@consiliency/agent-board-schema 1.51.0 → 1.53.0

package/tests/fixtures/test-prereqs.sql

@@ -658,211 +658,12 @@ AS $$
          END;
 $$;
 
--- One row per (function, relation, acquisition). `own` distinguishes an
--- acquisition written in the function's own body from one reached through a
--- callee; `origin_name` names the function the acquisition actually lives in.
-CREATE OR REPLACE FUNCTION agent_board_test.lock_edges()
-RETURNS TABLE (
-  fn_oid      oid,
-  fn_name     text,
-  fn_sig      text,
-  rel_oid     oid,
-  rel_name    text,
-  lock_mode   text,
-  via         text,
-  path        int[],
-  own         boolean,
-  origin_oid  oid,
-  origin_name text
-)
-LANGUAGE sql STABLE
-SET search_path = pg_catalog
-AS $lockedges$
-WITH RECURSIVE
-fns AS (
-  SELECT p.oid,
-         p.proname,
-         p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' AS sig,
-         agent_board_test.stripped_body(p.oid) AS body,
-         p.proconfig
-    FROM pg_proc p
-    JOIN pg_namespace n ON n.oid = p.pronamespace
-   WHERE n.nspname = 'agent_board'
-     AND p.prokind IN ('f', 'p')
-     AND p.prolang <> (SELECT oid FROM pg_language WHERE lanname = 'internal')
-),
--- Resolve BARE names the way PostgreSQL would. A function pinning search_path
--- WITHOUT agent_board cannot reach these tables unqualified, so bare matches are
--- not attributed to it. No search_path setting at all is treated as bare-resolving,
--- which over-approximates membership rather than under-approximating it.
-q AS (
-  SELECT f.oid, f.proname, f.sig, f.body,
-         CASE WHEN NOT EXISTS (SELECT 1 FROM unnest(coalesce(f.proconfig, '{}')) c
-                                WHERE c LIKE 'search\_path=%')
-              OR EXISTS (SELECT 1 FROM unnest(f.proconfig) c
-                          WHERE c LIKE 'search\_path=%'
-                            AND ',' || replace(replace(split_part(c, '=', 2), ' ', ''), '"', '') || ','
-                                LIKE '%,agent\_board,%')
-              THEN '(?:agent_board\.)?' ELSE 'agent_board\.' END AS q
-    FROM fns f
-),
-rels AS (
-  SELECT c.oid AS rel_oid, c.relname, n.nspname
-    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
-   WHERE c.relkind IN ('r', 'p')
-     AND (n.nspname = 'agent_board' OR (n.nspname = 'auth' AND c.relname = 'users'))
-),
--- Prefilter: a function can only touch a relation whose name its body contains.
-cand AS (
-  SELECT f.oid AS fn_oid, f.body, f.q, r.rel_oid, r.relname,
-         CASE WHEN r.nspname = 'agent_board' THEN f.q ELSE r.nspname || '\.' END AS rq
-    FROM q f CROSS JOIN rels r
-   WHERE f.body ~ ('\m' || r.relname || '\M')
-),
-lit AS (
-  SELECT c.fn_oid, c.body, c.q, c.rel_oid, c.relname, c.rq,
-         substring(c.body FROM
-           '(?:insert\s+into\s+(?:only\s+)?' || c.rq || '\m' || c.relname || '\M)') AS ins_hit,
-         substring(c.body FROM
-           '(?:update\s+(?:only\s+)?' || c.rq || '\m' || c.relname || '\M[^;]{0,250}?\mset\M)') AS upd_hit,
-         substring(c.body FROM
-           '(?:delete\s+from\s+(?:only\s+)?' || c.rq || '\m' || c.relname || '\M)') AS del_hit,
-         substring(c.body FROM
-           '(?:' || c.rq || '\m' || c.relname
-           || '\M[^;]{0,250}?for\s+(?:update|no\s+key\s+update|share|key\s+share))') AS lock_hit
-    FROM cand c
-),
--- FK columns by NAME, from pg_attribute over conkey. Shape (v) is gated on the
--- SET naming one of these; hand-listing them, or skipping the gate, is what
--- turns this detector into a cycle-fabricator.
-fkcols AS (
-  SELECT k.conname, k.conrelid, k.confrelid, a.attname
-    FROM pg_constraint k
-    CROSS JOIN LATERAL unnest(k.conkey) AS ck(attnum)
-    JOIN pg_attribute a ON a.attrelid = k.conrelid AND a.attnum = ck.attnum
-   WHERE k.contype = 'f'
-),
-upd AS (
-  SELECT l.fn_oid, fc.conname, fc.confrelid,
-         min(strpos(l.body, substring(l.body FROM
-           '(?:update\s+(?:only\s+)?' || l.rq || '\m' || l.relname
-           || '\M[^;]{0,250}?\mset\M[^;]{0,250}?\m' || fc.attname || '\M\s*=)'))) AS pos
-    FROM lit l
-    JOIN fkcols fc ON fc.conrelid = l.rel_oid
-   WHERE l.body ~ ('(?:update\s+(?:only\s+)?' || l.rq || '\m' || l.relname
-                   || '\M[^;]{0,250}?\mset\M[^;]{0,250}?\m' || fc.attname || '\M\s*=)')
-   GROUP BY l.fn_oid, fc.conname, fc.confrelid
-),
-direct AS (
-  -- (i) an explicit row lock written in the body
-  SELECT l.fn_oid, l.rel_oid,
-         regexp_replace(substring(l.lock_hit FROM
-           'for\s+(update|no\s+key\s+update|share|key\s+share)'), '\s+', ' ', 'g') AS lock_mode,
-         'textual' AS via,
-         strpos(l.body, l.lock_hit) AS pos
-    FROM lit l WHERE l.lock_hit IS NOT NULL
-  UNION ALL
-  -- (ii) UPDATE row-locks the updated rows
-  SELECT l.fn_oid, l.rel_oid, 'update', 'write-update', strpos(l.body, l.upd_hit)
-    FROM lit l WHERE l.upd_hit IS NOT NULL
-  UNION ALL
-  -- (iii) DELETE row-locks the deleted rows
-  SELECT l.fn_oid, l.rel_oid, 'update', 'write-delete', strpos(l.body, l.del_hit)
-    FROM lit l WHERE l.del_hit IS NOT NULL
-  UNION ALL
-  -- (iv) INSERT takes FOR KEY SHARE on every referenced parent row
-  SELECT l.fn_oid, k.confrelid, 'key share', 'fk-insert:' || k.conname, strpos(l.body, l.ins_hit)
-    FROM lit l
-    JOIN pg_constraint k ON k.conrelid = l.rel_oid AND k.contype = 'f'
-   WHERE l.ins_hit IS NOT NULL
-  UNION ALL
-  -- (v) an UPDATE that re-points an FK column locks the NEW parent row
-  SELECT u.fn_oid, u.confrelid, 'key share', 'fk-update:' || u.conname, u.pos
-    FROM upd u
-  UNION ALL
-  -- (vi) DELETE of a referenced row locks the referencing child rows
-  SELECT l.fn_oid, k.conrelid,
-         CASE k.confdeltype WHEN 'c' THEN 'update'
-                            WHEN 'n' THEN 'no key update'
-                            WHEN 'd' THEN 'no key update'
-                            ELSE 'key share' END,
-         'fk-delete:' || k.conname, strpos(l.body, l.del_hit)
-    FROM lit l
-    JOIN pg_constraint k ON k.confrelid = l.rel_oid AND k.contype = 'f'
-   WHERE l.del_hit IS NOT NULL
-),
-calls AS (
-  SELECT c.oid AS caller, e.oid AS callee, e.proname AS callee_name,
-         strpos(c.body, substring(c.body FROM c.q || '\m' || e.proname || '\M\s*\(')) AS pos
-    FROM q c JOIN q e ON e.oid <> c.oid
-   WHERE c.body ~ (c.q || '\m' || e.proname || '\M\s*\(')
-),
-reach AS (
-  SELECT d.fn_oid, d.rel_oid, d.lock_mode, d.via, array[d.pos] AS path,
-         true AS own, d.fn_oid AS origin_oid
-    FROM direct d
-  UNION ALL
-  SELECT c.caller, r.rel_oid, r.lock_mode, 'callee:' || c.callee_name,
-         c.pos || r.path, false, r.origin_oid
-    FROM reach r JOIN calls c ON c.callee = r.fn_oid
-) CYCLE fn_oid SET is_cycle USING cycle_path
-SELECT r.fn_oid, f.proname, f.sig, r.rel_oid,
-       (SELECT n.nspname || '.' || cl.relname FROM pg_class cl
-          JOIN pg_namespace n ON n.oid = cl.relnamespace WHERE cl.oid = r.rel_oid),
-       r.lock_mode, r.via, r.path, r.own, r.origin_oid,
-       (SELECT proname FROM q WHERE oid = r.origin_oid)
-  FROM reach r JOIN q f ON f.oid = r.fn_oid
- WHERE NOT r.is_cycle;
-$lockedges$;
-
--- The name-resolved call closure (reflexive), so a test can ask "does this route
--- reach <serialising helper>" without re-deriving the graph.
-CREATE OR REPLACE FUNCTION agent_board_test.fn_call_closure()
-RETURNS TABLE (root_oid oid, root_name text, reached_oid oid, reached_name text)
-LANGUAGE sql STABLE
-SET search_path = pg_catalog
-AS $closure$
-WITH RECURSIVE
-fns AS (
-  SELECT p.oid, p.proname, agent_board_test.stripped_body(p.oid) AS body, p.proconfig
-    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-   WHERE n.nspname = 'agent_board' AND p.prokind IN ('f','p')
-     AND p.prolang <> (SELECT oid FROM pg_language WHERE lanname = 'internal')
-),
-q AS (
-  SELECT f.oid, f.proname, f.body,
-         CASE WHEN NOT EXISTS (SELECT 1 FROM unnest(coalesce(f.proconfig,'{}')) c
-                                WHERE c LIKE 'search\_path=%')
-              OR EXISTS (SELECT 1 FROM unnest(f.proconfig) c
-                          WHERE c LIKE 'search\_path=%'
-                            AND ','||replace(replace(split_part(c,'=',2),' ',''),'"','')||','
-                                LIKE '%,agent\_board,%')
-              THEN '(?:agent_board\.)?' ELSE 'agent_board\.' END AS q
-    FROM fns f
-),
-calls AS (
-  SELECT c.oid AS caller, e.oid AS callee
-    FROM q c JOIN q e ON e.oid <> c.oid
-   WHERE c.body ~ (c.q || '\m' || e.proname || '\M\s*\(')
-),
-closure AS (
-  SELECT oid AS root, oid AS reached FROM q
-  UNION
-  SELECT c.root, e.callee FROM closure c JOIN calls e ON e.caller = c.reached
-)
-SELECT c.root, (SELECT proname FROM q WHERE oid = c.root),
-       c.reached, (SELECT proname FROM q WHERE oid = c.reached)
-  FROM closure c;
-$closure$;
-
-COMMENT ON FUNCTION agent_board_test.lock_edges() IS
-  'FK-aware per-function row-lock edge set: explicit locks, write locks, and the FOR KEY SHARE / child locks PostgreSQL takes through foreign keys. Test-only; see message-board#281.';
-
 GRANT USAGE ON SCHEMA agent_board_test TO PUBLIC;
 
 -- ---------------------------------------------------------------------------
--- IDENTIFIER MATCHERS (Consiliency/message-board#405, #417). ONE definition of
--- "does this body reference agent_board.<name>", used by every assertion that asks.
+-- IDENTIFIER MATCHERS (Consiliency/message-board#405, #416, #417, #424). ONE definition of
+-- "does this body reference agent_board.<name>", and of "does this statement WRITE <rel>" and
+-- "does this statement ASSIGN <rel>.<col>", used by every assertion that asks.
 --
 -- WHY THESE EXIST. The same lookup was hand-written at ~20 sites and drifted twice in
 -- opposite directions in consecutive review rounds: first too STRICT (an abutting-paren,
@@ -880,11 +681,48 @@ GRANT USAGE ON SCHEMA agent_board_test TO PUBLIC;
 --   * a QUOTED identifier is case-SENSITIVE, so `"AGENT_BOARD".boards` is a different object
 --     (`to_regclass('"AGENT_BOARD".boards')` returns NULL);
 --   * a reference is ours only if it is UNQUALIFIED or qualified by exactly `agent_board` — any
---     other qualifier names someone else's object.
+--     other qualifier names someone else's object — or by `<database>.agent_board`, the three-part
+--     spelling PostgreSQL accepts for the current database;
+--   * a statement writes a column only where the GRAMMAR puts an assignment target: the SET list
+--     of an UPDATE or a MERGE update action, an INSERT / MERGE-insert column list, a no-column-list
+--     INSERT (every column), a COPY FROM whose column list names it (or has no list), a
+--     SELECT INTO a new table. A column named in a WHERE, RETURNING, ON or a SET value is READ.
+--
+-- WHAT THIS FAMILY CANNOT SEE, stated here because the residue belongs where the matcher lives:
+--   * DOLLAR-QUOTE DESYNC. The subject is a literal-stripped body; a body whose apostrophes are
+--     unbalanced inside a dollar-quoted string desynchronises the stripper and everything after
+--     the desync is read as a literal (memory: a live function survived only on an even apostrophe
+--     count). `same_stmt()` skips the literal forms it knows (`'…'` with `''`, `E'…'` with `\'`);
+--     it does not know a nested `$tag$…$tag$` and treats its contents as code.
+--   * DYNAMIC SQL. `execute format('update agent_board.%I …', v_rel)` writes a relation no pattern
+--     over the body can name. `mark_retention_metadata` is the one such writer today; change 9 of
+--     the #416 plan names it positively, and a second one fails there by name.
+--   * INDIRECTION. A relation reached through a VIEW with an INSTEAD OF trigger or a rule, a
+--     function variable holding a relation name, or a callee in another schema is not a write of
+--     the base relation to these patterns. `lock_edges` closes over `agent_board` callees only.
+--   * STATEMENT SPAN. `same_stmt()` ends at the first `;` outside a string literal. A `;` inside a
+--     nested dollar-quoted string or a comment the stripper did not remove ends the span early —
+--     that is under-matching (a miss), the silent direction, and it is bounded only by the
+--     stripper's own tests.
+--   * NESTING DEPTH. `set_run()` consumes a parenthesised sub-expression whole to TWO levels; a
+--     SET-list terminator keyword at the third level ends the run early (a miss). CPR-0 row
+--     `k1-three-level-paren-KNOWN-MISS` records the bound as a measured value.
+--   * ITSELF. CPR-0b's tokenizer walks the family's own bodies for regex operands; those six
+--     sites carry hand literals by construction and are annotated `loud-literal` for the lint,
+--     because a matcher cannot be the scanner that judges whether it is a matcher.
+--   * THE PARSER'S VIEW. `agent_board_write_enforcement_class` WEC-24 asks plpgsql_check for the
+--     relations each plpgsql function depends on and requires every regex-found (writer, relation)
+--     pair to be among them. That bounds this family's FALSE POSITIVES against the real parser;
+--     it cannot bound the misses, because a dependency is a read or a write alike.
 --
 -- CALLERS MUST USE `~` / regexp_instr WITHOUT THE 'i' FLAG. The case rules are inside these
 -- patterns; adding 'i' would fold the quoted alternative and reintroduce the second defect.
 -- Keywords that should stay case-insensitive get agent_board_test.ci_re() for the same reason.
+--
+-- COMPOSITION RULE. Only a `*_re` carries the `(?c)` director, and a director is legal ONLY at
+-- position 0 of a regular expression (`b|(?c)a` and `(?:(?c)a)` both raise `invalid regular
+-- expression`). So no site concatenates anything onto, or two of, the `*_re` outputs. A site that
+-- needs a union composes `*_frag`s and wraps ONCE with `agent_board_test.re(...)`.
 
 -- A SPACE IN p_text BECOMES `\s+`, because every space this is ever given separates the words of a
 -- multiword SQL keyword (`insert into`, `no key`, `key share`) and PostgreSQL accepts any whitespace
@@ -914,6 +752,13 @@ $$;
 create or replace function agent_board_test.ident_chars() returns text
 language sql immutable set search_path to pg_catalog as $$ select 'A-Za-z0-9_$' $$;
 
+-- ANY identifier token, unquoted or quoted, with no case rule: the database component of a
+-- three-part name and an INSERT alias are matched by SHAPE, since neither names our object.
+create or replace function agent_board_test.ident_any_frag() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?:[A-Za-z_][' || agent_board_test.ident_chars() || ']*|"[^"]*")'
+$$;
+
 -- THE BOUNDARY GUARDS. Three rejections, each a defect that shipped:
 --   * an ASCII identifier character or a quote immediately before/after — `dashboards`, `x$boards`;
 --   * a NON-ASCII letter, which PostgreSQL also admits in an unquoted identifier, so
@@ -934,18 +779,94 @@ language sql immutable set search_path to pg_catalog as $$
   select '(?![' || agent_board_test.ident_chars() || '])(?![^\x00-\x7F])'
 $$;
 
+-- THE STATEMENT SPAN. Replaces every hand-rolled `[^;]*` / `[^;]{0,250}?` join: a run of non-`;`
+-- characters in which a STRING LITERAL is consumed whole, so a `;` inside `'a;b'` does not end the
+-- statement and a `where` inside `'where'` is not a keyword. Two literal forms: `E'…'` (with `\'`
+-- and `''` escapes; the `E` must be a standalone token, because `line'x'` lexes as an identifier
+-- followed by a PLAIN literal) and the plain `'…'` form (`''` escapes only; a backslash is an
+-- ordinary character under standard_conforming_strings). No live agent_board body uses an E-string
+-- today, so that arm pins the NEXT writer, not a current miss. Greedy: a caller that needs a
+-- position takes the leftmost match, which is unchanged; only its extent grows.
+create or replace function agent_board_test.same_stmt() returns text
+language sql immutable set search_path to pg_catalog as $q$
+  select $s$(?:[^;']|(?<![A-Za-z0-9_$])[Ee]'(?:[^'\\]|\\.|'')*'|'(?:[^']|'')*')*$s$
+$q$;
+
+-- THE SET-CLAUSE SPAN: same_stmt()'s token set MINUS the keywords that end THIS statement's SET
+-- list (p_terms, an alternation, refused as a whole word by a lookahead on every step) PLUS a
+-- parenthesised sub-expression consumed whole to two levels of nesting — so a `where` inside
+-- `set slug = (select 1 from t where q = 1), claim_policy = 2` does not end the run while
+-- `set slug = x where claim_policy = y` does. The terminator set is a PARAMETER because it differs
+-- by statement: UPDATE passes `where|from|returning`; MERGE passes `when\s+(?:not\s+)?matched|
+-- returning` — the next WHEN CLAUSE, never a bare `when`, so `case when` survives in both. A shared
+-- set with `when` in it was measured to hide `set slug = case when x then y else z end,
+-- claim_policy = p`. Letters in p_terms fold to either case unless they follow a backslash
+-- (`\s` stays `\s`). A paren group cannot be entered partially: `(` is not in the character class,
+-- so the run either consumes a balanced group or stops before it.
+create or replace function agent_board_test.set_run(p_terms text) returns text
+language sql immutable set search_path to pg_catalog as $q$
+  with chars as (
+    select c, ord, coalesce(lag(c) over (order by ord), '') as prev
+      from regexp_split_to_table(p_terms, '') with ordinality as x(c, ord)
+  ),
+  t as (
+    select string_agg(case when c ~ '[A-Za-z]' and prev <> '\' then '[' || upper(c) || lower(c) || ']'
+                           else c end, '' order by ord) as folded
+      from chars
+  ),
+  lit as (select $s$(?<![A-Za-z0-9_$])[Ee]'(?:[^'\\]|\\.|'')*'|'(?:[^']|'')*'$s$ as l),
+  p0 as (select '\((?:[^();'']|' || l || ')*\)' as p from lit),
+  p1 as (select '\((?:[^();'']|' || lit.l || '|' || p0.p || ')*\)' as p from lit, p0)
+  select '(?:(?!\m(?:' || t.folded || ')\M)(?:[^;''()]|' || lit.l || '|' || p1.p || '))*'
+    from t, lit, p1
+$q$;
+
+-- THE ONLY PLACE A DIRECTOR IS ATTACHED TO A COMPOSED PATTERN. Sites that need a union of frags
+-- wrap once here; see the composition rule above.
+create or replace function agent_board_test.re(p_frag text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)(?:' || p_frag || ')'
+$$;
+
 -- The un-prefixed fragments. Public matchers add the (?c) director exactly once; these exist so a
 -- matcher can embed another without producing a mid-pattern director, which PostgreSQL rejects.
+--
+-- p_name is `[schema.]name`; the default schema is agent_board. A dotted name matches ONLY the
+-- schema-qualified spelling of that other schema's object (`lock_edges` asks for `auth.users`).
+-- p_bare_ok = false REQUIRES the schema qualifier: `lock_edges` / `fn_call_closure` derive it from
+-- the function's search_path (a function pinning search_path WITHOUT agent_board cannot reach these
+-- names unqualified), and routing them through an always-optional qualifier would have widened
+-- their acceptance — a consolidation that is not the union of what it replaces (#417).
+-- A three-part name `<db>.agent_board.<name>` is accepted; the database component is admitted only
+-- when the schema component follows it, so `mb_db.other.boards` is still refused.
+create or replace function agent_board_test.qname_frag(p_name text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard()
+      || '(?:(?:' || agent_board_test.ident_any_frag() || '\s*\.\s*)?'
+      || agent_board_test.ident_re(case when p_name like '%.%' then split_part(p_name, '.', 1) else 'agent_board' end)
+      || '\s*\.\s*)' || case when p_bare_ok then '?' else '' end
+      || agent_board_test.ident_re(case when p_name like '%.%' then split_part(p_name, '.', 2) else p_name end)
+      || agent_board_test.trail_guard()
+$$;
+
 create or replace function agent_board_test.qname_frag(p_name text) returns text
 language sql immutable set search_path to pg_catalog as $$
-  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
-      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+  select agent_board_test.qname_frag(p_name, true)
+$$;
+
+create or replace function agent_board_test.call_frag(p_name text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard()
+      || '(?:(?:' || agent_board_test.ident_any_frag() || '\s*\.\s*)?'
+      || agent_board_test.ident_re(case when p_name like '%.%' then split_part(p_name, '.', 1) else 'agent_board' end)
+      || '\s*\.\s*)' || case when p_bare_ok then '?' else '' end
+      || agent_board_test.ident_re(case when p_name like '%.%' then split_part(p_name, '.', 2) else p_name end)
+      || '\s*\('
 $$;
 
 create or replace function agent_board_test.call_frag(p_name text) returns text
 language sql immutable set search_path to pg_catalog as $$
-  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
-      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || '\s*\('
+  select agent_board_test.call_frag(p_name, true)
 $$;
 
 -- THE (?c) DIRECTOR IS THE ENFORCEMENT, not the comment above it. A caller that passes 'i' to
@@ -958,21 +879,26 @@ $$;
 -- caller who prefixes anything gets `invalid regular expression` rather than a silent fold.
 --
 -- EXACTLY WHICH CALLERS THE DIRECTOR PROTECTS, stated narrowly because the first version of this
--- paragraph claimed more: a pattern that BEGINS with qname_re/call_re/stmt_re is protected against a
--- passed 'i' flag AND against the `~*` operator, because the director is inside the pattern. A
--- caller that composes a *_frag directly is NOT protected — the frags carry no director by design,
--- since one mid-pattern is a syntax error. They exist for embedding inside the _re matchers, and
--- EXECUTE on them is revoked below so they are not casually reachable; a test author who calls a
--- frag with `~*` deliberately is outside what any mechanism here can prevent, and that residue is
--- named rather than papered over.
+-- paragraph claimed more: a pattern that BEGINS with a `*_re` is protected against a passed 'i'
+-- flag AND against the `~*` operator, because the director is inside the pattern. A caller that
+-- composes a *_frag directly is NOT protected — the frags carry no director by design, since one
+-- mid-pattern is a syntax error. They exist for embedding inside the _re matchers and inside
+-- agent_board_test.re(), and EXECUTE on them is revoked below so they are not casually reachable;
+-- a test author who calls a frag with `~*` deliberately is outside what any mechanism here can
+-- prevent, and that residue is named rather than papered over.
 create or replace function agent_board_test.qname_re(p_name text) returns text
 language sql immutable set search_path to pg_catalog as $$
   select '(?c)' || agent_board_test.qname_frag(p_name)
 $$;
 
+create or replace function agent_board_test.call_re(p_name text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.call_frag(p_name, p_bare_ok)
+$$;
+
 create or replace function agent_board_test.call_re(p_name text) returns text
 language sql immutable set search_path to pg_catalog as $$
-  select '(?c)' || agent_board_test.call_frag(p_name)
+  select agent_board_test.call_re(p_name, true)
 $$;
 
 -- A COLUMN token. Unquoted identifiers fold, so `SET CLAIM_POLICY = …` names the same column as
@@ -983,22 +909,52 @@ language sql immutable set search_path to pg_catalog as $$
   select agent_board_test.lead_guard() || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
 $$;
 
-create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text) returns text
+-- A COLUMN REFERENCE, qualified or bare: `bm.membership_state` as well as `membership_state`.
+-- col_frag is the SET-list form and its lead guard rejects a preceding dot ON PURPOSE (a dotted
+-- name in call or relation position is another schema's object). A column READ — a predicate, an
+-- ORDER BY operand, a SELECT item — is qualified as often as not, and `col_frag` alone dropped
+-- `c.resource_key` writers out of a class set (measured: two of them). The qualified arm accepts
+-- any identifier before the dot, since the qualifier is an alias that names nothing of ours; a
+-- non-column token that happens to sit after a dot (`x.effective_at(`) is admitted the way the
+-- hand-rolled `\meffective_at\M` admitted it. Director-free (Consiliency/message-board#417 PR 3).
+create or replace function agent_board_test.col_ref_frag(p_name text) returns text
 language sql immutable set search_path to pg_catalog as $$
-  -- "a statement whose verb is one of p_verbs and whose target is agent_board.p_rel".
-  -- SPACES INSIDE A MULTIWORD VERB BECOME `\s+`: `INSERT\nINTO` and `DELETE  FROM` are the same
-  -- statement to PostgreSQL. The hand-rolled expressions this consolidated used `\s+` and got that
-  -- right; the first shared version made the space literal and LOST a property the scattered
-  -- versions had — a consolidation is only safe if it is at least the union of what it replaces.
-  select '(?c)(?:' || (select string_agg(agent_board_test.ci_re(v), '|')
-                         from regexp_split_to_table(p_verbs, '\|') as v)
+  select '(?:' || agent_board_test.ident_any_frag() || '\s*\.\s*' || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+         || '|' || agent_board_test.col_frag(p_name) || ')'
+$$;
+
+-- "a statement whose verb is one of p_verbs and whose target is agent_board.p_rel".
+-- SPACES INSIDE A MULTIWORD VERB BECOME `\s+`: `INSERT\nINTO` and `DELETE  FROM` are the same
+-- statement to PostgreSQL. The hand-rolled expressions this consolidated used `\s+` and got that
+-- right; the first shared version made the space literal and LOST a property the scattered
+-- versions had — a consolidation is only safe if it is at least the union of what it replaces.
+-- Director-free, so it can sit inside an alternation; stmt_re is `'(?c)' || stmt_frag`.
+-- THE VERB STARTS A WORD (`\m`): without it `xupdate agent_board.boards set claim_policy`
+-- matched col_write_re — an identifier ending in a verb read as the verb. Found by the codex seat
+-- on Consiliency/message-board#435 round 1; pinned by CPR-0 `r65-verb-prefix-word` and the
+-- CPR-0a rule 'stmt_frag(core): the verb starts a word'.
+create or replace function agent_board_test.stmt_frag(p_verbs text, p_rel text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '\m(?:' || (select string_agg(agent_board_test.ci_re(v), '|')
+                     from regexp_split_to_table(p_verbs, '\|') as v)
       || ')\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
-      || agent_board_test.qname_frag(p_rel)
+      || agent_board_test.qname_frag(p_rel, p_bare_ok)
 $$;
 
-revoke all on function agent_board_test.qname_frag(text) from public;
-revoke all on function agent_board_test.call_frag(text) from public;
-revoke all on function agent_board_test.col_frag(text) from public;
+create or replace function agent_board_test.stmt_frag(p_verbs text, p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.stmt_frag(p_verbs, p_rel, true)
+$$;
+
+create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.stmt_frag(p_verbs, p_rel, p_bare_ok)
+$$;
+
+create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.stmt_re(p_verbs, p_rel, true)
+$$;
 
 -- THE INSERT-WITHOUT-COLUMN-LIST RULE, AS A NAMED OBJECT. It began as an expression inlined in
 -- CPR-6, and CPR-0's rows for it RECONSTRUCTED that expression instead of calling it — so the rows
@@ -1018,16 +974,11 @@ revoke all on function agent_board_test.col_frag(text) from public;
 -- SPLIT INTO frag + re, matching qname/call/col, because CPR-6 embeds this rule INSIDE a larger
 -- alternation and a director is only legal at position 0. It used to embed
 -- `replace(insert_all_columns_re(...), '(?c)', '')` — so CPR-0's rows compiled X while production
--- compiled a TEXTUAL TRANSFORMATION of X. Behaviourally identical today (CPR-6 matches with `~`,
--- which is case-sensitive anyway, so the director is belt-and-braces there), but the rows would have
--- stayed green if the rule ever became director-dependent, or if a `(?c)` appeared anywhere but
--- position 0 and the replace stripped it silently. Two strings are not one object. Now CPR-6 embeds
--- the frag and CPR-0's rows exercise the frag: the same object, no transformation at any call site.
-create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+-- compiled a TEXTUAL TRANSFORMATION of X. Two strings are not one object. Now the frag is embedded
+-- and CPR-0's rows exercise the frag: the same object, no transformation at any call site.
+create or replace function agent_board_test.insert_all_columns_frag(p_rel text, p_bare_ok boolean) returns text
 language sql immutable set search_path to pg_catalog as $$
-  select agent_board_test.ci_re('insert') || '\s+' || agent_board_test.ci_re('into')
-      || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
-      || agent_board_test.qname_frag(p_rel)
+  select agent_board_test.stmt_frag('insert into', p_rel, p_bare_ok)
       || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
       -- ONLY VALUES AND SELECT. `default` and `overriding` were excluded here too and were DEAD
       -- CODE: an exclusion only matters if the keyword can be followed by `\s*\(` and so be mistaken
@@ -1036,7 +987,12 @@ language sql immutable set search_path to pg_catalog as $$
       -- not. Removed rather than kept with rows that cannot gate them.
       || agent_board_test.ci_re('values')     || '(?![A-Za-z0-9_$])|'
       || agent_board_test.ci_re('select')     || '(?![A-Za-z0-9_$]))'
-      || '(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_$]*))?\s*\()'
+      || agent_board_test.ident_any_frag() || ')?\s*\()'
+$$;
+
+create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.insert_all_columns_frag(p_rel, true)
 $$;
 
 create or replace function agent_board_test.insert_all_columns_re(p_rel text) returns text
@@ -1044,4 +1000,455 @@ language sql immutable set search_path to pg_catalog as $$
   select '(?c)' || agent_board_test.insert_all_columns_frag(p_rel)
 $$;
 
+-- THE MERGE TWIN: `merge into <rel> … then insert values|default values|overriding …` with no
+-- column list writes every column. A `when not matched [by target]` prefix is not required — a
+-- valid MERGE can carry `then insert` under no other arm, so requiring it could only under-match.
+-- The join after `insert` is `\s*`, not a statement span: with a span, a column list would be
+-- skipped and `then insert (slug) values (1)` credited as an all-column write.
+create or replace function agent_board_test.merge_insert_all_columns_frag(p_rel text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.stmt_frag('merge into', p_rel, p_bare_ok) || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('then') || '\s+' || agent_board_test.ci_re('insert')
+      || '\s*(?:' || agent_board_test.ci_re('default values') || '|' || agent_board_test.ci_re('values')
+      || '|' || agent_board_test.ci_re('overriding') || ')(?![A-Za-z0-9_$])'
+$$;
+
+create or replace function agent_board_test.merge_insert_all_columns_frag(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.merge_insert_all_columns_frag(p_rel, true)
+$$;
+
+-- EVERY STATEMENT SHAPE THAT WRITES p_rel, as one group of per-verb arms:
+--   * `insert into | merge into | update | delete from <rel>`;
+--   * TRUNCATE with a relation LIST (`truncate agent_board.claims, agent_board.boards` writes
+--     boards) and the optional `table` / `only` words;
+--   * COPY … FROM, with the optional column list consumed BEFORE the direction word (`copy rel
+--     (cols) from` continues with a column list, not `\s+from`); `copy … to` is a read;
+--   * SELECT … INTO [temp|unlogged] [table] <rel> — a table created by the statement. The relation
+--     must sit at the INTO target: `select … into v_var from <rel>` is a read of <rel>.
+-- This is the union. A caller that must keep verb KINDS apart (`lock_edges`, whose edges are named
+-- by kind) calls stmt_frag(<one verb>, rel, bare_ok) per kind, never this.
+create or replace function agent_board_test.write_frag(p_rel text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?:' || agent_board_test.stmt_frag('insert into|merge into|update|delete from', p_rel, p_bare_ok)
+      || '|' || agent_board_test.lead_guard() || agent_board_test.ci_re('truncate')
+      || '(?:\s+' || agent_board_test.ci_re('table') || ')?\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+      || '(?:[A-Za-z_"][A-Za-z0-9_."]*\s*\*?\s*,\s*(?:' || agent_board_test.ci_re('only') || '\s+)?)*'
+      || agent_board_test.qname_frag(p_rel, p_bare_ok)
+      || '|' || agent_board_test.stmt_frag('copy', p_rel, p_bare_ok)
+      || '\s*(?:\([^)]*\))?\s*' || agent_board_test.ci_re('from') || agent_board_test.trail_guard()
+      || '|\m' || agent_board_test.ci_re('select') || '\M' || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('into') || '\s+(?:(?:' || agent_board_test.ci_re('temporary')
+      || '|' || agent_board_test.ci_re('temp') || '|' || agent_board_test.ci_re('unlogged') || ')\s+)?'
+      || '(?:' || agent_board_test.ci_re('table') || '\s+)?' || agent_board_test.qname_frag(p_rel, p_bare_ok)
+      || ')'
+$$;
+
+create or replace function agent_board_test.write_frag(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.write_frag(p_rel, true)
+$$;
+
+create or replace function agent_board_test.write_re(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.write_frag(p_rel)
+$$;
+
+-- The union of write_frag over a relation list — one helper call at a site, never a string_agg of
+-- `*_re` outputs there. An EMPTY list is refused rather than returned as a pattern that matches
+-- nothing: a class assertion handed an empty class would otherwise read "no writer" as clean.
+create or replace function agent_board_test.writes_any_frag(p_rels text[], p_bare_ok boolean) returns text
+language plpgsql immutable set search_path to pg_catalog as $$
+begin
+  if p_rels is null or cardinality(p_rels) = 0 then
+    raise exception 'writes_any_frag: the relation list is empty';
+  end if;
+  return '(?:' || (select string_agg(agent_board_test.write_frag(r, p_bare_ok), '|') from unnest(p_rels) as r) || ')';
+end $$;
+
+create or replace function agent_board_test.writes_any_frag(p_rels text[]) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.writes_any_frag(p_rels, true)
+$$;
+
+create or replace function agent_board_test.writes_any_re(p_rels text[]) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.writes_any_frag(p_rels)
+$$;
+
+-- An EXPLICIT locking clause — `for update`, `for no key update`, `for share`, `for key share` —
+-- as a fragment, and `row_lock_re(rel)`: that clause in the SAME STATEMENT as a reference to
+-- <rel>, stepping over literals (`same_stmt()`), so a `'for update'` inside a string is not a lock
+-- and a lock in the NEXT statement is not this relation's. Five sites carried five hand copies of
+-- the clause before this existed (CPR-14, CPR-14a, ledger_authority:963, signer_lifecycle:702);
+-- one copy here is the object each of them now names.
+create or replace function agent_board_test.row_lock_frag() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('no key') || '\s+)?(?:'
+      || agent_board_test.ci_re('update') || '|' || agent_board_test.ci_re('share') || '|' || agent_board_test.ci_re('key share') || ')'
+      || agent_board_test.trail_guard()
+$$;
+
+create or replace function agent_board_test.row_lock_re(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.qname_frag(p_rel) || agent_board_test.same_stmt() || agent_board_test.row_lock_frag()
+$$;
+
+-- A statement that ASSIGNS <rel>.<col>, POSITIONALLY — the column sits where the grammar puts an
+-- assignment target. The first shared draft was `stmt_re || '[^;]*' || col_frag`, which made
+-- `update boards set slug = x where claim_policy = y` a writer of claim_policy; CPR-6 read exactly
+-- that way, so consolidating onto it would have consolidated onto an over-match. Three arms:
+--   (1) `update <rel> … set <run> col =`         — a scalar SET target;
+--   (2) `update <rel> … set <run> (…, col, …) =` — the row form, reachable after scalar targets
+--                                                  (`set updated_at = now(), (slug, claim_policy)
+--                                                  = (…)`);
+--   (3) `merge into <rel> … then update set <run> col =` — the phrase only a MERGE WHEN clause can
+--       contain, so `when matched AND <pred> then update set` and PG17's `when not matched by
+--       source then update set` are both accepted;
+--   (4) `insert into <rel> … do update set <run> col =` — the ON CONFLICT upsert arm. Missing from
+--       the first three-arm version; found by the codex seat on Consiliency/message-board#435
+--       round 2 (`insert into boards(id) values (1) on conflict (id) do update set claim_policy =
+--       'advisory'` matched no arm). Thirteen live functions upsert, three of them onto FK columns
+--       (`_upsert_inbox_item.board_id`, `register_fleet_machine.trust_domain_id`,
+--       `heartbeat.thread_id`), so this arm changes lock_edges' fk-update set — see FKL-9.
+-- <run> is set_run() with that statement's terminators. This is the arm set lock_edges uses for
+-- "an UPDATE re-points an FK column", which is why it is a named object of its own: an INSERT
+-- naming the column is a different edge kind there (fk-insert), already derived from the INSERT.
+create or replace function agent_board_test.col_assign_frag(p_rel text, p_col text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?:' || agent_board_test.stmt_frag('update', p_rel, p_bare_ok) || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('set') || '\M' || agent_board_test.set_run('where|from|returning')
+      || '(?:' || agent_board_test.col_frag(p_col) || '|\([^)]*' || agent_board_test.col_frag(p_col) || '[^)]*\))\s*='
+      || '|' || agent_board_test.stmt_frag('merge into', p_rel, p_bare_ok) || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('then update set') || '\M'
+      || agent_board_test.set_run('when\s+(?:not\s+)?matched|returning')
+      || agent_board_test.col_frag(p_col) || '\s*='
+      || '|' || agent_board_test.stmt_frag('insert into', p_rel, p_bare_ok) || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('do update set') || '\M' || agent_board_test.set_run('where|returning')
+      || '(?:' || agent_board_test.col_frag(p_col) || '|\([^)]*' || agent_board_test.col_frag(p_col) || '[^)]*\))\s*='
+      || ')'
+$$;
+
+-- Every statement shape that writes <rel>.<col>: the assignment arms above plus
+--   (4) `insert into <rel> [alias] (…, col, …)`      — an INSERT column list;
+--   (5) `merge into <rel> … then insert (…, col, …)` — a MERGE-insert column list;
+--   (6) an INSERT with no column list (every column) — insert_all_columns_frag;
+--   (7) a MERGE-insert with no column list          — merge_insert_all_columns_frag;
+--   (8) `copy <rel> [(…, col, …)] from`             — a COPY FROM whose list names col or is absent;
+--   (9) `select … into [temp] [table] <rel>`        — a table the statement creates, every column.
+-- Arm (4)'s alias is any identifier token, without the VALUES/SELECT keyword exclusion that
+-- insert_all_columns_frag needs: the only sentences the exclusion would change here (`insert into
+-- rel values (…col…)`) are all-column writes that arm (6) already accepts, so an exclusion here
+-- could flip no row and would be an unpinned rule.
+create or replace function agent_board_test.col_write_frag(p_rel text, p_col text, p_bare_ok boolean) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?:' || agent_board_test.col_assign_frag(p_rel, p_col, p_bare_ok)
+      || '|' || agent_board_test.stmt_frag('insert into', p_rel, p_bare_ok)
+      || '(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?' || agent_board_test.ident_any_frag() || ')?'
+      || '\s*\([^)]*' || agent_board_test.col_frag(p_col) || '[^)]*\)'
+      || '|' || agent_board_test.stmt_frag('merge into', p_rel, p_bare_ok) || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('then insert') || '\s*\([^)]*' || agent_board_test.col_frag(p_col) || '[^)]*\)'
+      || '|' || agent_board_test.insert_all_columns_frag(p_rel, p_bare_ok)
+      || '|' || agent_board_test.merge_insert_all_columns_frag(p_rel, p_bare_ok)
+      || '|' || agent_board_test.stmt_frag('copy', p_rel, p_bare_ok)
+      || '\s*(?:\((?:[^)]*' || agent_board_test.col_frag(p_col) || '[^)]*)\))?\s*'
+      || agent_board_test.ci_re('from') || agent_board_test.trail_guard()
+      || '|\m' || agent_board_test.ci_re('select') || '\M' || agent_board_test.same_stmt()
+      || '\m' || agent_board_test.ci_re('into') || '\s+(?:(?:' || agent_board_test.ci_re('temporary')
+      || '|' || agent_board_test.ci_re('temp') || '|' || agent_board_test.ci_re('unlogged') || ')\s+)?'
+      || '(?:' || agent_board_test.ci_re('table') || '\s+)?' || agent_board_test.qname_frag(p_rel, p_bare_ok)
+      || ')'
+$$;
+
+create or replace function agent_board_test.col_write_frag(p_rel text, p_col text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.col_write_frag(p_rel, p_col, true)
+$$;
+
+create or replace function agent_board_test.col_write_re(p_rel text, p_col text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.col_write_frag(p_rel, p_col)
+$$;
+
+-- Resolve BARE names the way PostgreSQL would for THIS function. A function pinning search_path
+-- WITHOUT agent_board cannot reach our objects unqualified, so bare matches are not attributed to
+-- it. No search_path setting at all is treated as bare-resolving, which over-approximates
+-- membership rather than under-approximating it. One definition, read by lock_edges AND
+-- fn_call_closure — it used to be two copies. Returns boolean, so it is outside the text-returning
+-- family CPR-0b gates, by construction.
+create or replace function agent_board_test.bare_ok(p_fn oid) returns boolean
+language sql stable set search_path to pg_catalog as $$
+  select not exists (select 1 from pg_proc p, unnest(coalesce(p.proconfig, '{}')) c
+                      where p.oid = p_fn and c like 'search\_path=%')
+      or exists (select 1 from pg_proc p, unnest(p.proconfig) c
+                  where p.oid = p_fn and c like 'search\_path=%'
+                    and ',' || replace(replace(split_part(c, '=', 2), ' ', ''), '"', '') || ','
+                        like '%,agent\_board,%')
+$$;
+
+revoke all on function agent_board_test.ident_any_frag() from public;
+revoke all on function agent_board_test.same_stmt() from public;
+revoke all on function agent_board_test.set_run(text) from public;
+revoke all on function agent_board_test.qname_frag(text) from public;
+revoke all on function agent_board_test.qname_frag(text, boolean) from public;
+revoke all on function agent_board_test.call_frag(text) from public;
+revoke all on function agent_board_test.call_frag(text, boolean) from public;
+revoke all on function agent_board_test.col_frag(text) from public;
+revoke all on function agent_board_test.col_ref_frag(text) from public;
+revoke all on function agent_board_test.stmt_frag(text, text) from public;
+revoke all on function agent_board_test.stmt_frag(text, text, boolean) from public;
 revoke all on function agent_board_test.insert_all_columns_frag(text) from public;
+revoke all on function agent_board_test.insert_all_columns_frag(text, boolean) from public;
+revoke all on function agent_board_test.merge_insert_all_columns_frag(text) from public;
+revoke all on function agent_board_test.merge_insert_all_columns_frag(text, boolean) from public;
+revoke all on function agent_board_test.write_frag(text) from public;
+revoke all on function agent_board_test.write_frag(text, boolean) from public;
+revoke all on function agent_board_test.writes_any_frag(text[]) from public;
+revoke all on function agent_board_test.writes_any_frag(text[], boolean) from public;
+revoke all on function agent_board_test.col_assign_frag(text, text, boolean) from public;
+revoke all on function agent_board_test.col_write_frag(text, text) from public;
+revoke all on function agent_board_test.col_write_frag(text, text, boolean) from public;
+revoke all on function agent_board_test.row_lock_frag() from public;
+
+-- One row per (function, relation, acquisition). `own` distinguishes an
+-- acquisition written in the function's own body from one reached through a
+-- callee; `origin_name` names the function the acquisition actually lives in.
+--
+-- Every textual arm is a matcher from the family above, PER KIND (the expected strings in
+-- fk_lock_edges / task_thread_lock_order pin the kind of every edge by name, so the kinds must
+-- stay distinguishable): `stmt_frag('insert into'|'update'|'delete from', rel, bare_ok)`,
+-- `col_assign_frag(rel, fk_col, bare_ok)` for the FK re-point, `qname_frag || same_stmt() ||
+-- <lock clause>` for an explicit lock, `call_frag(proname, bare_ok)` for a call edge. The bounded
+-- `[^;]{0,250}?` spans became same_stmt(). MERGE is not modelled here (no agent_board body uses
+-- it; a MERGE update/insert would be an unrecorded write edge — stated, not closed).
+CREATE OR REPLACE FUNCTION agent_board_test.lock_edges()
+RETURNS TABLE (
+  fn_oid      oid,
+  fn_name     text,
+  fn_sig      text,
+  rel_oid     oid,
+  rel_name    text,
+  lock_mode   text,
+  via         text,
+  path        int[],
+  own         boolean,
+  origin_oid  oid,
+  origin_name text
+)
+LANGUAGE sql STABLE
+SET search_path = pg_catalog
+AS $lockedges$
+WITH RECURSIVE
+fns AS (
+  SELECT p.oid,
+         p.proname,
+         p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' AS sig,
+         agent_board_test.stripped_body(p.oid) AS body,
+         agent_board_test.bare_ok(p.oid) AS bare
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'agent_board'
+     AND p.prokind IN ('f', 'p')
+     AND p.prolang <> (SELECT oid FROM pg_language WHERE lanname = 'internal')
+),
+rels AS (
+  SELECT c.oid AS rel_oid, c.relname, n.nspname,
+         -- the matcher's `[schema.]name`: agent_board is the default schema, anything else is
+         -- named explicitly and can only be reached qualified
+         CASE WHEN n.nspname = 'agent_board' THEN c.relname ELSE n.nspname || '.' || c.relname END AS mname
+    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+   WHERE c.relkind IN ('r', 'p')
+     AND (n.nspname = 'agent_board' OR (n.nspname = 'auth' AND c.relname = 'users'))
+),
+-- Prefilter: a function can only touch a relation whose name its body contains. A case-folded
+-- substring test is looser than every arm it guards (each arm's match contains the name in some
+-- case), so it can only save work, never a match. MATERIALIZED so the planner cannot hoist the
+-- expensive matchers above it — without that, every (function, relation) pair ran the full
+-- pattern and lock_edges() took minutes instead of seconds.
+cand AS MATERIALIZED (
+  SELECT f.oid AS fn_oid, f.body, r.rel_oid, r.relname, r.mname,
+         (f.bare AND r.nspname = 'agent_board') AS rb
+    FROM fns f CROSS JOIN rels r
+   WHERE strpos(lower(f.body), lower(r.relname)) > 0
+),
+lit AS MATERIALIZED (
+  SELECT c.fn_oid, c.body, c.rel_oid, c.relname, c.mname, c.rb,
+         substring(c.body FROM agent_board_test.re(
+           agent_board_test.stmt_frag('insert into', c.mname, c.rb))) AS ins_hit,
+         substring(c.body FROM agent_board_test.re(
+           agent_board_test.stmt_frag('update', c.mname, c.rb) || agent_board_test.same_stmt()
+           || '\m' || agent_board_test.ci_re('set') || '\M')) AS upd_hit,
+         substring(c.body FROM agent_board_test.re(
+           agent_board_test.stmt_frag('delete from', c.mname, c.rb))) AS del_hit,
+         substring(c.body FROM agent_board_test.re(
+           agent_board_test.qname_frag(c.mname, c.rb) || agent_board_test.same_stmt()
+           || '\m' || agent_board_test.ci_re('for') || '\s+(?:' || agent_board_test.ci_re('update')
+           || '|' || agent_board_test.ci_re('no key update') || '|' || agent_board_test.ci_re('share')
+           || '|' || agent_board_test.ci_re('key share') || ')' || agent_board_test.trail_guard())) AS lock_hit
+    FROM cand c
+),
+-- FOR UPDATE OF <alias, ...> locks only the listed relations. The lock arm above matches every
+-- relation named earlier in the statement, so an OF list has to be read back: the relation's
+-- alias (the identifier after its name, or the bare name when it has none) must appear in it.
+-- Without this, `from a join b ... for update of a` fabricated a lock on b — and the fabricated
+-- edge reached FKL-10 as an opposite-order pair that no transaction can hold.
+lock_scope AS (
+  SELECT l.*,
+         lower(substring(l.lock_hit FROM '(?i)^' || agent_board_test.qname_frag(l.mname, l.rb)
+                 || '\s+(?:as\s+)?([A-Za-z_][A-Za-z0-9_$]*)')) AS rel_alias,
+         (SELECT array_agg(lower(trim(both '"' from x)))
+            FROM regexp_split_to_table(
+                   substring(substr(l.body, strpos(l.body, l.lock_hit) + length(l.lock_hit))
+                     FROM '(?i)^\s+of\s+((?:[A-Za-z_][A-Za-z0-9_$]*|"[^"]*")(?:\s*,\s*(?:[A-Za-z_][A-Za-z0-9_$]*|"[^"]*"))*)'),
+                   '\s*,\s*') AS x) AS of_list
+    FROM lit l
+   WHERE l.lock_hit IS NOT NULL
+),
+-- FK columns by NAME, from pg_attribute over conkey. Shape (v) is gated on the
+-- SET naming one of these; hand-listing them, or skipping the gate, is what
+-- turns this detector into a cycle-fabricator.
+fkcols AS (
+  SELECT k.conname, k.conrelid, k.confrelid, a.attname
+    FROM pg_constraint k
+    CROSS JOIN LATERAL unnest(k.conkey) AS ck(attnum)
+    JOIN pg_attribute a ON a.attrelid = k.conrelid AND a.attnum = ck.attnum
+   WHERE k.contype = 'f'
+),
+-- Same prefilter shape as `cand`: the column name must appear before the assignment matcher runs.
+updcand AS MATERIALIZED (
+  SELECT l.fn_oid, l.body, l.mname, l.rb, fc.conname, fc.confrelid, fc.attname
+    FROM lit l
+    JOIN fkcols fc ON fc.conrelid = l.rel_oid
+   WHERE strpos(lower(l.body), lower(fc.attname)) > 0
+),
+upd AS (
+  SELECT u.fn_oid, u.conname, u.confrelid, min(strpos(u.body, h.hit)) AS pos
+    FROM updcand u
+    CROSS JOIN LATERAL (SELECT substring(u.body FROM agent_board_test.re(
+           agent_board_test.col_assign_frag(u.mname, u.attname, u.rb))) AS hit) h
+   WHERE h.hit IS NOT NULL
+   GROUP BY u.fn_oid, u.conname, u.confrelid
+),
+direct AS (
+  -- (i) an explicit row lock written in the body
+  SELECT l.fn_oid, l.rel_oid,
+         lower(regexp_replace(substring(l.lock_hit FROM
+           '(?i)\mfor\s+(update|no\s+key\s+update|share|key\s+share)\M'), '\s+', ' ', 'g')) AS lock_mode,
+         'textual' AS via,
+         strpos(l.body, l.lock_hit) AS pos
+    FROM lock_scope l
+   WHERE l.of_list IS NULL
+      OR l.rel_alias = ANY (l.of_list)
+      OR lower(l.relname) = ANY (l.of_list)
+  UNION ALL
+  -- (ii) UPDATE row-locks the updated rows
+  SELECT l.fn_oid, l.rel_oid, 'update', 'write-update', strpos(l.body, l.upd_hit)
+    FROM lit l WHERE l.upd_hit IS NOT NULL
+  UNION ALL
+  -- (iii) DELETE row-locks the deleted rows
+  SELECT l.fn_oid, l.rel_oid, 'update', 'write-delete', strpos(l.body, l.del_hit)
+    FROM lit l WHERE l.del_hit IS NOT NULL
+  UNION ALL
+  -- (iv) INSERT takes FOR KEY SHARE on every referenced parent row
+  SELECT l.fn_oid, k.confrelid, 'key share', 'fk-insert:' || k.conname, strpos(l.body, l.ins_hit)
+    FROM lit l
+    JOIN pg_constraint k ON k.conrelid = l.rel_oid AND k.contype = 'f'
+   WHERE l.ins_hit IS NOT NULL
+  UNION ALL
+  -- (v) an UPDATE that re-points an FK column locks the NEW parent row
+  SELECT u.fn_oid, u.confrelid, 'key share', 'fk-update:' || u.conname, u.pos
+    FROM upd u
+  UNION ALL
+  -- (vi) DELETE of a referenced row locks the referencing child rows
+  SELECT l.fn_oid, k.conrelid,
+         CASE k.confdeltype WHEN 'c' THEN 'update'
+                            WHEN 'n' THEN 'no key update'
+                            WHEN 'd' THEN 'no key update'
+                            ELSE 'key share' END,
+         'fk-delete:' || k.conname, strpos(l.body, l.del_hit)
+    FROM lit l
+    JOIN pg_constraint k ON k.confrelid = l.rel_oid AND k.contype = 'f'
+   WHERE l.del_hit IS NOT NULL
+),
+-- One pattern per (callee, qualification) rather than one per pair, and the same name-substring
+-- prefilter before the matcher runs.
+pats AS MATERIALIZED (
+  SELECT oid, proname,
+         agent_board_test.call_re(proname, true)  AS pat_bare,
+         agent_board_test.call_re(proname, false) AS pat_qualified
+    FROM fns
+),
+callcand AS MATERIALIZED (
+  SELECT c.oid AS caller, c.body, e.oid AS callee, e.proname AS callee_name,
+         CASE WHEN c.bare THEN e.pat_bare ELSE e.pat_qualified END AS pat
+    FROM fns c JOIN pats e ON e.oid <> c.oid
+   WHERE strpos(lower(c.body), lower(e.proname)) > 0
+),
+calls AS (
+  SELECT x.caller, x.callee, x.callee_name, strpos(x.body, h.hit) AS pos
+    FROM callcand x
+    CROSS JOIN LATERAL (SELECT substring(x.body FROM x.pat) AS hit) h
+   WHERE h.hit IS NOT NULL
+),
+reach AS (
+  SELECT d.fn_oid, d.rel_oid, d.lock_mode, d.via, array[d.pos] AS path,
+         true AS own, d.fn_oid AS origin_oid
+    FROM direct d
+  UNION ALL
+  SELECT c.caller, r.rel_oid, r.lock_mode, 'callee:' || c.callee_name,
+         c.pos || r.path, false, r.origin_oid
+    FROM reach r JOIN calls c ON c.callee = r.fn_oid
+) CYCLE fn_oid SET is_cycle USING cycle_path
+SELECT r.fn_oid, f.proname, f.sig, r.rel_oid,
+       (SELECT n.nspname || '.' || cl.relname FROM pg_class cl
+          JOIN pg_namespace n ON n.oid = cl.relnamespace WHERE cl.oid = r.rel_oid),
+       r.lock_mode, r.via, r.path, r.own, r.origin_oid,
+       (SELECT proname FROM fns WHERE oid = r.origin_oid)
+  FROM reach r JOIN fns f ON f.oid = r.fn_oid
+ WHERE NOT r.is_cycle;
+$lockedges$;
+
+-- The name-resolved call closure (reflexive), so a test can ask "does this route
+-- reach <serialising helper>" without re-deriving the graph.
+CREATE OR REPLACE FUNCTION agent_board_test.fn_call_closure()
+RETURNS TABLE (root_oid oid, root_name text, reached_oid oid, reached_name text)
+LANGUAGE sql STABLE
+SET search_path = pg_catalog
+AS $closure$
+WITH RECURSIVE
+fns AS (
+  SELECT p.oid, p.proname, agent_board_test.stripped_body(p.oid) AS body,
+         agent_board_test.bare_ok(p.oid) AS bare
+    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'agent_board' AND p.prokind IN ('f','p')
+     AND p.prolang <> (SELECT oid FROM pg_language WHERE lanname = 'internal')
+),
+pats AS MATERIALIZED (
+  SELECT oid, proname,
+         agent_board_test.call_re(proname, true)  AS pat_bare,
+         agent_board_test.call_re(proname, false) AS pat_qualified
+    FROM fns
+),
+-- Same prefilter-then-match shape as lock_edges(): the substring test is looser than the matcher
+-- and MATERIALIZED keeps the planner from running the matcher on every pair.
+callcand AS MATERIALIZED (
+  SELECT c.oid AS caller, c.body, e.oid AS callee,
+         CASE WHEN c.bare THEN e.pat_bare ELSE e.pat_qualified END AS pat
+    FROM fns c JOIN pats e ON e.oid <> c.oid
+   WHERE strpos(lower(c.body), lower(e.proname)) > 0
+),
+calls AS (
+  SELECT x.caller, x.callee FROM callcand x WHERE x.body ~ x.pat
+),
+closure AS (
+  SELECT oid AS root, oid AS reached FROM fns
+  UNION
+  SELECT c.root, e.callee FROM closure c JOIN calls e ON e.caller = c.reached
+)
+SELECT c.root, (SELECT proname FROM fns WHERE oid = c.root),
+       c.reached, (SELECT proname FROM fns WHERE oid = c.reached)
+  FROM closure c;
+$closure$;
+
+COMMENT ON FUNCTION agent_board_test.lock_edges() IS
+  'FK-aware per-function row-lock edge set: explicit locks, write locks, and the FOR KEY SHARE / child locks PostgreSQL takes through foreign keys. Test-only; see message-board#281.';