@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/migrations/20260803000100_agent_board_rowid_total_order.sql

@@ -0,0 +1,1201 @@
+-- MBROWID — deterministic board-membership row identity (total order + R-LINK-7 bootstrap).
+-- Closes the remaining third of message-board#79 (bootstrap resurrection of a removed
+-- creator: "2 rows, 1 active") and freezes every latest-row membership reader on a total
+-- order so equal-created_at duplicates cannot be read differently by different defenses.
+--
+-- THEME: board_memberships has no single authoritative row per (board_id, agent_id). The
+-- active-membership unique index is PARTIAL —
+-- idx_agent_board_board_memberships_active_unique on (board_id, agent_id) WHERE
+-- membership_state in ('joined','subscribed') (20260505000000:34-36) — so a raw INSERT
+-- onto a NON-ACTIVE row creates a SECOND row instead of conflicting. Latest-row readers
+-- previously used `order by created_at desc limit 1`; created_at defaults to
+-- transaction_timestamp() and is equal for same-txn writes, so the tie broke
+-- non-deterministically. Two defenses reading the same pair could disagree.
+--
+-- WHAT THIS MIGRATION DOES
+--   1. Total-order every live latest-row reader: `order by created_at desc, id desc`
+--      (per-agent reads: `agent_id, created_at desc, id desc`). Catalog-derived inventory
+--      (8 functions / 10 sites + v_board_directory):
+--        _active_board_membership_id          (20260506000000 last-definer)
+--        _upsert_board_membership_state       (20260802000100 last-definer) — 1 site
+--        join_board                           (20260730000100 last-definer)
+--        resolve_board_request                (20260730000100 last-definer)
+--        update_board_membership              (20260801000100 last-definer) — 2 sites
+--        list_board_pending_memberships       (20260727000100 last-definer) — 2 sites
+--        create_tasking_delivery              (20260718000200 last-definer; tasks idempotency
+--                                             site counted by COUNT-EQUALITY structural proof)
+--        post_board_message                   (20260718000200 last-definer; messages idempotency
+--                                             site counted by COUNT-EQUALITY structural proof)
+--        v_board_directory                    (DROP+CREATE last definer 20260515000000:397-444)
+--      Bodies are copied forward from the LIVE catalog (pg_get_functiondef /
+--      pg_get_viewdef), not from older migration files. create or replace preserves
+--      grants; the view is drop + create so SELECT is re-granted.
+--
+--   2. bootstrap_board_owner_memberships R-LINK-7 guard (20260723000100 last-definer):
+--      re-seed only when there is NO active row AND NO removed row. NEVER suppress on
+--      'left' alone — that is the sole-owner-lockout recovery trigger pinned by assertion
+--      23 of tests/agent_board_rolereset.test.sql. requested-only and invited-only
+--      creators ARE still re-seeded; a removed+left pair is suppressed.
+--
+--   3a. Duplicate-aware ACTIVE-row selection at EVERY acting read site (not just the
+--      mutator). A pure `order by created_at desc, id desc` can select a higher-id
+--      REMOVED (or REQUESTED) row while an ACTIVE row still exists. Every reader that
+--      then ACTS on the resulting state must prefer active first, then total-order:
+--        order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+--                 created_at desc, id desc
+--      Sites that now prefer active (when one exists), then total-order:
+--        _upsert_board_membership_state       — FOR UPDATE pre-read (avoids 23505)
+--        join_board                           — joinability / idempotent-join state read
+--        update_board_membership              — both sites (authz pre-read + LEAVEIDEM return)
+--        list_board_pending_memberships       — distinct-on-per-agent selection
+--        v_board_directory                    — current_membership lateral
+--      Currently-removed standing (mutator + join_board self-join guard) uses the
+--      R-LINK-7 SET predicate (exists removed AND not exists active), not a single row.
+--
+--   3b. join_board joinability agrees with mutator + grant_board_role on removed+left
+--      histories: the self-join guard uses the R-LINK-7 set predicate for "removed
+--      standing", not just the total-ordered latest row's membership_state. Otherwise a
+--      higher-UUID left row would admit open-board self-join while standing is removed.
+--      Combined with 3a, a low-id ACTIVE + high-id REMOVED pair is treated as active
+--      for idempotent join on private / invite_only boards (the active member is not
+--      locked out of their own board).
+--
+--   3c. Bare total-order retained (deliberately) where the reader is NOT acting on
+--      "current standing" but on newest row regardless of state, or where active is
+--      already filtered by the WHERE clause:
+--        resolve_board_request                — pending-only gate: must see the newest
+--                                               requested/invited marker, not prefer a
+--                                               coexisting active (approval path is for
+--                                               non-active pending rows; active standing
+--                                               is already joinable via join_board)
+--        _active_board_membership_id          — WHERE already restricts to joined|subscribed
+--        create_tasking_delivery / post_board_message — task/message idempotency keys,
+--                                               not membership standing
+--
+-- FOUR RAW INSERT WRITERS — per-writer ruling (IF-0-MBROLERESET-1(c) / EC-MBROWID-4):
+--   1. create_board owner seed (20260723000100) — KEEP RAW.
+--      Runs only on a genuine board insert (if v_did_insert); no prior membership can
+--      exist. on conflict (active) do update covers the slug-collision active case.
+--   2. bootstrap_board_owner_memberships (this migration) — KEEP RAW; FIX THE GUARD
+--      to the R-LINK-7 shape above. The only raw writer that manufactured the harmful
+--      "2 rows, 1 active" resurrection.
+--   3. _redeem_invite_for_agent (20260724000100) — KEEP RAW.
+--      R-LINK-7 guard already refuses removed; on conflict (active) rank-max; left gets
+--      the normal left+joined pair, never a second active row.
+--   4. _fedsession_autojoin_default_board (20260729000100) — KEEP RAW (benign).
+--      not exists (any row) guard + exception when unique_violation then null.
+--   None of the four route through _upsert_board_membership_state: the mutator clamps
+--   role to 'member' on non-active→active re-entry (ROLERESET), which would erase
+--   writer 1's owner seed and writer 3's admin preset.
+--
+-- WHY A TRIGGER IS FORBIDDEN: a BEFORE INSERT/UPDATE trigger on board_memberships
+-- would also fire for the intentional non-default seeders (create_board owner,
+-- bootstrap owner, invite preset_role, fedsession member) and erase their intentional
+-- roles. The clamp and total-order live in the mutator / readers only.
+--
+-- Non-goals: no drop/widen of the partial unique index; no delete/merge/renumber of
+-- existing rows (delivery_recipients, callback_subscriptions, board_invite_redemptions
+-- pin membership row identity via FK); schema_version stays 8.
+--
+-- Additive, forward-only. Last-definer rule: only this file is live for the recreated
+-- objects after apply.
+
+-- 1. _active_board_membership_id ---------------------------------------------------------
+CREATE OR REPLACE FUNCTION agent_board._active_board_membership_id(p_board_id uuid, p_agent_id uuid)
+ RETURNS uuid
+ LANGUAGE sql
+ STABLE
+AS $$
+  select bm.id
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('joined', 'subscribed')
+   order by bm.created_at desc, bm.id desc
+   limit 1
+$$;
+-- 2. _upsert_board_membership_state (total order + active-prefer + R-LINK-7 set) ---------
+CREATE OR REPLACE FUNCTION agent_board._upsert_board_membership_state(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS agent_board.board_memberships
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_metadata jsonb;
+  -- EC-MBROWID-3: currently-removed standing (R-LINK-7 set form), not a single row.
+  v_currently_removed boolean;
+begin
+  if p_membership_state not in ('requested', 'invited', 'joined', 'subscribed', 'left', 'removed') then
+    raise exception 'invalid board membership state' using errcode = '22023';
+  end if;
+
+  -- Metadata must be a JSON OBJECT. Previously a scalar/array was stored verbatim on insert and
+  -- concatenated on update; the reserved-key strip below iterates keys, so a non-object would raise
+  -- an opaque internal error. Fail explicitly instead. Reachable from the CLI `--metadata`, which
+  -- parses arbitrary JSON — this is a deliberate, declared behavior change for ALL mutator callers.
+  if jsonb_typeof(coalesce(p_metadata, '{}'::jsonb)) <> 'object' then
+    raise exception 'board membership metadata must be a JSON object' using errcode = '22023';
+  end if;
+
+  -- Reserved namespace: `ops_*` keys are operational state (the retention sweep's skip marker
+  -- `ops_retained_at`, read for board_memberships at 20260513000001:122) and must never be writable
+  -- by a caller whose own row they govern. Strip them from caller input; operational writers set
+  -- the column directly.
+  select coalesce(jsonb_object_agg(e.key, e.value), '{}'::jsonb)
+    into v_metadata
+    from jsonb_each(coalesce(p_metadata, '{}'::jsonb)) as e(key, value)
+   where e.key not like 'ops\_%';
+
+  -- EC-MBROWID-3 / R-LINK-7: currently-removed standing is the SET predicate
+  -- (exists removed AND no active), not a single total-ordered row. A higher-id
+  -- removed row can coexist with an active row; inferring "removed" from the
+  -- total-order winner alone would then try to activate the removed row and
+  -- collide with idx_agent_board_board_memberships_active_unique (23505).
+  -- Capture standing before the row lock so the predicate is independent of
+  -- which physical row the active-preferring SELECT below returns.
+  v_currently_removed :=
+    exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state = 'removed'
+    ) and not exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state in ('joined', 'subscribed')
+    );
+
+  -- Duplicate-aware ACTIVE-row selection (3a): prefer an active row when one
+  -- exists, then total-order by created_at desc, id desc. A pure total-order
+  -- can select a higher-id REMOVED row while an ACTIVE row still exists.
+  -- When v_currently_removed, no active row exists and the total-order pick is
+  -- non-active (re-entry clamp applies below).
+  select *
+    into v_membership
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1
+   for update;
+
+  if v_membership.id is null then
+    -- INSERT branch intentionally omits `role` so a no-prior-row entry takes the table default
+    -- (20260717000100:13-15). Do not write role here — an explicit write is wrong.
+    insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, left_at, metadata)
+    values (
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      p_created_by_agent_id,
+      case when p_membership_state in ('left', 'removed') then now() else null end,
+      v_metadata
+    )
+    returning * into v_membership;
+  else
+    update agent_board.board_memberships bm
+       set membership_state = p_membership_state,
+           created_by_agent_id = coalesce(p_created_by_agent_id, bm.created_by_agent_id),
+           -- PRESERVE the first departure time. Restamping it would let the departing agent (or a
+           -- re-kicking owner) push its own row past the retention cutoff (20260513000001:121).
+           left_at = case
+                       when p_membership_state in ('left', 'removed') then
+                         case
+                           -- SAME terminal state re-asserted: preserve the FIRST departure time so a
+                           -- repeat call cannot push the retention cutoff forward.
+                           when v_membership.membership_state = p_membership_state
+                             then coalesce(v_membership.left_at, now())
+                           -- GENUINE transition (notably left -> removed, an owner barring
+                           -- invite-link re-entry for an already-departed agent) stamps NOW. R-LINK-7
+                           -- deliberately does not block voluntary 'left' (20260724000100:321-322),
+                           -- so this is the real kick moment; inheriting the earlier departure would
+                           -- both lose the audit answer and make the marker row retention-eligible
+                           -- prematurely.
+                           else now()
+                         end
+                       else null
+                     end,
+           -- ROLERESET (#79): clamp role to the table default on non-active -> active re-entry.
+           -- Hardcoded 'member' (column default at 20260717000100:13-15); do not read
+           -- information_schema at runtime. Active -> active preserves bm.role (including owner).
+           -- Unconditional — no service_role exemption.
+           -- MBROWID: origin is non-active when the selected row is non-active OR when
+           -- currently-removed standing holds (R-LINK-7 set form). With active-preferring
+           -- selection those agree; the set form is load-bearing against equal-created_at
+           -- removed+left duplicates where a single-row read would flip with id order.
+           role = case
+                    when p_membership_state in ('joined', 'subscribed')
+                     and (
+                       v_membership.membership_state not in ('joined', 'subscribed')
+                       or v_currently_removed
+                     )
+                    then 'member'
+                    else bm.role
+                  end,
+           metadata = coalesce(bm.metadata, '{}'::jsonb) || v_metadata,
+           updated_at = now()
+     where bm.id = v_membership.id
+     returning * into v_membership;
+  end if;
+
+  return v_membership;
+end;
+$$;
+-- 3. bootstrap_board_owner_memberships (R-LINK-7 guard) ---------------------------------
+CREATE OR REPLACE FUNCTION agent_board.bootstrap_board_owner_memberships()
+ RETURNS TABLE(board_id uuid, owner_agent_id uuid, membership_id uuid)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+#variable_conflict use_column
+declare
+  v_row record;
+  v_membership_id uuid;
+begin
+  -- service_role-only: current_agent_id() is null for service_role, non-null for any
+  -- authenticated principal (guarded here in addition to the EXECUTE revoke below).
+  if not agent_board._is_service_role() then
+    raise exception 'bootstrap_board_owner_memberships is service_role-only' using errcode = '42501';
+  end if;
+
+  -- R-LINK-7 guard shape (structural proof requires no-active AND no-removed
+  -- contiguously): re-seed only when the creator has no active membership AND is
+  -- not currently removed. NEVER suppress on 'left' alone — that is the
+  -- sole-owner-lockout recovery trigger (agent_board_rolereset.test.sql assertion
+  -- 23). requested/invited-only creators still re-seed; a removed+left pair is
+  -- suppressed.
+  for v_row in
+    select b.id as board_id, b.created_by_agent_id as owner_agent_id
+      from agent_board.boards b
+     where not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = b.id
+          and bm.agent_id = b.created_by_agent_id
+          and bm.membership_state in ('joined', 'subscribed')
+     )
+       and not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = b.id
+          and bm.agent_id = b.created_by_agent_id
+          and bm.membership_state = 'removed'
+     )
+  loop
+    insert into agent_board.board_memberships as bm(board_id, agent_id, membership_state, role, created_by_agent_id)
+    values (v_row.board_id, v_row.owner_agent_id, 'joined', 'owner', v_row.owner_agent_id)
+    on conflict (board_id, agent_id) where (membership_state in ('joined', 'subscribed'))
+      do update set role = 'owner', updated_at = now()
+    returning bm.id into v_membership_id;
+
+    board_id := v_row.board_id;
+    owner_agent_id := v_row.owner_agent_id;
+    membership_id := v_membership_id;
+    return next;
+  end loop;
+end;
+$$;
+-- 4. join_board (active-prefer + total order + R-LINK-7 joinability) --------------------
+CREATE OR REPLACE FUNCTION agent_board.join_board(p_board_id uuid, p_agent_id uuid, p_membership_state text DEFAULT 'joined'::text, p_created_by_agent_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_board agent_board.boards%rowtype;
+  v_existing_state text;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_membership_state not in ('joined', 'subscribed') then
+    raise exception 'join_board only accepts joined or subscribed' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_agent_id) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+  if p_created_by_agent_id is not null and not exists (select 1 from agent_board.agents where id = p_created_by_agent_id) then
+    raise exception 'creator agent not found' using errcode = 'P0002';
+  end if;
+
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+
+  -- MBROWID (3a): prefer ACTIVE standing for joinability / idempotent-join. A bare
+  -- total-order can surface a high-id REMOVED row while a low-id JOINED row exists,
+  -- locking an active member out of their own private / invite_only board (P0002).
+  select bm.membership_state
+    into v_existing_state
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1;
+
+  if v_actor is not null and v_actor <> p_agent_id and v_actor <> v_board.created_by_agent_id then
+    raise exception 'board membership actor mismatch' using errcode = '42501';
+  end if;
+
+  -- NULLFIX (CR): v_existing_state is NULL when the caller has NO membership row, and the original
+  -- guard then evaluated to NULL — `not (false or false or NULL)` is NULL, not TRUE — so `if NULL
+  -- then` never fired and ANY resolvable actor self-joined ANY board, private ones included. That
+  -- (not the null-actor bypass) was the true root cause of the live "joined a private invite_only
+  -- board with no invite" finding, and it is reachable by an ACTIVE agent, which the GATENULL guard
+  -- above cannot touch. coalesce() makes the absent-row case FALSE so the raise fires.
+  --
+  -- MBROWID (3b): a 'removed' agent is excluded from self-joining even an OPEN board via the
+  -- R-LINK-7 SET predicate (exists removed AND no active), not a single latest-row state.
+  -- Total-ordering the latest-row read alone is insufficient: a removed+left pair with equal
+  -- created_at can surface 'left' as the total-order winner while standing is still removed
+  -- (mutator + grant_board_role already use set-based rules). The three defenses must agree.
+  if v_actor is not null
+     and v_actor = p_agent_id
+     and v_board.created_by_agent_id <> v_actor
+     and not (
+       not (
+         exists (
+           select 1 from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = p_agent_id
+              and bm.membership_state = 'removed'
+         ) and not exists (
+           select 1 from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = p_agent_id
+              and bm.membership_state in ('joined', 'subscribed')
+         )
+       )
+       and (
+         v_board.visibility = 'open'
+         or (v_board.visibility = 'invite_only' and coalesce(v_existing_state, '') = 'invited')
+         or coalesce(v_existing_state, '') in ('joined', 'subscribed')
+       )
+     ) then
+    raise exception 'board is not joinable by this agent' using errcode = 'P0002';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    p_membership_state,
+    coalesce(p_created_by_agent_id, p_agent_id),
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.created_at, v_membership.updated_at;
+end;
+$$;
+-- 5. resolve_board_request --------------------------------------------------------------
+CREATE OR REPLACE FUNCTION agent_board.resolve_board_request(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_board agent_board.boards%rowtype;
+  v_existing_state text;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_membership_state not in ('joined', 'subscribed', 'removed') then
+    raise exception 'resolve_board_request only accepts joined, subscribed, or removed' using errcode = '22023';
+  end if;
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null then
+    if v_board.role_gate_enforced then
+      -- Gate ON: NO creator exemption. Every actor (including a demoted creator)
+      -- must hold an active owner/admin membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+           and bm.role in ('owner', 'admin')
+      ) then
+        raise exception 'board request resolution requires owner or admin role' using errcode = '42501';
+      end if;
+    elsif v_actor <> v_board.created_by_agent_id then
+      -- Gate OFF: creator bypasses; any other actor needs an active membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+      ) then
+        raise exception 'board request resolution requires active membership' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  select bm.membership_state
+    into v_existing_state
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by bm.created_at desc, bm.id desc
+   limit 1;
+
+  -- NULLFIX (CR): same NULL-falsy hazard — with NO membership row v_existing_state is NULL and
+  -- `NULL not in (...)` is NULL, so the raise never fired and a caller could "resolve" an agent
+  -- that had never requested or been invited STRAIGHT to joined, bypassing the whole request path
+  -- (reachable by any active member on a gate-OFF board, incl. via `rooms approve --agent-id`).
+  if coalesce(v_existing_state, '') not in ('requested', 'invited') then
+    raise exception 'pending board membership not found' using errcode = 'P0002';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    p_membership_state,
+    p_created_by_agent_id,
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$$;
+-- 6. update_board_membership (both sites: active-prefer + total order) ------------------
+CREATE OR REPLACE FUNCTION agent_board.update_board_membership(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_board agent_board.boards%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+  v_is_service boolean := agent_board._is_service_role();
+  v_existing_state text;
+  v_target_role text;
+  v_actor_role text;
+begin
+  -- (1) Unresolved principal fails closed (GATENULL #58 posture). Raised before any lookup so this
+  -- cannot be used as a membership-existence oracle.
+  if v_actor is null and not v_is_service then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  -- (2) AUTHORITY BEFORE DISCLOSURE. For a caller acting on ANOTHER agent's row the owner/admin
+  -- check runs BEFORE the membership lookup, so an unauthorized caller cannot distinguish
+  -- P0002 'board membership not found' from 42501 and thus cannot probe whether an arbitrary
+  -- (board_id, agent_id) pair has a membership row. (The self branch legitimately learns about its
+  -- own membership, and the service path is the operator.)
+  if not v_is_service and v_actor <> p_agent_id then
+    select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+    if v_board.id is null then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    select bm.role
+      into v_actor_role
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = v_actor
+       and bm.membership_state in ('joined', 'subscribed')
+     limit 1;
+    if v_actor_role is null or v_actor_role not in ('owner', 'admin') then
+      raise exception 'board membership change requires owner or admin role'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- (3) Pre-existing precondition, preserved. Also captures the target's CURRENT role for the
+  -- rank check below.
+  -- MBROWID (3a): prefer ACTIVE standing. Bare total-order can surface a high-id REMOVED
+  -- row while a low-id JOINED row exists, so self-service would reject a legitimate
+  -- joined->joined toggle with 42501 'self membership change not permitted'.
+  select bm.membership_state, bm.role
+    into v_existing_state, v_target_role
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1;
+  if v_existing_state is null then
+    raise exception 'board membership not found' using errcode = 'P0002';
+  end if;
+
+  -- (4) MEMBSTATE authorization. Skipped ONLY for a genuine service_role/operator caller; every
+  -- authenticated caller (whose actor is guaranteed non-null by step 1) is gated.
+  if not v_is_service then
+    if v_actor = p_agent_id then
+      -- SELF-SERVICE. Deliberately NO board lookup on this branch: the board row is only needed
+      -- for the authority checks below, and requiring an ACTIVE board here would strand an agent
+      -- holding a live membership on an ARCHIVED board with no way to leave it (leave_board
+      -- delegates straight into this RPC, 20260512000002:154-158).
+      --
+      -- Leaving is permitted only FROM a live/pending state, and joined<->subscribed may be
+      -- toggled. Promotion INTO the board is NOT permitted — that belongs to the approval path.
+      -- The 'removed' exclusion is load-bearing: allowing removed -> left would let a kicked agent
+      -- erase the 'removed' marker (memberships are updated IN PLACE, so the row IS the record),
+      -- which is exactly the marker _redeem_invite_for_agent's R-LINK-7 defense reads
+      -- (20260724000100:323-335) — i.e. it would launder a kick into invite-link re-entry.
+      --
+      -- LEAVEIDEM (#81): a same-state TERMINAL call is additionally permitted. It is a no-op
+      -- (returned unchanged at step 5), so it neither erases nor refreshes the marker — it simply
+      -- restores idempotence to leave_board without widening the transition set.
+      if not (
+        (p_membership_state = 'left'
+         and v_existing_state in ('joined', 'subscribed', 'invited', 'requested'))
+        or (p_membership_state in ('joined', 'subscribed')
+            and v_existing_state in ('joined', 'subscribed'))
+        or (p_membership_state = v_existing_state
+            and p_membership_state in ('left', 'removed'))
+      ) then
+        raise exception 'self membership change not permitted; use the join/approval path'
+          using errcode = '42501';
+      end if;
+    else
+      -- ACTING ON ANOTHER AGENT'S MEMBERSHIP. The board-active check and the ACTIVE owner/admin
+      -- requirement already ran in step (2) (authority before disclosure). This RPC is the
+      -- schema's only eviction path — no sibling can move a JOINED member to removed
+      -- (resolve_board_request only resolves requested/invited, 20260725000100:212) — so it is
+      -- gated more strictly than its siblings, with NO creator exemption: a bare
+      -- created_by_agent_id is deliberately NOT sufficient. ROOMOWN seeds the creator's owner
+      -- membership at create_board time (20260723000100), so a legitimate creator holds one, while
+      -- a DEMOTED or REMOVED creator must not retain eviction power (the R-DELEG-1 lesson).
+      --
+      -- STRICT RANK SUPERIORITY (owner=4 > admin=3 > member=2 > observer=1). Without it an admin
+      -- could evict the OWNER, or admins could evict each other.
+      if agent_board._role_rank(v_actor_role)
+         <= agent_board._role_rank(coalesce(v_target_role, '')) then
+        raise exception 'board membership change requires a higher board role than the target'
+          using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  -- (5) LEAVEIDEM (#81): a same-state TERMINAL call is a TRUE no-op — return the row untouched
+  -- rather than re-entering the mutator, which would restamp left_at and re-merge metadata.
+  -- Placed AFTER the authorization block on purpose: returning early before step (2)/(4) would
+  -- hand an UNAUTHORIZED caller a successful no-op instead of 42501, turning this RPC into a
+  -- membership-state oracle for arbitrary (board, agent) pairs. Authority is still required; the
+  -- entitled caller simply gets an unchanged row.
+  -- Scoped to the AUTHENTICATED path on purpose: a service_role/operator caller re-asserting a
+  -- terminal state may legitimately be attaching an annotation via p_metadata (CLI --metadata), and
+  -- silently dropping it would be a lossy success. The operator falls through to the mutator, which
+  -- now preserves left_at for an UNCHANGED terminal state anyway — so the operator keeps the
+  -- metadata merge without reacquiring the restamp defect.
+  if not v_is_service
+     and p_membership_state = v_existing_state
+     and p_membership_state in ('left', 'removed') then
+    -- MBROWID (3a): same active-preferring total-order as the authz pre-read above so
+    -- the no-op return row agrees with the state used for authorization.
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  select * into v_membership
+    from agent_board._upsert_board_membership_state(
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      null,
+      p_metadata
+    );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$$;
+-- 7. list_board_pending_memberships (both sites: active-prefer + total order) -----------
+CREATE OR REPLACE FUNCTION agent_board.list_board_pending_memberships(p_board_id uuid)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, handle text, display_name text, agent_type text, membership_state text, role text, created_by_agent_id uuid, requested_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ STABLE SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- FLAT owner/admin gate, ALWAYS. Fail closed on a null actor (suspended/unmapped
+  -- principal, or service_role) — mirrors set_board_role_gate, NOT the write-RPC
+  -- `if v_actor is not null` bypass. Authz precedes disclosure.
+  if v_actor is null
+     or not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = p_board_id
+          and bm.agent_id = v_actor
+          and bm.role in ('owner', 'admin')
+          and bm.membership_state in ('joined', 'subscribed')
+     ) then
+    raise exception 'only a board owner or admin may list pending memberships' using errcode = '42501';
+  end if;
+
+  -- Current standing per agent, scoped to this board, filtered to the pending set.
+  -- MBROWID (3a): prefer ACTIVE over bare total-order so a stale high-id REQUESTED
+  -- (or REMOVED) row cannot surface an already-active agent as pending. The dedup
+  -- subquery is ALSO scoped to p_board_id so no other board's rows can leak in.
+  -- Outer ORDER BY remains bare total-order (presentation only; no state acted on).
+  return query
+  select
+    latest.id,
+    latest.board_id,
+    latest.agent_id,
+    a.handle,
+    a.display_name,
+    a.agent_type,
+    latest.membership_state,
+    latest.role,
+    latest.created_by_agent_id,
+    latest.created_at as requested_at,
+    latest.updated_at
+  from (
+    select distinct on (bm.agent_id) bm.*
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+     order by
+       bm.agent_id,
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+  ) latest
+  join agent_board.agents a on a.id = latest.agent_id
+  where latest.membership_state in ('requested', 'invited')
+  order by latest.created_at desc, latest.id desc;
+end;
+$$;
+-- 8. create_tasking_delivery (idempotency total-order for COUNT-EQUALITY) ---------------
+CREATE OR REPLACE FUNCTION agent_board.create_tasking_delivery(p_thread_id uuid, p_created_by_agent_id uuid, p_title text, p_details text DEFAULT NULL::text, p_recipient_agent_ids uuid[] DEFAULT NULL::uuid[], p_board_id uuid DEFAULT NULL::uuid, p_priority text DEFAULT 'medium'::text, p_orchestration_mode text DEFAULT 'distributed'::text, p_idempotency_key text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(task_id uuid, created_event_id uuid, delivered_recipient_count integer, inbox_item_count integer, callback_outbox_count integer, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_task agent_board.tasks%rowtype;
+  v_created_event_id uuid;
+  v_created_task record;
+  v_recipient_ids uuid[];
+  v_recipient_id uuid;
+  v_membership record;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_delivered_count integer := 0;
+  v_inbox_count integer := 0;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  if nullif(trim(p_title), '') is null then
+    raise exception 'task title is required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if p_orchestration_mode not in ('distributed', 'hierarchical', 'hybrid') then
+    raise exception 'invalid orchestration mode' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  if (p_recipient_agent_ids is null or cardinality(p_recipient_agent_ids) = 0) and p_board_id is null then
+    raise exception 'tasking delivery requires explicit recipients or a board target' using errcode = '22023';
+  end if;
+  if p_recipient_agent_ids is not null and array_position(p_recipient_agent_ids, null) is not null then
+    raise exception 'recipient_agent_ids must not contain nulls' using errcode = '22023';
+  end if;
+  if p_board_id is not null then
+    if not exists (select 1 from agent_board.boards where id = p_board_id) then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    if not agent_board._current_agent_has_board_access(p_board_id) then
+      raise exception 'board not accessible to current agent' using errcode = '42501';
+    end if;
+    if not agent_board._current_agent_can_send_to_board(p_board_id) then
+      raise exception 'board send requires a non-observer board role' using errcode = '42501';
+    end if;
+  end if;
+
+  select array_agg(distinct recipient_id)
+    into v_recipient_ids
+    from unnest(coalesce(p_recipient_agent_ids, '{}'::uuid[])) as recipient_id;
+
+  if v_recipient_ids is not null and (
+    select count(*)
+      from agent_board.agents
+     where id = any(v_recipient_ids)
+  ) <> cardinality(v_recipient_ids) then
+    raise exception 'recipient agent not found' using errcode = 'P0002';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      p_board_id,
+      'create_tasking_delivery',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'create_tasking_delivery:' || p_thread_id::text || ':' || v_actor_agent_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_task
+      from agent_board.tasks
+     where thread_id = p_thread_id
+       and created_by_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'create_tasking_delivery'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc, id desc
+     limit 1;
+  end if;
+
+  if v_task.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'create_tasking_delivery',
+        'priority', p_priority
+      );
+    if p_board_id is not null then
+      v_metadata := v_metadata || jsonb_build_object('boardId', p_board_id::text);
+    end if;
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_task
+      from agent_board.create_task(
+        p_thread_id,
+        v_actor_agent_id,
+        trim(p_title),
+        p_details,
+        null,
+        null,
+        p_priority,
+        p_orchestration_mode,
+        v_metadata
+      );
+
+    v_created_event_id := v_created_task.created_event_id;
+
+    select *
+      into v_task
+      from agent_board.tasks
+     where id = v_created_task.task_id;
+  else
+    select te.id
+      into v_created_event_id
+      from agent_board.task_events te
+     where te.task_id = v_task.id
+       and te.event_sequence = 1;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(coalesce(p_details, p_title), 280);
+  v_fetch_descriptor := agent_board._build_fetch_descriptor(
+    'task',
+    v_task.id,
+    'agent_board.v_task_tree',
+    'tasking delivery',
+    jsonb_build_object('threadId', p_thread_id::text)
+  );
+
+  if v_recipient_ids is not null then
+    foreach v_recipient_id in array v_recipient_ids loop
+      v_recipient := agent_board._upsert_delivery_recipient(
+        'tasking',
+        v_recipient_id,
+        'task',
+        null,
+        v_task.id,
+        null,
+        null,
+        null,
+        jsonb_build_object('priority', p_priority)
+      );
+
+      v_inbox := agent_board._upsert_inbox_item(
+        v_recipient.id,
+        v_recipient_id,
+        null,
+        v_recipient.delivery_mode,
+        'task',
+        null,
+        v_task.id,
+        null,
+        trim(p_title),
+        v_preview,
+        p_priority,
+        true,
+        false,
+        v_fetch_descriptor,
+        jsonb_build_object('threadId', p_thread_id::text)
+      );
+
+      v_delivered_count := v_delivered_count + 1;
+      v_inbox_count := v_inbox_count + 1;
+      v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+    end loop;
+  end if;
+
+  if p_board_id is not null then
+    for v_membership in
+      select bm.id, bm.agent_id
+        from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by bm.created_at
+    loop
+      v_recipient := agent_board._upsert_delivery_recipient(
+        'tasking',
+        v_membership.agent_id,
+        'task',
+        null,
+        v_task.id,
+        null,
+        p_board_id,
+        v_membership.id,
+        jsonb_build_object('priority', p_priority)
+      );
+
+      v_inbox := agent_board._upsert_inbox_item(
+        v_recipient.id,
+        v_membership.agent_id,
+        v_recipient.board_id,
+        v_recipient.delivery_mode,
+        'task',
+        null,
+        v_task.id,
+        null,
+        trim(p_title),
+        v_preview,
+        p_priority,
+        true,
+        v_recipient.board_id is not null,
+        v_fetch_descriptor,
+        jsonb_build_object('threadId', p_thread_id::text, 'boardId', p_board_id::text)
+      );
+
+      v_delivered_count := v_delivered_count + 1;
+      v_inbox_count := v_inbox_count + 1;
+      v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+    end loop;
+  end if;
+
+  return query
+  select v_task.id, v_created_event_id, v_delivered_count, v_inbox_count, v_callback_count, v_task.created_at, v_task.updated_at;
+end;
+$$;
+-- 9. post_board_message (idempotency total-order for COUNT-EQUALITY) --------------------
+CREATE OR REPLACE FUNCTION agent_board.post_board_message(p_thread_id uuid, p_author_agent_id uuid, p_board_id uuid, p_subject text, p_body text, p_message_type text DEFAULT 'comment'::text, p_priority text DEFAULT 'medium'::text, p_idempotency_key text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(message_id uuid, board_id uuid, delivered_recipient_count integer, callback_outbox_count integer, created_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $$
+declare
+  v_message agent_board.messages%rowtype;
+  v_created_message record;
+  v_membership record;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_delivered_count integer := 0;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_subject), '') is null or nullif(trim(p_body), '') is null then
+    raise exception 'subject and body are required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not exists (select 1 from agent_board.boards where id = p_board_id) then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_has_board_access(p_board_id) then
+    raise exception 'board not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_can_send_to_board(p_board_id) then
+    raise exception 'board send requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      p_board_id,
+      'post_board_message',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'post_board_message:' || p_thread_id::text || ':' || v_actor_agent_id::text || ':' || p_board_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_message
+      from agent_board.messages
+     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'post_board_message'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc, id desc
+     limit 1;
+  end if;
+
+  if v_message.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'post_board_message',
+        'subject', trim(p_subject),
+        'priority', p_priority,
+        'boardId', p_board_id::text
+      );
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_message
+      from agent_board.post_message(
+        p_thread_id,
+        v_actor_agent_id,
+        p_body,
+        p_message_type,
+        null,
+        v_metadata
+      );
+
+    select *
+      into v_message
+      from agent_board.messages
+     where id = v_created_message.message_id;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(p_body, 280);
+  v_fetch_descriptor := agent_board._build_fetch_descriptor(
+    'board',
+    p_board_id,
+    'agent_board.v_board_feed',
+    'board delivery',
+    jsonb_build_object('messageId', v_message.id::text)
+  );
+
+  for v_membership in
+    select bm.id, bm.agent_id
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.membership_state in ('joined', 'subscribed')
+     order by bm.created_at
+  loop
+    v_recipient := agent_board._upsert_delivery_recipient(
+      'board',
+      v_membership.agent_id,
+      'message',
+      v_message.id,
+      null,
+      null,
+      p_board_id,
+      v_membership.id,
+      jsonb_build_object('priority', p_priority)
+    );
+
+    v_inbox := agent_board._upsert_inbox_item(
+      v_recipient.id,
+      v_membership.agent_id,
+      p_board_id,
+      v_recipient.delivery_mode,
+      'message',
+      v_message.id,
+      null,
+      null,
+      trim(p_subject),
+      v_preview,
+      p_priority,
+      true,
+      true,
+      v_fetch_descriptor,
+      jsonb_build_object('threadId', p_thread_id::text, 'boardId', p_board_id::text)
+    );
+
+    v_delivered_count := v_delivered_count + 1;
+    v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+  end loop;
+
+  v_callback_count := v_callback_count + agent_board._queue_board_post_callbacks(
+    p_board_id,
+    v_message.id,
+    trim(p_subject),
+    v_preview,
+    p_priority,
+    v_fetch_descriptor
+  );
+
+  return query
+  select v_message.id, p_board_id, v_delivered_count, v_callback_count, v_message.created_at;
+end;
+$$;
+-- 10. v_board_directory: DROP + CREATE (last definer used drop view, not create or replace)
+-- MBROWID (3a): current_membership lateral prefers ACTIVE standing, then total-order.
+-- Bare total-order can report 'removed' for an active member (high-id removed + low-id
+-- joined) and disagree with _active_board_membership_id.
+drop view if exists agent_board.v_board_directory;
+
+create view agent_board.v_board_directory
+with (security_invoker = true)
+as
+ SELECT b.id AS board_id,
+    b.slug AS board_slug,
+    b.name AS board_name,
+    b.description AS board_description,
+    b.status AS board_status,
+    b.visibility AS board_visibility,
+    b.created_by_agent_id,
+    creator.handle AS created_by_handle,
+    COALESCE(members.active_member_count, 0::bigint) AS active_member_count,
+    current_membership.membership_state AS current_membership_state,
+    COALESCE(board_activity.latest_board_activity_at, b.updated_at) AS latest_board_activity_at,
+    b.created_at,
+    b.updated_at
+   FROM agent_board.boards b
+     JOIN agent_board.agents creator ON creator.id = b.created_by_agent_id
+     LEFT JOIN LATERAL ( SELECT count(*) AS active_member_count
+           FROM agent_board.board_memberships bm
+          WHERE bm.board_id = b.id AND (bm.membership_state = ANY (ARRAY['joined'::text, 'subscribed'::text]))) members ON true
+     LEFT JOIN LATERAL ( SELECT bm.membership_state
+           FROM agent_board.board_memberships bm
+          WHERE bm.board_id = b.id AND bm.agent_id = agent_board.current_agent_id()
+          ORDER BY
+            CASE WHEN bm.membership_state = ANY (ARRAY['joined'::text, 'subscribed'::text]) THEN 0 ELSE 1 END,
+            bm.created_at DESC,
+            bm.id DESC
+         LIMIT 1) current_membership ON true
+     LEFT JOIN LATERAL ( SELECT max(ii.created_at) AS latest_board_activity_at
+           FROM agent_board.inbox_items ii
+          WHERE ii.board_id = b.id AND ii.visible_in_board_feed = true) board_activity ON true
+  WHERE b.status = 'active'::text AND b.visibility <> 'directory_hidden'::text AND (b.visibility = 'open'::text OR b.created_by_agent_id = agent_board.current_agent_id() OR current_membership.membership_state IS NOT NULL);
+
+grant select on agent_board.v_board_directory to authenticated, service_role;
+
+
+-- Re-issue comments on recreated mutator / bootstrap / list / update so next authors
+-- do not inherit a stale ROLERESET-era comment that pretends MBROWID is still deferred.
+comment on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb) is
+  'UNAUTHORIZED PRIMITIVE — accepts any membership state; every caller MUST gate. '
+  'MBROWID: pre-read is duplicate-aware (prefer active, then created_at desc, id desc) and '
+  'currently-removed standing uses the R-LINK-7 set predicate (exists removed AND no active). '
+  'ROLERESET (#79): on the UPDATE path only, clamps role to the table default (''member'', '
+  '20260717000100:13-15) when transitioning from a non-active origin into joined|subscribed; '
+  'INSERT omits role and takes the table default. Active->active preserves role. LEAVEIDEM '
+  '(#81): preserves the FIRST left_at across repeated terminal transitions (the retention sweep '
+  'keys on left_at, 20260513000001:121) and strips the reserved `ops_*` metadata namespace from '
+  'caller input (the sweep skips rows carrying ops_retained_at). Not a chokepoint — raw-INSERT '
+  'seeders (create_board owner, bootstrap, invite redeem, fedsession autojoin) bypass this '
+  'function by design.';
+
+comment on function agent_board.bootstrap_board_owner_memberships() is
+  'service_role-only repair sweep: seeds a joined owner membership for boards whose creator '
+  'has no active membership AND is not currently removed (R-LINK-7). Voluntary left remains '
+  'the sole-owner-lockout recovery trigger. Takes no caller/role param.';
+
+comment on function agent_board.update_board_membership(uuid, uuid, text, jsonb) is
+  'Updates a board membership state. MEMBSTATE (#75): service_role retains full '
+  'modify-on-behalf-of; an authenticated caller with an unresolved actor fails closed (42501); '
+  'a caller acting on its OWN membership may only leave or toggle joined<->subscribed; a caller '
+  'acting on ANOTHER agent''s membership must hold an active owner/admin membership AND strictly '
+  'higher board rank than the target. LEAVEIDEM (#81): a same-state terminal call is a TRUE no-op '
+  'returned unchanged AFTER authorization. MBROWID: both latest-row reads prefer an active row '
+  'when one exists, then created_at desc, id desc.';
+
+comment on function agent_board.list_board_pending_memberships(uuid) is
+  'Owner/admin-gated reader for a board''s pending (requested + invited) memberships, '
+  'current-standing-per-agent preferring active then total order '
+  '(agent_id, active-first, created_at desc, id desc). FLAT owner/admin gate ALWAYS, '
+  'fail-closed on a null actor (else 42501). Board-scoped. service_role hits 42501 '
+  '(null current_agent_id()); operators read the table directly.';
+
+-- Privileges: create or replace preserves EXECUTE; re-state bootstrap and view grants.
+revoke all on function agent_board.bootstrap_board_owner_memberships() from public, anon, authenticated;
+grant execute on function agent_board.bootstrap_board_owner_memberships() to service_role;
+
+revoke all on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb)
+  from public, anon, authenticated;
+grant execute on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb)
+  to service_role;
+
+grant execute on function agent_board.join_board(uuid, uuid, text, uuid, jsonb)
+  to authenticated, service_role;
+grant execute on function agent_board.resolve_board_request(uuid, uuid, text, uuid, jsonb)
+  to authenticated, service_role;
+grant execute on function agent_board.update_board_membership(uuid, uuid, text, jsonb)
+  to authenticated, service_role;
+grant execute on function agent_board.list_board_pending_memberships(uuid)
+  to authenticated, service_role;