@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_consent_gating.test.sql

@@ -0,0 +1,489 @@
+-- MBCONSENT-B(ii) pgTAP: ROUTE GATING (#82) + the paired widening (#108).
+--
+-- The acceptance suite for plan #111. Unlike the three inert predecessors, this change makes
+-- calls that succeed today begin failing -- so EVERY deny assertion has a paired allow, and the
+-- allow half is not optional. A gate that refuses everything passes every force-join test; that
+-- exact defect shipped in the first revision of this migration and was caught in review.
+--
+-- Methodology:
+--   * RPC probes are driven by the JWT claim triplet only. SET LOCAL ROLE is never used: it
+--     revokes _is_service_role() and would mask the operator carve-out behind a permission error
+--     on the function itself.
+--   * The class assertion (EC-4) is derived from the CATALOG, not a hand-maintained list, so a
+--     route added later fails it AND NAMES ITSELF. Every prior statement of the route set said
+--     four; there are five.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(53);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims', '', true); end $$;
+create function pg_temp.state(b uuid, a uuid) returns text language sql as $$
+  select membership_state from agent_board.board_memberships
+   where board_id = b and agent_id = a
+   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+            created_at desc, id desc
+   limit 1;
+$$;
+
+insert into auth.users(id, instance_id, aud, role, email)
+select ('c0000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000','authenticated','authenticated','gate'||n||'@t.test'
+from generate_series(1,10) n;
+
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('c1000000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','gate-agent-'||n,'Gate Agent '||n,'active',
+       ('c0000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,10) n;
+
+-- Agent 1 owns every board here.
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('c2000000-0000-4000-8000-000000000001','gate-open','Gate Open',
+        'c1000000-0000-4000-8000-000000000001','open','active'),
+       ('c2000000-0000-4000-8000-000000000002','gate-priv','Gate Private',
+        'c1000000-0000-4000-8000-000000000001','private','active'),
+       ('c2000000-0000-4000-8000-000000000003','gate-hidden','Gate Hidden',
+        'c1000000-0000-4000-8000-000000000001','directory_hidden','active'),
+       ('c2000000-0000-4000-8000-000000000004','gate-inv','Gate InviteOnly',
+        'c1000000-0000-4000-8000-000000000001','invite_only','active');
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+select b, 'c1000000-0000-4000-8000-000000000001'::uuid, 'owner', 'joined',
+       'c1000000-0000-4000-8000-000000000001'::uuid
+  from unnest(array['c2000000-0000-4000-8000-000000000001','c2000000-0000-4000-8000-000000000002',
+                    'c2000000-0000-4000-8000-000000000003','c2000000-0000-4000-8000-000000000004']::uuid[]) b;
+
+-- ===========================================================================
+-- EC-1 DENY -- no route admits a non-consenting subject
+-- ===========================================================================
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+
+-- join_board: the CREATOR path. This is the #82 hole: creating a board did not entitle the
+-- creator to place other people in it, but the actor-mismatch guard explicitly let them past.
+select throws_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000002'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb)
+$$, '42501', 'board membership actor mismatch',
+   'EC-1 join_board: a board CREATOR cannot join a stranger to their own board');
+
+-- update_board_membership: an owner cannot ADMIT a non-consenting subject.
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id, left_at)
+values ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003',
+        'member','left','c1000000-0000-4000-8000-000000000001', now());
+select throws_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003','joined')
+$$, '42501', null,
+   'EC-1 update: an owner cannot admit a non-consenting subject');
+
+-- resolve_board_request: a MANUFACTURED request is board-authored, therefore NEUTRAL on the
+-- ledger, and admits nobody. This is the laundering route.
+select lives_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003','requested')
+$$, 'EC-1 setup: an owner MAY manufacture a `requested` row -- it is neutral');
+select throws_ok($$
+  select agent_board.resolve_board_request(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000003'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb)
+$$, '42501', null,
+   'EC-1 resolve: approving a MANUFACTURED request admits nobody');
+
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003'),
+  'requested',
+  'EC-1: after all three refusals the subject is still NOT active');
+
+-- ===========================================================================
+-- EC-2 ALLOW -- every legitimate path still works
+-- ===========================================================================
+select pg_temp.claims('c0000000-0000-0000-0000-000000000002');
+select lives_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000002'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb) $$,
+  'EC-2 join_board: the subject self-joins an open board [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000002'),
+  'joined', 'EC-2 join_board: the subject self-joins an open board');
+
+-- a GENUINE request, approved
+select pg_temp.claims('c0000000-0000-0000-0000-000000000004');
+select lives_ok($$
+  select agent_board.request_join_board(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000004')
+$$, 'EC-2 setup: the subject requests');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+select lives_ok($$
+  select agent_board.resolve_board_request(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000004'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb) $$,
+  'EC-2 resolve: an owner approves a GENUINE request [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000004'),
+  'joined', 'EC-2 resolve: an owner approves a GENUINE request');
+
+-- promoting a CONSENTING subject via update_board_membership
+select pg_temp.claims('c0000000-0000-0000-0000-000000000005');
+select lives_ok($$
+  select agent_board.request_join_board(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005')
+$$, 'EC-2 setup: another subject requests');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+select lives_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005','joined') $$,
+  'EC-2 update: an owner MAY promote a CONSENTING subject [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005'),
+  'joined', 'EC-2 update: an owner MAY promote a CONSENTING subject');
+
+-- A CONSENTING subject with a STALE HIGHER ROLE must still be admissible. Roles are retained
+-- on a departed row and the sink clamps an admission back to `member`, so comparing the actor
+-- against the retained role refused a departed OWNER re-entry that they had genuinely
+-- requested. Deny-side correctness cannot see this; only an allow assertion can.
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values ('c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000006',
+        'owner','joined','c1000000-0000-4000-8000-000000000001');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000006');
+select lives_ok($$
+  select agent_board.leave_board(
+    'c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000006')
+$$, 'EC-2 setup: that owner leaves, RETAINING the owner role on the departed row');
+select lives_ok($$
+  select agent_board.request_join_board(
+    'c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000006')
+$$, 'EC-2 setup: and genuinely requests re-entry');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+-- lives_ok FIRST. Written as a bare select this ABORTS the file when the rank fix is reverted:
+-- 12 of 34 assertions ran and no `not ok` was emitted, so the mutation read as "not caught".
+-- I had just fixed this exact shape in EC-6 and reproduced it in the very next assertion --
+-- which is why the note below matters more than this one fix.
+select lives_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000006','joined')
+$$, 'EC-2: a CONSENTING departed OWNER can be re-admitted -- rank uses the EFFECTIVE role');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000006'),
+  'joined',
+  'EC-2: ...and they are ACTIVE afterwards');
+
+-- active -> active is not an admission
+select lives_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005','subscribed') $$,
+  'EC-2 update: active -> active admits nobody and stays allowed [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005'),
+  'subscribed', 'EC-2 update: active -> active admits nobody and stays allowed');
+
+-- eviction and demotion untouched
+select lives_ok($$
+  select agent_board.update_board_membership(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005','removed') $$,
+  'EC-2 update: eviction is untouched [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000005'),
+  'removed', 'EC-2 update: eviction is untouched');
+
+-- re-entry after leaving
+select pg_temp.claims('c0000000-0000-0000-0000-000000000002');
+select lives_ok($$
+  select agent_board.leave_board(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000002')
+$$, 'EC-2 setup: the subject leaves');
+select lives_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000002'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb) $$,
+  'EC-2 join_board: re-entry after leaving still works [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000002'),
+  'joined', 'EC-2 join_board: re-entry after leaving still works');
+
+-- ===========================================================================
+-- EC-3 OPERATOR -- the carve-out is preserved on every route
+-- ===========================================================================
+select pg_temp.service();
+select lives_ok($$
+  select agent_board._upsert_board_membership_state(
+    'c2000000-0000-4000-8000-000000000002','c1000000-0000-4000-8000-000000000006','joined') $$,
+  'EC-3: service_role places a subject directly [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000002','c1000000-0000-4000-8000-000000000006'),
+  'joined', 'EC-3: service_role places a subject directly');
+select is(
+  (select provenance from agent_board.board_membership_events
+    where agent_id = 'c1000000-0000-4000-8000-000000000006' order by seq desc limit 1),
+  'operator-designated', 'EC-3: ...recorded as an operator placement, never as consent');
+select lives_ok($$
+  select agent_board.resolve_board_request(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000003'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb) $$,
+  'EC-3: service_role may resolve a pending row the gate refuses to an owner [call succeeds]');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003'),
+  'joined', 'EC-3: service_role may resolve a pending row the gate refuses to an owner');
+
+-- ===========================================================================
+-- EC-6 / EC-7 -- consent is EXERCISABLE (#108), and the widening admits nobody else
+-- ===========================================================================
+-- EC-6: an invitee can accept on EVERY visibility, including the two that previously excluded
+-- self-entry outright and therefore made consent impossible to give.
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+select lives_ok($$
+  select agent_board.invite_board_member(
+    'c2000000-0000-4000-8000-000000000002'::uuid,'c1000000-0000-4000-8000-000000000007'::uuid,
+    'c1000000-0000-4000-8000-000000000001'::uuid)
+$$, 'EC-6 setup: the owner invites to a PRIVATE board');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000007');
+-- lives_ok FIRST, then the state. A bare select from join_board RAISES when the widening is
+-- absent, which ABORTS the transaction and kills the rest of the file -- 18 of 28 assertions
+-- ran and no `not ok` was ever emitted. A test that crashes is indistinguishable from a broken
+-- test file, and that ambiguity has misled this work twice. It must FAIL, not abort.
+select lives_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000002'::uuid,'c1000000-0000-4000-8000-000000000007'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb)
+$$, 'EC-6: an invitee can ACCEPT on a private board -- consent is exercisable');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000002','c1000000-0000-4000-8000-000000000007'),
+  'joined', 'EC-6: ...and the invitee is now ACTIVE on 002');
+
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+select lives_ok($$
+  select agent_board.invite_board_member(
+    'c2000000-0000-4000-8000-000000000003'::uuid,'c1000000-0000-4000-8000-000000000007'::uuid,
+    'c1000000-0000-4000-8000-000000000001'::uuid)
+$$, 'EC-6 setup: the owner invites to a directory_hidden board');
+select pg_temp.claims('c0000000-0000-0000-0000-000000000007');
+-- lives_ok FIRST, then the state. A bare select from join_board RAISES when the widening is
+-- absent, which ABORTS the transaction and kills the rest of the file -- 18 of 28 assertions
+-- ran and no `not ok` was ever emitted. A test that crashes is indistinguishable from a broken
+-- test file, and that ambiguity has misled this work twice. It must FAIL, not abort.
+select lives_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000003'::uuid,'c1000000-0000-4000-8000-000000000007'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb)
+$$, 'EC-6: ...and on directory_hidden');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000003','c1000000-0000-4000-8000-000000000007'),
+  'joined', 'EC-6: ...and the invitee is now ACTIVE on 003');
+
+-- EC-7: THE PAIRED ASSERTION. The widening must admit NOBODY ELSE. Dropping the
+-- actor = subject condition would fail THIS while EC-6 still passes -- a re-opened #82 looks
+-- like a WORKING feature with a hole in it, not like a broken one.
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+select lives_ok($$
+  select agent_board.invite_board_member(
+    'c2000000-0000-4000-8000-000000000004'::uuid,'c1000000-0000-4000-8000-000000000008'::uuid,
+    'c1000000-0000-4000-8000-000000000001'::uuid)
+$$, 'EC-7 setup: the owner invites agent 8');
+select throws_ok($$
+  select agent_board.join_board(
+    'c2000000-0000-4000-8000-000000000004'::uuid,'c1000000-0000-4000-8000-000000000008'::uuid,
+    'joined'::text, null::uuid, '{}'::jsonb)
+$$, '42501', 'board membership actor mismatch',
+   'EC-7: a THIRD PARTY cannot use the widened invitation path for someone else');
+select is(pg_temp.state('c2000000-0000-4000-8000-000000000004','c1000000-0000-4000-8000-000000000008'),
+  'invited',
+  'EC-7: ...and the invitee is still merely invited, not admitted');
+
+-- ===========================================================================
+-- EC-4 CLASS -- catalog-derived, so a future ungated route fails and NAMES ITSELF
+-- ===========================================================================
+-- The assertion that would have caught the fifth route. It does not enumerate expected routes
+-- and check them off; it asks the catalog which authenticated functions can reach an active
+-- membership, and requires each to be gated or explicitly exempt WITH A REASON.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.prokind = 'f'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and has_function_privilege('authenticated', p.oid, 'EXECUTE')
+      -- reaches an active membership, directly or through the shared sink
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            -- Includes update_board_membership: a one-hop WRAPPER calling it with 'joined'
+            -- reaches an active membership without ever naming the sink, and would otherwise
+            -- evade this class assertion entirely.
+            ~ '(_upsert_board_membership_state|_redeem_invite_for_agent|update_board_membership|insert into agent_board\.board_memberships)'
+      -- gated: consults the predicate, or refuses a non-subject actor structurally
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            !~ '(_membership_consent_present|actor mismatch|requires an act by that agent)'
+      -- stated exemptions, each with a reason recorded in the migration header
+      and p.proname not in (
+        'create_board',        -- the actor IS the subject: it seeds the creator's own seat
+        'redeem_invite_link',  -- self-only: no target parameter, passes current_agent_id()
+        'invite_board_member', -- writes `invited` only -- an offer, not a membership
+        'request_join_board',  -- writes `requested` only
+        'leave_board',         -- writes `left` only
+        'grant_board_role'     -- requires an already-active membership; never SETs the state
+      )),
+  '',
+  'EC-4 CLASS: every authenticated route reaching an active membership is gated or exempt');
+
+-- ...and the exemptions are not assertions of convenience: the three "writes only X" claims are
+-- checked, because an exemption that stops being true is how the fifth route hid.
+-- Matches the literal passed to EITHER the shared sink OR update_board_membership. The first
+-- version looked only at the sink, so leave_board -- which calls update_board_membership --
+-- matched nothing and the assertion passed by finding NOTHING rather than by verifying
+-- anything. Right answer, broken check: exactly the fail-open shape this suite exists to stop.
+select is(
+  (select coalesce(string_agg(p.proname || '=' || m[1], ', ' order by p.proname), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     cross join lateral regexp_matches(
+       regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g'),
+       '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(joined|subscribed)''',
+       'g') m
+    where n.nspname = 'agent_board'
+      and p.proname in ('invite_board_member','request_join_board','leave_board')),
+  '',
+  'EC-4: the "writes only a pending state" exemptions still hold -- none reaches an active state');
+
+-- ...and each writes the state its exemption claims, verified positively rather than by absence.
+select is(
+  (select string_agg(p.proname || '=' || m[1], ' ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     cross join lateral regexp_matches(
+       regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g'),
+       '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(invited|requested|left)''',
+       'g') m
+    where n.nspname = 'agent_board'
+      and p.proname in ('invite_board_member','request_join_board','leave_board')),
+  'invite_board_member=invited leave_board=left request_join_board=requested',
+  'EC-4: ...and each writes exactly the pending state its exemption names');
+
+-- ===========================================================================
+-- EC-5 NO REGRESSION -- gating did not change what is RECORDED
+-- ===========================================================================
+select is(
+  (select provenance from agent_board.board_membership_events
+    where agent_id = 'c1000000-0000-4000-8000-000000000002'
+      and board_id = 'c2000000-0000-4000-8000-000000000001'
+    order by seq asc limit 1),
+  'target-authored',
+  'EC-5: a self-join is still recorded as the subject''s own act');
+
+-- ===========================================================================
+-- The consent read happens UNDER a row lock (MBCONSENT-B(iii))
+-- ===========================================================================
+-- Structural, and deliberately labelled as such. The real proof is a TWO-SESSION probe -- a
+-- withdrawal committed between the consent read and the write must not be overwritten -- and
+-- that cannot run inside this single-transaction harness (see #103). Verified live:
+--
+--   A approves, holding the transaction open   -> returns joined
+--   B withdraws mid-approval                   -> BLOCKS 3015ms on A's lock, then applies
+--   final state                                -> left  (the withdrawal is not lost)
+--
+-- What this assertion adds is regression cover: if the `for update` is dropped, the two-session
+-- outcome silently changes and nothing else here would notice.
+-- The lock must span the WHOLE (board_id, agent_id) SET -- both predicates, ORDER BY bm.id,
+-- FOR UPDATE, and NO state filter and NO limit. That breadth is what serializes a concurrent
+-- self-withdrawal on a DIFFERENT physical row (the active one) than the pending row being
+-- resolved. A lock scoped to the pending row alone -- the earlier wrong implementation --
+-- would satisfy a bare "any FOR UPDATE" check while leaving the duplicate-shape race open
+-- (Fable A2). The single-session tests below pin row IDENTITY, not contention, so this
+-- structural assertion is the only durable regression guard until #115's deterministic
+-- two-session probe lands. It is written as one regex so a pending-only, state-filtered, or
+-- LIMITed lock all fail it. The regex anchors on `for update;` (the statement
+-- terminator), NOT a bare `for update`: `for update skip locked` would otherwise pass
+-- while SKIP LOCKED turns the guard into a no-op for exactly the contended row,
+-- silently reopening the race -- the classic wrong "fix" for lock-wait reports. `nowait`
+-- is excluded too (it at least fails loudly).
+select matches(
+  (select regexp_replace(regexp_replace(pg_get_functiondef(p.oid), '/\*.*?\*/', '', 'gs'), '--[^\n]*', '', 'g')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'resolve_board_request'),
+  'from agent_board\.board_memberships[[:space:]]+bm[[:space:]]+where bm\.board_id = p_board_id[[:space:]]+and bm\.agent_id = p_agent_id[[:space:]]+order by bm\.id[[:space:]]+for update;',
+  'LOCK: resolve_board_request locks the WHOLE (board, agent) set -- unfiltered, id-ordered, for update');
+
+-- ...and the consent read comes AFTER that lock, not before it. Order is the whole point:
+-- a lock taken after the check protects nothing.
+select ok(
+  (select position('for update' in body) < position('_membership_consent_present' in body)
+     from (select regexp_replace(regexp_replace(pg_get_functiondef(p.oid), '/\*.*?\*/', '', 'gs'), '--[^\n]*', '', 'g') as body
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'resolve_board_request') s),
+  'LOCK: ...and reads consent AFTER taking it, not before');
+
+-- The sink acts on the row the CALLER named, rather than reselecting (#109).
+select matches(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_upsert_board_membership_state'),
+  'if p_membership_id is not null then',
+  'LOCK: the sink honours a caller-supplied row identity instead of reselecting');
+
+-- ===========================================================================
+-- MBCONSENT-B(iii): the (active, pending) DUPLICATE shape -- behavioural, not structural
+-- ===========================================================================
+-- The four-seat review (a native Fable seat, executing) found the structural lock assertions
+-- passed a plausible wrong implementation: #109 was unpinned, and approving a consenting
+-- subject on this shape regressed to a raw 23505. These pin the EFFECT, not the presence of a
+-- lock. Agents 9 and 10 are fresh; the duplicate is seeded directly because request_join_board
+-- now refuses to create it (that refusal is asserted separately below).
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id, created_at)
+values ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000009',
+        'member','joined','c1000000-0000-4000-8000-000000000001', now() - interval '2 days'),
+       ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000009',
+        'member','requested','c1000000-0000-4000-8000-000000000001', now());
+insert into agent_board.board_membership_events(board_id, agent_id, event_kind, result_state, provenance, actor_agent_id)
+values ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000009',
+        'consent_join_request','requested','target-authored','c1000000-0000-4000-8000-000000000009');
+
+select pg_temp.claims('c0000000-0000-0000-0000-000000000001');
+
+-- APPROVE on the duplicate: no-op success returning the ACTIVE row, never a 23505 (A3).
+select lives_ok($$
+  select agent_board.resolve_board_request(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000009'::uuid,'joined'::text,null::uuid,'{}'::jsonb)
+$$, 'DUP: approving an already-active consenting subject succeeds (no 23505)');
+select is(
+  (select count(*)::int from agent_board.board_memberships
+    where agent_id = 'c1000000-0000-4000-8000-000000000009'
+      and membership_state in ('joined','subscribed')),
+  1,
+  'DUP: ...and the active membership is intact, not collided');
+
+-- REJECT on the duplicate: the PENDING row goes left, the ACTIVE row is UNTOUCHED (#109 core).
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id, created_at)
+       -- ACTIVE row NEWER so it wins the created_at DESC sort. A resolver that selects the
+       -- total-order winner instead of the pending row (the #109 bug) would then lock and
+       -- downgrade THIS active row on reject -- which is exactly what must fail.
+values ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000010',
+        'member','requested','c1000000-0000-4000-8000-000000000001', now() - interval '2 days'),
+       ('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000010',
+        'member','joined','c1000000-0000-4000-8000-000000000001', now());
+select lives_ok($$
+  select agent_board.resolve_board_request(
+    'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000010'::uuid,'removed'::text,null::uuid,'{}'::jsonb)
+$$, 'DUP: rejecting the pending request succeeds');
+select is(
+  (select membership_state from agent_board.board_memberships
+    where agent_id = 'c1000000-0000-4000-8000-000000000010'
+      and membership_state in ('joined','subscribed')),
+  'joined',
+  'DUP: #109 -- rejecting the pending request leaves the ACTIVE membership untouched');
+select is(
+  (select count(*)::int from agent_board.board_memberships
+    where agent_id = 'c1000000-0000-4000-8000-000000000010' and membership_state = 'left'),
+  1,
+  'DUP: ...and the pending row became left');
+
+-- OPTION 3 root cause: an ALREADY-ACTIVE member requesting is a no-op, not a demotion (B5).
+select pg_temp.claims('c0000000-0000-0000-0000-000000000002');
+select lives_ok($$
+  select agent_board.request_join_board(
+    'c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000002')
+$$, 'DUP setup: an active member requests');
+select is(
+  (select string_agg(membership_state, ',' order by created_at)
+     from agent_board.board_memberships
+    where board_id = 'c2000000-0000-4000-8000-000000000001'
+      and agent_id = 'c1000000-0000-4000-8000-000000000002'),
+  'joined',
+  'DUP: an active member requesting stays a single joined row -- no demotion, no duplicate (B5)');
+
+select is((select version from agent_board.schema_version), 8,
+  'schema_version stays 8 -- additive');
+
+select finish();
+rollback;