@consiliency/agent-board-schema 1.55.0 → 1.57.0

package/tests/agent_board_membership_current_row_class.test.sql

@@ -0,0 +1,462 @@
+-- MBROWID 3a as a CLASS (message-board#542): every statement that picks ONE
+-- board_memberships row must prefer the active row first.
+--
+-- WHY THIS FILE EXISTS. MBROWID (20260803000100) ruled that a reader acting on
+-- "current standing" orders
+--     case when membership_state in ('joined','subscribed') then 0 else 1 end,
+--     created_at desc, id desc
+-- and enumerated the readers of its day in a comment. ROOMCONTRACT
+-- (20261003000100) then shipped list_board_members with bare
+-- `created_at desc, id desc` at BOTH its selection sites, and nothing noticed:
+-- the rule lived in a comment, and agent_board_rowid.test.sql pins the id DESC
+-- tiebreak, not the active-first key. This file makes the key a class property,
+-- so the next reader that forgets it fails here and NAMES itself.
+--
+-- THE CLASS, derived from the catalog (every agent_board function body, read
+-- through agent_board_test.stripped_body so a comment cannot supply or hide a
+-- site). A SITE is a query that picks ONE row from a SOURCE:
+--   * SOURCE `direct`: agent_board.board_memberships or the unfiltered view
+--     agent_board.v_board_memberships, at the query's own parenthesis level;
+--   * SOURCE `outer` (form shown as `limit(outer)` etc.): a parenthesised group
+--     -- a derived table or a CTE body -- that reads either one directly or one
+--     group down, with the choosing ORDER BY outside the group;
+-- and the ONE-ROW forms, each followed at the same level:
+--   * `limit`   : ORDER BY <list> LIMIT|FETCH;
+--   * `distinct`: DISTINCT ON (...) ... ORDER BY <list>;
+--   * `into`    : a plpgsql SELECT ... INTO with an ORDER BY and no LIMIT, which
+--                 silently keeps the first row.
+-- The ORDER BY operands are NOT inspected: a recency order spelled through an
+-- output alias or a column ordinal is in the class the same as `created_at desc`,
+-- and so is a non-recency order (see _grant_within_ceiling below).
+-- A site is:
+--   * `active-first` when the MBROWID 3a key is the FIRST ordering item (for
+--     DISTINCT ON, the first after exactly the DISTINCT ON expressions) AND a
+--     COMPLETE ascending item: `case when membership_state in ('joined',
+--     'subscribed') then 0 else 1 end`, then only [ASC] [NULLS FIRST|LAST], then
+--     `,` or the end of the list (see the key pattern for why);
+--   * `filtered:<set>` when the key is absent but the query's own WHERE pins
+--     membership_state to an explicit literal set AT ITS OWN LEVEL (a
+--     `membership_state in (...)` inside a nested subquery, on any table, is
+--     consumed with that subquery and never read as this query's filter). The
+--     row is then chosen among rows of that set only, and the set is asserted
+--     EXACTLY per exemption below;
+--   * `latest-row` otherwise -- the defect.
+--
+-- WHAT IS ASSERTED.
+--   CRC-1  the exact site population (function / form / verdict). A new site --
+--          compliant or not -- changes it and appears in the diff by name, so
+--          reverse membership holds, and a site that silently leaves the class
+--          (a matcher that stops matching) fails too.
+--   CRC-2  no site is `latest-row`; the failure lists every offender by name.
+--   CRC-3  each exemption, positively: the exact function and the exact state set
+--          its WHERE pins. Widening one (resolve_board_request's pending read
+--          admitting 'joined', say) fails here even though the site stays
+--          "filtered".
+--   CRC-4  the active-first members, exactly.
+--   CRC-5..  behaviour rows: the SAME pattern objects over fixture text, with the
+--          REJECT rows (key after another ordering item, a key naming the wrong
+--          states, a key only in a comment, a `)` inside a literal) that every
+--          defective matcher passes.
+--
+-- WHAT THIS CANNOT SEE, stated so the green is not over-read:
+--   * views as SITES. v_board_directory's current_membership lateral is
+--     active-first and is pinned BEHAVIOURALLY by agent_board_rowid.test.sql; a
+--     deparsed viewdef spells the key `CASE WHEN (... = ANY (ARRAY[...]))`, which
+--     this matcher does not read. (A function reading v_board_memberships IS a
+--     site, above.)
+--   * any other view or set-returning function that exposes membership rows,
+--     read by a function: only the two relation names above are sources.
+--   * an `outer` source nested more than two groups deep, and nesting deeper than
+--     three parenthesis levels inside one ORDER BY or WHERE.
+--   * dynamic SQL (EXECUTE of an assembled string), and a choice made by
+--     max()/min() or a window function instead of ORDER BY.
+--   * a filter widened by an OR elsewhere in the same WHERE level: the filter
+--     check reads the first `membership_state in (...)` conjunct at that level,
+--     not the boolean structure around it. An `outer` site's filter is read from
+--     the span AFTER the group, so a filter inside the derived table does not
+--     exempt it (fails closed).
+--   * the key's SEMANTICS beyond its spelling. The matcher accepts one exact
+--     spelling (arms 0/1, the literal pair in that order, ascending) and rejects
+--     every other; an equivalent spelling (`in ('subscribed','joined')`,
+--     `then 0 else 2`, a helper function returning the rank) is reported
+--     `latest-row` and fails closed rather than being judged.
+--   * a key spelled inside a DOLLAR-quoted string constant within the ORDER BY
+--     list. Literals are kept (see _crc_bodies), so such a constant's text would
+--     satisfy the key match. A single-quoted constant cannot: its doubled quotes
+--     (`(''joined''`) break the `\(\s*'joined'` match. Ordering by a string
+--     constant is not a shape any reader has a reason to write; it is named here
+--     because the fixture rows cover the comment arm and not this one.
+-- The shapes the second review round named (a derived table or CTE with the
+-- ORDER BY ... LIMIT outside it, a read through v_board_memberships, an ORDER BY
+-- alias or ordinal, a filter inside a nested subquery) are detected, and pinned
+-- by CRC-15..CRC-19.
+--
+-- HAND-COUNTED plan: CRC-1..CRC-4 + 20 behaviour rows = 24.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(24);
+
+-- The composed patterns, built ONCE from the shared matcher family and read by
+-- both the catalog scan and the behaviour rows, so the rows exercise the same
+-- objects the scan compiles.
+--   lit   : a plain string literal, consumed whole ('' escapes), so a `)` or `;`
+--           inside one cannot end a span;
+--   bal   : a parenthesised group, literal-aware, three levels deep;
+--   item  : one token of the SAME parenthesis level (a group is ONE token);
+--   qn    : a reference to agent_board.board_memberships OR to the unfiltered
+--           view agent_board.v_board_memberships (bare admitted: every
+--           agent_board function that could read either bare pins agent_board
+--           on its search_path, and over-admitting only ADDS sites, which fails
+--           closed);
+--   grp   : a parenthesised group (derived table, CTE body) that references qn
+--           directly or one group down -- the `outer` source, whose ORDER BY
+--           sits OUTSIDE the group that reads memberships.
+create temp view _crc_frag as
+with base as (
+  select
+    $l$'(?:[^']|'')*'$l$ as lit,
+    '\m' || agent_board_test.ci_re('order by') || '\M' as orderby,
+    '\m(?:' || agent_board_test.ci_re('limit') || '|' || agent_board_test.ci_re('fetch') || ')\M' as limitkw,
+    '(?:' || agent_board_test.qname_frag('board_memberships', true)
+      || '|' || agent_board_test.qname_frag('v_board_memberships', true) || ')' as qn
+),
+bal as (
+  select b.*,
+         '\((?:[^()'']|' || b.lit || '|\((?:[^()'']|' || b.lit
+           || '|\((?:[^()'']|' || b.lit || ')*\))*\))*\)' as bal
+    from base b
+),
+it as (
+  select b.*, '(?:[^;()'']|' || b.lit || '|' || b.bal || ')' as item,
+         '(?:[^()'']|' || b.lit || '|' || b.bal || ')' as gitem
+    from bal b
+),
+g1 as (
+  select i.*, '\(' || i.gitem || '*?' || i.qn || i.gitem || '*\)' as grp1
+    from it i
+)
+select
+  g.*,
+  '(?:' || g.grp1 || '|\(' || g.gitem || '*?' || g.grp1 || g.gitem || '*\))' as grp,
+  -- the MBROWID 3a key, literals included: its operands ARE the claim.
+  -- It must be a COMPLETE ASCENDING ORDER BY item, so the pattern pins three
+  -- things, not just the CASE text:
+  --   * the arms: exactly `then 0 else 1` -- `then 1 else 0` is the reversal
+  --     and does not match (`\s+0\s+` also refuses `0.5`, `00`, `0::int`);
+  --   * the CONTINUATION after END: only an optional ASC, then an optional
+  --     NULLS FIRST|LAST, then `,` or the END of the ORDER BY list. DESC (the
+  --     reversal), arithmetic (`* 0` erases the preference), a cast, COLLATE,
+  --     or anything else leaves the item unmatched, and the site falls through
+  --     to `latest-row` (fails closed). NULLS FIRST/LAST are admitted because
+  --     they are inert here: this CASE has an ELSE and literal arms, so it is
+  --     never NULL and a NULLS clause cannot reorder it;
+  --   * the START is checked by the classifier, not here: nothing but the
+  --     DISTINCT ON expressions may precede the key in the list.
+  agent_board_test.ci_re('case') || '\s+' || agent_board_test.ci_re('when') || '\s+'
+    || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in')
+    || $k$\s*\(\s*'joined'\s*,\s*'subscribed'\s*\)\s*$k$
+    || agent_board_test.ci_re('then') || '\s+0\s+' || agent_board_test.ci_re('else') || '\s+1\s+'
+    || agent_board_test.ci_re('end') || agent_board_test.trail_guard()
+    || '(?:\s+' || agent_board_test.ci_re('asc') || agent_board_test.trail_guard() || ')?'
+    || '(?:\s+' || agent_board_test.ci_re('nulls') || '\s+(?:' || agent_board_test.ci_re('first')
+    || '|' || agent_board_test.ci_re('last') || ')' || agent_board_test.trail_guard() || ')?'
+    || '\s*(?:,|$)' as key,
+  -- a `membership_state in ('<a>', '<b>', ...)` conjunct AT THE WHERE-SPAN'S OWN
+  -- LEVEL: every group before it is consumed whole, so a filter inside a nested
+  -- subquery (on any table) is never read as this query's filter.
+  '^(?:(?!' || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in') || '\s*\()'
+    || g.item || ')*' || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in')
+    || '\s*\(((?:\s*' || g.lit || '\s*,?)+)\)' as filter
+from g1 g;
+
+-- Six extraction patterns: three single-row FORMS x two SOURCES. The sources run
+-- as SEPARATE patterns because a 'g' scan never returns overlapping matches: a
+-- derived table with its own LIMIT inside and another outside would otherwise
+-- lose one of the two sites.
+--   form `limit`   : <source> <where-span> ORDER BY <list> LIMIT|FETCH
+--   form `distinct`: DISTINCT ON (<exprs>) ... <source> <where-span> ORDER BY <list> <end of level>
+--   form `into`    : SELECT ... INTO <var> ... <source> <where-span> ORDER BY <list>, no LIMIT
+--                    (`into` directly followed by the relation is an INSERT target)
+-- Every pattern captures (1) the where-span, (2) the ORDER BY list; `distinct`
+-- captures (3) the DISTINCT ON group.
+create temp table _crc_re on commit drop as
+with src(source, s, guard) as (
+  -- An OUTER match's where-span may not itself name the relation at its own
+  -- level: `exists (select … from memberships …) then … from memberships … order
+  -- by … limit 1` is the DIRECT site after the group, not a second, outer one.
+  select 'direct', f.qn, '' from _crc_frag f
+  union all
+  select 'outer', f.grp, '(?!' || f.qn || ')' from _crc_frag f
+)
+select
+  x.source,
+  agent_board_test.re(
+    x.s || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=' || f.limitkw || ')'
+  ) as limit_re,
+  agent_board_test.re(
+    '\m' || agent_board_test.ci_re('distinct on') || '\s*(' || f.bal || ')'
+    || '(?:(?!' || f.orderby || ')' || f.item || ')*?' || x.s
+    || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=\s*(?:\)|;|$))'
+  ) as distinct_re,
+  agent_board_test.re(
+    '\m' || agent_board_test.ci_re('into') || '\M(?!\s*' || f.qn || ')'
+    || '(?:(?!' || f.orderby || ')' || f.item || ')*?' || x.s
+    || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=\s*(?:\)|;|$|\m'
+    || agent_board_test.ci_re('for') || '\M|\m' || agent_board_test.ci_re('loop') || '\M))'
+  ) as into_re,
+  agent_board_test.re(f.key) as key_re,
+  agent_board_test.re(f.filter) as filter_re,
+  agent_board_test.re(f.lit) as lit_re
+from src x cross join _crc_frag f;
+
+-- Bodies: every live agent_board function, plus the behaviour-row fixtures, in
+-- ONE relation so both go through the same extraction.
+-- stripped_body(..., true) KEEPS LITERALS on purpose: the key's operands
+-- 'joined'/'subscribed' and the exemption filter sets ARE the claim, and a
+-- literal-stripped body would make every key and every filter read identically.
+-- Comments are still removed, so prose cannot supply a key.
+create temp table _crc_fixture (label text primary key, src text not null) on commit drop;
+insert into _crc_fixture(label, src) values
+  ('latest',        $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by bm.created_at desc, bm.id desc limit 1$f$),
+  ('keyed',         $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end, bm.created_at desc, bm.id desc limit 1$f$),
+  ('key-after',     $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by bm.created_at desc, case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end limit 1$f$),
+  ('key-wrong-set', $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'removed') then 0 else 1 end, bm.created_at desc limit 1$f$),
+  ('key-in-comment',$f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by /* case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end, */ bm.created_at desc limit 1$f$),
+  ('paren-literal', $f$select bm.id into v from agent_board.board_memberships bm where bm.note <> ')' and bm.board_id = p order by bm.created_at desc limit 1$f$),
+  ('distinct',      $f$return query select * from (select distinct on (bm.agent_id) bm.* from agent_board.board_memberships bm where bm.board_id = p order by bm.agent_id, bm.created_at desc) x order by x.agent_id$f$),
+  ('into-nolimit',  $f$select bm.role into v from agent_board.board_memberships bm where bm.board_id = p order by bm.updated_at desc$f$),
+  ('end-desc',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end desc, bm.created_at desc limit 1$f$),
+  ('end-times-zero',$f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end * 0, bm.created_at desc limit 1$f$),
+  ('then1-else0',   $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 1 else 0 end, bm.created_at desc limit 1$f$),
+  ('end-cast',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end::text, bm.created_at desc limit 1$f$),
+  ('end-asc',       $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end ASC nulls last, bm.created_at desc limit 1$f$),
+  ('filtered',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p and bm.membership_state in ('joined','subscribed') order by bm.created_at desc limit 1$f$),
+  ('outer-derived', $f$select x.id into v from (select bm.id, bm.created_at from agent_board.board_memberships bm where bm.board_id = p) x order by x.created_at desc limit 1$f$),
+  ('outer-cte',     $f$return query with h as (select bm.* from agent_board.board_memberships bm where bm.board_id = p) select h.id from h order by h.created_at desc limit 1$f$),
+  ('view',          $f$select m.board_membership_id into v from agent_board.v_board_memberships m where m.board_id = p order by m.created_at desc limit 1$f$),
+  ('ordinal',       $f$select bm.id, bm.created_at into v, t from agent_board.board_memberships bm where bm.board_id = p order by 2 desc limit 1$f$),
+  ('nested-filter', $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p and exists (select 1 from agent_board.agents o where o.id = bm.agent_id and o.membership_state in ('joined','subscribed')) order by bm.created_at desc limit 1$f$),
+  ('not-a-site',    $f$perform 1 from agent_board.board_memberships bm where bm.board_id = p order by bm.id for update; for r in select bm.id from agent_board.board_memberships bm where bm.membership_state in ('joined', 'subscribed') order by bm.created_at loop null; end loop$f$);
+
+create temp view _crc_bodies as
+select 'catalog'::text as kind,
+       p.proname::text as proname,
+       agent_board_test.stripped_body(p.oid, true) as body
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+ where n.nspname = 'agent_board'
+   and p.prokind = 'f'
+union all
+select 'fixture', x.label, agent_board_test.strip_sql(x.src, true)
+  from _crc_fixture x;
+
+create temp view _crc_sites as
+with raw as (
+  select b.kind, b.proname, 'limit'::text as form, r.source, m[1] as where_span, m[2] as order_list, null::text as don
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.limit_re, 'g') as m
+  union all
+  select b.kind, b.proname, 'distinct', r.source, m[2], m[3], m[1]
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.distinct_re, 'g') as m
+  union all
+  select b.kind, b.proname, 'into', r.source, m[1], m[2], null
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.into_re, 'g') as m
+),
+cls as (
+  select raw.*,
+         nullif(regexp_instr(raw.order_list, k.key_re), 0) as key_at,
+         (select array_to_string(array_agg(l[1] order by ord), ',')
+            from regexp_matches(substring(raw.where_span from k.filter_re), k.lit_re, 'g')
+                 with ordinality as fl(l, ord)) as filter_set
+    from raw join _crc_re as k on k.source = 'direct'
+)
+-- ACTIVE-FIRST means the key is the FIRST ordering item: nothing may precede it
+-- except, for DISTINCT ON, exactly the DISTINCT ON expressions (which partition
+-- and do not choose). The ordering operands are NOT inspected, so a recency order
+-- spelled through an output alias or a column ordinal is judged the same way as
+-- `created_at desc` -- and so is a non-recency order (a rank): any single-row
+-- choice over memberships is in the class.
+select kind, proname,
+       form || case when source = 'outer' then '(outer)' else '' end as form,
+       case
+         when key_at is not null
+              and (translate(substr(order_list, 1, key_at - 1), E' \t\r\n', '') = ''
+                   or (form = 'distinct'
+                       and translate(substr(order_list, 1, key_at - 1), E' \t\r\n', '')
+                           = translate(substr(don, 2, length(don) - 2), E' \t\r\n', '') || ','))
+           then 'active-first'
+         when filter_set is not null then 'filtered:' || filter_set
+         else 'latest-row'
+       end as verdict
+  from cls;
+
+-- ---------------------------------------------------------------------------
+-- CRC-1: the exact population, derived from the catalog.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '/' || form || '/' || verdict order by proname, form, verdict)
+     from _crc_sites where kind = 'catalog'),
+  array[
+    '_active_board_membership_id/limit/filtered:''joined'',''subscribed''',
+    '_grant_within_ceiling/limit/filtered:''joined'',''subscribed''',
+    '_upsert_board_membership_state/limit/active-first',
+    'join_board/limit/active-first',
+    'list_board_members/distinct/active-first',
+    'list_board_members/limit/active-first',
+    'list_board_pending_memberships/distinct/active-first',
+    'list_my_board_requests/limit/active-first',
+    'request_join_board/limit/filtered:''joined'',''subscribed''',
+    'resolve_board_request/limit/filtered:''joined'',''subscribed''',
+    'resolve_board_request/limit/filtered:''requested'',''invited''',
+    'update_board_membership/limit/active-first',
+    'update_board_membership/limit/active-first'
+  ]::text[],
+  'CRC-1: every catalog statement choosing ONE board_memberships row is exactly this set');
+
+-- ---------------------------------------------------------------------------
+-- CRC-2: no site chooses the bare latest row.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(array_agg(proname || '/' || form order by proname, form), '{}'::text[])
+     from _crc_sites where kind = 'catalog' and verdict = 'latest-row'),
+  '{}'::text[],
+  'CRC-2: no function chooses one board membership row without the MBROWID 3a key or an exact filter');
+
+-- ---------------------------------------------------------------------------
+-- CRC-3: each exemption's claim, positively -- the function and the EXACT set
+-- its WHERE pins. Why each is legitimately not active-first:
+--   _active_board_membership_id -- returns the ACTIVE row's id; the WHERE already
+--     restricts to joined/subscribed, and the partial unique index allows at most
+--     one such row, so there is nothing for the key to prefer (MBROWID 3c).
+--   request_join_board          -- the same: its idempotent return reads the
+--     caller's existing ACTIVE row only.
+--   resolve_board_request (active) -- the approval path's "already active" probe.
+--   _grant_within_ceiling       -- orders by ROLE RANK, not recency: it takes the
+--     grantor's highest active role, among active rows only. With one active row
+--     per (board, agent) the order is moot; it is in the class because the class
+--     no longer requires a recency operand (an alias or ordinal would hide one).
+--   resolve_board_request (pending) -- MBROWID 3c: the approval gate must see the
+--     newest requested/invited marker, NOT prefer a coexisting active row; the
+--     active case is handled by the probe above.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '=' || substr(verdict, length('filtered:') + 1) order by proname, verdict)
+     from _crc_sites where kind = 'catalog' and verdict like 'filtered:%'),
+  array[
+    '_active_board_membership_id=''joined'',''subscribed''',
+    '_grant_within_ceiling=''joined'',''subscribed''',
+    'request_join_board=''joined'',''subscribed''',
+    'resolve_board_request=''joined'',''subscribed''',
+    'resolve_board_request=''requested'',''invited'''
+  ]::text[],
+  'CRC-3: the five filtered exemptions pin exactly these membership_state sets');
+
+-- ---------------------------------------------------------------------------
+-- CRC-4: the active-first members, exactly.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '/' || form order by proname, form)
+     from _crc_sites where kind = 'catalog' and verdict = 'active-first'),
+  array[
+    '_upsert_board_membership_state/limit',
+    'join_board/limit',
+    'list_board_members/distinct',
+    'list_board_members/limit',
+    'list_board_pending_memberships/distinct',
+    'list_my_board_requests/limit',
+    'update_board_membership/limit',
+    'update_board_membership/limit'
+  ]::text[],
+  'CRC-4: these eight sites carry the MBROWID 3a active-first key');
+
+-- ---------------------------------------------------------------------------
+-- CRC-5..14: behaviour rows over fixture text, through the same objects.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'latest'),
+  array['limit/latest-row']::text[],
+  'CRC-5 REJECT: bare created_at desc, id desc + LIMIT is latest-row');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'keyed'),
+  array['limit/active-first']::text[],
+  'CRC-6 ACCEPT: the MBROWID 3a key before the recency operands is active-first');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-after'),
+  array['limit/latest-row']::text[],
+  'CRC-7 REJECT: the key AFTER a recency operand does not make the choice active-first');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-wrong-set'),
+  array['limit/latest-row']::text[],
+  'CRC-8 REJECT: a key preferring (joined, removed) is not the active-first key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-in-comment'),
+  array['limit/latest-row']::text[],
+  'CRC-9 REJECT: a key written only in a comment is stripped and does not count');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'paren-literal'),
+  array['limit/latest-row']::text[],
+  'CRC-10 REJECT: a `)` inside a string literal in the WHERE does not hide the site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'distinct'),
+  array['distinct/latest-row']::text[],
+  'CRC-11 REJECT: a DISTINCT ON per-agent choice by bare recency is latest-row (and the outer order is not a site)');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'into-nolimit'),
+  array['into/latest-row']::text[],
+  'CRC-12 REJECT: SELECT ... INTO ordered by updated_at desc with no LIMIT keeps the first row, and is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'filtered'),
+  array['limit/filtered:''joined'',''subscribed''']::text[],
+  'CRC-13 ACCEPT-AS-EXEMPTION: a WHERE pinning membership_state reports its exact set');
+select is(
+  (select count(*)::int from _crc_sites where kind = 'fixture' and proname = 'not-a-site'),
+  0,
+  'CRC-14: a lock-ordering PERFORM and an unbounded ascending iteration choose no row and are not sites');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'outer-derived'),
+  array['limit(outer)/latest-row']::text[],
+  'CRC-15 REJECT: a derived table read by an OUTER order by recency + LIMIT is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'outer-cte'),
+  array['limit(outer)/latest-row']::text[],
+  'CRC-16 REJECT: a CTE over memberships chosen by the outer ORDER BY ... LIMIT is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'view'),
+  array['limit/latest-row']::text[],
+  'CRC-17 REJECT: a latest-row read through the unfiltered view v_board_memberships is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'ordinal'),
+  array['limit/latest-row']::text[],
+  'CRC-18 REJECT: ORDER BY a column ordinal (or an alias) is a site; the operand is not inspected');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'nested-filter'),
+  array['limit/latest-row']::text[],
+  'CRC-19 REJECT: a membership_state filter inside a nested subquery is not this query''s filter');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-desc'),
+  array['limit/latest-row']::text[],
+  'CRC-20 REJECT: `... END DESC` is inactive-first -- the exact reversal -- not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-times-zero'),
+  array['limit/latest-row']::text[],
+  'CRC-21 REJECT: `... END * 0` erases the preference and is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'then1-else0'),
+  array['limit/latest-row']::text[],
+  'CRC-22 REJECT: `THEN 1 ELSE 0` is the reversal and is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-cast'),
+  array['limit/latest-row']::text[],
+  'CRC-23 REJECT: `... END::text` (a cast continuation) is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-asc'),
+  array['limit/active-first']::text[],
+  'CRC-24 ACCEPT: `... END ASC NULLS LAST` is the key (ASC is the default; NULLS is inert on a non-null CASE)');
+
+select * from finish();
+rollback;