.relname
+       from pg_class c join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = 'agent_board' and c.relkind in ('v', 'm')
+        and agent_board_test.stripped_viewdef(c.oid, true) ~ 'claim_policy'
+   ) s),
+  '_claimgate_board_claim_policy, _claimgate_board_claim_policy_of, _claimgate_lock_board_policy, '
+  'acquire_claim, renew_claim, set_board_claim_policy, v_ownerless_claim_quota',
+  'CPR-1 CLASS: these are all the ROUTINE BODIES and VIEW/MATVIEW DEFINITIONS in agent_board that mention claim_policy — the range this query actually covers; a check constraint, column default or index mentioning the column is outside it, and safely so, since none of those can resolve a policy for a caller or yield a lease. A fifth resolver fails here and names itself');
+
+-- CPR-2. Of those, the DECIDERS — the ones that act on the answer — must serialise. Asserted as
+-- the exact set of callers of the lock helper, so a decider added without the lock is absent here
+-- and a non-decider that takes it is present unexpectedly. Either direction fails.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname <> '_claimgate_lock_board_policy'
+      and agent_board_test.stripped_body(p.oid, true) ~ '_claimgate_lock_board_policy'),
+  'acquire_claim, renew_claim, set_board_claim_policy',
+  'CPR-2 CLASS: these are the deciders that take the board policy lock — the write paths and the writer itself');
+
+-- CPR-3. AND TAKE IT BEFORE THE DECISION, which is the correction that makes this fix different
+-- from the one that was falsified in review. The first design said "before the agent-scoped lock";
+-- in acquire_claim that lock lives INSIDE the branch a stale 'advisory' read SKIPS, so on the
+-- dangerous path it is never reached. Source ORDER is asserted per function against the marker
+-- that IS that function's decision.
+select is(
+  (select string_agg(x.proname || '=' ||
+            case when regexp_instr(b.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) = 0 then 'NO-LOCK'
+                 when regexp_instr(b.body, x.decision, 1, 1, 0, 'i') = 0 then 'NO-DECISION'
+                 when regexp_instr(b.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0)
+                        < regexp_instr(b.body, x.decision, 1, 1, 0, 'i')
+                   then 'lock-first'
+                 else 'DECISION-FIRST' end, ', ' order by x.proname)
+     from (values
+             ('acquire_claim',          agent_board_test.call_re('_claimgate_board_claim_policy_of')),
+             ('renew_claim',            agent_board_test.call_re('_claimgate_board_claim_policy_of')),
+             ('set_board_claim_policy', 'into\s+v_prev_policy')
+           ) as x(proname, decision)
+     join pg_proc p on p.proname = x.proname
+     join pg_namespace n on n.oid = p.pronamespace and n.nspname = 'agent_board'
+     cross join lateral (select agent_board_test.stripped_body(p.oid, true) as body) b),
+  'acquire_claim=lock-first, renew_claim=lock-first, set_board_claim_policy=lock-first',
+  'CPR-3 ORDER: in each decider the board lock precedes the policy decision in source order — the population is a restatement of CPR-2''s catalog-derived set with a per-function decision marker, so a FOURTH decider fails CPR-2 before this list can go stale; the behavioural half is claimpolicy_acquire_revert_race.spec');
+
+-- CPR-4. acquire_claim takes TWO advisory locks. Board first, always: it is the only function that
+-- takes the actor-scoped quota lock, so one consistent order here is the whole cycle argument.
+-- CPR-4 REMOVED (#405 completeness review). It read acquire_claim alone; CPR-4a derives the same
+-- ordering over every function taking the actor-scoped quota lock and so strictly contains it.
+-- Confirmed by mutation before removal: inverting acquire_claim's two locks trips CPR-4a (it tripped
+-- CPR-4 and CPR-4a together). The universal clause CPR-4's description used to carry is CPR-4a's.
+
+
+-- CPR-4a. THE CLAUSE CPR-4'S SENTENCE USED TO CARRY. It ended "and nothing in the schema takes them
+-- the other way" — a claim about every function, backed by a query that read acquire_claim and
+-- nothing else. The population is derived instead: every function taking the actor-scoped quota
+-- lock, each labelled with the order of its two lock events.
+--
+-- The marker is `pg_advisory_xact_lock(hashtext(` and it does NOT match the board helper, which
+-- calls `hashtextextended` — the character after `hashtext` differs, so the two stay distinguishable
+-- without a negative lookahead. `\s*` between tokens rather than a plain substring, so a caller
+-- spelling the call across a line break is still seen.
+--
+-- upsert_delegation_policy is in the population and takes NO board lock, which is why it cannot
+-- invert anything; it is asserted positively here rather than filtered out, so it having to change
+-- is a decision someone makes rather than an exemption that erodes.
+select is(
+  (with q as (
+     select p.proname,
+            regexp_instr(agent_board_test.stripped_body(p.oid, true),
+              agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) as board_pos,
+            regexp_instr(agent_board_test.stripped_body(p.oid, true),
+              'pg_(try_)?advisory_xact_lock\s*\(\s*hashtext\s*\(', 1, 1, 0, 'i') as quota_pos
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and agent_board_test.stripped_body(p.oid, true) ~* 'pg_(try_)?advisory_xact_lock\s*\(\s*hashtext\s*\('
+   )
+   select coalesce(string_agg(proname || '=' ||
+            (case when board_pos = 0            then 'no-board-lock'
+                  when board_pos < quota_pos    then 'board-then-agent'
+                  else 'AGENT-THEN-BOARD' end), ', ' order by proname), '<none>')
+     from q),
+  'acquire_claim=board-then-agent, upsert_delegation_policy=no-board-lock',
+  'CPR-4a ORDER (schema-wide): every function taking the actor-scoped quota lock either never takes the board lock or takes the board lock FIRST — the universal half of CPR-4, derived from the catalog rather than asserted about one function');
+
+-- CPR-5. THE EXEMPTION, ASSERTED POSITIVELY. `v_ownerless_claim_quota` resolves board policy at
+-- query time (#393's OQ-29) and is deliberately NOT serialised. The claim that makes that safe is
+-- "it cannot produce a lease", and this asserts exactly that rather than asserting it is absent
+-- from CPR-2: its ONLY rewrite rule is the view's own `_RETURN` SELECT (ev_type 1). An
+-- `ON UPDATE ... DO INSTEAD` rule added to it would fail here.
+select is(
+  (select format('rules=%s, user_triggers=%s',
+                 (select string_agg(r.rulename || ':' || r.ev_type::text, ',' order by r.rulename)
+                    from pg_rewrite r where r.ev_class = 'agent_board.v_ownerless_claim_quota'::regclass),
+                 (select count(*) from pg_trigger t
+                   where t.tgrelid = 'agent_board.v_ownerless_claim_quota'::regclass
+                     and not t.tgisinternal)::text)),
+  'rules=_RETURN:1, user_triggers=0',
+  'CPR-5 EXEMPTION (positive): the census resolver is SELECT-only — its only rewrite rule is _RETURN AND it carries no INSTEAD OF trigger, the other way a view accepts writes; so a stale policy read there yields a report line and can never yield a lease');
+
+-- ===========================================================================
+-- THE SOLE-WRITER PROOF. #406 argued it from has_table_privilege + zero triggers, which does not
+-- exclude column-level grants, rules, other definer routines, or dynamic SQL. Four bounds, each
+-- asserted, because an advisory lock only excludes callers that also take it.
+-- ===========================================================================
+
+-- CPR-6. Source bound.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema', 'agent_board_test')
+      and n.nspname !~ '^pg_'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and agent_board_test.stripped_body(p.oid, true)
+            ~ (agent_board_test.stmt_re('update|merge into|insert into', 'boards')
+               || '[^;]*' || agent_board_test.col_frag('claim_policy')
+              -- COPY, parsed by POSITION rather than by token. Three things this gets right that a
+              -- verb-plus-token test did not:
+              --   * `copy boards from …` with NO column list writes EVERY column, claim_policy
+              --     included, and contains no claim_policy token — the widest form of the verb.
+              --   * the direction word must follow the relation and its optional column list, so
+              --     `copy boards to '/tmp/from.csv'` cannot match on a PATH containing "from".
+              --     (Literals are kept by this scan, so the path really is in the text.)
+              --   * a column list that does NOT name claim_policy (`copy boards (slug) from …`)
+              --     writes only that column and is correctly NOT a member: the optional group fails
+              --     to match it, and the direction word is then not where the pattern requires.
+               || '|' || agent_board_test.ci_re('copy') || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+               || agent_board_test.qname_frag('boards')
+               || '\s*(?:\([^)]*' || agent_board_test.col_frag('claim_policy') || '[^)]*\)\s*)?'
+               || agent_board_test.ci_re('from') || '(?![A-Za-z0-9_])'
+              -- INSERT WITH NO COLUMN LIST, the same shape as COPY without one and a PRE-EXISTING
+              -- hole rather than one this change introduced: `insert into boards values (…)` and
+              -- `insert into boards select …` write EVERY column, claim_policy included, and carry
+              -- no claim_policy token. COPY was special-cased and INSERT was not.
+              -- The INSERT-without-column-list rule is a NAMED OBJECT, embedded VERBATIM — the frag,
+              -- not `replace(re, '(?c)', '')`. CPR-0's rows compile this same frag, so row and
+              -- production are one object rather than two strings that agree today.
+               || '|' || agent_board_test.insert_all_columns_frag('boards')
+               || '|\m' || agent_board_test.ci_re('select') || '(?![A-Za-z0-9_])[^;]*\m'
+               || agent_board_test.ci_re('into') || '(?![A-Za-z0-9_])[^;]*'
+               || agent_board_test.qname_frag('boards') || '[^;]*' || agent_board_test.col_frag('claim_policy'))),
+  'set_board_claim_policy',
+  'CPR-6 SOLE WRITER (source): across EVERY non-system schema, exactly one function has a statement targeting boards that mentions claim_policy — a STATEMENT test rather than an enumeration of assignment spellings, so the multi-column form `set (slug, claim_policy) = (…)` lands here too, and a SECURITY DEFINER writer in another schema cannot bypass the premise by living outside agent_board');
+
+-- CPR-7. Column-privilege bound — the one #406's table-level check cannot give. A grant of UPDATE
+-- on `claim_policy` alone to `authenticated` passes `has_table_privilege(..., 'UPDATE')=false` at
+-- table level in neither direction reliably, and would be invisible to CPR-6 entirely.
+select is(
+  (select coalesce(string_agg(distinct grantee, ','), '<none>')
+     from information_schema.column_privileges
+    where table_schema = 'agent_board' and table_name = 'boards' and privilege_type = 'UPDATE'
+      and grantee <> (select relowner::regrole::text from pg_class where oid = 'agent_board.boards'::regclass)),
+  '<none>',
+  'CPR-7 SOLE WRITER (column privileges): no non-owner grantee holds UPDATE on ANY column of agent_board.boards, claim_policy included');
+
+-- CPR-8. Rule and trigger bound.
+select is(
+  format('rules=%s, user_triggers=%s, anon=%s, authenticated=%s, service_role=%s',
+         (select count(*) from pg_rewrite where ev_class = 'agent_board.boards'::regclass)::text,
+         (select count(*) from pg_trigger where tgrelid = 'agent_board.boards'::regclass and not tgisinternal)::text,
+         has_table_privilege('anon',          'agent_board.boards', 'update')::text,
+         has_table_privilege('authenticated', 'agent_board.boards', 'update')::text,
+         has_table_privilege('service_role',  'agent_board.boards', 'update')::text),
+  'rules=0, user_triggers=0, anon=false, authenticated=false, service_role=false',
+  'CPR-8 SOLE WRITER (rules/triggers/table privileges): boards carries no rewrite rule and no user trigger, and none of the three PostgREST roles holds table-level UPDATE — the general bound over ALL grantees is CPR-7, whose information_schema source expands a table-level grant per column and so sees a grant to any role, not just these three');
+
+-- CPR-9. Dynamic-SQL bound. A `set claim_policy` assembled at run time is invisible to CPR-6, so
+-- the population that COULD assemble one is bounded instead, and each member is cleared
+-- positively: get_bundle_compatibility contains no write at all, and mark_retention_metadata's
+-- table allowlist is a literal that does not contain `boards` (it only ever assigns
+-- metadata/payload). Literals are KEPT by this scan, which is what makes the allowlist visible.
+select is(
+  (select string_agg(p.proname || ':mentions_boards=' ||
+            (agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.qname_re('boards'))::text ||
+            '/mentions_threads=' ||
+            (agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.qname_re('threads'))::text ||
+            '/mentions_claims=' ||
+            (agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.qname_re('claims'))::text, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~* '\mexecute\M'),
+  'get_bundle_compatibility:mentions_boards=false/mentions_threads=false/mentions_claims=false, mark_retention_metadata:mentions_boards=false/mentions_threads=false/mentions_claims=false',
+  'CPR-9 SOLE WRITER (EXECUTE token): the functions in agent_board that contain an `execute` token are these and neither names boards, threads or claims — a third, or either one gaining any of the three, fails here. The range is that token, not dynamic SQL in general: a statement assembled and run some other way is outside it. The claims field is what makes a dynamic claims writer visible, since CPR-14a strips literals and cannot see one');
+
+-- CPR-10. The writer's ROW lock is still `for no key update` and not `for update`. This is not
+-- cosmetic: `for update` conflicts with the FOR KEY SHARE an FK reference to boards takes, which
+-- turns "hold KEY SHARE, then want the advisory lock" into a real cycle.
+-- claimpolicy_writer_keyshare.spec MEASURES both directions; this makes the source change visible
+-- too, so the two fail together rather than one silently drifting.
+select is(
+  (select format('for_no_key_update=%s, for_update=%s',
+                 (agent_board_test.stripped_body(p.oid, true) ~ 'for\s+no\s+key\s+update')::text,
+                 (agent_board_test.stripped_body(p.oid, true) ~ 'for\s+update')::text)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where p.oid = to_regprocedure('agent_board.set_board_claim_policy(uuid,text)')),
+  'for_no_key_update=true, for_update=false',
+  'CPR-10 LOCK ORDER: set_board_claim_policy row-locks boards with FOR NO KEY UPDATE, which does not conflict with the FK''s FOR KEY SHARE — measured both ways in claimpolicy_writer_keyshare.spec');
+
+-- ===========================================================================
+-- THE OTHER PREMISE: WHICH BOARD. Both write paths lock the board they derived from the claim's
+-- thread, so `threads.board_id` must not move under them.
+-- ===========================================================================
+
+-- CPR-11. The writer set for UPDATEs of agent_board.threads.
+--
+-- THE SCHEMA QUALIFIER IS OPTIONAL IN THE PATTERN, DELIBERATELY. This scan used to require the
+-- literal `agent_board.threads`, which made it blind to `update threads` resolved through a
+-- function's own `search_path` — the identical write, spelled one way the regex did not admit.
+-- Measured, not theorised: injecting a function with `set search_path to agent_board` and a bare
+-- `update threads set board_id = …` left this assertion GREEN. The qualifier is now an optional
+-- group, so both spellings land in the same population.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.stmt_re('update', 'threads')),
+  '_next_thread_message_sequence, _upsert_delivery_recipient',
+  'CPR-11 BOARD IMMUTABILITY: these are the functions that UPDATE agent_board.threads, qualified or not — a third has to be decided against this premise rather than inheriting it');
+
+-- CPR-12. THE POPULATION IS A STATEMENT TEST, NOT A SPELLING LIST. It matched `board_id =` after an
+-- UPDATE or INSERT, which enumerated two spellings of assignment and called that the class. Three
+-- valid forms were unmatched: the multi-column form `set (board_id, …) = (…)`, a
+-- `MERGE … WHEN MATCHED THEN UPDATE SET board_id`, and a plain INSERT naming board_id in its COLUMN
+-- LIST rather than an assignment. The population is now "a statement targeting threads that mentions
+-- board_id at all", which admits every spelling of assignment including ones nobody has thought of;
+-- it is deliberately WIDER than assignment (an UPDATE merely reading board_id in its WHERE lands
+-- here too), because a false member is labelled and must be decided about, while a missed one is
+-- invisible. Measured: the widening leaves today's population unchanged.
+--
+-- CPR-12. And the only one that assigns `board_id` does it FIRST-BOARD-WINS. That guard is what
+-- makes the transition null -> board and never board -> board, which is why locking the board
+-- derived before the wait is locking the right board. The one drift it leaves — a null board
+-- STAMPED during the wait — is handled by resolving policy from the locked id rather than by
+-- re-walking the thread; CPR-20 pins the constitutive 'inherit' that stamp would have to displace.
+select is(
+  (select coalesce(string_agg(p.proname || '[' ||
+            (case when agent_board_test.stripped_body(p.oid, true)
+                       ~ 'update\s+agent_board\.threads\s+t\s+set\s+board_id\s*=\s*p_board_id\s+where\s+t\.board_id\s+is\s+null'
+                  then 'first-board-wins' else 'UNGUARDED' end) || ']', ', ' order by p.proname), '<none>')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema', 'agent_board_test')
+      and n.nspname !~ '^pg_'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and agent_board_test.stripped_body(p.oid, true)
+            ~ (agent_board_test.stmt_re('update|merge into|insert into', 'threads') || '[^;]*' || agent_board_test.col_frag('board_id'))),
+  '_upsert_delivery_recipient[first-board-wins]',
+  'CPR-12 BOARD IMMUTABILITY: the sole writer of threads.board_id stamps only where it is null (OBSGATE first-board-wins), so a board can be gained but never moved');
+
+-- CPR-13. And no session can do it directly.
+select is(
+  format('anon=%s, authenticated=%s, service_role=%s',
+         has_table_privilege('anon',          'agent_board.threads', 'update')::text,
+         has_table_privilege('authenticated', 'agent_board.threads', 'update')::text,
+         has_table_privilege('service_role',  'agent_board.threads', 'update')::text),
+  'anon=false, authenticated=false, service_role=false',
+  'CPR-13 BOARD IMMUTABILITY: none of the PostgREST roles holds table-level UPDATE on agent_board.threads — the bound over ALL grantees is CPR-13a, so board_id is reachable only through the definer function CPR-12 clears');
+
+-- ---------------------------------------------------------------------------
+-- CPR-13a/b/c. THE AXIS PARITY THIS PREMISE WAS MISSING.
+--
+-- `boards.claim_policy` is bounded on five axes (CPR-6 source, CPR-7 column privileges, CPR-8
+-- rules/triggers/table privileges, CPR-9 dynamic SQL, CPR-10 lock strength). `threads.board_id`
+-- had three, and the two premises carry the SAME weight: the fix locks the board id observed
+-- before the wait, so `null -> board` is safe (a mid-wait stamp reads as the enforcing 'inherit')
+-- but `board -> board` would let a caller lock board X and skip as 'advisory' while the claim now
+-- sits on enforcing board Y.
+--
+-- The gap was MEASURED, not inferred. Against the pre-#408 file all three of these violations left
+-- the suite 26/26 GREEN: a column-level `grant update (board_id) on threads to authenticated`, a
+-- new unqualified unguarded `update threads set board_id` writer, and a trigger on threads. The
+-- identical column grant on `boards` went red on CPR-7 — that control is what shows the asymmetry
+-- was in the assertions rather than in the code, which measured clean on every axis.
+-- ---------------------------------------------------------------------------
+
+-- CPR-13a. The column-privilege bound. THIS IS THE ONE CPR-13 CANNOT GIVE: after
+-- `grant update (board_id) on agent_board.threads to authenticated`,
+-- `has_table_privilege(...,'UPDATE')` is still FALSE while `has_column_privilege(...)` is TRUE, so
+-- CPR-13 stays green while a session really can move the column. Mirrors CPR-7 for boards.
+select is(
+  (select coalesce(string_agg(distinct grantee, ','), '<none>')
+     from information_schema.column_privileges
+    where table_schema = 'agent_board' and table_name = 'threads' and privilege_type = 'UPDATE'
+      and grantee <> (select relowner::regrole::text from pg_class where oid = 'agent_board.threads'::regclass)),
+  '<none>',
+  'CPR-13a BOARD IMMUTABILITY (column privileges): no non-owner grantee holds UPDATE on ANY column of agent_board.threads, board_id included — the bound CPR-13''s table-level test cannot express');
+
+-- CPR-13b. The rule and trigger bound. A `before update` trigger on threads rewrites board_id
+-- underneath the definer function CPR-12 clears, and an `on update do instead` rule redirects the
+-- write entirely — neither is visible to a source scan of the function bodies. Mirrors CPR-8.
+select is(
+  format('rules=%s, user_triggers=%s',
+         (select count(*) from pg_rewrite where ev_class = 'agent_board.threads'::regclass)::text,
+         (select count(*) from pg_trigger where tgrelid = 'agent_board.threads'::regclass and not tgisinternal)::text),
+  'rules=0, user_triggers=0',
+  'CPR-13b BOARD IMMUTABILITY (rules/triggers): threads carries no rewrite rule and no user trigger, so nothing rewrites board_id beneath the first-board-wins guard CPR-12 pins');
+
+-- CPR-13c. The dynamic-SQL bound is CPR-9's, EXTENDED IN PLACE rather than duplicated here: its
+-- format string now carries `mentions_threads` beside `mentions_boards` for each of the two
+-- EXECUTE-bearing functions. A sibling assertion would have restated CPR-9's "exactly two
+-- functions contain an EXECUTE" population claim in a second place, and two copies of one
+-- exact-set claim drift. What remains for this slot is the bound CPR-9 does not give: that
+-- `threads` is not reachable from a session by any privilege path at all, column grants included,
+-- which CPR-13 + CPR-13a give jointly — asserted here as one positive statement rather than left
+-- to be composed by a reader.
+-- CPR-13c REMOVED (#405 completeness review). It asserted the CONJUNCTION of CPR-13 (table-level
+-- UPDATE for the three PostgREST roles) and CPR-13a (non-owner column grants) and detected nothing
+-- either of them missed. Confirmed by mutation before removal, both directions: a TABLE grant trips
+-- CPR-13 and CPR-13a; a COLUMN grant trips CPR-13a. Two assertions pinning one property is how a
+-- later editor deletes the wrong one, so the conjunction went and the two bounds stayed.
+
+
+-- ===========================================================================
+-- LOCK ORDER (b): the claim-row -> board-lock inversion, bounded by PRIVILEGE rather than by
+-- convention. Every path here takes the board lock before touching a claims row; the inverse
+-- holder would be a session sitting on a claims row lock and then entering a policy path.
+-- ===========================================================================
+
+-- CPR-14. No function takes one WITH AN EXPLICIT LOCKING CLAUSE — which is what this query asks,
+-- and all it asks. The description used to say "no function takes a row lock on claims", and that
+-- sentence is FALSE: `update agent_board.claims` takes row locks too, and five functions do it
+-- (acquire_claim, renew_claim, set_board_claim_policy, reclaim_fleet_machine, release_claim). The
+-- premise that actually holds is the ORDERED one, and it is CPR-14a's, not this one's: of those
+-- five, only the three that also take the board lock reach it at all, and all three take the board
+-- lock FIRST. This assertion is still worth having — an explicit `for update` on claims is the one
+-- spelling that could appear anywhere in a body, including before the board lock — but a
+-- description claiming the whole class was quoted as a premise by
+-- claimpolicy_claimrow_lock_order.spec, which is how one false sentence became two.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '<none>')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~ (agent_board_test.qname_re('claims') || '[^;]*\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:' || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')(?![A-Za-z0-9_])')),
+  '<none>',
+  'CPR-14 LOCK ORDER: no function in agent_board takes a claims row lock through an EXPLICIT locking clause (for update / for no key update / for share / for key share) — the spelling that could sit anywhere in a body; the UPDATE-shaped row locks, which CPR-14a enumerates and orders, are not this assertion''s subject');
+
+-- CPR-14a. THE PREMISE CPR-14'S DESCRIPTION USED TO CLAIM, ASSERTED AS FAR AS A SOURCE SCAN CAN.
+-- A row lock on claims is taken by `update agent_board.claims` just as surely as by `for update`,
+-- so the question that decides the cycle is not "does anything take one" but "does anything take
+-- one and THEN want the board lock".
+--
+-- WHAT THIS IS: A REGRESSION TRIPWIRE, not an execution-order proof. It compares FIRST-OCCURRENCE
+-- SOURCE POSITIONS in the stripped body. That is genuinely weaker than execution order and the
+-- gaps are real: a branch that takes the row lock only on one path, a loop, or a CALLEE that
+-- performs the UPDATE would all evade it. A source scan has a floor and this is it. What the
+-- tripwire does deliver is worth having on its own: it fails CLOSED on a new claims writer (the
+-- population is catalog-derived, so an addition changes the string and names itself) and it
+-- relabels a same-body swap INVERTED — verified by moving renew_claim's own lock call after its
+-- UPDATE, which produced `renew_claim[INVERTED]`.
+--
+-- THE ACTUAL EXECUTION-ORDER EVIDENCE IS ELSEWHERE, and this comment exists so nobody mistakes
+-- this assertion for it: a pg_proc call-closure measurement over the applied bundle established
+-- the two sets and their intersection — every function that row-locks claims, every function whose
+-- CALL CLOSURE (not just direct body) reaches _claimgate_lock_board_policy, and the order in each
+-- of the three members of the intersection. reclaim_fleet_machine and release_claim row-lock claims
+-- and never reach the helper by any path; acquire_claim, renew_claim and set_board_claim_policy
+-- take the board lock first. That measurement also confirmed there are no triggers on claims and no
+-- FK referencing it, so no lock event is added by a path the call graph cannot see.
+--
+-- THE POPULATION AND THE COMPARISON ARE THE SAME EXPRESSION, which they were not at first: the
+-- population admitted DELETE, MERGE and explicit locking clauses while the ordering comparison
+-- searched only for UPDATE, so a DELETE-shaped row lock followed by the board lock was labelled
+-- `board-lock-first`. Both now come from `row_pos`, and membership IS `row_pos` having been found.
+--
+-- UNIFYING THEM MOVED THE FAILURE MODE, which is why the shape list then had to be re-derived
+-- rather than trusted. While the two disagreed, an unmatched shape was MISLABELLED; now an
+-- unmatched shape falls out of the census ENTIRELY and is not flagged at all. `INSERT … ON
+-- CONFLICT … DO UPDATE` locks and updates an existing row and matched NEITHER regex, so a function
+-- using it and then taking the board lock would simply have vanished from the population while the
+-- description claimed every new writer names itself. It is the third arm of `row_pos` now.
+--
+-- THE ARMS ARE A LIST, AND CALLING THEM "DERIVED" WAS ITSELF AN OVERSTATEMENT. Three regexes and
+-- a five-name expected string are a hand list however carefully chosen. What IS asserted is the
+-- COMPLEMENT, by CPR-14b below: everything whose body mentions claims either lands in one of these
+-- arms' census or carries no write verb at all. So an unlisted write shape does not vanish — it
+-- fails CPR-14b and names itself. That is the property the word "derived" was reaching for, and it
+-- needed an assertion rather than a sentence.
+--
+-- THE PLAIN-INSERT ARM IS DELIBERATELY WIDER THAN "ROW LOCK". An `INSERT` into claims takes no lock
+-- on an EXISTING row, so on a strict reading it does not belong. It is here because the property
+-- that matters is participation in a LOCK CYCLE, not the lock's taxonomy: every insert form can
+-- block on `claims_active_resource_unique` against a concurrent inserter, and acquire_claim (board
+-- lock, then that unique insert) is the other half of exactly that cycle. Excluding it was
+-- justified last round on the grounds that acquire_claim is in the census anyway through its
+-- UPDATE — true of TODAY's body only, asserted nowhere, and worthless against a NEW insert-only
+-- writer that takes the board lock afterwards. Including the arm asserts it instead. It also
+-- subsumes the upsert arm that replaced it: `least()` finds the INSERT at or before any
+-- `ON CONFLICT`, so `DO UPDATE` and `DO NOTHING` both enter the census with no window to get wrong.
+--
+-- ONE SHAPE REMAINS OUT OF MODEL: a row lock taken by a CALLEE rather than in this body. The
+-- tripwire is per-body by construction; the call-closure measurement recorded above is what covers
+-- that direction.
+--
+-- NO CHARACTER-BOUNDED WINDOWS, and that is a correction rather than a preference. The upsert arm
+-- was written as `claims … [^;]{0,250} … on conflict`, and the gap between them spans the column
+-- list AND the VALUES list: measured at 337 characters on a realistic claims upsert, so the arm did
+-- not match the shape it was named for and such a writer dropped out of the census silently — the
+-- exact fail-open the arm was added to close. `[^;]` alone already confines a match to a single
+-- statement (literals are stripped here, so no `;` can appear inside one), which is the containment
+-- the bound was reaching for. The bound added nothing but a number to get wrong.
+select is(
+  (with bodies as (
+     select p.proname, agent_board_test.stripped_body(p.oid) as body
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   ), posed as (
+     select proname,
+            regexp_instr(body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) as lock_pos,
+            least(
+              coalesce(nullif(regexp_instr(body,
+                agent_board_test.stmt_re('update|delete from|merge into', 'claims'),
+                1, 1, 0, 'i'), 0), 2147483647),
+              coalesce(nullif(regexp_instr(body,
+                agent_board_test.qname_re('claims') || '[^;]*\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:' || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')(?![A-Za-z0-9_])',
+                1, 1, 0, 'i'), 0), 2147483647),
+              coalesce(nullif(regexp_instr(body,
+                agent_board_test.stmt_re('insert into', 'claims'),
+                1, 1, 0, 'i'), 0), 2147483647)
+            ) as row_pos
+       from bodies
+   )
+   select coalesce(string_agg(proname || '[' ||
+            (case when lock_pos = 0        then 'no-board-lock'
+                  when lock_pos < row_pos  then 'board-lock-first'
+                  else 'INVERTED' end) || ']', ', ' order by proname), '<none>')
+     from posed
+    where row_pos < 2147483647),
+  'acquire_claim[board-lock-first], reclaim_fleet_machine[no-board-lock], release_claim[no-board-lock], renew_claim[board-lock-first], set_board_claim_policy[board-lock-first]',
+  'CPR-14a LOCK ORDER (source-position tripwire): for every function whose body takes a claims row lock by one of the modelled shapes — UPDATE, DELETE, MERGE, ANY INSERT (upsert or plain), or an explicit locking clause — the board-lock helper is either absent from that body or appears EARLIER IN THE SOURCE TEXT than the shape; a regression tripwire on source position, not a proof of execution order, with the out-of-model shapes named in the comment above');
+
+-- CPR-14b. THE COMPLEMENT OF CPR-14a'S CENSUS, which is what turns three hand-written regexes into
+-- a bounded claim. CPR-14a can only order the functions its arms MATCH; a claims writer using a
+-- shape no arm knows falls out of the census entirely and is ordered by nothing. This asserts that
+-- the leftovers are all READERS: every function whose body mentions claims but which CPR-14a did
+-- not census carries no write verb anywhere in its body.
+--
+-- Deliberately BLUNT — the verb scan is whole-body, not claims-scoped, so a leftover that writes
+-- some OTHER table fails this too. That is the intended behaviour and not a rough edge: such a
+-- function has to be looked at and decided about, rather than inheriting an exemption nobody chose.
+--
+-- KEYED BY OID, NOT BY proname, and that was a real hole rather than a tidy-up. The complement was
+-- computed as `proname not in (censused)`, so if ONE overload of a name was censused, ANOTHER
+-- overload of the same name using an unmodelled write shape was excluded from the complement —
+-- ignored by CPR-14a because its shape is unmodelled, and by CPR-14b because its NAME was already
+-- censused. It vanished from both, which is exactly what this assertion exists to prevent. The
+-- members are rendered as full signatures so the failure message distinguishes overloads too.
+--
+-- WHAT THIS COMPLEMENT BOUNDS, and what it does not — because "complement of a hand list" reads
+-- like a total bound and is not one. It bounds: any agent_board routine whose stripped body
+-- contains the whole word `claims`, qualified or unqualified, that CPR-14a's arms did not census.
+-- It does NOT bound:
+--   * a table whose name merely CONTAINS claims — a partition like `claims_p1` is not `\mclaims\M`.
+--     Checked rather than assumed: agent_board.claims is not partitioned and has no children today,
+--     so this is a bound on future schema shape, not a live hole.
+--   * a writer in ANOTHER SCHEMA — outside this file's subject entirely.
+--   * dynamic SQL, whose claims mention lives in a string literal `stripped_body` removes here;
+--     CPR-9's `mentions_claims` field is what covers that direction.
+--   * verbs outside the scanned set (`COPY … TO/FROM`, `SELECT … INTO`), which are write paths this
+--     regex does not name.
+select is(
+  (with bodies as (
+     select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as body
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   ), mentioners as (
+     select oid, proname, body from bodies where body ~ agent_board_test.qname_re('claims')
+   ), censused as (
+     select oid from mentioners
+      where body ~ agent_board_test.stmt_re('update|delete from|merge into', 'claims')
+         or body ~ (agent_board_test.qname_re('claims') || '[^;]*\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:' || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')(?![A-Za-z0-9_])')
+         or body ~ agent_board_test.stmt_re('insert into', 'claims')
+   )
+   select coalesce(string_agg(m.oid::regprocedure::text || '[' ||
+            (case when m.body ~* '\m(update|delete|insert|merge|truncate|copy)\M|\mselect\M[^;]*\minto\M'
+                  then 'HAS-WRITE-VERB' else 'no-write-verb' end) || ']', ', ' order by m.oid::regprocedure::text), '<none>')
+     from mentioners m
+    where m.oid not in (select oid from censused)),
+  '_agent_can_access_thread(uuid,uuid)[no-write-verb], _claimgate_active_ownerless_claims(uuid)[no-write-verb], _claimgate_promotion_blockers(text)[no-write-verb]',
+  'CPR-14b LOCK ORDER (census complement): every function mentioning claims that CPR-14a did NOT census is a pure reader — so a claims writer using a shape no arm matches fails HERE instead of vanishing from both assertions');
+
+-- ---------------------------------------------------------------------------
+-- CPR-3a/3b/3c. THE PREMISE EVERYTHING ELSE RESTS ON, WHICH NOTHING PINNED.
+--
+-- "Policy is resolved from the board id that was LOCKED" is the load-bearing claim of this whole
+-- change, and no assertion coupled the two. CPR-3 checks only that the lock call appears BEFORE the
+-- resolver in source order — so `policy_of(board_of_thread(p_thread_id))` written after
+-- `lock(v_board_id)` passes the entire inventory while re-walking the thread and reopening exactly
+-- the null->board drift the lock exists to exclude. Position is not coupling.
+--
+-- WHY THERE IS NO ISOLATION PERMUTATION FOR THE null->board CASE, measured rather than assumed: the
+-- helper takes NO lock when the board is null (`if p_board_id is not null`). On a boardless thread
+-- there is therefore no wait point, nothing blocks, and no interleaving can be constructed at that
+-- position — a permutation there would be a probe pointed at nothing. What actually guards the case
+-- is structural: the resolver is called with the SAME identifier that was locked (CPR-3a), so a
+-- board stamped mid-flight cannot be observed by this path at all, and CPR-18 pins that the absent
+-- board resolves to the ENFORCING answer. Those two together are the guarantee; the spec suite
+-- carries the cases that DO have a wait point.
+-- ---------------------------------------------------------------------------
+
+-- CPR-3a. The resolver's argument is the identifier that was locked — captured from each body and
+-- compared, not inferred from ordering.
+select is(
+  (select string_agg(x.proname || '=' ||
+            (case when x.locked is null                      then 'NO-LOCK-ARG'
+                  when x.resolved is null                    then 'NO-RESOLVER-ARG'
+                  when x.locked = x.resolved                 then 'same-var(' || x.locked || ')'
+                  else 'DIFFERENT-VAR(' || x.locked || ' vs ' || x.resolved || ')' end),
+            ', ' order by x.proname)
+     from (select p.proname,
+                  substring(agent_board_test.stripped_body(p.oid)
+                            from '"?_claimgate_lock_board_policy"?\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)') as locked,
+                  substring(agent_board_test.stripped_body(p.oid)
+                            from '"?_claimgate_board_claim_policy_of"?\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)') as resolved
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board'
+              and p.prolang <> (select oid from pg_language where lanname = 'internal')
+              and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_claimgate_board_claim_policy_of')
+              and p.proname <> '_claimgate_board_claim_policy') x),
+  'acquire_claim=same-var(v_board_id), renew_claim=same-var(v_board_id)',
+  'CPR-3a COUPLING: each path resolves the policy from the SAME identifier it locked — a resolver called on a freshly re-walked board (policy_of(board_of_thread(…))) is named DIFFERENT-VAR here, which CPR-3''s source-order check cannot see');
+
+-- CPR-3b. EXACTLY ONE OF EACH CALL, which is what makes CPR-3a's first-match capture SOUND rather
+-- than merely usually right. `substring` returns the FIRST match, so a body with a valid first pair
+-- followed by a second resolver call on a different variable —
+-- `policy_of(v_fresh_board_id)` in a later branch — satisfies CPR-3, CPR-3a and a mere
+-- "at least one bare identifier" check, while that later variable can observe exactly the stamp the
+-- captured-id reasoning excludes. Counting closes it by construction: a second call of either kind
+-- is a failure that names itself, and the fix is then to decide about the second call rather than to
+-- out-regex it.
+--
+-- Measured before choosing this bound: both legitimate bodies contain exactly one of each, so the
+-- assertion costs nothing today. A body that genuinely needs two must fail here and be argued for.
+--
+-- TWO LIMITS THIS CANNOT REACH, stated rather than implied, because a source scan has a floor:
+--   * SHADOWING. Equal captured NAMES are not equal BINDINGS — a nested PL/pgSQL block may declare
+--     its own `v_board_id`, and this comparison would read the two as the same variable. Nothing
+--     here resolves scopes; what bounds it is that both bodies are single-block and CPR-3b's count
+--     makes a second declaration-plus-call pattern fail.
+--   * DOMINANCE. CPR-3c pins that the re-read appears between the lock and the decision in SOURCE
+--     ORDER; it does not prove the re-read executes on every path that reaches the decision. A
+--     conditional re-read would pass. That is an execution-order claim, and the isolation specs are
+--     where execution order is demonstrated.
+select is(
+  (select string_agg(x.proname || '=locks:' || x.locks || '/resolvers:' || x.resolvers
+                     || '/bare:' || x.bare::text, ', ' order by x.proname)
+     from (select p.proname,
+                  (select count(*) from regexp_matches(agent_board_test.stripped_body(p.oid),
+                     agent_board_test.call_re('_claimgate_lock_board_policy'), 'g')) as locks,
+                  (select count(*) from regexp_matches(agent_board_test.stripped_body(p.oid),
+                     agent_board_test.call_re('_claimgate_board_claim_policy_of'), 'g')) as resolvers,
+                  agent_board_test.stripped_body(p.oid)
+                    ~* '"?_claimgate_board_claim_policy_of"?\s*\(\s*[A-Za-z_][A-Za-z0-9_]*\s*\)' as bare
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board'
+              and p.prolang <> (select oid from pg_language where lanname = 'internal')
+              and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_claimgate_board_claim_policy_of')
+              and p.proname <> '_claimgate_board_claim_policy') x),
+  'acquire_claim=locks:1/resolvers:1/bare:true, renew_claim=locks:1/resolvers:1/bare:true',
+  'CPR-3b COUPLING (capture soundness): each path takes the board lock ONCE and resolves the policy ONCE, with a bare identifier — so CPR-3a''s first-match capture cannot be defeated by a second resolver call on a different variable in a later branch');
+
+-- CPR-3c. renew re-reads the CLAIM after the lock and before the decision. The re-read is what makes
+-- renew's answer reflect the writer's committed state rather than its pre-wait snapshot; it is
+-- cheaply visible in source and was pinned only by prose.
+select ok(
+  (select regexp_instr(b.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) > 0
+      -- SEARCHED FROM THE LOCK, not from the top: renew reads the claim BEFORE the lock too (to
+      -- derive the board from the token), so a first-occurrence search finds that earlier read and
+      -- would report the property false while it holds. Measured on this bundle: lock@1863,
+      -- pre-lock read@367, re-read@1940, resolver@2309.
+      and regexp_instr(b.body, 'select[^;]*from\s+agent_board\.claims\M',
+                       regexp_instr(b.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0), 1, 0, 'i') > 0
+      and regexp_instr(b.body, 'select[^;]*from\s+agent_board\.claims\M',
+                       regexp_instr(b.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0), 1, 0, 'i')
+            < regexp_instr(b.body, agent_board_test.call_re('_claimgate_board_claim_policy_of'), 1, 1, 0)
+     from pg_proc p
+     cross join lateral (select agent_board_test.stripped_body(p.oid) as body) b
+    where p.oid = to_regprocedure('agent_board.renew_claim(uuid,timestamptz)')),
+  'CPR-3c RE-READ: renew_claim re-SELECTs the claim AFTER taking the board lock and BEFORE resolving the policy — the ordering that makes its decision reflect the committed state rather than its pre-wait snapshot');
+
+-- ---------------------------------------------------------------------------
+-- CPR-14c. THE CALLEE DIRECTION, WHICH BOTH PER-BODY ASSERTIONS MISS BY CONSTRUCTION.
+--
+-- CPR-14a and CPR-14b each read ONE body. A function that delegates its claims row lock to a callee
+-- and then takes the board lock itself is invisible to both: its own body contains no row-lock
+-- shape, so CPR-14a never censuses it and CPR-14b classifies it as a reader. That direction was
+-- covered by a one-time call-closure measurement recorded in a comment — which is rule 5's exact
+-- shape, a fact about the moment it was written with nothing re-checking it.
+--
+-- IT IS ONE HALF OF A UNION, and the reason is a regression the rework caused. The membership
+-- version it replaced would have named a NON-row-locking root that delegates; this order version
+-- excludes such a root only if its own body never mentions the board lock, so replacing rather than
+-- adding closed one case and opened another. CPR-14d below is the membership half, kept alongside
+-- with today's members enumerated so a WRAPPER appears there and has to be decided about VISIBLY
+-- rather than being carved out by a predicate nobody re-reads.
+--
+-- AND FIRST SOURCE POSITION IS NOT EXECUTION ORDER, stated because this file rejects that inference
+-- elsewhere and must not rely on it here: a body with an early lock in one branch and
+-- `rowlock_callee(); lock();` in another passes, since the first textual lock precedes the callee
+-- while that second branch executes claims-lock first. Branch semantics are beyond a source scan.
+-- What this assertion covers is a body whose FIRST lock mention follows a row-locking call site;
+-- what it does not cover is which of several mentions a given path reaches.
+--
+-- IT COMPARES ORDER, NOT MEMBERSHIP, and the first version did not — which was unsound in BOTH
+-- directions. That version excluded any root that itself row-locks claims, so a function taking the
+-- board lock, row-locking claims safely AFTER it, and DELEGATING another claims row lock BEFORE it
+-- was omitted — the exact composed inversion this assertion exists to catch. And it admitted every
+-- ordinary WRAPPER of acquire_claim, because membership in two closures says nothing about order,
+-- so the exemption-resistance the narrowing was justified by was never bought.
+--
+-- The predicate is now: the caller's own body references the board lock, and it CALLS a callee whose
+-- closure reaches a claims row-locker, and that call site precedes the lock. A wrapper has no board
+-- lock in its own body and is excluded on that ground rather than by a membership carve-out; a
+-- self-row-locking root is no longer excluded at all.
+--
+-- ITS OWN LIMIT, stated: fn_call_closure()'s edges are name matches over stripped bodies, so a
+-- callee invoked through dynamic SQL is invisible to it. CPR-9's EXECUTE-token bound is what covers
+-- that direction.
+select is(
+  (with fns as (
+     select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as body
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   ), rowlockers as (
+     select oid from fns
+      where body ~ agent_board_test.stmt_re('update|delete from|merge into', 'claims')
+         or body ~ agent_board_test.stmt_re('insert into', 'claims')
+         or body ~ (agent_board_test.qname_re('claims') || '[^;]*\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:' || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')(?![A-Za-z0-9_])')
+   ), reaches_rowlock as (
+     select distinct c.root_oid as oid
+       from agent_board_test.fn_call_closure() c
+      where c.reached_oid in (select oid from rowlockers)
+   ), edges as (
+     select r.proname as caller, e.proname as callee,
+            regexp_instr(r.body, '\m' || e.proname || '\M\s*\(', 1, 1, 0, 'i') as call_pos,
+            regexp_instr(r.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) as lock_pos
+       from fns r join fns e on e.oid <> r.oid
+      where e.oid in (select oid from reaches_rowlock)
+        and r.body ~ agent_board_test.call_re(e.proname)
+        and regexp_instr(r.body, agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0) > 0
+   )
+   select coalesce(string_agg(distinct caller || '->' || callee, ', '
+                              order by caller || '->' || callee), '<none>')
+     from edges
+    where call_pos > 0 and call_pos < lock_pos),
+  '<none>',
+  'CPR-14c LOCK ORDER (callee direction): no function calls a claims row-locking callee BEFORE it takes the board lock — compared by the position of the CALL SITE against the lock in the caller''s own body, so the composed inversion neither per-body assertion can see is named here');
+
+-- CPR-14d. THE MEMBERSHIP HALF OF THE UNION, restored rather than replaced. CPR-14c asks about
+-- ORDER and therefore says nothing about a root whose own body never mentions the board lock; this
+-- one asks only WHO reaches both, and enumerates them. A legitimate wrapper of acquire_claim will
+-- appear here and fail — that is intended: the exemption is then a visible edit to this expected
+-- string with a reason beside it, rather than a predicate carve-out that silently covers shapes
+-- nobody considered. The two together catch both the delegated inversion and the composed one.
+select is(
+  (with fns as (
+     select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as body
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   ), rowlockers as (
+     select oid from fns
+      where body ~ agent_board_test.stmt_re('update|delete from|merge into', 'claims')
+         or body ~ agent_board_test.stmt_re('insert into', 'claims')
+         or body ~ (agent_board_test.qname_re('claims') || '[^;]*\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:' || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')(?![A-Za-z0-9_])')
+   )
+   select coalesce(string_agg(distinct c.root_name, ', ' order by c.root_name), '<none>')
+     from agent_board_test.fn_call_closure() c
+    where c.reached_name = '_claimgate_lock_board_policy'
+      and c.root_oid in (select root_oid from agent_board_test.fn_call_closure()
+                          where reached_oid in (select oid from rowlockers))),
+  'acquire_claim, renew_claim, set_board_claim_policy',
+  'CPR-14d LOCK ORDER (callee direction, membership half): these are the functions that reach BOTH a claims row-locker and the board lock through their call closures — a fourth, wrapper or composer alike, is named here and must be decided about rather than exempted by a predicate');
+
+-- ---------------------------------------------------------------------------
+-- CPR-0 / CPR-0a. THE MATCHERS' BEHAVIOUR TABLE, AND A GATE ON THE TABLE ITSELF.
+--
+-- WHY BOTH. The identifier matchers drifted four times across three review rounds, and every
+-- version passed its accept cases. So a table was added. Then the SAME defect appeared INSIDE the
+-- table three times: rows that pass for a reason unrelated to the rule they are named for — first
+-- r06 (tested `$` through an adjacency that rejected it earlier), then a12/r13 (compiled a
+-- reconstruction rather than the production object), then a13/a14/a15 (keyword branches that the
+-- subject text could never exercise). Each was found by a different reviewer, after the previous
+-- fix, by the same procedure: revert a rule and see which rows move.
+--
+-- THREE OCCURRENCES IS ENOUGH EVIDENCE THAT A HAND-COMPILED REVERT MAP CANNOT BE TRUSTED, because
+-- compiling it is the same act as writing the rows. So the map is mechanical now: CPR-0a reverts
+-- each rule in turn, re-evaluates every row, and requires at least one row to flip. A rule with no
+-- flipping row FAILS AND NAMES ITSELF — which is what would have caught all three, and none of
+-- which a human reading the table did.
+--
+-- The rows are DATA rather than inline expressions so both assertions evaluate the same list: a
+-- row CPR-0 checks and CPR-0a cannot re-evaluate would be back to two lists that agree today.
+-- ---------------------------------------------------------------------------
+create temp table _mrow (label text primary key, expr text, want boolean) on commit drop;
+
+insert into _mrow(label, expr, want) values
+  -- ACCEPTS: spellings PostgreSQL resolves to OUR object
+  ('a01-qualified',      $x$'update agent_board.claims set x' ~ agent_board_test.stmt_re('update','claims')$x$, true),
+  ('a02-unqualified',    $x$'update claims set x' ~ agent_board_test.stmt_re('update','claims')$x$, true),
+  ('a03-upper-unquoted', $x$'UPDATE AGENT_BOARD.CLAIMS SET x' ~ agent_board_test.stmt_re('update','claims')$x$, true),
+  ('a04-quoted-lower',   $x$'update "agent_board"."claims" set x' ~ agent_board_test.stmt_re('update','claims')$x$, true),
+  ('a05-verb-newline',   $x$'insert' || chr(10) || 'into claims v' ~ agent_board_test.stmt_re('insert into','claims')$x$, true),
+  ('a06-verb-2spaces',   $x$'delete  from claims where x' ~ agent_board_test.stmt_re('delete from','claims')$x$, true),
+  ('a07-verb-tab',       $x$'merge' || chr(9) || 'into claims m' ~ agent_board_test.stmt_re('merge into','claims')$x$, true),
+  -- a08 gates ci_re's OWN space rule, which a05-a07 do NOT: they exercise whitespace inside a verb
+  -- through stmt_re, which would still work if ci_re emitted a literal space and stmt_re rewrote it.
+  ('a08-cire-phrase',    $x$'no' || chr(10) || 'key' ~ ('(?c)' || agent_board_test.ci_re('no key'))$x$, true),
+  ('a09-inheritance',    $x$'update agent_board.boards* set x' ~ agent_board_test.stmt_re('update','boards')$x$, true),
+  ('a10-call-space',     $x$'perform _claimgate_lock_board_policy (v)' ~ agent_board_test.call_re('_claimgate_lock_board_policy')$x$, true),
+  ('a11-call-quoted',    $x$'perform agent_board."_claimgate_lock_board_policy"(v)' ~ agent_board_test.call_re('_claimgate_lock_board_policy')$x$, true),
+  ('a12-col-upper',      $x$'set CLAIM_POLICY = x' ~ agent_board_test.col_frag('claim_policy')$x$, true),
+  ('a13-ins-novals',     $x$'insert into agent_board.boards values (1,2)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, true),
+  ('a14-ins-select',     $x$'insert into agent_board.boards select (1)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, true),
+  -- a15/a16 cover two INSERT FORMS the rule must census. They do NOT gate a keyword exclusion, and
+  -- that is stated rather than implied: DEFAULT is only ever followed by VALUES and OVERRIDING by
+  -- SYSTEM/USER, so neither can be mistaken for an alias-before-`(`. The exclusions for them were
+  -- therefore DEAD CODE and have been removed rather than kept with rows that cannot gate them.
+  ('a15-ins-default',    $x$'insert into agent_board.boards default values' ~ agent_board_test.insert_all_columns_frag('boards')$x$, true),
+  ('a16-ins-overriding', $x$'insert into agent_board.boards overriding user value values (1)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, true),
+  ('a17-ins-re-eq-frag', $x$agent_board_test.insert_all_columns_re('boards') = '(?c)' || agent_board_test.insert_all_columns_frag('boards')$x$, true),
+  -- REJECTS: spellings PostgreSQL resolves ELSEWHERE
+  ('a18-verb-rel-spaces', $x$'update  agent_board.claims set x' ~ agent_board_test.stmt_re('update','claims')$x$, true),
+  ('r01-other-schema',   $x$'update other.claims set x' ~ agent_board_test.stmt_re('update','claims')$x$, false),
+  ('r02-dot-space',      $x$'perform other . _claimgate_lock_board_policy(v)' ~ agent_board_test.call_re('_claimgate_lock_board_policy')$x$, false),
+  ('r03-quoted-upper',   $x$'update "AGENT_BOARD"."claims" set x' ~ agent_board_test.stmt_re('update','claims')$x$, false),
+  ('r04-prefix-word',    $x$'update dashboards set x' ~ agent_board_test.stmt_re('update','boards')$x$, false),
+  ('r05-dollar-lead',    $x$'perform x$_claimgate_lock_board_policy(v)' ~ agent_board_test.call_re('_claimgate_lock_board_policy')$x$, false),
+  ('r06-dollar-rel',     $x$'from x$claims c' ~ agent_board_test.qname_re('claims')$x$, false),
+  ('r07-nonascii-lead',  $x$'perform ' || chr(233) || '_claimgate_lock_board_policy(v)' ~ agent_board_test.call_re('_claimgate_lock_board_policy')$x$, false),
+  ('r08-nonascii-trail', $x$'from claims' || chr(233) || ' c' ~ agent_board_test.qname_re('claims')$x$, false),
+  ('r09-col-nonascii',   $x$'set claim_policy' || chr(233) || ' = x' ~ agent_board_test.col_frag('claim_policy')$x$, false),
+  ('r10-col-dollar',     $x$'set x$claim_policy = x' ~ agent_board_test.col_frag('claim_policy')$x$, false),
+  ('r11-i-flag',         $x$regexp_instr('x "AGENT_BOARD"."claims" y', agent_board_test.qname_re('claims'), 1, 1, 0, 'i') > 0$x$, false),
+  ('r12-ci-operator',    $x$'x "AGENT_BOARD"."claims" y' ~* agent_board_test.qname_re('claims')$x$, false),
+  ('r13-ins-collist',    $x$'insert into agent_board.boards (slug) values (1)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, false),
+  ('r14-ins-alias',      $x$'insert into agent_board.boards as b(slug) values (1)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, false),
+  ('r16-call-i-flag',    $x$regexp_instr('perform "AGENT_BOARD"."_claimgate_lock_board_policy"(v)', agent_board_test.call_re('_claimgate_lock_board_policy'), 1, 1, 0, 'i') > 0$x$, false),
+  ('r15-ins-qalias',     $x$'insert into agent_board.boards as "b"(slug) values (1)' ~ agent_board_test.insert_all_columns_frag('boards')$x$, false);
+
+create function pg_temp.mverdict(p_expr text) returns boolean
+language plpgsql as $f$
+declare v boolean;
+begin
+  execute format('select (%s)', p_expr) into v;
+  return coalesce(v, false);
+exception when others then
+  -- A row whose expression cannot compile is a FAILED row, not a skipped one: returning null here
+  -- would let a broken pattern read as agreement with a `false` expectation.
+  return not (select want from _mrow where expr = p_expr);
+end $f$;
+
+select is(
+  (select coalesce(string_agg(label || '=' || pg_temp.mverdict(expr)::text, ', ' order by label), '<none>')
+     from _mrow),
+  (select coalesce(string_agg(label || '=' || want::text, ', ' order by label), '<none>') from _mrow),
+  'CPR-0 MATCHER BEHAVIOUR: over PLAIN and DOUBLE-QUOTED identifiers, the matchers accept the spellings PostgreSQL resolves to our object and reject those it resolves elsewhere — Unicode-escape identifiers (U&"...") are OUT OF SCOPE and unhandled, so this is not a claim about every spelling');
+
+-- CPR-0a. EVERY RULE HAS A ROW THAT FAILS WITHOUT IT — compiled by the database, not by hand.
+-- ONE BEHAVIOUR PER ENTRY, AND EACH NAMES THE ROW THAT MUST FLIP. Both are corrections.
+--
+-- THE SPLIT PAID FOR ITSELF ON ITS FIRST RUN, which is the answer to "why are these so finely
+-- divided": separating the behaviours immediately exposed FOUR matcher rules the coarser hand list
+-- had never reverted — ident_re's quoted alternative, qname_frag's OPTIONAL qualifier, call_re's own
+-- director, and stmt_re's `\s+` between verb and relation. Two of them had no row at all (a18, r16
+-- were added for them). A reviewer tempted to recombine entries should read that as the cost.
+--
+-- NO DESCRIPTION CARRIES A COUNT, and the rule that replaced is worth recording because it was
+-- WRONG in a way that took a reviewer to see. It said a count is "safe" when it sits beside its own
+-- assertion's expected value, since the two would fail together. They do not. PROXIMITY IS NOT
+-- DERIVATION: nothing computes the count from the expected value, so the assertion fails on drift
+-- only until a maintainer updates the expected value — which is the normal maintenance path — and
+-- from that moment the count is silently wrong with nothing failing.
+--
+-- Measured rather than argued: add a function to agent_board_test, and CPR-0b fails; update its
+-- expected value the way a maintainer would, and it passes again while any count in its prose is now
+-- false. So the "safe" category did not exist. There are only counts that are easier to notice and
+-- counts that are harder, and the durable move is the one this package already made when its runner
+-- dropped "28 tests" and "42-migration union": delete them. The expected values enumerate every
+-- member by name; a reader who wants a number can count one that cannot drift.
+--
+-- THE RECURSION IS THE POINT, not an aside: the rule written to prevent stale counts made a claim
+-- broader than its own mechanism supported — the same shape as every finding in this review, in the
+-- sentence codifying the lesson from the previous one.
+--
+-- IN THESE TWO ASSERTIONS the expected values enumerate every entry by name, so no count appears in
+-- either description: it would add nothing a reader cannot see and one more thing that can go stale.
+--
+-- COMPOUND ENTRIES LET A COVERED BRANCH CONCEAL AN UNCOVERED SIBLING: `keyword exclusions` reverted
+-- VALUES and SELECT together, and `lead_guard` reverted its dot-whitespace and non-ASCII guards
+-- together, so deleting one row still left the rule reporting as gated through the other. That is
+-- the r06 defect at the RULE level — the map certifying a rule it only half tests.
+--
+-- AND "SOME ROW FLIPPED" IS NOT "THE ROW FOR THIS RULE FLIPPED". The gate now requires the NAMED
+-- row, so a rule cannot borrow coverage from an unrelated one.
+create temp table _mrule (rule_name text primary key, fn text, expect_row text, revert_sql text) on commit drop;
+
+insert into _mrule(rule_name, fn, expect_row, revert_sql) values
+  ('ci_re: a space becomes \s+', 'agent_board_test.ci_re(text)', 'a08-cire-phrase', $r$
+     create or replace function agent_board_test.ci_re(p_text text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select coalesce(string_agg(case when c ~ '[A-Za-z]' then '[' || upper(c) || lower(c) || ']' else c end, ''), '')
+         from regexp_split_to_table(p_text, '') as c $b$; $r$),
+  ('ident_chars: $ is an identifier character', 'agent_board_test.ident_chars()', 'r05-dollar-lead', $r$
+     create or replace function agent_board_test.ident_chars() returns text
+     language sql immutable set search_path to pg_catalog as $b$ select 'A-Za-z0-9_' $b$; $r$),
+  ('ident_re: the quoted alternative', 'agent_board_test.ident_re(text)', 'a04-quoted-lower', $r$
+     create or replace function agent_board_test.ident_re(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select '(?:' || agent_board_test.ci_re(p_name) || ')' $b$; $r$),
+  ('lead_guard: reject a dot with whitespace', 'agent_board_test.lead_guard()', 'r02-dot-space', $r$
+     create or replace function agent_board_test.lead_guard() returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select '(?<![' || agent_board_test.ident_chars() || '."])(?<![^\x00-\x7F])' $b$; $r$),
+  ('lead_guard: reject a leading non-ASCII letter', 'agent_board_test.lead_guard()', 'r07-nonascii-lead', $r$
+     create or replace function agent_board_test.lead_guard() returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select '(?<![' || agent_board_test.ident_chars() || '."])(?<!\.\s*)' $b$; $r$),
+  ('trail_guard: reject a trailing non-ASCII letter', 'agent_board_test.trail_guard()', 'r08-nonascii-trail', $r$
+     create or replace function agent_board_test.trail_guard() returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select '(?![' || agent_board_test.ident_chars() || '])' $b$; $r$),
+  ('qname_frag: the qualifier is OPTIONAL', 'agent_board_test.qname_frag(text)', 'a02-unqualified', $r$
+     create or replace function agent_board_test.qname_frag(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.lead_guard() || agent_board_test.ident_re('agent_board')
+           || '\s*\.\s*' || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard() $b$; $r$),
+  ('qname_re: the (?c) director', 'agent_board_test.qname_re(text)', 'r11-i-flag', $r$
+     create or replace function agent_board_test.qname_re(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.qname_frag(p_name) $b$; $r$),
+  ('call_frag: whitespace may precede the paren', 'agent_board_test.call_frag(text)', 'a10-call-space', $r$
+     create or replace function agent_board_test.call_frag(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
+           || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || '\(' $b$; $r$),
+  ('call_re: the (?c) director', 'agent_board_test.call_re(text)', 'r16-call-i-flag', $r$
+     create or replace function agent_board_test.call_re(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.call_frag(p_name) $b$; $r$),
+  ('col_frag: the column token carries identifier rules', 'agent_board_test.col_frag(text)', 'a12-col-upper', $r$
+     create or replace function agent_board_test.col_frag(p_name text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.lead_guard() || p_name || agent_board_test.trail_guard() $b$; $r$),
+  ('stmt_re: \s+ between the verb and the relation', 'agent_board_test.stmt_re(text,text)', 'a18-verb-rel-spaces', $r$
+     create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select '(?c)(?:' || (select string_agg(agent_board_test.ci_re(v), '|')
+                              from regexp_split_to_table(p_verbs, '\|') as v)
+           || ') (?:' || agent_board_test.ci_re('only') || '\s+)?' || agent_board_test.qname_frag(p_rel) $b$; $r$),
+  ('insert rule: the VALUES exclusion', 'agent_board_test.insert_all_columns_frag(text)', 'a13-ins-novals', $r$
+     create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.ci_re('insert into') || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+           || agent_board_test.qname_frag(p_rel)
+           || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
+           || agent_board_test.ci_re('select') || '(?![A-Za-z0-9_$]))'
+           || '(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_$]*))?\s*\()' $b$; $r$),
+  ('insert rule: the SELECT exclusion', 'agent_board_test.insert_all_columns_frag(text)', 'a14-ins-select', $r$
+     create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.ci_re('insert into') || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+           || agent_board_test.qname_frag(p_rel)
+           || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
+           || agent_board_test.ci_re('values') || '(?![A-Za-z0-9_$]))'
+           || '(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_$]*))?\s*\()' $b$; $r$),
+  ('insert rule: no backtracking before the paren', 'agent_board_test.insert_all_columns_frag(text)', 'r13-ins-collist', $r$
+     create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.ci_re('insert into') || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+           || agent_board_test.qname_frag(p_rel) || '\s*(?!\()' $b$; $r$),
+  ('insert rule: the quoted-alias alternative', 'agent_board_test.insert_all_columns_frag(text)', 'r15-ins-qalias', $r$
+     create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.ci_re('insert into') || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+           || agent_board_test.qname_frag(p_rel)
+           || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
+           || agent_board_test.ci_re('values') || '(?![A-Za-z0-9_$])|'
+           || agent_board_test.ci_re('select') || '(?![A-Za-z0-9_$]))'
+           || '[A-Za-z_][A-Za-z0-9_$]*)?\s*\()' $b$; $r$),
+  ('insert re: composed from the frag', 'agent_board_test.insert_all_columns_re(text)', 'a17-ins-re-eq-frag', $r$
+     create or replace function agent_board_test.insert_all_columns_re(p_rel text) returns text
+     language sql immutable set search_path to pg_catalog as $b$
+       select agent_board_test.insert_all_columns_frag(p_rel) $b$; $r$);
+
+create temp table _mflip (rule_name text, expect_row text, flipped text, named_row_flipped boolean) on commit drop;
+
+do $mut$
+declare
+  r      record;
+  v_save text;
+  v_hits text;
+begin
+  for r in select * from _mrule order by rule_name loop
+    v_save := pg_get_functiondef(r.fn::regprocedure);
+    execute r.revert_sql;
+    select coalesce(string_agg(m.label, ' ' order by m.label), '<NONE>')
+      into v_hits
+      from _mrow m
+     where pg_temp.mverdict(m.expr) <> m.want;
+    execute v_save;                       -- restore before the next rule
+    insert into _mflip
+    values (r.rule_name, r.expect_row, v_hits,
+            v_hits ~ ('(^| )' || r.expect_row || '( |$)'));
+  end loop;
+end $mut$;
+
+select is(
+  (select coalesce(string_agg(rule_name || ' (wanted ' || expect_row || ', got ' || flipped || ')',
+                              '; ' order by rule_name), '<none>')
+     from _mflip where not named_row_flipped),
+  '<none>',
+  'CPR-0a REVERT MAP (mechanical): reverting each rule makes THE ROW NAMED FOR THAT RULE fail — one behaviour per entry and a named row per entry, so a compound revert cannot let a covered branch conceal an uncovered sibling and no rule can borrow coverage from an unrelated row — the map is compiled by reverting each rule and re-evaluating the rows, not by hand, because three separate rows have now certified axes they did not test and a human reading the table caught none of them');
+
+-- CPR-0b. AND THE RULE INVENTORY IS RECONCILED AGAINST THE CATALOG, because _mrule is still written
+-- by hand and a matcher added without an entry would be SILENTLY UNGATED — which contradicts
+-- CPR-0a's own sentence. Deriving "every rule a regex-building function implements" from its source
+-- is not mechanical; deriving "every FUNCTION in this schema is either gated or positively exempted"
+-- is, and it closes the exposure that matters: a new matcher cannot arrive unnoticed.
+--
+-- Every function in agent_board_test is classified. A new matcher appears as `NOT-GATED` and fails;
+-- a new helper appears too and must be exempted deliberately. That is rule 1 applied to the gate's
+-- own inventory: the classification comes from pg_proc, and the exemptions are asserted positively
+-- rather than by absence.
+select is(
+  (select string_agg(p.proname || '=' ||
+            (case when exists (select 1 from _mrule r where r.fn like '%.' || p.proname || '(%')
+                  then 'gated' else 'NOT-GATED' end), ', ' order by p.proname)
+     from pg_proc p where p.pronamespace = 'agent_board_test'::regnamespace),
+  'call_frag=gated, call_re=gated, ci_re=gated, col_frag=gated, fn_call_closure=NOT-GATED, '
+  'ident_chars=gated, ident_re=gated, insert_all_columns_frag=gated, insert_all_columns_re=gated, '
+  'lead_guard=gated, lock_edges=NOT-GATED, qname_frag=gated, qname_re=gated, '
+  'row_lock_rank=NOT-GATED, row_locks_conflict=NOT-GATED, stmt_re=gated, strip_sql=NOT-GATED, '
+  'stripped_body=NOT-GATED, stripped_def=NOT-GATED, stripped_viewdef=NOT-GATED, trail_guard=gated',
+  'CPR-0b RULE INVENTORY: every function in agent_board_test is either covered by a CPR-0a rule or positively listed as not a pattern matcher — the NOT-GATED entries are body readers and lock helpers, which build no regex, and the expected value names every one of them; a new matcher added without a rule appears here as NOT-GATED and fails by name');
+
+-- CPR-15/16. And no session can take one either — the OPERATION, not a privilege proxy for it.
+-- `select ... for update` on claims is refused with 42501 to both roles that can read the table,
+-- because a row lock needs UPDATE/DELETE privilege and neither holds it at table or column level.
+-- anon cannot even SELECT. Run inside a DO block so the SET LOCAL role is unwound with the
+-- subtransaction throws_ok opens.
+select throws_ok(
+  $$ do $cpr$ begin
+       perform set_config('role', 'authenticated', true);
+       perform 1 from agent_board.claims limit 1 for update;
+     end $cpr$ $$,
+  '42501', NULL,
+  'CPR-15 LOCK ORDER: an authenticated session cannot row-lock a claim DIRECTLY — `select ... for update` is refused 42501, so the hand-written inversion claimpolicy_claimrow_lock_order.spec constructs cannot be spelled that way; composition through granted definer RPCs is a separate path, narrowed in that spec''s header');
+
+select throws_ok(
+  $$ do $cpr$ begin
+       perform set_config('role', 'service_role', true);
+       perform 1 from agent_board.claims limit 1 for update;
+     end $cpr$ $$,
+  '42501', NULL,
+  'CPR-16 LOCK ORDER: nor can service_role spell it directly — the operator carve-out exempts it from the guards, not from the table grants; what service_role could do is compose it across two RPCs, which is why CPR-22 now pins the lock helper as grantable to nobody');
+
+-- ===========================================================================
+-- THE HELPERS: contract and authorization.
+-- ===========================================================================
+
+-- CPR-17/18. The null fallbacks, which are what make the "board stamped mid-wait" drift
+-- CONSERVATIVE rather than a hole: an absent board resolves to the ENFORCING policy.
+select is(
+  (select agent_board._claimgate_board_of_thread(null)),
+  null::uuid,
+  'CPR-17 NULL FALLBACK: a null thread has no board — so nothing is locked and nothing can go stale');
+
+select is(
+  (select agent_board._claimgate_board_claim_policy_of(null)),
+  'inherit',
+  'CPR-18 NULL FALLBACK: an absent board resolves to inherit, the ENFORCING answer — a board stamped onto a null-board thread mid-wait can therefore only make this path stricter, never permissive');
+
+-- CPR-19/20. The composition is the SAME function it replaced. `_claimgate_board_claim_policy` is
+-- what the census view resolves through and what BCP-5 pins; decomposing it into the two halves
+-- the enforcement paths call separately must not have moved its answer on either case.
+select is(
+  (select agent_board._claimgate_board_claim_policy(c.thread) from _cpr c),
+  (select agent_board._claimgate_board_claim_policy_of(agent_board._claimgate_board_of_thread(c.thread)) from _cpr c),
+  'CPR-19 COMPOSITION: for a board-linked thread the thread-keyed resolver and the two halves agree — one definition of the walk, not two');
+
+select is(
+  (select agent_board._claimgate_board_claim_policy(c.free_thread) from _cpr c),
+  'inherit',
+  'CPR-20 COMPOSITION: a thread with NO board still resolves inherit — a claim cannot opt itself out by omitting the board (BCP-5''s rule, unchanged by the decomposition)');
+
+-- CPR-21. And the board-linked fixture really is advisory, so CPR-19 is comparing something.
+-- Without this CPR-19 could agree on 'inherit' twice and prove nothing.
+select is(
+  (select agent_board._claimgate_board_claim_policy(c.thread) from _cpr c),
+  'advisory',
+  'CPR-21 DISCRIMINATION: the fixture board is advisory, so CPR-19 compares a non-default answer rather than agreeing on the fallback twice');
+
+-- CPR-22..24. AUTHORIZATION. The serialisation is only worth something if a session cannot take
+-- the lock on a key of its own choosing, or skip it; and the two read helpers must stay narrower
+-- than the thread-keyed resolver, which KEEPS its authenticated grant because the census view
+-- resolves through it.
+-- CPR-22. THE GRANT THIS PR REMOVED, AND WHY. The description here used to say the helper was
+-- "unreachable from a session" while its own expected string asserted `service_role=true` — and a
+-- service_role SESSION could indeed call it. That is not academic: with the grant in place, a
+-- single service_role transaction could call `renew_claim` (whose `update agent_board.claims` sits
+-- OUTSIDE the ownerless block, so the row lock is taken even though `_is_service_role()`
+-- short-circuits the board lock) and then call this helper DIRECTLY — assembling claim-row-lock
+-- then board-lock, the very inversion claimpolicy_claimrow_lock_order.spec constructs by hand. It
+-- was reproduced as a real `deadlock detected` before the grant was removed.
+--
+-- The grant was dead weight: the helper is NOT SECURITY DEFINER and its three callers ARE, owned
+-- by the same owner, so they reach it by ownership. Nothing in the schema, the TypeScript packages
+-- (client/cli/mcp/runtime), or the Edge Functions names it — derived from the tree, not assumed.
+-- ENUMERATED FROM THE ACL, ACROSS EVERY OVERLOAD OF THE NAME. Two hand lists have been removed
+-- from this assertion in successive rounds, and the second was introduced by the fix for the first.
+--
+--   Round 3 replaced four has_function_privilege() calls (public/anon/authenticated/service_role)
+--   with aclexplode, because a grant to any fifth role was invisible. Measured: with EXECUTE
+--   granted to a fifth role the old form returned all-false and PASSED.
+--
+--   Round 4 removed the SIGNATURE filter. That fix keyed the query to
+--   `to_regprocedure('…(uuid)')` while its own description claimed "an overload carrying one is
+--   named here" — a claim one `create function …(text)` away from false. The property actually
+--   wanted is about the NAME: nothing in agent_board called _claimgate_lock_board_policy should be
+--   executable by a non-owner, whatever its argument types. Enumerating overloads is strictly
+--   stronger than asserting none exists, and does not require that second fact to be kept true.
+--
+--   Round 5 corrected the WORD: the scan takes any pg_proc row, so it covers ROUTINES — procedures
+--   and aggregates as well as functions — while the description said "function overloads". The
+--   scan was right and the sentence was narrow; both now say routine. 20261001000100 has the same
+--   scope and had to change its REVOKE verb to match, because `on function` RAISES against a
+--   procedure.
+--
+-- Four fail-open modes closed here, each deliberately:
+--   * `proacl IS NULL` means DEFAULT privileges, and the default for a function is EXECUTE to
+--     PUBLIC. aclexplode(NULL) returns ZERO ROWS, so a plain enumeration would report '<none>' for
+--     the one state where PUBLIC really can call it. Reported as its own row per overload.
+--   * ZERO overloads would also aggregate to '<none>' and PASS — an absent function reported as a
+--     clean ACL. The count is checked first and says so instead.
+--   * grantee 0 is PUBLIC and renders as '-' through regrole; spelled out so a PUBLIC grant is
+--     legible in the failure message rather than looking like a dash.
+--   * a grantee OID with no pg_roles row is RENDERED, not raised on. `a.grantee::regrole` raises
+--     for a dangling OID, and a raise inside a pgTAP assertion aborts the file and emits NO
+--     `not ok` at all — rule 3's exact shape, and the same trap to_regprocedure avoided before.
+--     The migration's matching `raise` is correct precisely because it is NOT an assertion: there,
+--     skipping silently would leave a live grant standing.
+select is(
+  (with fns as (
+     select p.oid, p.proacl, p.proowner, p.oid::regprocedure::text as sig
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board' and p.proname = '_claimgate_lock_board_policy'
+   ), findings as (
+     select f.sig || ' -> DEFAULT ACL (public holds EXECUTE implicitly)' as entry
+       from fns f where f.proacl is null
+     union all
+     select f.sig || ' -> ' ||
+            case when a.grantee = 0 then 'PUBLIC'
+                 else coalesce((select quote_ident(r.rolname) from pg_roles r where r.oid = a.grantee),
+                               'OID ' || a.grantee::text) end
+       from fns f cross join lateral aclexplode(f.proacl) a
+      where a.privilege_type = 'EXECUTE' and a.grantee <> f.proowner
+   )
+   select case when (select count(*) from fns) = 0
+                 then 'NO FUNCTION NAMED agent_board._claimgate_lock_board_policy'
+               else coalesce((select string_agg(entry, '; ' order by entry) from findings), '<none>')
+          end),
+  '<none>',
+  'CPR-22 AUTHORIZATION: no non-owner grantee holds EXECUTE on ANY ROUTINE named agent_board._claimgate_lock_board_policy — functions, procedures and aggregates alike, enumerated from each one''s ACL, so a grant to any role on any signature or kind is named here rather than slipping past a list of four roles or a filter on one signature');
+
+-- ENUMERATED FROM THE ACL, like CPR-22 and for the same reason: three named roles are a hand list,
+-- and a grant to any fourth was invisible to the old form. Pinned to the two exact signatures with
+-- to_regprocedure — correct HERE (this is a property of these two specific functions, not of a
+-- name) and the opposite of CPR-22's name scan, which asks a property of the name. A missing
+-- function yields no row and fails by comparison rather than raising.
+select is(
+  (select string_agg(x.nm || ':' || x.grantees, ', ' order by x.nm)
+     from (select p.proname as nm,
+       (select case
+                 when p.proacl is null then 'DEFAULT-ACL(public holds EXECUTE)'
+                 else coalesce((select string_agg(distinct g.who, ',' order by g.who)
+                                  from (select case when a.grantee = 0 then 'PUBLIC'
+                                                    else coalesce((select r.rolname from pg_roles r where r.oid = a.grantee),
+                                                                  'OID ' || a.grantee::text) end as who
+                                          from aclexplode(p.proacl) a
+                                         where a.privilege_type = 'EXECUTE' and a.grantee <> p.proowner) g),
+                               '<none>') end) as grantees
+             from pg_proc p
+            where p.oid in (to_regprocedure('agent_board._claimgate_board_of_thread(uuid)'),
+                            to_regprocedure('agent_board._claimgate_board_claim_policy_of(uuid)'))) x),
+  '_claimgate_board_claim_policy_of:service_role, _claimgate_board_of_thread:service_role',
+  'CPR-23 AUTHORIZATION: the two halves are granted to service_role and to NOBODY ELSE — enumerated from each ACL rather than asked of three named roles, so a grant to any other role is named here; they read threads/boards under SECURITY DEFINER, so an authenticated grant would expose any thread''s board past RLS');
+
+-- ENUMERATED, because has_function_privilege COULD NOT DECIDE THIS ASSERTION'S OWN SENTENCE. It
+-- claims the ACL was preserved "rather than silently re-granting to PUBLIC" — but
+-- has_function_privilege('authenticated', …) returns TRUE when PUBLIC holds the grant, so the exact
+-- state the sentence rules out was indistinguishable from the one it asserts. The grantee list is
+-- read from the ACL instead, where PUBLIC appears by name.
+select is(
+  (select (select case
+                 when p.proacl is null then 'DEFAULT-ACL(public holds EXECUTE)'
+                 else coalesce((select string_agg(distinct g.who, ',' order by g.who)
+                                  from (select case when a.grantee = 0 then 'PUBLIC'
+                                                    else coalesce((select r.rolname from pg_roles r where r.oid = a.grantee),
+                                                                  'OID ' || a.grantee::text) end as who
+                                          from aclexplode(p.proacl) a
+                                         where a.privilege_type = 'EXECUTE' and a.grantee <> p.proowner) g),
+                               '<none>') end)
+     from pg_proc p
+    where p.oid = to_regprocedure('agent_board._claimgate_board_claim_policy(uuid)')),
+  'authenticated,service_role',
+  'CPR-24 AUTHORIZATION: the thread-keyed resolver''s non-owner grantees are exactly authenticated and service_role — the census view resolves through it, and a PUBLIC grant is now DISTINGUISHABLE from the authenticated one rather than reading as the same true');
+
+-- CPR-25. The lock helper works on the level it demands. The REFUSAL is the interesting half and
+-- cannot be asserted here — `set transaction isolation level` must be a transaction's first
+-- statement and this file is already inside one — so it is pinned by name in
+-- claimpolicy_isolation_refusal.spec. This asserts the allow side, which is what would break if
+-- the guard's comparison were inverted.
+select lives_ok(
+  $$ select agent_board._claimgate_lock_board_policy(
+              (select board from _cpr)) $$,
+  'CPR-25 ISOLATION GUARD (allow side): under READ COMMITTED the lock is taken and returns — the refusal under REPEATABLE READ is pinned in claimpolicy_isolation_refusal.spec, which is the only place it can be');
+
+-- CPR-26. The NULL is CAST, because an untyped one is ambiguous the moment a same-name overload
+-- exists: `_claimgate_lock_board_policy(null)` resolves against every overload and raises
+-- `function is not unique`. That fails closed rather than aborting, so it was not a hole — but it
+-- reported a defect in the WRONG assertion (this one) for a condition CPR-22 is the one to name.
+-- Found while probing a same-name procedure for CPR-22's routine scope.
+--
+-- CPR-26. And a null board is isolation-checked but locks nothing — the deliberate absence of a
+-- carve-out. Asserted so the branch is exercised rather than assumed unreachable.
+select lives_ok(
+  $$ select agent_board._claimgate_lock_board_policy(null::uuid) $$,
+  'CPR-26 ISOLATION GUARD: a null board takes no lock (there is no board row to serialise on) and is still admitted under READ COMMITTED');
+
+-- CPR-22a. AND THE REVOKE DID NOT BREAK THE DEFINER PATH. CPR-22 is a negative — it would stay
+-- green if the helper became uncallable by EVERYONE including its own callers, which would take
+-- the enforcement offline rather than securing it. So the positive half is asserted by RUNNING the
+-- path: `set_board_claim_policy` is SECURITY DEFINER, reaches the helper by ownership, and its
+-- advisory lock must actually be HELD afterwards.
+--
+-- NOT VACUOUS, and that is the whole design of this assertion. `lives_ok` alone would pass if the
+-- helper were never entered, so the state check is separate (rule 3): the advisory lock the helper
+-- takes is looked for in pg_locks for THIS backend. The board is flipped advisory -> inherit, the
+-- transition that reaches the lock; the fixture board is already 'advisory' (CPR-21 pins that), so
+-- the call is a real transition rather than a no-op.
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board_b from _cpr), 'inherit') $$,
+  'CPR-22a AUTHORIZATION (positive half): with the helper granted to nobody, the SECURITY DEFINER writer still reaches it by ownership — the revoke closed the session path without taking enforcement offline');
+
+-- The state half, keyed to BOARD B SPECIFICALLY. `count(*) > 0` over all advisory locks would be
+-- satisfied by the lock CPR-25 already holds on the other board and would prove nothing about this
+-- call; the key is recomputed here the same way the helper computes it, and split into the
+-- (classid, objid) pair pg_locks records for a bigint advisory key.
+select is(
+  (select count(*)
+     from pg_locks l, (select hashtextextended('agent_board.board_claim_policy:' ||
+                                               (select board_b from _cpr)::text, 0) as k) x
+    where l.locktype = 'advisory'
+      and l.pid = pg_backend_pid()
+      and l.classid = ((x.k >> 32) & 4294967295)::oid
+      and l.objid   = (x.k & 4294967295)::oid),
+  1::bigint,
+  'CPR-22a-state AUTHORIZATION: and the advisory lock for THAT board is genuinely held by this backend afterwards — so CPR-22a exercised the helper rather than passing on a lock some earlier assertion took');
+
+-- CPR-25a. THE GUARD'S COMPARISON TEXT — and text is all it is. Read the scope note before
+-- treating a green here as a refusal guarantee.
+--
+-- WHAT IT ASSERTS: that the body contains an inequality against the single ACCEPTED level, spelled
+-- `v_isolation <> 'read committed'`. WHAT IT DOES NOT ASSERT: that this comparison is the one
+-- CONTROLLING the raise. It is a regex over the stripped body, so a dead or unrelated inequality
+-- elsewhere would satisfy it while a narrower operative guard admitted another level. Proving
+-- control flow is beyond what a source scan can do, and a longer regex would not change that — it
+-- would only make the same claim harder to audit.
+--
+-- SO THE BEHAVIOURAL PIN IS THE SPEC, NOT THIS: claimpolicy_isolation_refusal.spec's `sz` and `ru`
+-- permutations RUN a transaction at serializable and at read uncommitted and observe the 0A000 by
+-- name. This assertion earns its place beside them because a permutation only pins the levels it
+-- ENUMERATES: the guard's inequality form is what extends the refusal to a level no permutation
+-- names, and that form is textual, so a text assertion is the right instrument for it.
+--
+-- THE INDEPENDENCE, MEASURED RATHER THAN REASONED — and the first version of this comment got it
+-- wrong, which is worth leaving on the record given what this file is for. It claimed that
+-- inverting to `= 'read committed'` "fails only this one, because every permutation's level is
+-- still refused". Measured: that inversion refuses READ COMMITTED and ADMITS the other three, so
+-- it fails `sz`, `ru`, CPR-25, CPR-26 and both halves of CPR-22a as well. It is not an isolating
+-- mutation at all.
+--
+-- What actually separates the two instruments is a BEHAVIOUR-PRESERVING reformulation:
+-- `not (v_isolation = 'read committed')` is semantically identical — measured refusing repeatable
+-- read, serializable and read uncommitted while admitting read committed, exactly as before — so
+-- every permutation and every other assertion stays green, and ONLY this one goes red. That is the
+-- honest statement of what this assertion adds: it pins the FORM while the permutations pin the
+-- behaviour, and a change that alters the form without altering today's behaviour is caught here
+-- alone. Narrowing to `= 'repeatable read'` alters both, and fails `sz`, `ru` and this together.
+--
+-- `stripped_body(oid, true)` KEEPS literals, which is required and not incidental here: the marker
+-- IS the literal 'read committed' inside the comparison. Comments are still stripped, so prose
+-- mentioning the level cannot satisfy it.
+--
+-- PINNED TO THE (uuid) SIGNATURE, and here that is CORRECT — the opposite of CPR-22, deliberately.
+-- The two ask different questions. CPR-22 asks a property of the NAME ("no overload is executable
+-- by a non-owner"), so filtering to one signature would let another carry a grant. This asks a
+-- property of THE GUARD the three deciders actually call, which is the (uuid) one; an unrelated
+-- overload's body has no bearing on it.
+--
+-- to_regprocedure() rather than `p.proname = …`, and that is not stylistic. Selecting by NAME made
+-- this a scalar subquery over a SET: adding one overload made it return two rows, and
+-- `more than one row returned by a subquery used as an expression` ABORTED the whole file — 32 of
+-- 33 assertions ran and the missing one emitted no `not ok` at all. Rule 3's exact shape, found by
+-- running the overload mutation rather than by reading. Four scalar subqueries in this file carried
+-- the same latent abort and are all pinned now.
+select is(
+  (select substring(agent_board_test.stripped_body(p.oid, true)
+                    from '(v_isolation\s*(?:<>|!=|=)\s*''[a-z ]+'')')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where p.oid = to_regprocedure('agent_board._claimgate_lock_board_policy(uuid)')),
+  'v_isolation <> ''read committed''',
+  'CPR-25a ISOLATION GUARD (comparison TEXT, not control flow): the guard''s body spells an inequality against the one accepted level rather than an equality against one refused level — this pins the FORM that extends refusal to levels no permutation enumerates; the refusal itself is demonstrated behaviourally by the sz and ru permutations in claimpolicy_isolation_refusal.spec');
+
+select * from finish();
+rollback;