The house guard 'p_company_id NOT IN (SELECT public.user_company_ids())'
skips the deny branch on UNKNOWN (NULL on either side). Not exploitable
today (company_members.company_id is NOT NULL) but a NULL p_company_id
passes the guard, and the shape fails silently under change. 9 live
functions carried it (link_*_to_voucher, reserve/release_voucher_range,
mark_entry_as_opening_balance, retag_line_dimensions,
ensure_company_dimensions, company_has_capability, rotate_company_inbox).
- caller_is_company_member(uuid): NULL-safe membership predicate
(NULL -> false, always).
- Mechanical rewrite: every public function carrying the raw pattern is
re-created via pg_get_functiondef with the guard swapped — deliberate
over hand-copying 9 bodies (the stale-copy hazard behind the 07-03
constraint clobber). Probe-validated locally: pattern swapped, NULL
denied.
- pg-real ratchet: after full replay no public function may contain the
raw pattern (also blocks future reintroduction); detector self-test;
helper semantics (member/foreigner/NULL).
Existing tenant-guard suites re-assert deny semantics on the rewritten
functions in CI.
Part of dev_docs/mcp_optimization_plan.md (P2-3 follow-up, PR #872 review).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
