@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/agent_board_667_sender_effects.test.sql

@@ -0,0 +1,100 @@
+-- Only the exact present native sender overloads execute. Missing platform
+-- objects earn no native effect credit. Void return alone never proves a send.
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+select set_config('request.jwt.claim.role','service_role',true);
+insert into agent_board.agents(id,agent_type,handle,display_name,status)
+values('667d0000-0000-4000-8000-000000000001','agent','sender-effects','Sender effects','active');
+insert into agent_board.threads(id,thread_type,created_by_agent_id,subject)
+values('667d0000-0000-4000-8000-000000000010','coordination','667d0000-0000-4000-8000-000000000001','Topic is literal data');
+create temp table xb_sf_cases(fn text,label text,expression text,topic text,expected jsonb,binary_value bytea,private boolean,generated_payload_id boolean) on commit drop;
+insert into xb_sf_cases values
+ ('realtime.send(jsonb,text,text,boolean)','JSON generated ID',
+  $$realtime.send('{"value":1}','sf667-event','sf667-json-generated')$$,'sf667-json-generated','{"value":1}',null,true,true),
+ ('realtime.send(jsonb,text,text,boolean)','JSON supplied ID',
+  $$realtime.send('{"id":"caller-id","value":2}','sf667-event','sf667-json-supplied',false)$$,'sf667-json-supplied','{"id":"caller-id","value":2}',null,false,false),
+ ('realtime.send(jsonb,text,text,boolean)','JSON null payload',
+  $$realtime.send(null::jsonb,'sf667-event','sf667-json-null',true)$$,'sf667-json-null',null,null,true,false),
+ ('realtime.send_binary(bytea,text,text,boolean)','binary default private',
+  $$realtime.send_binary(decode('0041ff','hex'),'sf667-event','sf667-binary-private')$$,'sf667-binary-private',null,decode('0041ff','hex'),true,false),
+ ('realtime.send_binary(bytea,text,text,boolean)','binary explicit public',
+  $$realtime.send_binary(decode('00','hex'),'sf667-event','sf667-binary-public',false)$$,'sf667-binary-public',null,decode('00','hex'),false,false);
+-- Unquoting the native SET template must execute a valid own history write,
+-- rather than earning a kill from a syntax error swallowed by the native body.
+insert into xb_sf_cases
+select fn,label,format('%s(%s,''sf667-event'',%L,true)',callee,payload,topic),topic,expected,binary_value,true,generated
+from(values
+ ('realtime.send(jsonb,text,text,boolean)','JSON expression-looking topic','realtime.send',$q$'{"value":3}'::jsonb$q$,'{"value":3}'::jsonb,null::bytea,true),
+ ('realtime.send_binary(bytea,text,text,boolean)','binary expression-looking topic','realtime.send_binary',$q$decode('41','hex')$q$,null::jsonb,decode('41','hex'),false)
+) v(fn,label,callee,payload,expected,binary_value,generated)
+cross join(values($q$'sf667-literal'; select agent_board.create_task('667d0000-0000-4000-8000-000000000010','667d0000-0000-4000-8000-000000000001','sf667-topic-side-effect'); --$q$)) x(raw_topic)
+cross join lateral(select replace(raw_topic,'sf667-literal','sf667-literal-'||callee) as topic) unique_topic;
+create function pg_temp.xb_sf_call(p_label text,p_expression text,p_topic text,p_expected jsonb,p_binary bytea,p_private boolean,p_generated boolean) returns setof text
+language plpgsql volatile as $$
+declare n bigint; correct boolean;
+begin
+  return next lives_ok('select '||p_expression,'SN '||p_label||' native call returns');
+  select count(*),bool_and(m.id is not null and m.binary_payload is not distinct from p_binary
+    and m.payload is not distinct from case when p_generated then p_expected||jsonb_build_object('id',m.id) else p_expected end
+    and m.private is not distinct from p_private and m.extension='broadcast'
+    and m.updated_at is not null and m.inserted_at is not null and m.skip_broadcast=false
+    and (p_expected->>'id' is distinct from 'caller-id' or m.id::text<>'caller-id'))
+    into n,correct from realtime.messages m where m.topic=p_topic and m.event='sf667-event';
+  return next ok(n=1 and coalesce(correct,false),'SN '||p_label||' wrote the exact own row');
+end$$;
+create function pg_temp.xb_sf_refusal_state(p_identity text) returns text
+language plpgsql volatile as $$
+begin
+  return is((select count(*) from realtime.messages where event='sf667-denied' and topic=
+    case when p_identity like 'realtime.send_binary%' then 'sf667-denied-binary' else 'sf667-denied-json' end),
+    0::bigint,'SN '||p_identity||' RLS refusal wrote no own row');
+end$$;
+grant select on xb_sf_cases,xb_sf_reference to service_role,authenticated;
+select plan(9+2*(select count(*)::integer from xb_sf_cases where to_regprocedure(fn) is not null)
+  +2*(select count(*)::integer from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null));
+select is((select array_agg(identity order by identity collate "C") from pg_temp.xb_sf_reference where kind='wrapper'),
+  array['realtime.send(jsonb,text,text,boolean)','realtime.send_binary(bytea,text,text,boolean)']::text[],
+  'SN scope is exactly the two sender overloads');
+select is((select count(*) from pg_temp.xb_sf_reference where kind='shape'),2::bigint,'SN explicit parent and leaf effect classes exist');
+select is((select string_agg(identity||': '||problem,', ' order by identity,problem) from pg_temp.xb_sf_problems()),null::text,
+  'SN native sender effect profile is completely classified')
+where exists(select 1 from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null);
+select * from skip('native senders absent; no target or primitive admission credit',1)
+where not exists(select 1 from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null);
+select is((select count(*) from pg_temp.xb_sf_admitted()),
+  (select count(*) from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null),'SN only the verified present senders are admitted');
+select is((select count(*) from agent_board.tasks where thread_id='667d0000-0000-4000-8000-000000000010'),0::bigint,'SN own fixture starts without history');
+select is((with actual as (select rel from pg_temp.xb_sf_targets()),
+  canonical as (select relid::oid as rel from pg_partition_tree(to_regclass('realtime.messages')))
+  select count(*) from ((select rel from actual except select rel from canonical)
+    union all (select rel from canonical except select rel from actual)) d),0::bigint,
+  'SN independently derived partition tree has no omitted target') where to_regclass('realtime.messages') is not null;
+select * from skip('native destination absent; no target coverage credit',1) where to_regclass('realtime.messages') is null;
+select ok((select count(*)>=2 and bool_and(pg_temp.xb_sf_profile(t.rel)=r.payload) from pg_temp.xb_sf_targets() t
+  join pg_temp.xb_sf_reference r on r.kind='shape' and r.identity=case when t.rel=to_regclass('realtime.messages') then 'root' else 'leaf' end),
+  'SN every live destination positively matches its effect class') where to_regclass('realtime.messages') is not null;
+select * from skip('native destination absent; no positive effect class credit',1) where to_regclass('realtime.messages') is null;
+set local role service_role;
+select r.* from (select * from xb_sf_cases where to_regprocedure(fn) is not null order by label) c
+cross join lateral pg_temp.xb_sf_call(c.label,c.expression,c.topic,c.expected,c.binary_value,c.private,c.generated_payload_id) r;
+reset role;
+select is((select count(*) from agent_board.tasks where thread_id='667d0000-0000-4000-8000-000000000010'),0::bigint,
+  'SN quoted topics created no own history') where exists(select 1 from xb_sf_cases where to_regprocedure(fn) is not null);
+select * from skip('native calls absent; no literal-effect credit',1) where not exists(select 1 from xb_sf_cases where to_regprocedure(fn) is not null);
+-- RLS denial is intentionally caught by native code. Both the warning and the
+-- separate no-row assertion matter; lives_ok alone is never refusal evidence.
+set local role authenticated;
+select lives_ok('select '||case when identity like 'realtime.send_binary%' then
+  $$realtime.send_binary(decode('42','hex'),'sf667-denied','sf667-denied-binary',true)$$ else
+  $$realtime.send('{"denied":true}','sf667-denied','sf667-denied-json',true)$$ end,
+  'SN '||identity||' caught RLS refusal returns')
+from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null order by identity;
+reset role;
+select pg_temp.xb_sf_refusal_state(identity)
+from pg_temp.xb_sf_reference where kind='wrapper' and to_regprocedure(identity) is not null order by identity;
+select is((select count(distinct fn) from xb_sf_cases),2::bigint,'SN fixtures include both concrete payload types');
+select * from finish();
+rollback;

package/tests/agent_board_667_sender_profile_controls.test.sql

@@ -0,0 +1,29 @@
+-- Classifier controls execute even when the native platform is absent. They
+-- prove recognition/restoration, not native calls or native effect admission.
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+select plan(10);
+create temp table xb_sf_prior_profile on commit drop as select * from pg_temp.xb_sf_problems();
+select ok((select count(*)>0 from pg_temp.xb_sf_reference where kind='primitive'),'SP fixed-call reference is nonempty');
+select is((select count(*) from pg_temp.xb_sf_reference where kind='wrapper'),2::bigint,'SP only two sender identities are candidates');
+select lives_ok($q$create function pg_temp.clock_timestamp() returns timestamptz language sql as $b$select now()$b$$q$,
+  'SP valid clock shadow is registered');
+select ok(exists(select 1 from pg_temp.xb_sf_problems() where identity like 'pg_temp_%.clock_timestamp()' and problem='unreviewed fixed-call shadow'),
+  'SP clock shadow names its full identity');
+select is((select count(*) from pg_temp.xb_sf_admitted()),0::bigint,'SP clock shadow prevents sender admission');
+drop function pg_temp.clock_timestamp();
+select is((select jsonb_agg(to_jsonb(p) order by identity,problem) from pg_temp.xb_sf_problems() p),
+  (select jsonb_agg(to_jsonb(p) order by identity,problem) from xb_sf_prior_profile p),'SP clock removal restores the prior profile');
+select lives_ok($q$create function pg_temp.jsonb_set(jsonb,text[],jsonb,boolean) returns jsonb language sql as $b$select $1$b$$q$,
+  'SP valid JSON shadow is registered');
+select ok(exists(select 1 from pg_temp.xb_sf_problems() where identity like 'pg_temp_%.jsonb_set(jsonb,text[],jsonb,boolean)' and problem='unreviewed fixed-call shadow'),
+  'SP JSON shadow names its full overload');
+select is((select count(*) from pg_temp.xb_sf_admitted()),0::bigint,'SP JSON shadow prevents sender admission');
+drop function pg_temp.jsonb_set(jsonb,text[],jsonb,boolean);
+select is((select jsonb_agg(to_jsonb(p) order by identity,problem) from pg_temp.xb_sf_problems() p),
+  (select jsonb_agg(to_jsonb(p) order by identity,problem) from xb_sf_prior_profile p),'SP JSON removal restores the prior profile');
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_delimiter_behavior.test.sql

@@ -0,0 +1,84 @@
+-- Native own-row and cursor witnesses, distinct from effect-class disposition.
+create extension if not exists pgtap with schema extensions;set search_path=extensions,public,agent_board;begin;
+select to_regprocedure('storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)') is not null as native_present \gset
+\if :native_present
+select plan(41);
+insert into storage.buckets(id,name) values('667-delimiter-own','667-delimiter-own'),('667-delimiter-decoy','667-delimiter-decoy');
+insert into storage.objects(id,bucket_id,name,created_at,updated_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned,metadata) values
+('66700000-0000-4000-8000-000000000201','667-delimiter-own','alpha','2020-01-01 UTC','2020-01-02 UTC','2020-01-03 UTC','new',null,false,true,'{"n":1}'),
+('66700000-0000-4000-8000-000000000202','667-delimiter-own','alpha','2019-12-30 UTC','2019-12-31 UTC','2020-01-01 UTC','a','2020-02-01 00:00:00.123456 UTC',false,true,'{"n":2}'),
+('66700000-0000-4000-8000-000000000203','667-delimiter-own','alpha!','2020-01-02 UTC','2020-01-03 UTC','2020-01-04 UTC','one',null,false,true,'{"n":3}'),
+('66700000-0000-4000-8000-000000000204','667-delimiter-own','beta','2020-01-03 UTC','2020-01-04 UTC','2020-01-05 UTC','one',null,false,true,'{"n":4}'),
+('66700000-0000-4000-8000-000000000205','667-delimiter-own','folder/one','2020-01-04 UTC','2020-01-05 UTC','2020-01-06 UTC','one',null,false,true,'{"n":5}'),
+('66700000-0000-4000-8000-000000000206','667-delimiter-own','folder/two','2020-01-05 UTC','2020-01-06 UTC','2020-01-07 UTC','one',null,false,true,'{"n":6}'),
+('66700000-0000-4000-8000-000000000207','667-delimiter-own','alpha-marker','2020-01-06 UTC','2020-01-07 UTC','2020-01-08 UTC','one',null,true,true,'{"n":7}'),
+('66700000-0000-4000-8000-000000000208','667-delimiter-decoy','decoy','2020-01-07 UTC','2020-01-08 UTC','2020-01-09 UTC','one',null,false,true,'{"n":8}');
+insert into storage.objects(id,bucket_id,name,created_at,updated_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned,metadata) values('66700000-0000-4000-8000-000000000209','667-delimiter-own','alpha','2019-12-30 UTC','2019-12-31 UTC','2020-01-01 UTC','b','2020-02-01 00:00:00.123789 UTC',false,true,'{"n":9}');
+create temp table sd_rows(ordinal bigint generated always as identity,name text,id uuid,metadata jsonb,updated_at timestamptz,created_at timestamptz,last_accessed_at timestamptz,version text,archived_at timestamptz,is_delete_marker boolean,is_versioned boolean) on commit drop;
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD default ascending native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha','alpha!','beta','folder/']::text[],'SD default ascending returns exact own names');
+select ok((select count(*)=1 and bool_and(id='66700000-0000-4000-8000-000000000201'::uuid and metadata='{"n":1}'::jsonb and version='new' and created_at='2020-01-01 UTC'::timestamptz and updated_at='2020-01-02 UTC'::timestamptz and last_accessed_at='2020-01-03 UTC'::timestamptz and archived_at is null and not is_delete_marker and is_versioned) from sd_rows where name='alpha'),'SD exact own leaf fields are preserved');
+select ok((select count(*)=1 and bool_and(id is null and metadata is null and version is null and created_at is null and updated_at is null and last_accessed_at is null and archived_at is null) from sd_rows where name='folder/'),'SD folder fields are distinct from a leaf');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','desc','exclude','exclude',null::timestamptz,'')$call$,'SD default descending native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['folder/','beta','alpha!','alpha']::text[],'SD default descending returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','',100,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD empty delimiter native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha','alpha!','beta','folder/one','folder/two']::text[],'SD empty delimiter returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','folder/','/',100,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD nested prefix native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['folder/one','folder/two']::text[],'SD nested prefix returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'alpha','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD start after native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha!','beta','folder/']::text[],'SD start after returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'alpha','beta','asc','exclude','exclude',null::timestamptz,'')$call$,'SD next token takes priority native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['folder/']::text[],'SD next token takes priority returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',1,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD one key limit native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha']::text[],'SD one key limit returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','asc','only','exclude',null::timestamptz,'')$call$,'SD archived only native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha','alpha']::text[],'SD archived only returns exact own names');
+select is((select array_agg(version order by ordinal) from sd_rows),array['a','b']::text[],'SD archived versions use millisecond and version order');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','asc','include','exclude',null::timestamptz,'')$call$,'SD versions included native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha','alpha','alpha','alpha!','beta','folder/']::text[],'SD versions included returns exact own names');
+select is((select array_agg(version order by ordinal) from sd_rows where name='alpha'),array['new','a','b']::text[],'SD current and archived versions keep their own order');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','asc','exclude','only',null::timestamptz,'')$call$,'SD markers ascending native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha-marker']::text[],'SD markers ascending returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','desc','exclude','only',null::timestamptz,'')$call$,'SD markers descending native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha-marker']::text[],'SD markers descending returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',100,'','','asc','include','only',null::timestamptz,'')$call$,'SD multiversion markers native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha-marker']::text[],'SD multiversion markers returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',1,'','alpha','asc','include','exclude','2020-02-01 00:00:00.123900 UTC'::timestamptz,'a')$call$,'SD version cursor millisecond boundary native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['alpha']::text[],'SD version cursor millisecond boundary returns exact own names');
+select is((select array_agg(version order by ordinal) from sd_rows),array['b']::text[],'SD version cursor resumes at the exact millisecond tie');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/',1,'beta','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD folder cursor native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['folder/']::text[],'SD folder cursor returns exact own names');
+insert into storage.objects(bucket_id,name,version,is_versioned) values('667-delimiter-own','quote''; SELECT 1; --','one',true);
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','quote''; SELECT 1; --','/',100,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD SQL looking prefix native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['quote''; SELECT 1; --']::text[],'SD SQL looking prefix returns exact own names');
+truncate sd_rows;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','quote''; SELECT 1; --','''; SELECT 1; --',100,'','','asc','exclude','exclude',null::timestamptz,'')$call$,'SD SQL looking delimiter native call lives');
+select is((select array_agg(name order by ordinal) from sd_rows),array['quote''; SELECT 1; --']::text[],'SD SQL looking delimiter returns exact own names');
+grant insert,select on sd_rows to service_role,authenticated;grant usage,select on sequence sd_rows_ordinal_seq to service_role,authenticated;
+truncate sd_rows;set local role service_role;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/')$call$,'SD service_role native call lives');
+reset role;
+select is((select count(*) from sd_rows),5::bigint,'SD service_role row visibility');
+truncate sd_rows;set local role authenticated;
+select lives_ok($call$insert into sd_rows(name,id,metadata,updated_at,created_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned) select * from storage.list_objects_with_delimiter('667-delimiter-own','','/')$call$,'SD authenticated native call lives');
+reset role;
+select is((select count(*) from sd_rows),0::bigint,'SD authenticated row visibility');
+\else
+select plan(1);select ok(to_regprocedure('storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)') is null,'SD native delimiter absent; no native behavior credit');
+\endif
+select * from finish();rollback;

package/tests/agent_board_667_storage_delimiter_controls.test.sql

@@ -0,0 +1,23 @@
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+\ir fixtures/agent_board_667_timestamp_guard.sql
+\ir fixtures/agent_board_667_search_guard.sql
+\ir fixtures/agent_board_667_delimiter_guard.sql
+select plan(4);
+create temp table ss_prior on commit drop as select * from pg_temp.xb_sd_prerequisite_problems();
+create function pg_temp.date_trunc(text,timestamptz) returns timestamptz language sql as $f$select null::timestamptz$f$;
+select ok(exists(select 1 from pg_proc where oid='pg_temp.date_trunc(text,timestamptz)'::regprocedure),
+  'SD own resolution control is installed in the catalog');
+select ok(exists(select 1 from pg_temp.xb_sd_prerequisite_problems()
+  where identity=pg_temp.xb_cf_fn('pg_temp.date_trunc(text,timestamptz)'::regprocedure) and problem='unreviewed delimiter overload or shadow'),
+  'SD resolution census names the injected overload identity');
+select is((select count(*) from pg_temp.xb_sd_admitted()),0::bigint,'SD unreviewed overload closes admission');
+drop function pg_temp.date_trunc(text,timestamptz);
+select is((select jsonb_agg(jsonb_build_array(identity,problem) order by identity,problem) from pg_temp.xb_sd_prerequisite_problems()),
+  (select jsonb_agg(jsonb_build_array(identity,problem) order by identity,problem) from ss_prior),
+  'SD own overload removal restores the prior prerequisite findings');
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_delimiter_profile.test.sql

@@ -0,0 +1,61 @@
+create extension if not exists pgtap with schema extensions;
+create extension if not exists plpgsql_check with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+\ir fixtures/agent_board_667_timestamp_guard.sql
+\ir fixtures/agent_board_667_search_guard.sql
+\ir fixtures/agent_board_667_delimiter_guard.sql
+select to_regprocedure('storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)') is not null as native_present \gset
+\if :native_present
+select plan(18);
+select is((select string_agg(identity||': '||problem,', ' order by identity,problem) from pg_temp.xb_sd_problems()),null::text,
+  'SD complete source, relation, resolution and callback profile matches');
+select is((select array_agg(fn order by fn) from pg_temp.xb_sd_admitted()),
+  array['storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)'::regprocedure::oid],
+  'SD exactly the native delimiter OID is admitted');
+select is((select count(*) from pg_temp.xb_sd_views),842::bigint,'SD all source-bound query and expression views parsed');
+select is((select array_agg(category||':'||n order by category) from (select category,count(*) n from pg_temp.xb_sd_views group by category) q),
+  array['dynamic:666','expression:166','static:10']::text[],'SD every inventory category is present');
+select is((select payload->>'prosrc_md5' from pg_temp.xb_sd_reference where kind='coverage'),
+  (select md5(prosrc) from pg_proc where oid='storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)'::regprocedure),
+  'SD constructor coverage is bound to the actual native body');
+select is((select jsonb_array_length(payload->'execute_sites') from pg_temp.xb_sd_reference where kind='coverage'),3,
+  'SD lexical coverage includes every EXECUTE site');
+select ok(exists(select 1 from pg_temp.xb_sd_reach() where fn='pg_catalog.date_trunc(text,timestamptz)'::regprocedure),
+  'SD timestamp normalization primitive is reached');
+select ok(exists(select 1 from pg_temp.xb_sd_roots() where fn='pg_catalog.format(text,"any")'::regprocedure),
+  'SD SQL constructors themselves are in the executable graph');
+select ok(exists(select 1 from pg_temp.xb_sd_roots() where fn='storage.get_common_prefix(text,text,text)'::regprocedure),
+  'SD source expressions reach the separately reviewed SQL prefix helper');
+select ok((select count(*) from pg_temp.xb_sd_views v join pg_temp.xb_sd_reference q on q.kind='query' and q.identity=v.identity where q.payload->>'role'='record')=
+  (select sum((e->>'variants')::integer) from pg_temp.xb_sd_reference r cross join lateral jsonb_array_elements(r.payload->'execute_sites') e where r.kind='coverage' and e->>'role'='record')
+  and (select jsonb_array_length(payload->'record_fields')>0 from pg_temp.xb_sd_reference where kind='coverage'),
+  'SD every record batch has a nonempty source-derived field-type check');
+select is((select array_agg(distinct d.refobjid::regclass::text order by d.refobjid::regclass::text) from pg_temp.xb_sd_views v
+  join pg_rewrite w on w.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid
+  where d.refclassid='pg_class'::regclass and d.refobjid<>v.rel),array['storage.objects']::text[],
+  'SD parsed inventory selects only the reviewed persistent target');
+create function pg_temp.xb_sd_null_execute() returns void language plpgsql as $f$begin execute null::text;end$f$;
+select throws_ok('select pg_temp.xb_sd_null_execute()','22004','query string argument of EXECUTE is null',
+  'SD nullable constructor path is a refusal, not executable caller text');
+select ok((select bool_and(payload->>'group' in('dynamic','static','expression')) from pg_temp.xb_sd_reference where kind='query'),
+  'SD reference rows have classified source origins');
+create temp table xb_sd_effect(note text) on commit drop;
+create function pg_temp.xb_sd_dml() returns trigger language plpgsql as $f$
+begin insert into pg_temp.xb_sd_effect values('called');return new;end$f$;
+create trigger xb_sd_dml_control before insert on storage.objects for each row execute function pg_temp.xb_sd_dml();
+insert into storage.buckets(id,name) values('667-delimiter-dml','667-delimiter-dml');
+select lives_ok($call$select * from storage.list_objects_with_delimiter('667-delimiter-dml','','/')$call$,'SD SELECT with a live DML callback lives');
+select is((select count(*) from pg_temp.xb_sd_effect),0::bigint,'SD native SELECT does not invoke the DML callback');
+select lives_ok($call$insert into storage.objects(bucket_id,name) values('667-delimiter-dml','own-dml-control')$call$,'SD own DML callback control lives');
+select is((select count(*) from pg_temp.xb_sd_effect),1::bigint,'SD own DML positively invokes the same callback');
+select is((select count(*) from pg_temp.xb_sd_admitted()),1::bigint,'SD DML-only callback preserves SELECT admission');
+\else
+select plan(1);
+select ok(to_regprocedure('storage.list_objects_with_delimiter(text,text,text,integer,text,text,text,text,text,timestamp with time zone,text)') is null
+  and not exists(select 1 from pg_temp.xb_sd_admitted()),'SD absent native delimiter has no admission or native credit');
+\endif
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_search_behavior.test.sql

@@ -0,0 +1,93 @@
+-- Native own-row witnesses, separate from the finite effect/dispatch guard.
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+select to_regprocedure('storage.search(text,text,integer,integer,integer,text,text,text,text,text)') is not null as native_present \gset
+\if :native_present
+select plan(42);
+insert into storage.buckets(id,name) values('667-search-own','667-search-own'),('667-search-decoy','667-search-decoy');
+insert into storage.objects(id,bucket_id,name,created_at,updated_at,last_accessed_at,version,archived_at,is_delete_marker,is_versioned,metadata) values
+('66700000-0000-4000-8000-000000000201','667-search-own','alpha','2020-01-01 UTC','2020-01-02 UTC','2020-01-03 UTC','new',null,false,true,'{"n":1}'),
+('66700000-0000-4000-8000-000000000202','667-search-own','alpha','2019-12-30 UTC','2019-12-31 UTC','2020-01-01 UTC','old','2020-02-01 UTC',false,true,'{"n":2}'),
+('66700000-0000-4000-8000-000000000203','667-search-own','alpha!','2020-01-02 UTC','2020-01-03 UTC','2020-01-04 UTC','one',null,false,true,'{"n":3}'),
+('66700000-0000-4000-8000-000000000204','667-search-own','beta','2020-01-03 UTC','2020-01-04 UTC','2020-01-05 UTC','one',null,false,true,'{"n":4}'),
+('66700000-0000-4000-8000-000000000205','667-search-own','folder/one','2020-01-04 UTC','2020-01-05 UTC','2020-01-06 UTC','one',null,false,true,'{"n":5}'),
+('66700000-0000-4000-8000-000000000206','667-search-own','folder/two','2020-01-05 UTC','2020-01-06 UTC','2020-01-07 UTC','one',null,false,true,'{"n":6}'),
+('66700000-0000-4000-8000-000000000207','667-search-own','alpha-marker','2020-01-06 UTC','2020-01-07 UTC','2020-01-08 UTC','one',null,true,true,'{"n":7}'),
+('66700000-0000-4000-8000-000000000208','667-search-decoy','decoy','2020-01-07 UTC','2020-01-08 UTC','2020-01-09 UTC','one',null,false,true,'{"n":8}');
+create temp table ss_rows(ordinal bigint generated always as identity,name text,id uuid,updated_at timestamptz,created_at timestamptz,last_accessed_at timestamptz,metadata jsonb,version text,archived_at timestamptz,is_delete_marker boolean,is_versioned boolean) on commit drop;
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','asc','exclude','exclude')$call$,'SS default ascending native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha','alpha!','beta','folder']::text[],'SS default ascending returns exact own names');
+select ok((select count(*)=1 and bool_and(id='66700000-0000-4000-8000-000000000201'::uuid and metadata='{"n":1}'::jsonb and version='new' and created_at='2020-01-01 UTC'::timestamptz and updated_at='2020-01-02 UTC'::timestamptz and archived_at is null and not is_delete_marker and is_versioned) from ss_rows where name='alpha'),'SS exact own leaf fields are preserved');
+select ok((select count(*)=1 and bool_and(id is null and metadata is null and version is null and created_at is null and updated_at is null) from ss_rows where name='folder'),'SS folder fields are distinct from a leaf');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','desc','exclude','exclude')$call$,'SS default descending native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','beta','alpha!','alpha']::text[],'SS default descending returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',1,1,1,'','name','asc','exclude','exclude')$call$,'SS offset and limit native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha!']::text[],'SS offset and limit returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('folder/','667-search-own',100,1,0,'','name','asc','exclude','exclude')$call$,'SS nested prefix native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['one','two']::text[],'SS nested prefix returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'alp','name','asc','exclude','exclude')$call$,'SS search term native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha','alpha!']::text[],'SS search term returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','asc','only','exclude')$call$,'SS archived only native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha']::text[],'SS archived only returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','asc','include','exclude')$call$,'SS versions included native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha','alpha','alpha!','beta','folder']::text[],'SS versions included returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','asc','exclude','only')$call$,'SS markers ascending native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha-marker']::text[],'SS markers ascending returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','desc','exclude','only')$call$,'SS markers descending native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha-marker']::text[],'SS markers descending returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','name','asc','include','only')$call$,'SS multiversion markers native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha-marker']::text[],'SS multiversion markers returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'alp','name','desc','exclude','exclude')$call$,'SS bounded descending prefix native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['alpha!','alpha']::text[],'SS bounded descending prefix returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','created_at','asc','exclude','exclude')$call$,'SS non-name created_at asc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','alpha','alpha!','beta']::text[],'SS non-name created_at asc returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','created_at','desc','exclude','exclude')$call$,'SS non-name created_at desc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','beta','alpha!','alpha']::text[],'SS non-name created_at desc returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','updated_at','asc','exclude','exclude')$call$,'SS non-name updated_at asc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','alpha','alpha!','beta']::text[],'SS non-name updated_at asc returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','updated_at','desc','exclude','exclude')$call$,'SS non-name updated_at desc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','beta','alpha!','alpha']::text[],'SS non-name updated_at desc returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','last_accessed_at','asc','exclude','exclude')$call$,'SS non-name last_accessed_at asc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','alpha','alpha!','beta']::text[],'SS non-name last_accessed_at asc returns exact own names');
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,'','last_accessed_at','desc','exclude','exclude')$call$,'SS non-name last_accessed_at desc native call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array['folder','beta','alpha!','alpha']::text[],'SS non-name last_accessed_at desc returns exact own names');
+insert into storage.objects(bucket_id,name,version,is_versioned) values('667-search-own',$data$quote'; SELECT 1; --$data$,'one',true);
+truncate ss_rows;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own',100,1,0,$data$quote'; SELECT 1; --$data$,'name','asc')$call$,'SS SQL-looking search data call lives');
+select is((select array_agg(name order by ordinal) from ss_rows),array[$data$quote'; SELECT 1; --$data$]::text[],'SS SQL-looking search value remains bound data');
+grant insert,select on ss_rows to service_role,authenticated;
+grant usage,select on sequence ss_rows_ordinal_seq to service_role,authenticated;
+truncate ss_rows;
+set local role service_role;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own')$call$,'SS service role native call lives');
+reset role;
+select is((select count(*) from ss_rows),5::bigint,'SS service role sees own default rows');
+truncate ss_rows;
+set local role authenticated;
+select lives_ok($call$insert into ss_rows(name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search('','667-search-own')$call$,'SS authenticated native call lives');
+reset role;
+select is((select count(*) from ss_rows),0::bigint,'SS native empty policy set refuses authenticated rows');
+\else
+select plan(1);
+select ok(to_regprocedure('storage.search(text,text,integer,integer,integer,text,text,text,text,text)') is null,'SS native search absent; no native behavior credit');
+\endif
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_search_controls.test.sql

@@ -0,0 +1,22 @@
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+\ir fixtures/agent_board_667_timestamp_guard.sql
+\ir fixtures/agent_board_667_search_guard.sql
+select plan(4);
+create temp table ss_prior on commit drop as select * from pg_temp.xb_ss_prerequisite_problems();
+create function pg_temp.array_to_string(text[],text) returns text language sql as $f$select 'own-shadow'$f$;
+select ok(exists(select 1 from pg_proc where oid='pg_temp.array_to_string(text[],text)'::regprocedure),
+  'SS own resolution control is installed in the catalog');
+select ok(exists(select 1 from pg_temp.xb_ss_prerequisite_problems()
+  where identity=pg_temp.xb_cf_fn('pg_temp.array_to_string(text[],text)'::regprocedure) and problem='unreviewed search overload or shadow'),
+  'SS resolution census names the injected overload identity');
+select is((select count(*) from pg_temp.xb_ss_admitted()),0::bigint,'SS unreviewed overload closes admission');
+drop function pg_temp.array_to_string(text[],text);
+select is((select jsonb_agg(jsonb_build_array(identity,problem) order by identity,problem) from pg_temp.xb_ss_prerequisite_problems()),
+  (select jsonb_agg(jsonb_build_array(identity,problem) order by identity,problem) from ss_prior),
+  'SS own overload removal restores the prior prerequisite findings');
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_search_profile.test.sql

@@ -0,0 +1,60 @@
+create extension if not exists pgtap with schema extensions;
+create extension if not exists plpgsql_check with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+\ir fixtures/agent_board_667_conversion_guard.sql
+\ir fixtures/agent_board_667_sender_guard.sql
+\ir fixtures/agent_board_667_timestamp_guard.sql
+\ir fixtures/agent_board_667_search_guard.sql
+select to_regprocedure('storage.search(text,text,integer,integer,integer,text,text,text,text,text)') is not null as native_present \gset
+\if :native_present
+select plan(18);
+select is((select string_agg(identity||': '||problem,', ' order by identity,problem) from pg_temp.xb_ss_problems()),null::text,
+  'SS complete source, relation, resolution and callback profile matches');
+select is((select array_agg(fn order by fn) from pg_temp.xb_ss_admitted()),
+  array['storage.search(text,text,integer,integer,integer,text,text,text,text,text)'::regprocedure::oid],
+  'SS exactly the native search OID is admitted');
+select is((select count(*) from pg_temp.xb_ss_views),341::bigint,'SS all source-bound query and expression views parsed');
+select is((select array_agg(category||':'||n order by category) from (select category,count(*) n from pg_temp.xb_ss_views group by category) q),
+  array['dynamic:152','expression:176','static:13']::text[],'SS every inventory category is present');
+select is((select payload->>'prosrc_md5' from pg_temp.xb_ss_reference where kind='coverage'),
+  (select md5(prosrc) from pg_proc where oid='storage.search(text,text,integer,integer,integer,text,text,text,text,text)'::regprocedure),
+  'SS constructor coverage is bound to the actual native body');
+select is((select jsonb_array_length(payload->'execute_sites') from pg_temp.xb_ss_reference where kind='coverage'),4,
+  'SS lexical coverage includes every EXECUTE site');
+select ok(exists(select 1 from pg_temp.xb_ss_reach() where fn='pg_catalog.texticlike_support(internal)'::regprocedure),
+  'SS ILIKE planner support callback is reached');
+select ok(exists(select 1 from pg_temp.xb_ss_roots() where fn='pg_catalog.format(text,"any")'::regprocedure),
+  'SS SQL constructors themselves are in the executable graph');
+select ok(exists(select 1 from pg_temp.xb_ss_roots() where fn='storage.get_common_prefix(text,text,text)'::regprocedure),
+  'SS source expressions reach the separately reviewed SQL prefix helper');
+select ok((select count(*) from pg_temp.xb_ss_views v join pg_temp.xb_ss_reference q on q.kind='query' and q.identity=v.identity where q.payload->>'role'='record')=
+  (select sum((e->>'variants')::integer) from pg_temp.xb_ss_reference r cross join lateral jsonb_array_elements(r.payload->'execute_sites') e where r.kind='coverage' and e->>'role'='record')
+  and (select jsonb_array_length(payload->'record_fields')>0 from pg_temp.xb_ss_reference where kind='coverage'),
+  'SS every record batch has a nonempty source-derived field-type check');
+select is((select array_agg(distinct d.refobjid::regclass::text order by d.refobjid::regclass::text) from pg_temp.xb_ss_views v
+  join pg_rewrite w on w.ev_class=v.rel join pg_depend d on d.classid='pg_rewrite'::regclass and d.objid=w.oid
+  where d.refclassid='pg_class'::regclass and d.refobjid<>v.rel),array['storage.objects']::text[],
+  'SS parsed inventory selects only the reviewed persistent target');
+create function pg_temp.xb_ss_null_execute() returns void language plpgsql as $f$begin execute null::text;end$f$;
+select throws_ok('select pg_temp.xb_ss_null_execute()','22004','query string argument of EXECUTE is null',
+  'SS nullable constructor path is a refusal, not executable caller text');
+select ok((select bool_and(payload->>'group' in('dynamic','static','expression')) from pg_temp.xb_ss_reference where kind='query'),
+  'SS reference rows have classified source origins');
+create temp table xb_ss_effect(note text) on commit drop;
+create function pg_temp.xb_ss_dml() returns trigger language plpgsql as $f$
+begin insert into pg_temp.xb_ss_effect values('called');return new;end$f$;
+create trigger xb_ss_dml_control before insert on storage.objects for each row execute function pg_temp.xb_ss_dml();
+insert into storage.buckets(id,name) values('667-search-dml','667-search-dml');
+select lives_ok($call$select * from storage.search('','667-search-dml')$call$,'SS SELECT with a live DML callback lives');
+select is((select count(*) from pg_temp.xb_ss_effect),0::bigint,'SS native SELECT does not invoke the DML callback');
+select lives_ok($call$insert into storage.objects(bucket_id,name) values('667-search-dml','own-dml-control')$call$,'SS own DML callback control lives');
+select is((select count(*) from pg_temp.xb_ss_effect),1::bigint,'SS own DML positively invokes the same callback');
+select is((select count(*) from pg_temp.xb_ss_admitted()),1::bigint,'SS DML-only callback preserves SELECT admission');
+\else
+select plan(1);
+select ok(to_regprocedure('storage.search(text,text,integer,integer,integer,text,text,text,text,text)') is null
+  and not exists(select 1 from pg_temp.xb_ss_admitted()),'SS absent native search has no admission or native credit');
+\endif
+select * from finish();
+rollback;

package/tests/agent_board_667_storage_timestamp_behavior.test.sql

@@ -0,0 +1,58 @@
+-- Native behavior is separate from the catalog effect/admission proof.
+create extension if not exists pgtap with schema extensions;
+set search_path=extensions,public,agent_board;
+begin;
+select (to_regprocedure('storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)') is not null and to_regclass('storage.objects') is not null and to_regclass('storage.buckets') is not null) as native_present \gset
+\if :native_present
+select plan(19);
+insert into storage.buckets(id,name) values ('667-timestamp-probe','667-timestamp-probe');
+insert into storage.objects(id,bucket_id,name,created_at,updated_at,version,archived_at,is_delete_marker,is_versioned,metadata) values
+ ('66700000-0000-4000-8000-000000000001','667-timestamp-probe','alpha','2020-01-01 UTC','2020-01-02 UTC','v1',null,false,true,'{"n":1}'),
+ ('66700000-0000-4000-8000-000000000002','667-timestamp-probe','folder/child','2020-01-03 UTC','2020-01-04 UTC','v2',null,false,true,'{"n":2}'),
+ ('66700000-0000-4000-8000-000000000003','667-timestamp-probe','alpha','2020-01-01 UTC','2020-01-02 UTC','old','2020-02-01 UTC',false,true,'{"n":3}'),
+ ('66700000-0000-4000-8000-000000000004','667-timestamp-probe','deleted','2020-01-05 UTC','2020-01-06 UTC','v4',null,true,true,'{"n":4}'),
+ ('66700000-0000-4000-8000-000000000005','667-timestamp-probe','percent%literal','2020-01-07 UTC','2020-01-08 UTC','v5',null,false,true,'{"n":5}'),
+ ('66700000-0000-4000-8000-000000000006','667-timestamp-probe','percentXdecoy','2020-01-09 UTC','2020-01-10 UTC','v6',null,false,true,'{"n":6}'),
+ ('66700000-0000-4000-8000-000000000008','667-timestamp-probe','folder/another','2020-01-04 UTC','2020-01-05 UTC','v8',null,false,true,'{"n":8}');
+create temp table xb_timestamp_rows (ordinal bigint generated always as identity, key text,name text,id uuid,updated_at timestamptz,created_at timestamptz,last_accessed_at timestamptz,metadata jsonb,version text,archived_at timestamptz,is_delete_marker boolean,is_versioned boolean) on commit drop;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',100,1,'','asc','updated_at','')$q$,'ST native default call lives');
+select is((select array_agg(name order by ordinal) from xb_timestamp_rows),array['alpha','folder/','percent%literal','percentXdecoy']::text[],'ST default filters and folder aggregation');
+select ok((select count(*)=1 and bool_and(id='66700000-0000-4000-8000-000000000001'::uuid and key='alpha' and metadata='{"n":1}'::jsonb and version='v1' and not is_delete_marker and is_versioned) from xb_timestamp_rows where name='alpha'),'ST leaf fields preserved');
+select is((select jsonb_agg(jsonb_build_array(key,name,id,updated_at,created_at,metadata,version,archived_at,is_delete_marker,is_versioned) order by ordinal) from xb_timestamp_rows where name='alpha'),jsonb_build_array(jsonb_build_array('alpha','alpha','66700000-0000-4000-8000-000000000001'::uuid,'2020-01-02 UTC'::timestamptz,'2020-01-01 UTC'::timestamptz,'{"n":1}'::jsonb,'v1',null,false,true)),'ST exact stable leaf projection');
+select ok((select count(*)=1 and bool_and(id is null and key='folder' and created_at='2020-01-03 UTC'::timestamptz and updated_at=created_at and metadata is null and version is null) from xb_timestamp_rows where name='folder/'),'ST folder fields and timestamp');
+truncate xb_timestamp_rows;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',1,1,'alpha','asc','updated_at','2020-01-02 UTC')$q$,'ST cursor call lives');
+select is((select array_agg(name) from xb_timestamp_rows),array['folder/']::text[],'ST cursor and limit');
+truncate xb_timestamp_rows;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',100,1,'','desc','created_at','','include','include')$q$,'ST inclusive call lives');
+select is((select array_agg(name||':'||coalesce(version,'') order by ordinal) from xb_timestamp_rows),array['percentXdecoy:v6','percent%literal:v5','deleted:v4','folder/:','alpha:v1','alpha:old']::text[],'ST inclusive version and marker rows');
+truncate xb_timestamp_rows;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('percent%','667-timestamp-probe',100,1,'','asc','updated_at','','bogus','bogus')$q$,'ST literal percent and invalid filters call lives');
+select is((select array_agg(name) from xb_timestamp_rows),array['percent%literal']::text[],'ST LIKE metacharacter is literal');
+truncate xb_timestamp_rows;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',100,1,'','desc; select 1','created_at; select 1','','invalid','invalid')$q$,'ST invalid sort text falls back');
+select is((select array_agg(name order by ordinal) from xb_timestamp_rows),array['alpha','folder/','percent%literal','percentXdecoy']::text[],'ST invalid options use default filters');
+insert into storage.objects(id,bucket_id,name,created_at,updated_at,version,is_delete_marker,is_versioned)
+values ('66700000-0000-4000-8000-000000000007','667-timestamp-probe',$v$quote'; SELECT 1; --$v$,'2020-01-11 UTC','2020-01-12 UTC','v7',false,true);
+truncate xb_timestamp_rows;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp($v$quote'; SELECT 1; --$v$,'667-timestamp-probe',100,1,'','asc','updated_at','')$q$,'ST SQL-looking prefix call lives');
+select is((select array_agg(name order by ordinal) from xb_timestamp_rows),array[$v$quote'; SELECT 1; --$v$]::text[],'ST SQL-looking prefix is data');
+truncate xb_timestamp_rows;
+grant insert,select on xb_timestamp_rows to service_role,authenticated;
+grant usage,select on sequence xb_timestamp_rows_ordinal_seq to service_role,authenticated;
+set local role service_role;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',100,1,'','asc','updated_at','')$q$,'ST service role call lives');
+reset role;
+select is((select count(*) from xb_timestamp_rows),5::bigint,'ST service role sees own current non-marker rows');
+truncate xb_timestamp_rows;
+set local role authenticated;
+select lives_ok($q$insert into xb_timestamp_rows (key,name,id,updated_at,created_at,last_accessed_at,metadata,version,archived_at,is_delete_marker,is_versioned) select * from storage.search_by_timestamp('','667-timestamp-probe',100,1,'','asc','updated_at','')$q$,'ST authenticated role call lives');
+reset role;
+select is((select count(*) from xb_timestamp_rows),0::bigint,'ST authenticated role sees no rows under native empty policy set');
+\else
+select plan(1);
+select ok(to_regprocedure('storage.search_by_timestamp(text,text,integer,integer,text,text,text,text,text,text,text)') is null,
+  'ST native reader is absent; no native behavior credit');
+\endif
+select * from finish();
+rollback;