@consiliency/agent-board-schema 1.51.0 → 1.52.0

package/tests/agent_board_task_event_origin_posture.test.sql

@@ -50,7 +50,7 @@ select p.oid, p.proname
   from pg_proc p
   join pg_namespace n on n.oid = p.pronamespace
  where n.nspname = 'agent_board'
-   and agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+(agent_board\.)?task_events';
+   and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'task_events');
 
 create temp table _op_class on commit drop as
 with recursive walk as (
@@ -60,8 +60,7 @@ with recursive walk as (
       from pg_proc p
       join pg_namespace n on n.oid = p.pronamespace
       join walk w
-        on agent_board_test.stripped_body(p.oid)
-           ~* ('(^|[^a-z0-9_.])(agent_board\.)?' || w.proname || '\s*\(')
+        on agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re(w.proname)
      where n.nspname = 'agent_board' and p.oid <> w.oid and w.depth < 5
 )
 select oid, proname, min(depth) as depth from walk group by oid, proname;
@@ -106,11 +105,12 @@ select is(
   (select coalesce(string_agg(c.proname, ', ' order by c.proname), '')
      from _op_class c
     where (select count(*) from regexp_matches(
-             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(', 'g')) <> 0
+             agent_board_test.stripped_body(c.oid, true), agent_board_test.call_re('_append_task_event'), 'g')) <> 0
       and (select count(*) from regexp_matches(
-             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(', 'g'))
+             agent_board_test.stripped_body(c.oid, true), agent_board_test.call_re('_append_task_event'), 'g'))
        <> (select count(*) from regexp_matches(
-             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(\s*''', 'g'))),
+             agent_board_test.stripped_body(c.oid, true),
+             agent_board_test.re(agent_board_test.call_frag('_append_task_event') || '\s*'''), 'g'))),
   '',
   'OP-4 CLASS: every funnel caller passes an explicit literal posture -- a caller that does not is NAMED here');
 
@@ -120,8 +120,13 @@ select is(
 select is(
   (select coalesce(string_agg(d.proname, ', ' order by d.proname), '')
      from _op_direct d
+    -- The INSERT column-list arm ONLY (col_write_frag's arm 4), not col_write_re: that union also
+    -- accepts an INSERT with NO column list as a write of every column, and here a positional
+    -- insert that leaves origin_posture to its default is exactly the offender to name.
     where agent_board_test.stripped_body(d.oid)
-          !~* 'insert\s+into\s+(agent_board\.)?task_events\s*\([^)]*origin_posture'),
+          !~ agent_board_test.re(agent_board_test.stmt_frag('insert into', 'task_events')
+                                 || '(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?' || agent_board_test.ident_any_frag() || ')?'
+                                 || '\s*\([^)]*' || agent_board_test.col_frag('origin_posture') || '[^)]*\)')),
   '',
   'OP-5 CLASS: every DIRECT task_events INSERT names origin_posture -- one that does not is NAMED here');
 
@@ -314,7 +319,12 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and agent_board_test.stripped_body(p.oid, true) ~* 'set\s[^;]*\morigin_posture\s*='),
+      -- The relations that OWN the column come from the catalog, not a hand list: an
+      -- origin_posture column added to a second table joins this scan by itself.
+      and exists (select 1 from information_schema.columns c
+                   where c.table_schema = 'agent_board' and c.column_name = 'origin_posture'
+                     and agent_board_test.stripped_body(p.oid, true)
+                         ~ agent_board_test.re(agent_board_test.col_assign_frag(c.table_name, 'origin_posture', agent_board_test.bare_ok(p.oid))))),
   '',
   'OP-19: nothing UPDATEs origin_posture -- including through a dynamic-SQL template, which keeping literals makes visible');
 
@@ -336,8 +346,10 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.proname <> 'append_task_event'
+      -- bare_ok: a body that can reach the schema unqualified is scanned for the bare call too
+      -- (the hand-rolled form this replaced required the `agent_board.` qualifier).
       and agent_board_test.stripped_body(p.oid, true)
-          ~ '(^|[^a-z0-9_.])agent_board\.append_task_event\s*\('),
+          ~ agent_board_test.call_re('append_task_event', agent_board_test.bare_ok(p.oid))),
   '',
   'OP-20: no in-schema function calls the PUBLIC append_task_event -- one that did would be stamped direct-rpc and named by nothing else');
 

package/tests/agent_board_wake_recovery.test.sql

@@ -200,22 +200,34 @@ cols as (
 insert into _wr_class(kind, pattern)
 select 'relations', string_agg(relname, '|' order by relname) from rels
 union all
-select 'columns', string_agg(attname, '|' order by length(attname) desc, attname) from cols;
+-- The column arm is a col_ref_frag alternation, QUALIFIED OR BARE (`i.created_at <` and
+-- `created_at <` are both gates; a bare-only form would miss the alias spelling). The
+-- window below is measured from the start of the reference, so a qualified reference
+-- reaches `[^<>=]{0,40}` further back than the old `\m…\M` did -- a difference that can
+-- only ADD a match, which makes the exact-set claims below red, never green (measured on
+-- the 26 members: identical).
+select 'columns', '(?:' || string_agg(agent_board_test.col_ref_frag(attname), '|' order by length(attname) desc, attname) || ')' from cols;
 
 create or replace function pg_temp._wr_cursor_gates(p_text text) returns text
 language sql stable as $fn$
   select coalesce(
-    (select string_agg(distinct regexp_replace(m[1], '[[:space:]]+', ' ', 'g'), ' | ')
+    -- A qualifier on a column-first match is dropped from the report, so the strings
+    -- WR-8 pins stay `created_at <`, whichever alias the body spells. (This rewrites a
+    -- MATCH, not source text, so it is a plain regex rather than a family composition.)
+    (select string_agg(distinct regexp_replace(regexp_replace(m[1], '^[^.]*[.][[:space:]]*', ''),
+                                              '[[:space:]]+', ' ', 'g'), ' | ')
        from _wr_class c,
             regexp_matches(
               -- literals KEPT: this file's class members put real predicates in
               -- dynamic SQL (see the _wr_members header). Comments are removed.
               agent_board_test.strip_sql($1, true),
-              '(\m(' || c.pattern || ')\M[^<>=]{0,40}(?:<=|>=|<|>)'
-              || '|(?:<=|>=|<|>)[^<>=]{0,40}\m(' || c.pattern || ')\M'
-              || '|\m(' || c.pattern || ')\M[^<>=]{0,20}\mbetween\M'
-              || '|\mbetween\M[^<>=]{0,40}\m(' || c.pattern || ')\M)',
-              'gi') m
+              -- case-folding comes from the family (ci_re / ident_re), not from an `i` flag,
+              -- which the director's `(?c)` would override
+              agent_board_test.re('(' || c.pattern || '[^<>=]{0,40}(?:<=|>=|<|>)'
+              || '|(?:<=|>=|<|>)[^<>=]{0,40}' || c.pattern
+              || '|' || c.pattern || '[^<>=]{0,20}\m' || agent_board_test.ci_re('between') || '\M'
+              || '|\m' || agent_board_test.ci_re('between') || '\M[^<>=]{0,40}' || c.pattern || ')'),
+              'g') m
       where c.kind = 'columns'),
     '')
 $fn$;
@@ -270,7 +282,12 @@ select p.proname, 'function', pg_get_functiondef(p.oid), agent_board_test.stripp
   join pg_namespace n on n.oid = p.pronamespace
  where n.nspname = 'agent_board'
    and p.prolang <> (select oid from pg_language where lanname = 'internal')
-   and pg_get_functiondef(p.oid) ~* ('(' || (select pattern from _wr_class where kind = 'relations') || ')');
+   -- membership by RELATION REFERENCE in the stripped body (literals kept, because the
+   -- members this file exists for reference their relations inside dynamic SQL), rather
+   -- than a substring of the raw definition; measured: the same 15 functions.
+   and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.re(
+         (select string_agg(agent_board_test.qname_frag(x, agent_board_test.bare_ok(p.oid)), '|')
+            from unnest(string_to_array((select pattern from _wr_class where kind = 'relations'), '|')) x));
 
 -- ---------------------------------------------------------------------------
 -- WR-1 EXISTENCE
@@ -353,7 +370,7 @@ select is(
 
 select ok(
   (select agent_board_test.stripped_viewdef(to_regclass('agent_board.v_agent_wake_recovery'), true)
-            !~* '\morder[[:space:]]+by\M'),
+            !~ agent_board_test.re('\m' || agent_board_test.ci_re('order by') || '\M')),
   'WR-4 the wake recovery view carries no ORDER BY -- the unhandled set is a SET, not a cursor stream');
 
 -- ---------------------------------------------------------------------------
@@ -367,16 +384,20 @@ select is(
   coalesce(
     (select array_agg(btrim(btrim(split_part(e, '::', 1)), '''') order by btrim(btrim(split_part(e, '::', 1)), ''''))
        from unnest(string_to_array(
-              substring(pg_get_viewdef(to_regclass('agent_board.v_agent_wake_recovery'))
-                        from 'action_state = ANY \(ARRAY\[([^]]*)\]'), ',')) e),
+              -- literals KEPT: the state set being read IS a list of string literals
+              substring(agent_board_test.stripped_viewdef(to_regclass('agent_board.v_agent_wake_recovery'), true)
+                        from agent_board_test.re(agent_board_test.col_ref_frag('action_state') || '\s*=\s*' || agent_board_test.ci_re('any')
+                                                 || '\s*\(\s*' || agent_board_test.ci_re('array') || '\s*\[([^]]*)\]')), ',')) e),
     array['VIEW-STATE-SET-NOT-FOUND']),
   coalesce(
     (select array_agg(btrim(btrim(split_part(e, '::', 1)), '''') order by btrim(btrim(split_part(e, '::', 1)), ''''))
        from unnest(string_to_array(
+              -- source-scan: loud-literal pg_get_expr deparses a stored predicate tree -- no comment or literal can hide in it
               substring((select pg_get_expr(i.indpred, i.indrelid)
                            from pg_index i
                           where i.indexrelid = to_regclass('agent_board.idx_agent_board_inbox_items_agent_pending'))
-                        from 'action_state = ANY \(ARRAY\[([^]]*)\]'), ',')) e),
+                        from agent_board_test.re(agent_board_test.col_ref_frag('action_state') || '\s*=\s*' || agent_board_test.ci_re('any')
+                                                 || '\s*\(\s*' || agent_board_test.ci_re('array') || '\s*\[([^]]*)\]')), ',')) e),
     array['INDEX-STATE-SET-NOT-FOUND']),
   'WR-5 the view''s action_state set equals idx_agent_board_inbox_items_agent_pending''s predicate set -- editing either one alone fails here');
 
@@ -578,7 +599,8 @@ select is(
 -- The scoping is a catalog fact, not only a behavioural one: a future edit that
 -- drops the predicate but leaves the fixture passing for another reason fails here.
 select ok(
-  (select pg_get_viewdef(to_regclass('agent_board.v_agent_wake_recovery')) ~ 'current_agent_id\(\)'),
+  (select agent_board_test.stripped_viewdef(to_regclass('agent_board.v_agent_wake_recovery'))
+            ~ agent_board_test.call_re('current_agent_id')),
   'WR-6 the view definition itself scopes on current_agent_id() -- recipient scoping is server-side, never a caller''s filter');
 
 -- ---------------------------------------------------------------------------
@@ -617,16 +639,19 @@ select is(
   'created_at <',
   'WR-8 mark_retention_metadata''s ONLY pre-commit comparison is `created_at <` (an age cutoff) -- it never compares seq, and never gates on a lower bound');
 
--- `ops_retention_reason` is a jsonb KEY -- a string literal -- so it is read from
--- the RAW definition, which is true regardless of strip mode. The companion half
--- is read from `body`, i.e. through the shared strip: the UPDATE it looks for is
--- inside the `$retention$` dynamic-SQL block, which survives because this file
--- keeps literals (see the _wr_members header) but would NOT survive the default
--- literal-stripping mode. Restated so the next reader does not "simplify" the two
--- halves into one column.
+-- `ops_retention_reason` is a jsonb KEY -- a string literal -- and the UPDATE it
+-- accompanies is inside the `$retention$` dynamic-SQL block. Both are read from
+-- `body`, which KEEPS literals (see the _wr_members header): the key survives as a
+-- string, and the UPDATE survives because it is one. Neither would survive the
+-- default literal-stripping mode, and neither needs the raw `src` -- comments are
+-- the only thing the strip removes here. Restated so the next reader does not
+-- "simplify" the strip mode away. The UPDATE's target is the format() placeholder
+-- `agent_board.%1$I` -- the sweep is parameterised over the relation -- so this
+-- matches THAT spelling, not a relation name: a statement matcher would need a name
+-- the body does not contain.
 select ok(
-  (select src ~ 'ops_retention_reason'
-      and body ~ 'update agent_board'
+  (select body ~ 'ops_retention_reason'
+      and body ~ agent_board_test.re('\m' || agent_board_test.ci_re('update') || '\s+' || agent_board_test.ci_re('agent_board') || '\s*\.\s*%1\$I\M')
      from _wr_members where name = 'mark_retention_metadata'),
   'WR-8 mark_retention_metadata stamps retention metadata through an UPDATE sweep -- the age cutoff drives retention, not a fetch');
 
@@ -650,7 +675,7 @@ select is(
   'WR-8 claim_callback_outbox_events'' ONLY pre-commit gate is `available_at <=` -- a scheduling predicate, never a lower bound against a caller cursor');
 
 select ok(
-  (select body !~* '\mavailable_at\M[^<>=]{0,40}(?:>=|>)'
+  (select body !~ agent_board_test.re(agent_board_test.col_ref_frag('available_at') || '[^<>=]{0,40}(?:>=|>)')
      from _wr_members where name = 'claim_callback_outbox_events'),
   'WR-8 that gate is an UPPER bound (<=) and never a lower bound -- a `available_at >` would be a cursor, and is what this distinguishes');
 
@@ -683,7 +708,7 @@ select ok(
   'WR-9 claim_callback_outbox_events partitions the queue on outbox_status -- the lossless property #187 relies on, restated positively here');
 
 select ok(
-  (select src ~ 'action_state = ANY'
+  (select body ~ agent_board_test.re(agent_board_test.col_ref_frag('action_state') || '\s*=\s*' || agent_board_test.ci_re('any') || '\M')
      from _wr_members where name = 'v_agent_wake_recovery'),
   'WR-9 v_agent_wake_recovery partitions the inbox on action_state -- status, never an ordinal');
 
@@ -700,12 +725,14 @@ select is(
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and agent_board_test.stripped_body(p.oid, true) ~* 'action_state[[:space:]]*=[[:space:]]*[^=]'
       -- The schema qualification is OPTIONAL on purpose (board review F3): a writer
       -- using `set search_path` plus a bare `update inbox_items` was invisible to
       -- the qualified form, and WR-10 stayed green naming only one writer. Same
       -- class as the WR-7 name filter -- two name-based enumerators in one file.
-      and agent_board_test.stripped_body(p.oid, true) ~* 'update[[:space:]]+(agent_board\.)?inbox_items\M'),
+      -- col_write_re keeps the qualifier optional and binds the column to THIS relation's
+      -- write (the hand-rolled pair accepted `action_state =` anywhere in a body that also
+      -- updated inbox_items, a WHERE predicate included).
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.col_write_re('inbox_items', 'action_state')),
   'update_inbox_item_state',
   'WR-10 exactly ONE function writes inbox_items.action_state -- the only way out of the unhandled set');
 

package/tests/agent_board_write_enforcement_class.test.sql

@@ -332,7 +332,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(23);
+select plan(25);
 
 -- ===========================================================================================
 -- THE CLASS, derived from pg_catalog. Nothing below is a list of names.
@@ -357,10 +357,7 @@ select p.oid as fn_oid, t.relname, t.relkind
  where p.pronamespace = 'agent_board'::regnamespace
    and p.prokind in ('f','p')
    and p.prolang <> (select oid from pg_language where lanname = 'internal')
-   and lower(agent_board_test.stripped_body(p.oid, true))
-       ~ ('(insert\s+into|merge\s+into|update|delete\s+from|truncate|copy)(\s+table)?(\s+only)?\s+'
-          || '(("?agent_board"?\s*\.\s*)?' || t.relname || '\M'
-          || '|("?agent_board"?\s*\.\s*)?"' || t.relname || '")');
+   and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re(t.relname);
 
 create temp table _wec_closure on commit drop as
 select * from agent_board_test.fn_call_closure();
@@ -385,8 +382,17 @@ select * from agent_board_test.fn_call_closure();
 -- then satisfy the resolver arm — fail-CLOSED, and no agent_board function is written that way
 -- today (measured: this pattern and the digits-only one agree on ALL 67 shipped raisers; they
 -- differ only on the decoy).
+--
+-- Composed from the family (#437 round 1): the keywords are `ci_re` so the case rule lives in the
+-- pattern, not in a `lower()` around each subject, and the site the lint traces `via pat` scores
+-- the composition rather than a hand alternation on an absence form. The three uses below are
+-- `!~ (select pat from _wec_raise_pat)`, which the lint judges by THIS expression.
 create temp table _wec_raise_pat on commit drop as
-select 'errcode\s*=\s*''?42501|sqlstate\s+''?42501|insufficient_privilege'::text as pat;
+select agent_board_test.re(
+         agent_board_test.ci_re('errcode') || '\s*=\s*''?42501'
+         || '|' || agent_board_test.ci_re('sqlstate') || '\s+''?42501'
+         || '|' || agent_board_test.ci_re('insufficient_privilege')
+       ) as pat;
 
 -- THE POPULATION, per-OID and TRANSITIVE: an authenticated-executable root that reaches a direct
 -- writer through the call closure. `fn_call_closure()` is REFLEXIVE (every function reaches
@@ -580,7 +586,7 @@ select is(
              where cl.root_oid = p.oid
                and cl.reached_name in ('_resolved_actor_agent_id', 'current_agent_id',
                                        '_require_platform_admin_user_id'))
-      and lower(agent_board_test.stripped_body(p.oid, true)) !~ 'auth\s*\.\s*uid\s*\('),
+      and agent_board_test.stripped_body(p.oid, true) !~ agent_board_test.call_re('auth.uid', false)),
   array[]::text[],
   '#325 HALF A: EVERY authenticated-executable writer derives its actor from the SESSION — see the header on why this spelling is fail-OPEN against a dead closure and which assertions cover that');
 
@@ -599,7 +605,7 @@ select is(
 select is(
   (select coalesce(array_agg(p.sig order by p.sig), array[]::text[])
      from _wec_pop p
-    where lower(agent_board_test.stripped_body(p.oid, true)) ~ 'auth\s*\.\s*uid\s*\('),
+    where agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.call_re('auth.uid', false)),
   array['agent_board.self_enroll_human(text)']::text[],
   '#325: exactly ONE writer derives from raw auth.uid() — self_enroll_human CREATES the identity a session would resolve to, so it cannot use the resolver; scored on the own body because the closure form matches all 59 and would make Half A vacuous');
 
@@ -649,7 +655,7 @@ select is( -- pgtap-allow-raise-checked
                        and (ap.proname ~ '^_(current_)?agent_(can|has)_'
                             or ap.proname ~ '^_grant_within_'
                             or ap.proname in ('_invite_permitted', '_membership_consent_present')))
-              and lower(agent_board_test.stripped_body(p.oid, true)) !~ (select pat from _wec_raise_pat)) x),
+              and agent_board_test.stripped_body(p.oid, true) !~ (select pat from _wec_raise_pat)) x),
   array[
     'agent_board.block_board_inviter(uuid,uuid,uuid,jsonb) -> _resolved_actor_agent_id',
     'agent_board.create_or_find_thread(uuid,text,text,text,jsonb) -> _resolved_actor_agent_id',
@@ -698,7 +704,7 @@ select is(
                and (ap.proname ~ '^_(current_)?agent_(can|has)_'
                     or ap.proname ~ '^_grant_within_'
                     or ap.proname in ('_invite_permitted', '_membership_consent_present')))
-      and lower(agent_board_test.stripped_body(p.oid, true)) !~ (select pat from _wec_raise_pat)
+      and agent_board_test.stripped_body(p.oid, true) !~ (select pat from _wec_raise_pat)
       and not exists (
             select 1 from _wec_closure cl
              where cl.root_oid = p.oid
@@ -750,9 +756,9 @@ select ok(
 -- exclusion is currently the STRICTER choice, so a failure here means WEC-8 is being harder than
 -- it needs to be, not that it has gone soft.
 select ok(
-  lower(agent_board_test.stripped_body(
+  agent_board_test.stripped_body(
     (select oid from pg_proc where pronamespace = 'agent_board'::regnamespace
-      and proname = 'current_agent_id'), true)) !~ (select pat from _wec_raise_pat),
+      and proname = 'current_agent_id'), true) !~ (select pat from _wec_raise_pat),
   '#325: current_agent_id does NOT raise — it returns NULL on an unresolved principal, which is why it is not counted as a refusal in WEC-8');
 
 -- ===========================================================================================
@@ -1012,6 +1018,118 @@ select is(
   '88',
   '#325: 88 writing referential actions (74 CASCADE + 14 SET NULL) reach the 37 class relations — bump this number only after confirming the new edge is intended; see WEC-22, which names parents independently');
 
+-- ===========================================================================================
+-- WEC-24/25 — THE CROSS-CHECK (Consiliency/message-board#416 / #417 / #424, plan change 9).
+-- `write_re` is the suite's only definition of "writes" (the lint in
+-- scripts/check-test-source-scan-literals.mjs is what makes that true). This bounds it from the
+-- other side with a PARSER: plpgsql_check's plpgsql_show_dependency_tb, created inside this
+-- transaction and rolled back with it. For every plpgsql function in agent_board, the class
+-- relations the regex says it WRITES must be a SUBSET of the relations the parser says it
+-- TOUCHES.
+--
+-- WHAT THIS BOUNDS, STATED NARROWLY. The parser does not distinguish a read from a write, so a
+-- regex "writer" of a relation the function legitimately READS is still a subset member and is
+-- NOT caught here. The check convicts only a regex writer of a relation the parser never
+-- touches: a name matched in a comment or a literal, a look-alike identifier, or a relation
+-- named only inside dynamic SQL. The reverse direction (parser dependency, regex silent) is
+-- deliberately NOT asserted: dynamic SQL yields no parser dependency at all, and every function
+-- that reads A and writes B would be flagged on A — a list of false positives with a reason each.
+--
+-- DYNAMIC SQL. A body that EXECUTEs a COMPUTED string is parser-blind: `execute format('update
+-- agent_board.boards …')` or `q := 'update agent_board.boards …'; execute q;` is a regex writer
+-- (literals are KEPT in `_wec_direct`'s subject, because a raise's errcode literal must be
+-- visible) with no dependency — a FALSE over-match verdict. Measured before writing this: the
+-- parser DOES read a CONSTANT `execute 'update agent_board.boards …'` (it reports the relation),
+-- so the plan's m32 fixture in that spelling flips nothing; the variable-held spelling is the
+-- mutation. The subset check therefore SKIPS any function whose
+-- literal-stripped body contains an `execute` token, and WEC-25 names those functions
+-- positively. Measured on this tree: exactly `mark_retention_metadata`, whose dynamic targets —
+-- from its own allowlist literal — are messages, task_events, presence, callback_outbox_events,
+-- callback_delivery_attempts, inbox_items, delivery_recipients and board_memberships. That last
+-- one is a CLASS relation and the write is `update agent_board.%1$I …` inside format():
+-- invisible to `write_re('board_memberships')` AND to the parser. WEC-25 is therefore not
+-- decoration: it is the only assertion in this suite that names a writer of board_memberships
+-- neither definition of "writes" can see, and a second dynamic writer fails it by name. Its
+-- TARGET list above is prose: nothing here pins it (recorded as unpinned, plan m33).
+--
+-- TRIGGER FUNCTIONS need the relation they fire on to be parsed (NEW/OLD are typed by it); each
+-- is parsed once per pg_trigger attachment and the dependency sets are unioned. An UNATTACHED
+-- trigger function cannot be parsed and is reported as `PARSER-UNREADABLE`, not skipped.
+--
+-- PREREQUISITE. If plpgsql_check is not available on the cluster, WEC-24 reads
+-- `PREREQUISITE-MISSING plpgsql_check` and FAILS by name — never `skip`: undetermined is not a
+-- pass (AGENTS.md rule 4). Both the local cluster and CI's `supabase start` image ship it.
+-- ===========================================================================================
+do $$
+begin
+  if exists (select 1 from pg_available_extensions where name = 'plpgsql_check') then
+    execute 'create extension if not exists plpgsql_check with schema extensions';
+  end if;
+end $$;
+
+-- The parser's relation set for one function, reached through dynamic SQL so that an absent
+-- extension yields NULL here instead of a parse error that would abort the file (#113 class).
+create function pg_temp._wec_parser_rels(p_fn oid, p_rel oid) returns text[]
+language plpgsql as $$
+declare v_rels text[]; v_ns text;
+begin
+  select e.extnamespace::regnamespace::text into v_ns from pg_extension e where e.extname = 'plpgsql_check';
+  if v_ns is null then
+    return null;
+  end if;
+  execute format($q$ select coalesce(array_agg(distinct d.schema || '.' || d.name), '{}'::text[])
+                       from %I.plpgsql_show_dependency_tb($1::regprocedure, $2::regclass) d
+                      where d.type = 'RELATION' $q$, v_ns)
+     into v_rels using p_fn, p_rel;
+  return v_rels;
+end $$;
+
+create temp table _wec_plpgsql on commit drop as
+select p.oid as fn_oid, p.proname::text as proname,
+       p.prorettype = 'trigger'::regtype as is_trigger,
+       agent_board_test.stripped_body(p.oid) ~ agent_board_test.re('\m' || agent_board_test.ci_re('execute') || '\M') as dynamic_sql
+  from pg_proc p
+ where p.pronamespace = 'agent_board'::regnamespace
+   and p.prokind in ('f', 'p')
+   and p.prolang = (select oid from pg_language where lanname = 'plpgsql');
+
+create temp table _wec_parser on commit drop as
+select f.fn_oid,
+       (select count(*) from pg_extension where extname = 'plpgsql_check') > 0 as parser_present,
+       f.is_trigger and not exists (select 1 from pg_trigger tg where tg.tgfoid = f.fn_oid) as unattached_trigger,
+       (select array_agg(distinct r)
+          from (select tg.tgrelid from pg_trigger tg where tg.tgfoid = f.fn_oid
+                union all select 0::oid where not f.is_trigger) tr
+          cross join lateral unnest(coalesce(pg_temp._wec_parser_rels(f.fn_oid, tr.tgrelid), '{}'::text[])) as r) as rels
+  from _wec_plpgsql f;
+
+select is(
+  (select case
+            when not bool_and(parser_present) then 'PREREQUISITE-MISSING plpgsql_check'
+            else coalesce(string_agg(x.entry, ', ' order by x.entry), '<none>')
+          end
+     from _wec_parser pr
+     left join lateral (
+       select f.proname || ':' || w.relname as entry
+         from _wec_plpgsql f
+         join _wec_direct w on w.fn_oid = f.fn_oid
+        where f.fn_oid = pr.fn_oid
+          and not f.dynamic_sql
+          and (pr.unattached_trigger
+               or not ('agent_board.' || w.relname = any (coalesce(pr.rels, '{}'::text[]))))
+       union all
+       select f.proname || ':PARSER-UNREADABLE'
+         from _wec_plpgsql f
+        where f.fn_oid = pr.fn_oid and pr.unattached_trigger and not f.dynamic_sql
+     ) x on true),
+  '<none>',
+  'WEC-24 (change 9): every class relation `write_re` says a static plpgsql body writes is a relation the parser says that body touches — a regex writer the parser cannot see (comment, literal, look-alike, dynamic SQL) is named here as `function:relation`');
+
+select is(
+  (select coalesce(string_agg(proname, ', ' order by proname), '<none>') from _wec_plpgsql where dynamic_sql),
+  'mark_retention_metadata',
+  'WEC-25 (change 9): the plpgsql bodies WEC-24 skips for dynamic SQL are exactly these — mark_retention_metadata writes board_memberships through format(), which neither write_re nor the parser can see; a second dynamic writer fails here by name');
+
 select * from finish();
 
 rollback;