@consiliency/agent-board-schema 1.50.0 → 1.52.0

package/tests/agent_board_consent_emission.test.sql

@@ -232,7 +232,7 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and agent_board_test.stripped_body(p.oid) ~* '(insert into|update)[[:space:]]+agent_board\.board_memberships'
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|update', 'board_memberships')
       and agent_board_test.stripped_body(p.oid) !~* 'perform agent_board\._emit_membership_event'
       and p.proname <> 'grant_board_role'),
   '',
@@ -263,7 +263,8 @@ select is(
 
 -- ...and the one exemption is genuinely state-blind: membership_state never appears in a SET.
 select ok(
-  (select agent_board_test.stripped_body(p.oid) !~* 'set[^;]*membership_state[[:space:]]*='
+  (select agent_board_test.stripped_body(p.oid, true)
+            !~ agent_board_test.re(agent_board_test.col_assign_frag('board_memberships', 'membership_state', agent_board_test.bare_ok(p.oid)))
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'grant_board_role'),
   'COMPLETENESS: the exemption holds -- grant_board_role never SETs membership_state');
@@ -274,7 +275,7 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.proname <> '_emit_membership_event'
-      and pg_get_functiondef(p.oid) ~* 'insert into[[:space:]]+agent_board\.board_membership_events'),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.stmt_re('insert into', 'board_membership_events')),
   0,
   'COMPLETENESS: only _emit_membership_event writes the ledger -- the derivation cannot drift');
 
@@ -578,7 +579,7 @@ select is(
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
       and has_function_privilege('authenticated', p.oid, 'EXECUTE')
-      and pg_get_functiondef(p.oid) ~ '_membership_consent_present'),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_membership_consent_present')),
   'resolve_board_request, update_board_membership',
   'scope: exactly TWO authenticated routes read the predicate');
 

package/tests/agent_board_consent_gating.test.sql

@@ -309,7 +309,10 @@ select is(
       -- filter that is the fail-OPEN direction: the offender simply leaves the
       -- class and the expected-empty assertion stays green. (Same mechanism
       -- agent_board_wake_recovery.test.sql records for its own WR-7 filter.)
-            ~* '(_upsert_board_membership_state|_redeem_invite_for_agent|update_board_membership|insert into agent_board\.board_memberships)'
+            ~ agent_board_test.re(agent_board_test.call_frag('_upsert_board_membership_state')
+                               || '|' || agent_board_test.call_frag('_redeem_invite_for_agent')
+                               || '|' || agent_board_test.call_frag('update_board_membership')
+                               || '|' || agent_board_test.stmt_frag('insert into', 'board_memberships'))
       -- gated: consults the predicate, or refuses a non-subject actor structurally.
       --
       -- SPLIT IN TWO, by what kind of thing each marker IS. The single `!~` over a
@@ -326,16 +329,20 @@ select is(
       -- gate genuinely removed. It does not any more.
       -- anchored to the CALL shape, for the same reason the message half below is
       -- anchored to the raise shape: a bare substring is satisfied by a NAME.
-      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
-      -- IDENTITY: `\m_membership_consent_present\s*\(` also matches
-      -- `zz_other._membership_consent_present(...)` (measured true). Every live call
-      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- SCHEMA-QUALIFIED (`bare_ok => false`), because a bare-name anchor proves call
+      -- SYNTAX, not callee IDENTITY: the old `\m_membership_consent_present\s*\(` also
+      -- matched `zz_other._membership_consent_present(...)` (measured true). Every live
+      -- call site in agent_board is `agent_board.`-qualified, so requiring the
       -- qualification costs nothing today and is fail-CLOSED if someone later writes
       -- an unqualified call (it reads as NOT calling). Overload count is pinned
       -- separately, so schema + name is the identity.
-      and agent_board_test.stripped_body(p.oid) !~* '\magent_board\._membership_consent_present\s*\('
+      and agent_board_test.stripped_body(p.oid) !~ agent_board_test.call_re('_membership_consent_present', false)
+      -- The raise shape through the matcher family: `raise exception` case-folded with any
+      -- whitespace (the hand-rolled form was case-SENSITIVE, so `RAISE EXCEPTION` passed this
+      -- absence silently), then the message inside a literal of the same statement.
       and agent_board_test.stripped_body(p.oid, true)
-            !~ 'raise[[:space:]]+exception[^;]{0,250}(actor mismatch|requires an act by that agent)'
+            !~ agent_board_test.re('\m' || agent_board_test.ci_re('raise exception') || '\M' || agent_board_test.same_stmt()
+                                   || '''(?:[^'']|'''')*?(?:actor mismatch|requires an act by that agent)')
       -- stated exemptions, each with a reason recorded in the migration header
       and p.proname not in (
         'create_board',        -- the actor IS the subject: it seeds the creator's own seat
@@ -362,7 +369,9 @@ select is(
        -- LITERALS KEPT: the marker is the ARGUMENT ''joined''/''subscribed'' passed
        -- to the sink -- a string literal in the code being matched.
        agent_board_test.stripped_body(p.oid, true),
-       '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(joined|subscribed)''',
+       agent_board_test.re('(?:' || agent_board_test.call_frag('_upsert_board_membership_state')
+                           || '|' || agent_board_test.call_frag('update_board_membership') || ')'
+                           || '[^;]*?''(joined|subscribed)'''),
        'g') m
     where n.nspname = 'agent_board'
       and p.proname in ('invite_board_member','request_join_board','leave_board')),
@@ -377,7 +386,9 @@ select is(
      cross join lateral regexp_matches(
        -- LITERALS KEPT: same shape as above -- the state being written is a literal.
        agent_board_test.stripped_body(p.oid, true),
-       '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(invited|requested|left)''',
+       agent_board_test.re('(?:' || agent_board_test.call_frag('_upsert_board_membership_state')
+                           || '|' || agent_board_test.call_frag('update_board_membership') || ')'
+                           || '[^;]*?''(invited|requested|left)'''),
        'g') m
     where n.nspname = 'agent_board'
       and p.proname in ('invite_board_member','request_join_board','leave_board')),

package/tests/agent_board_enroll_resumption.test.sql

@@ -200,7 +200,7 @@ select is(
       -- while a third signing-key creator was live (message-board#293). This site was
       -- invisible to the #196 lint because that lint only inspects POSITIONAL and
       -- NEGATIVE assertions, and this is a PRESENCE match -- see the note on the lint.
-      and agent_board_test.stripped_body(p.oid) ~* 'insert into agent_board\.agent_signing_keys'),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'agent_signing_keys')),
   '_enroll_federated_identity_once, mint_delegated_child',
   'EC-2: only the enroll creator and delegated-child mint insert signing keys (strip_sql-derived)');
 

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -69,7 +69,8 @@ select has_column('agent_board', 'enrollment_federation_audit', 'enrolled_at', '
 -- writes it and total human revocation reads stable principal evidence from it. ----
 select is(
   (select count(*)::int from (
-     select pg_get_functiondef(p.oid) as def, p.proname
+     -- literals KEPT: a dynamic-SQL reference is still a reference, and this is an absence claim
+     select agent_board_test.stripped_body(p.oid, true) as def, p.proname
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
         -- pg_get_functiondef() RAISES on aggregate ('a') / window ('w') procs
@@ -85,11 +86,11 @@ select is(
           'revoke_human_subtree'
         )
    ) d
-   where lower(d.def) like '%enrollment_federation_audit%'),
+   where d.def ~ agent_board_test.qname_re('enrollment_federation_audit')),
   0, 'no agent_board RPC other than federation enrollment and total human revocation references enrollment_federation_audit');
 select is(
   (select count(*)::int from (
-     select pg_get_functiondef(p.oid) as def
+     select agent_board_test.stripped_body(p.oid, true) as def
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
         and p.prokind in ('f', 'p')  -- pg_get_functiondef raises on aggregate/window procs
@@ -97,7 +98,7 @@ select is(
           'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
           'send_multicast_message', 'create_tasking_delivery', 'revoke_agent')
    ) d
-   where lower(d.def) like '%enrollment_federation_audit%'),
+   where d.def ~ agent_board_test.qname_re('enrollment_federation_audit')),
   0, 'no send/session/revoke write-path RPC reads the enrollment audit table');
 
 -- #6 fix: the authenticated SELECT policy is scoped to the owning principal

package/tests/agent_board_federated_identity_injective_slug.test.sql

@@ -332,7 +332,9 @@ select is(
   (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
-      and agent_board_test.stripped_body(p.oid, true) ~ 'p_issuer\s*\|\|\s*''\|''\s*\|\|\s*p_subject'),
+      -- col_frag is the bare-identifier form (guards on both sides): a parameter, here
+      and agent_board_test.stripped_body(p.oid, true)
+            ~ agent_board_test.re(agent_board_test.col_frag('p_issuer') || '\s*\|\|\s*''\|''\s*\|\|\s*' || agent_board_test.col_frag('p_subject'))),
   '(none)',
   'CLS-2: no agent_board function still concatenates p_issuer || ''|'' || p_subject (offenders are named)');
 

package/tests/agent_board_federated_lock_order_class.test.sql

@@ -29,13 +29,22 @@
 --     them, and it re-synced only because that count is even -- working by luck).
 --     Both shapes are now mutation-pinned by name;
 --   * table and function names matched BOTH qualified and BARE, with each
---     function's own search_path (pg_proc.proconfig) deciding whether bare names
---     resolve into agent_board -- a route written `insert into board_memberships`
---     is visible, and so is `perform _redeem_invite_for_agent(...)`;
+--     function's own search_path (pg_proc.proconfig, via agent_board_test.bare_ok)
+--     deciding whether bare names resolve into agent_board -- a route written
+--     `insert into board_memberships` is visible, and so is
+--     `perform _redeem_invite_for_agent(...)`. The patterns are the shared matcher
+--     family in fixtures/test-prereqs.sql (stmt_frag / col_assign_frag / qname_frag
+--     / row_lock_frag / call_re), not regexes written here, so a boundary defect
+--     is fixed once and CPR-0 pins the family's behaviour (#416/#417/#424);
 --   * three acquisition shapes: INSERT into a direct FK child, an UPDATE that
---     re-points the FK column, and an explicit row lock in any statement shape
---     (including `from boards b join ... for update of b`, which an earlier
---     `where`-anchored pattern could not see);
+--     re-points the FK column (POSITIONALLY, in the SET list -- the hand regex this
+--     replaced took `board_id` anywhere after SET and credited grant_board_role,
+--     whose UPDATE only FILTERS by board_id, with a boards acquisition; measured
+--     on migration: that route and signed_grant_board_role, which reaches it, are
+--     the only two rows that changed, and neither is in EC-2's class), and an
+--     explicit row lock of any strength in any statement shape (including
+--     `from boards b join ... for update of b`, which an earlier `where`-anchored
+--     pattern could not see);
 --   * a function pinning search_path WITHOUT agent_board (e.g.
 --     _ensure_agent_auth_user's search_path='') is not credited with bare matches;
 --     no proconfig at all is treated as bare-resolving, over-approximating
@@ -100,16 +109,7 @@ fns as (
 -- with no search_path setting at all is treated as if bare names DO resolve, which
 -- over-approximates membership rather than under-approximating it.
 sp as (
-  select f.oid,
-         case
-           when not exists (select 1 from unnest(coalesce(f.proconfig, '{}')) c
-                             where c like 'search\_path=%') then true
-           else exists (select 1 from unnest(f.proconfig) c
-                         where c like 'search\_path=%'
-                           and ',' || replace(replace(split_part(c, '=', 2), ' ', ''), '"', '') || ','
-                               like '%,agent\_board,%')
-         end as bare_ok
-    from fns f
+  select f.oid, agent_board_test.bare_ok(f.oid) as bare_ok from fns f
 ),
 -- DIRECT FK children only: inserting into a grandchild locks the child row, not
 -- the grandparent, so transitive FK depth would manufacture false positives.
@@ -125,41 +125,60 @@ kids as (
      and c.confrelid in ('agent_board.boards'::regclass, 'auth.users'::regclass)
      and ns.nspname = 'agent_board'
 ),
-alt as (
-  select (select string_agg(distinct tbl, '|') from kids
-           where parent_oid = 'agent_board.boards'::regclass) as board_kids,
-         (select string_agg(distinct tbl, '|') from kids
-           where parent_oid = 'auth.users'::regclass) as owner_kids
-),
+-- The three acquisition shapes, composed from the shared matcher family
+-- (test-prereqs) and wrapped ONCE in re() per subject. Per function, because the
+-- bare-name arm depends on that function's search_path.
+--   (i)   INSERT into a direct FK child takes FOR KEY SHARE on the parent row
+--         -- stmt_frag('insert into', kid, bare_ok);
+--   (ii)  an UPDATE that RE-POINTS the FK column re-checks it and locks the new
+--         parent -- col_assign_frag(kid, fkcol, bare_ok), which is POSITIONAL:
+--         the column must sit in the SET list. The hand form this replaced
+--         accepted `board_id` anywhere after SET, including the WHERE clause, so
+--         an UPDATE that merely FILTERS by board_id was counted as an acquisition;
+--   (iii) an explicit row lock in ANY statement shape, deliberately not anchored
+--         on `where`: `from boards b join ... for update of b` is a real
+--         acquisition and the anchored form could not see it -- qname_frag ||
+--         same_stmt() || row_lock_frag(), every lock strength (the hand owner arm
+--         accepted only `for update`; a `for no key update` on auth.users is the
+--         same acquisition and now counts).
 pat as (
-  select f.oid, s.bare_ok,
-         case when s.bare_ok then '(?:agent_board\.)?' else 'agent_board\.' end as q
-    from fns f join sp s on s.oid = f.oid
+  select s.oid,
+         agent_board_test.re(
+           (select string_agg(agent_board_test.stmt_frag('insert into', k.tbl, s.bare_ok), '|')
+              from kids k where k.parent_oid = 'agent_board.boards'::regclass)
+           || '|' || (select string_agg(agent_board_test.col_assign_frag(k.tbl, 'board_id', s.bare_ok), '|')
+                        from kids k where k.parent_oid = 'agent_board.boards'::regclass)
+           || '|' || agent_board_test.qname_frag('boards', s.bare_ok) || agent_board_test.same_stmt()
+                  || agent_board_test.row_lock_frag()
+         ) as board_re,
+         agent_board_test.re(
+           (select string_agg(agent_board_test.stmt_frag('insert into', k.tbl, s.bare_ok), '|')
+              from kids k where k.parent_oid = 'auth.users'::regclass)
+           || '|' || (select string_agg(agent_board_test.col_assign_frag(k.tbl, 'owner_user_id', s.bare_ok)
+                                        || '|' || agent_board_test.col_assign_frag(k.tbl, 'auth_user_id', s.bare_ok), '|')
+                        from kids k where k.parent_oid = 'auth.users'::regclass)
+           || '|' || agent_board_test.qname_frag('auth.users', false) || agent_board_test.same_stmt()
+                  || agent_board_test.row_lock_frag()
+         ) as owner_re
+    from sp s
 ),
+-- The hit is the matched TEXT (an acquisition is present); its position is the
+-- match's own offset (regexp_instr), not the first occurrence of that text.
 own as (
-  select f.oid, f.proname, f.sig, f.body, p.bare_ok, p.q,
-         substring(f.body from
-           -- (i) INSERT into a direct FK child takes FOR KEY SHARE on the parent row
-           '(?:insert\s+into\s+(?:only\s+)?' || p.q || '\m(?:' || a.board_kids || ')\M)'
-           -- (ii) UPDATE that re-points the FK column re-checks it and locks the new parent
-           || '|(?:update\s+(?:only\s+)?' || p.q || '\m(?:' || a.board_kids || ')\M[^;]{0,250}?\mset\M[^;]{0,250}?\mboard_id\M\s*=)'
-           -- (iii) an explicit row lock in ANY statement shape. Deliberately not
-           -- anchored on `where`: `from boards b join ... for update of b` is a real
-           -- acquisition and the anchored form could not see it.
-           || '|(?:' || p.q || '\mboards\M[^;]{0,250}?for\s+(?:update|no\s+key\s+update|share|key\s+share))'
-         ) as board_hit,
-         substring(f.body from
-           '(?:insert\s+into\s+(?:only\s+)?' || p.q || '\m(?:' || a.owner_kids || ')\M)'
-           || '|(?:update\s+(?:only\s+)?' || p.q || '\m(?:' || a.owner_kids || ')\M[^;]{0,250}?\mset\M[^;]{0,250}?\m(?:owner_user_id|auth_user_id)\M\s*=)'
-           || '|(?:auth\.users\M[^;]{0,250}?for\s+update)'
-         ) as owner_hit
-    from fns f join pat p on p.oid = f.oid cross join alt a
+  select f.oid, f.proname, f.sig, f.body, s.bare_ok,
+         substring(f.body from p.board_re) as board_hit,
+         substring(f.body from p.owner_re) as owner_hit,
+         nullif(regexp_instr(f.body, p.board_re), 0) as board_at,
+         nullif(regexp_instr(f.body, p.owner_re), 0) as owner_at
+    from fns f join sp s on s.oid = f.oid join pat p on p.oid = f.oid
 ),
+-- A call edge is the callee's name in CALL position, schema-resolved the way the
+-- caller's search_path resolves it (call_re: a `other.callee(` is NOT an edge).
 edges as (
   select c.oid as caller, e.oid as callee
     from own c
     join fns e on e.oid <> c.oid
-   where c.body ~ (c.q || '\m' || e.proname || '\M\s*\(')
+   where c.body ~ agent_board_test.call_re(e.proname, c.bare_ok)
 ),
 acq_board(oid) as (
   select oid from own where board_hit is not null
@@ -176,22 +195,20 @@ select o.sig,
        (o.oid in (select oid from acq_owner)) as reaches_owner,
        (o.board_hit is not null) as own_board_lock,
        (o.owner_hit is not null) as own_owner_lock,
-       (o.body ~* '\mexecute\M') as uses_dynamic_sql,
+       (o.body ~ agent_board_test.re('\m' || agent_board_test.ci_re('execute') || '\M')) as uses_dynamic_sql,
        least(
-         case when o.board_hit is null then 2147483647 else strpos(o.body, o.board_hit) end,
-         coalesce((select min(strpos(o.body, substring(o.body from o.q || '\m' || f2.proname || '\M\s*\(')))
+         coalesce(o.board_at, 2147483647),
+         coalesce((select min(nullif(regexp_instr(o.body, agent_board_test.call_re(f2.proname, o.bare_ok)), 0))
                      from fns f2
                     where f2.oid <> o.oid
-                      and f2.oid in (select oid from acq_board)
-                      and o.body ~ (o.q || '\m' || f2.proname || '\M\s*\(')), 2147483647)
+                      and f2.oid in (select oid from acq_board)), 2147483647)
        ) as board_pos,
        least(
-         case when o.owner_hit is null then 2147483647 else strpos(o.body, o.owner_hit) end,
-         coalesce((select min(strpos(o.body, substring(o.body from o.q || '\m' || f2.proname || '\M\s*\(')))
+         coalesce(o.owner_at, 2147483647),
+         coalesce((select min(nullif(regexp_instr(o.body, agent_board_test.call_re(f2.proname, o.bare_ok)), 0))
                      from fns f2
                     where f2.oid <> o.oid
-                      and f2.oid in (select oid from acq_owner)
-                      and o.body ~ (o.q || '\m' || f2.proname || '\M\s*\(')), 2147483647)
+                      and f2.oid in (select oid from acq_owner)), 2147483647)
        ) as owner_pos
   from own o;
 

package/tests/agent_board_fedsession.test.sql

@@ -352,7 +352,9 @@ begin
 end $$;
 -- 36
 select ok(
-  pg_get_functiondef('agent_board.enroll_federated_human(text,text,text,jsonb,text)'::regprocedure)
+  -- literals kept: none of the pinned fragments is a string, but a raise message between two
+  -- of them is part of the ORDER this pins, and the strip must not splice around it
+  agent_board_test.stripped_body('agent_board.enroll_federated_human(text,text,text,jsonb,text)'::regprocedure, true)
     like '%from agent_board.boards b%for update%from agent_board.identity_providers ip%for update%_ensure_agent_auth_user(v_handle)%from auth.users u where u.id = v_uid for update%fleet_human_revocations r%r.issuer = p_issuer%r.subject = p_subject%_enroll_federated_human_after_revocation_gate%',
   '/portal-session locks default board then provider then owner and checks the durable marker before delegation');
 -- 37

package/tests/agent_board_fedsession_provider_absence_gate.test.sql

@@ -66,10 +66,15 @@ select is(
             else 'gate-after-owner'
           end
      from (
-       select coalesce(strpos(d, substring(d from
-                $g$raise\s+exception\s+'issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)'$g$)), 0) as p_gate,
-              strpos(d, '_ensure_agent_auth_user') as p_ensure,
-              strpos(d, substring(d from 'from\s+auth\.users[^;]{0,250}?for\s+update')) as p_lock
+       -- Positions are the match's own offset (regexp_instr: 0 when absent), not the
+       -- first occurrence of the matched text.
+       select regexp_instr(d,
+                agent_board_test.re('\m' || agent_board_test.ci_re('raise exception')
+                                    || '\s+''issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)''')) as p_gate,
+              regexp_instr(d, agent_board_test.call_re('_ensure_agent_auth_user')) as p_ensure,
+              -- the auth.users read and any row lock (FOR UPDATE / NO KEY UPDATE / SHARE / KEY
+              -- SHARE) in the same statement; the old hand form knew only `for update`
+              nullif(regexp_instr(d, agent_board_test.re(agent_board_test.stmt_frag('from', 'auth.users', false) || agent_board_test.same_stmt() || agent_board_test.row_lock_frag())), 0) as p_lock
          -- LITERALS KEPT (the `true`): the gate marker G-2 locates IS the raise
          -- message, so stripping literals would delete it and the positional claim
          -- would read 'gate-missing' forever. Comments -- including the NESTED

package/tests/agent_board_fedsession_stored_identity_gate.test.sql

@@ -78,7 +78,11 @@ select p.oid, p.proname, agent_board_test.stripped_body(p.oid, true) as body
  where n.nspname = 'agent_board'
    and p.prokind in ('f', 'p')
    and agent_board_test.stripped_body(p.oid, true) like '%\_federated\_identity\_slug(%'
-   and agent_board_test.stripped_body(p.oid, true) ~ 'agent_board\.agents[^;]*auth_user_id\s*=';
+   -- a read of agents on auth_user_id, in one statement: the relation (qualified as the
+   -- function's search_path allows) then the column, qualified or bare, then `=`
+   and agent_board_test.stripped_body(p.oid, true)
+         ~ agent_board_test.re(agent_board_test.qname_frag('agents', agent_board_test.bare_ok(p.oid)) || agent_board_test.same_stmt()
+                               || agent_board_test.col_ref_frag('auth_user_id') || '\s*=');
 
 -- 1 -- the class is NOT EMPTY. A class scan that finds nothing passes every
 -- "every member has X" assertion vacuously; this is the assertion that stops that.
@@ -113,9 +117,9 @@ select is((select string_agg(proname, ',' order by proname) from _c246),
 -- `have:` line instead of killing the run.
 create temp view _c246parts as
 select proname,
-       (regexp_split_to_array(body, 'exception\s+when\s+unique_violation'))[1] as pre_handler,
-       (regexp_split_to_array(body, 'exception\s+when\s+unique_violation'))[2] as in_handler,
-       array_length(regexp_split_to_array(body, 'exception\s+when\s+unique_violation'), 1) as parts
+       (regexp_split_to_array(body, agent_board_test.re('\m' || agent_board_test.ci_re('exception when unique_violation') || '\M')))[1] as pre_handler,
+       (regexp_split_to_array(body, agent_board_test.re('\m' || agent_board_test.ci_re('exception when unique_violation') || '\M')))[2] as in_handler,
+       array_length(regexp_split_to_array(body, agent_board_test.re('\m' || agent_board_test.ci_re('exception when unique_violation') || '\M')), 1) as parts
   from _c246;
 
 -- 3 -- the split boundary is UNAMBIGUOUS for every member. With a second `exception
@@ -129,7 +133,11 @@ select is(
 -- 4 -- SITE (7a): the idempotent branch, everything before the handler.
 select is(
   (select string_agg(proname, ',' order by proname) from _c246parts
-    where pre_handler ~ 'coalesce\(\s*v_existing\.metadata\s*#>>\s*''\{federation,issuer\}''\s*=\s*p_issuer\s+and\s+v_existing\.metadata\s*#>>\s*''\{federation,subject\}''\s*=\s*p_subject\s*,\s*false\s*\)'),
+    where pre_handler ~ agent_board_test.re(agent_board_test.call_frag('pg_catalog.coalesce', true) || '\s*'
+             || agent_board_test.ident_re('v_existing') || '\s*\.\s*' || agent_board_test.ident_re('metadata') || '\s*#>>\s*''\{federation,issuer\}''\s*=\s*' || agent_board_test.ident_re('p_issuer')
+             || '\s+' || agent_board_test.ci_re('and') || '\s+'
+             || agent_board_test.ident_re('v_existing') || '\s*\.\s*' || agent_board_test.ident_re('metadata') || '\s*#>>\s*''\{federation,subject\}''\s*=\s*' || agent_board_test.ident_re('p_subject')
+             || '\s*,\s*' || agent_board_test.ci_re('false') || '\s*\)')),
   (select string_agg(proname, ',' order by proname) from _c246),
   'every class member carries the gate at return site (7a) -- the idempotent branch, BEFORE the unique_violation handler');
 
@@ -138,7 +146,11 @@ select is(
 -- so this assertion is the ONLY thing standing between it and being ungated.
 select is(
   (select string_agg(proname, ',' order by proname) from _c246parts
-    where in_handler ~ 'coalesce\(\s*v_existing\.metadata\s*#>>\s*''\{federation,issuer\}''\s*=\s*p_issuer\s+and\s+v_existing\.metadata\s*#>>\s*''\{federation,subject\}''\s*=\s*p_subject\s*,\s*false\s*\)'),
+    where in_handler ~ agent_board_test.re(agent_board_test.call_frag('pg_catalog.coalesce', true) || '\s*'
+             || agent_board_test.ident_re('v_existing') || '\s*\.\s*' || agent_board_test.ident_re('metadata') || '\s*#>>\s*''\{federation,issuer\}''\s*=\s*' || agent_board_test.ident_re('p_issuer')
+             || '\s+' || agent_board_test.ci_re('and') || '\s+'
+             || agent_board_test.ident_re('v_existing') || '\s*\.\s*' || agent_board_test.ident_re('metadata') || '\s*#>>\s*''\{federation,subject\}''\s*=\s*' || agent_board_test.ident_re('p_subject')
+             || '\s*,\s*' || agent_board_test.ci_re('false') || '\s*\)')),
   (select string_agg(proname, ',' order by proname) from _c246),
   'every class member carries the gate at return site (8a) -- INSIDE the unique_violation race handler');
 

package/tests/agent_board_fk_lock_edges.test.sql

@@ -40,7 +40,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(16);
+select plan(18);
 
 -- ---------------------------------------------------------------------------
 -- The derivation, materialized once. `first_path` is the position PATH of the
@@ -176,7 +176,7 @@ select is(
 select is(
   (select coalesce(string_agg(distinct e.fn_name, ', ' order by e.fn_name), '')
      from _le e join pg_proc p on p.oid = e.fn_oid
-    where agent_board_test.stripped_body(p.oid) ~* '\mexecute\M'),
+    where agent_board_test.stripped_body(p.oid) ~ agent_board_test.re('\m' || agent_board_test.ci_re('execute') || '\M')),
   '',
   'FKL-7: no function with a lock edge uses dynamic SQL, which the position analysis cannot read');
 
@@ -200,6 +200,16 @@ select is(
 -- and disagree with each other about the order. #281 stops here deliberately:
 -- the ordering fix is a separate decision. Do not "green" this by editing the
 -- expectation -- a changed member means the lock graph changed.
+--
+-- ONE MEMBER HAS BEEN REMOVED since, and the lock graph did not change -- the detector
+-- did (#416/#417/#424 PR 1). `unsubscribe_callback_endpoint` was listed on the strength
+-- of three `fk-update` edges the old shape-(v) regex fabricated: its only UPDATE is
+-- `update callback_subscriptions cs set subscription_status = ... where cs.endpoint_id =`,
+-- and the old `set[^;]{0,250}?<col>\s*=` crossed from SET into WHERE and read the
+-- predicate as an FK re-point. lock_edges() now bounds the assignment scan at
+-- WHERE/FROM/RETURNING (col_assign_frag), so the function has no agents edge at all.
+-- Read the function before believing this comment: the WHERE is on line 15 of its
+-- stripped body.
 -- ===========================================================================
 select is(
   (select array_agg(m order by m) from (
@@ -239,7 +249,6 @@ select is(
     'signed_send_direct_message: agents(key share) then memberships(key share) [unserialised]',
     'signed_send_multicast_message: agents(key share) then memberships(key share) [unserialised]',
     'subscribe_callback_endpoint: memberships(key share) then agents(key share) [unserialised]',
-    'unsubscribe_callback_endpoint: memberships(key share) then agents(key share) [unserialised]',
     'update_board_membership: memberships(update) then agents(key share) [unserialised]'
   ]::text[],
   'FKL-9: the agents+board_memberships lock class, FK edges included (section 9''s text scan sees 3 of these)');
@@ -259,12 +268,45 @@ select is(
 -- pinned as a class in agent_board_task_thread_lock_order.test.sql (TT-1), which
 -- is what makes a REGRESSION fail there and name the function, rather than only
 -- failing here as an opaque re-appearance of the pair.
+--
+-- ONE PAIR HAS BEEN ADDED, and it is added with its own positive pin rather than as a
+-- widened exemption. F1's supersede-at-the-cap makes issue_signing_key_challenge write
+-- an agent_signing_key_challenges row while holding the agent_signing_keys row, which
+-- mint_fleet_agent_session takes in the opposite order -- so this detector named
+-- `agent_signing_key_challenges <-> agent_signing_keys` the first time that migration
+-- was written. The cycle is closed at RUNTIME, by `for update skip locked` on the
+-- eviction's row selection: a transaction that never waits on a challenge row cannot
+-- close a cycle. This detector is a static regex scan and cannot see a SKIP LOCKED, so
+-- it reports the pair and always will.
+--
+-- The clause is therefore pinned TWICE, POSITIVELY, so that deleting it fails a NAMED
+-- assertion rather than merely re-adding a member to a list that already contains it
+-- (which would be silent):
+--   * agent_board_signing_challenge_pending_cap.test.sql asserts the DEPLOYED body
+--     carries it, over stripped_body() so a comment cannot satisfy the match;
+--   * tests/isolation/specs/challenge_supersede_lock_order.spec proves the absence of
+--     the wait across two real sessions -- removing the clause turns its golden from a
+--     clean completion into `<waiting ...>` and then a deadlock.
+--
+-- ONE PAIR HAS BEEN REMOVED BY A DETECTOR FIX, not by an ordering change (#416/#417/#424
+-- PR 1). `agents <-> delegation_grants` rested on `fk-update` edges fabricated from
+-- `update delegation_grants set ... where child_agent_id = ...` in renew_delegated_grant
+-- and _revoke_agent_principal: the old shape-(v) regex ran on from SET into WHERE and took
+-- the predicate for an assignment. Neither function re-points the FK, so neither locks the
+-- agents row through it, and the pair never existed. The same fix, plus an unbounded
+-- statement span, MOVED but did not add a pair on the callback tables:
+-- claim_callback_outbox_events' `for update of coe skip locked` now locks
+-- callback_outbox_events (real; previously beyond the old 250-char window) and no longer
+-- callback_subscriptions (fabricated; `OF coe` does not name it -- lock_edges() now reads
+-- the OF list). `callback_endpoints <-> callback_outbox_events` is still reported after
+-- the fix; this comment does not claim to know which routes carry it.
 -- ===========================================================================
 select is(
   (select array_agg(p order by p) from (
      select distinct least(rel_a, rel_b) || ' <-> ' || greatest(rel_a, rel_b) as p
        from _abba where not both_advisory) z),
   array[
+    'agent_board.agent_signing_key_challenges <-> agent_board.agent_signing_keys',
     'agent_board.agent_signing_keys <-> agent_board.agents',
     'agent_board.agent_signing_keys <-> agent_board.board_memberships',
     'agent_board.agent_signing_keys <-> agent_board.fleet_machine_agents',
@@ -273,7 +315,6 @@ select is(
     'agent_board.agents <-> agent_board.board_invite_tokens',
     'agent_board.agents <-> agent_board.board_memberships',
     'agent_board.agents <-> agent_board.boards',
-    'agent_board.agents <-> agent_board.delegation_grants',
     'agent_board.agents <-> agent_board.fleet_machine_agents',
     'agent_board.agents <-> agent_board.fleet_machines',
     'agent_board.agents <-> agent_board.fleet_trust_domains',
@@ -314,7 +355,7 @@ select is(
   'FKL-11: the #281 ABBA is present and unserialised -- reported, NOT fixed here');
 
 -- ===========================================================================
--- THE PROBES. From here on, agent_board gains four functions that exist only to
+-- THE PROBES. From here on, agent_board gains six functions that exist only to
 -- exercise one acquisition shape each. They are never CALLED -- the detector
 -- reads bodies -- and the transaction is rolled back. Every exact-set assertion
 -- above has already run.
@@ -364,6 +405,30 @@ begin
 end;
 $probe$;
 
+-- Shape (v)'s boundary (#416/#417/#424 PR 1): the FK column appears ONLY in the WHERE. The
+-- detector that listed `unsubscribe_callback_endpoint` in FKL-9 read exactly this shape as an
+-- FK re-point. The SET here names no FK column, so the probe must carry the write-update
+-- edge and NOTHING through an FK.
+create function agent_board._probe416_fk_where(p_agent uuid)
+returns void language plpgsql as $probe$
+begin
+  update agent_board.board_memberships set role = 'member'
+   where agent_id = p_agent and board_id = p_agent;
+end;
+$probe$;
+
+-- Shape (i)'s OF list: `FOR UPDATE OF a` locks the aliased relation only. `boards` is named in
+-- the same statement and must NOT be credited; the second statement covers the no-alias
+-- spelling, where the OF list names the relation itself.
+create function agent_board._probe416_lock_of(p_id uuid)
+returns void language plpgsql as $probe$
+begin
+  perform 1 from agent_board.agents a join agent_board.boards b on b.id = a.id
+   where a.id = p_id for update of a;
+  perform 1 from agent_board.identity_providers where id = p_id for update of identity_providers;
+end;
+$probe$;
+
 -- The derivation, re-evaluated ONCE now that the probes exist. (Re-evaluating it
 -- per assertion is correct but costs a full re-scan of every body each time.)
 create temp table _lep on commit drop as select * from agent_board_test.lock_edges();
@@ -417,6 +482,20 @@ select is(
   'agent_board.agents share via textual',
   'FKL-16: an explicit row lock is reported with its MODE, not as a boolean');
 
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe416_fk_where'),
+  'agent_board.board_memberships update via write-update',
+  'FKL-17: an FK column in the WHERE is a predicate, not a re-point -- no fk-update edge');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe416_lock_of'),
+  'agent_board.agents update via textual | agent_board.identity_providers update via textual',
+  'FKL-18: FOR UPDATE OF locks the listed relations only -- boards, named in the same statement, gets no edge');
+
 select * from finish();
 
 rollback;

package/tests/agent_board_fleet_domain_reclaim.test.sql

@@ -404,10 +404,8 @@ select is(
           join pg_namespace n on n.oid = p.pronamespace
          where n.nspname = 'agent_board'
            and p.prokind = 'f'
-           and (
-             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_trust_domains\s*\([^)]*owner_agent_id'
-             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_trust_domains[^;]*owner_agent_id\s*='
-           )
+           and agent_board_test.stripped_body(p.oid, true)
+                 ~ agent_board_test.col_write_re('fleet_trust_domains', 'owner_agent_id')
       ) writers
   ),
   'reclaim_fleet_trust_domain',

package/tests/agent_board_fleet_machine_hijack.test.sql

@@ -409,10 +409,8 @@ select is(
           join pg_namespace n on n.oid = p.pronamespace
          where n.nspname = 'agent_board'
            and p.prokind = 'f'
-           and (
-             agent_board_test.stripped_body(p.oid) ~ 'insert into agent_board\.fleet_machines\s*\([^)]*trust_domain_id'
-             or agent_board_test.stripped_body(p.oid) ~ 'update agent_board\.fleet_machines[^;]*trust_domain_id\s*='
-           )
+           and agent_board_test.stripped_body(p.oid, true)
+                 ~ agent_board_test.col_write_re('fleet_machines', 'trust_domain_id')
       ) writers
   ),
   'reclaim_fleet_machine, register_fleet_machine',

package/tests/agent_board_fleet_machine_reactivation.test.sql

@@ -462,7 +462,11 @@ select is(
 -- not a state reader — its exemption claim is that it advances the ledger's effective_at.
 select ok(
   (
-    select pg_get_functiondef(p.oid) ~ 'effective_at = now\(\)'
+    -- the UPDATE ... SET effective_at = now() of fleet_revocation_events, as an assignment
+    -- to that relation's column rather than as the six characters `effective_at = now()`
+    select agent_board_test.stripped_body(p.oid)
+             ~ agent_board_test.re(agent_board_test.col_assign_frag('fleet_revocation_events', 'effective_at', agent_board_test.bare_ok(p.oid))
+                                   || '\s*' || agent_board_test.call_frag('pg_catalog.now', true) || '\s*\)')
       from pg_proc p
       join pg_namespace n on n.oid = p.pronamespace
      where n.nspname = 'agent_board'

package/tests/agent_board_fleet_machine_reclaim.test.sql

@@ -426,10 +426,8 @@ select is(
           join pg_namespace n on n.oid = p.pronamespace
          where n.nspname = 'agent_board'
            and p.prokind = 'f'
-           and (
-             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_machines\s*\([^)]*owner_agent_id'
-             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_machines[^;]*owner_agent_id\s*='
-           )
+           and agent_board_test.stripped_body(p.oid, true)
+                 ~ agent_board_test.col_write_re('fleet_machines', 'owner_agent_id')
       ) writers
   ),
   'reclaim_fleet_machine, register_fleet_machine',