@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_rowid.test.sql

@@ -0,0 +1,1274 @@
+-- MBROWID pgTAP: deterministic board-membership row identity.
+--
+-- This suite is intentionally written against the complete post-fix contract:
+-- total-order ties and every current-membership reader must prefer an active row.
+--
+-- Load-bearing methodology:
+--   * structural total-order proof strips SQL comments and scopes every counted
+--     ORDER BY site to its source relation. Every created_at DESC occurrence in
+--     each read statement must also be a created_at DESC, id DESC occurrence.
+--   * equal explicit past created_at values are the named exception to the normal
+--     distinct-timestamp fixture rule. Distinct timestamps never consult the UUID
+--     tiebreak and would make the behavioral proof vacuous.
+--   * UUID id DESC provides agreement, not temporal recency. Explicit IDs control
+--     both arrangements below.
+--   * every expected raise uses throws_ok; authenticated SECURITY DEFINER probes are
+--     driven by JWT claims only and carry both required principal controls.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(98);
+
+create temp view _rowid_order_sites as
+with defs as (
+  select
+    p.proname::text as proname,
+    pg_get_function_identity_arguments(p.oid) as args,
+    regexp_replace(
+      regexp_replace(
+        pg_get_functiondef(p.oid),
+        E'--[^\\n]*(\\n|$)',
+        E'\\n',
+        'g'
+      ),
+      E'/\\*([^*]|\\*+[^*/])*\\*+/',
+      ' ',
+      'g'
+    ) as def
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+  where n.nspname = 'agent_board'
+    and p.prokind = 'f'
+),
+statements as (
+  select
+    proname,
+    args,
+    statement_ordinality::int as statement_ordinality,
+    statement
+  from defs
+  cross join lateral regexp_split_to_table(def, ';')
+    with ordinality as split(statement, statement_ordinality)
+)
+select
+  proname,
+  args,
+  statement_ordinality,
+  case
+    when statement ~* 'from\s+agent_board\.board_memberships'
+      then 'board_memberships'
+    when statement ~* 'from\s+agent_board\.tasks'
+      then 'tasks'
+    when statement ~* 'from\s+agent_board\.messages'
+      then 'messages'
+  end as source_relation,
+  (select count(*)::int
+     from regexp_matches(statement, 'created_at\s+desc', 'gi')) as created_at_desc_count,
+  (select count(*)::int
+     from regexp_matches(
+       statement,
+       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
+       'gi'
+     )) as total_order_count
+from statements
+where statement ~* 'order\s+by.*created_at\s+desc'
+  and (
+    statement ~* 'from\s+agent_board\.board_memberships'
+    or (
+      proname = 'create_tasking_delivery'
+      and statement ~* 'from\s+agent_board\.tasks'
+    )
+    or (
+      proname = 'post_board_message'
+      and statement ~* 'from\s+agent_board\.messages'
+    )
+  );
+
+create temp view _rowid_function_order_counts as
+select
+  proname,
+  args,
+  sum(created_at_desc_count)::int as created_at_desc_count,
+  sum(total_order_count)::int as total_order_count
+from _rowid_order_sites
+group by proname, args;
+
+create temp table _rowid_fixture (
+  removed_board uuid,
+  removed_creator uuid,
+  left_board uuid,
+  left_creator uuid,
+  no_row_board uuid,
+  no_row_creator uuid,
+  requested_board uuid,
+  requested_creator uuid,
+  invited_board uuid,
+  invited_creator uuid,
+  mixed_board uuid,
+  mixed_creator uuid,
+  writer_board uuid,
+  writer_owner uuid,
+  writer_owner_user uuid,
+  redeem_board uuid,
+  redeem_owner uuid,
+  redeem_removed uuid,
+  redeem_left uuid,
+  redeem_code text,
+  fed_board uuid,
+  fed_agent uuid,
+  fed_provider text,
+  standing_a_board uuid,
+  standing_a_owner uuid,
+  standing_a_agent uuid,
+  standing_a_user uuid,
+  standing_a_expected_id uuid,
+  standing_b_board uuid,
+  standing_b_owner uuid,
+  standing_b_agent uuid,
+  standing_b_user uuid,
+  standing_b_expected_id uuid,
+  active_a_board uuid,
+  active_a_owner uuid,
+  active_a_owner_user uuid,
+  active_a_agent uuid,
+  active_a_agent_user uuid,
+  active_a_expected_id uuid,
+  active_b_board uuid,
+  active_b_owner uuid,
+  active_b_agent uuid,
+  active_b_agent_user uuid,
+  active_b_expected_id uuid,
+  active_c_board uuid,
+  active_c_owner uuid,
+  active_c_agent uuid,
+  active_c_agent_user uuid,
+  active_c_expected_id uuid,
+  pending_board uuid,
+  pending_agent uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_removed_creator uuid := gen_random_uuid();
+  v_left_creator uuid := gen_random_uuid();
+  v_no_row_creator uuid := gen_random_uuid();
+  v_requested_creator uuid := gen_random_uuid();
+  v_invited_creator uuid := gen_random_uuid();
+  v_mixed_creator uuid := gen_random_uuid();
+  v_writer_owner uuid := gen_random_uuid();
+  v_writer_owner_user uuid;
+  v_redeem_owner uuid := gen_random_uuid();
+  v_redeem_removed uuid := gen_random_uuid();
+  v_redeem_left uuid := gen_random_uuid();
+  v_fed_owner uuid := gen_random_uuid();
+  v_fed_agent uuid := gen_random_uuid();
+  v_standing_a_owner uuid := gen_random_uuid();
+  v_standing_b_owner uuid := gen_random_uuid();
+  v_active_a_owner uuid := gen_random_uuid();
+  v_active_b_owner uuid := gen_random_uuid();
+  v_active_c_owner uuid := gen_random_uuid();
+  v_standing_a_agent uuid := '10000000-0000-4000-8000-000000000001';
+  v_standing_b_agent uuid := '10000000-0000-4000-8000-000000000002';
+  v_active_a_agent uuid := '10000000-0000-4000-8000-000000000003';
+  v_active_b_agent uuid := '10000000-0000-4000-8000-000000000004';
+  v_active_c_agent uuid := '10000000-0000-4000-8000-000000000005';
+  v_pending_agent uuid := '10000000-0000-4000-8000-000000000006';
+  v_standing_a_user uuid;
+  v_standing_b_user uuid;
+  v_active_a_owner_user uuid;
+  v_active_a_agent_user uuid;
+  v_active_b_agent_user uuid;
+  v_active_c_agent_user uuid;
+  v_removed_board uuid := gen_random_uuid();
+  v_left_board uuid;
+  v_no_row_board uuid := gen_random_uuid();
+  v_requested_board uuid := gen_random_uuid();
+  v_invited_board uuid := gen_random_uuid();
+  v_mixed_board uuid := gen_random_uuid();
+  v_writer_board uuid;
+  v_redeem_board uuid;
+  v_fed_board uuid;
+  v_standing_a_board uuid;
+  v_standing_b_board uuid;
+  v_active_a_board uuid;
+  v_active_b_board uuid;
+  v_active_c_board uuid;
+  v_pending_board uuid;
+  v_redeem_code text;
+  v_fed_provider text;
+begin
+  v_writer_owner_user := public.ensure_github_user(
+    'rowid-writer-' || s,
+    'rowid-writer-' || s || '@example.test',
+    'rowid-writer-' || s,
+    'ROWID Writer'
+  );
+  v_standing_a_user := public.ensure_github_user(
+    'rowid-standing-a-' || s,
+    'rowid-standing-a-' || s || '@example.test',
+    'rowid-standing-a-' || s,
+    'ROWID Standing A'
+  );
+  v_standing_b_user := public.ensure_github_user(
+    'rowid-standing-b-' || s,
+    'rowid-standing-b-' || s || '@example.test',
+    'rowid-standing-b-' || s,
+    'ROWID Standing B'
+  );
+  v_active_a_owner_user := public.ensure_github_user(
+    'rowid-active-owner-' || s,
+    'rowid-active-owner-' || s || '@example.test',
+    'rowid-active-owner-' || s,
+    'ROWID Active Owner'
+  );
+  v_active_a_agent_user := public.ensure_github_user(
+    'rowid-active-a-' || s,
+    'rowid-active-a-' || s || '@example.test',
+    'rowid-active-a-' || s,
+    'ROWID Active A'
+  );
+  v_active_b_agent_user := public.ensure_github_user(
+    'rowid-active-b-' || s,
+    'rowid-active-b-' || s || '@example.test',
+    'rowid-active-b-' || s,
+    'ROWID Active B'
+  );
+  v_active_c_agent_user := public.ensure_github_user(
+    'rowid-active-c-' || s,
+    'rowid-active-c-' || s || '@example.test',
+    'rowid-active-c-' || s,
+    'ROWID Active C'
+  );
+
+  insert into agent_board.agents(
+    id, agent_type, handle, display_name, status, auth_user_id, owner_user_id
+  )
+  values
+    (v_removed_creator, 'agent', 'rowid-removed-' || s, 'ROWID Removed', 'active', null, null),
+    (v_left_creator, 'agent', 'rowid-left-' || s, 'ROWID Left', 'active', null, null),
+    (v_no_row_creator, 'agent', 'rowid-none-' || s, 'ROWID None', 'active', null, null),
+    (v_requested_creator, 'agent', 'rowid-requested-' || s, 'ROWID Requested', 'active', null, null),
+    (v_invited_creator, 'agent', 'rowid-invited-' || s, 'ROWID Invited', 'active', null, null),
+    (v_mixed_creator, 'agent', 'rowid-mixed-' || s, 'ROWID Mixed', 'active', null, null),
+    (v_writer_owner, 'agent', 'rowid-writer-' || s, 'ROWID Writer', 'active',
+      v_writer_owner_user, v_writer_owner_user),
+    (v_redeem_owner, 'agent', 'rowid-redeem-owner-' || s, 'ROWID Redeem Owner', 'active', null, null),
+    (v_redeem_removed, 'agent', 'rowid-redeem-removed-' || s, 'ROWID Redeem Removed', 'active', null, null),
+    (v_redeem_left, 'agent', 'rowid-redeem-left-' || s, 'ROWID Redeem Left', 'active', null, null),
+    (v_fed_owner, 'agent', 'rowid-fed-owner-' || s, 'ROWID Fed Owner', 'active', null, null),
+    (v_fed_agent, 'agent', 'rowid-fed-agent-' || s, 'ROWID Fed Agent', 'active', null, null),
+    (v_standing_a_owner, 'agent', 'rowid-standing-a-owner-' || s, 'ROWID Standing A Owner', 'active', null, null),
+    (v_standing_b_owner, 'agent', 'rowid-standing-b-owner-' || s, 'ROWID Standing B Owner', 'active', null, null),
+    (v_active_a_owner, 'agent', 'rowid-active-a-owner-' || s, 'ROWID Active A Owner', 'active',
+      v_active_a_owner_user, v_active_a_owner_user),
+    (v_active_b_owner, 'agent', 'rowid-active-b-owner-' || s, 'ROWID Active B Owner', 'active', null, null),
+    (v_active_c_owner, 'agent', 'rowid-active-c-owner-' || s, 'ROWID Active C Owner', 'active', null, null),
+    (v_standing_a_agent, 'agent', 'rowid-standing-a-agent-' || s, 'ROWID Standing A Agent', 'active',
+      v_standing_a_user, v_standing_a_user),
+    (v_standing_b_agent, 'agent', 'rowid-standing-b-agent-' || s, 'ROWID Standing B Agent', 'active',
+      v_standing_b_user, v_standing_b_user),
+    (v_active_a_agent, 'agent', 'rowid-active-a-agent-' || s, 'ROWID Active A Agent', 'active',
+      v_active_a_agent_user, v_active_a_agent_user),
+    (v_active_b_agent, 'agent', 'rowid-active-b-agent-' || s, 'ROWID Active B Agent', 'active',
+      v_active_b_agent_user, v_active_b_agent_user),
+    (v_active_c_agent, 'agent', 'rowid-active-c-agent-' || s, 'ROWID Active C Agent', 'active',
+      v_active_c_agent_user, v_active_c_agent_user),
+    (v_pending_agent, 'agent', 'rowid-pending-agent-' || s, 'ROWID Pending Agent', 'active', null, null);
+
+  -- Bootstrap matrix. left/removed rows satisfy board_memberships_state_left_at;
+  -- requested/invited rows carry NULL left_at.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility)
+  values
+    (v_removed_board, 'rowid-bootstrap-removed-' || s, 'ROWID Bootstrap Removed', v_removed_creator, 'open'),
+    (v_no_row_board, 'rowid-bootstrap-none-' || s, 'ROWID Bootstrap None', v_no_row_creator, 'open'),
+    (v_requested_board, 'rowid-bootstrap-requested-' || s, 'ROWID Bootstrap Requested', v_requested_creator, 'open'),
+    (v_invited_board, 'rowid-bootstrap-invited-' || s, 'ROWID Bootstrap Invited', v_invited_creator, 'open'),
+    (v_mixed_board, 'rowid-bootstrap-mixed-' || s, 'ROWID Bootstrap Mixed', v_mixed_creator, 'open');
+
+  insert into agent_board.board_memberships(
+    board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    (v_removed_board, v_removed_creator, 'removed', 'owner', v_removed_creator,
+      timestamptz '2019-06-01', timestamptz '2019-06-01'),
+    (v_requested_board, v_requested_creator, 'requested', 'owner', v_requested_creator,
+      null, timestamptz '2019-06-02'),
+    (v_invited_board, v_invited_creator, 'invited', 'owner', v_invited_creator,
+      null, timestamptz '2019-06-03'),
+    (v_mixed_board, v_mixed_creator, 'removed', 'owner', v_mixed_creator,
+      timestamptz '2019-06-04', timestamptz '2019-06-04'),
+    (v_mixed_board, v_mixed_creator, 'left', 'owner', v_mixed_creator,
+      timestamptz '2020-06-04', timestamptz '2020-06-04');
+
+  -- The assertion-23 recovery fixture starts as a normal create_board owner seed.
+  select board_id into v_left_board
+    from agent_board.create_board(
+      v_left_creator, 'rowid-bootstrap-left-' || s, 'ROWID Bootstrap Left',
+      'leave-again recovery', '{}'::jsonb, 'open'
+    );
+
+  -- Writer 1: a genuine create_board insert.
+  select board_id into v_writer_board
+    from agent_board.create_board(
+      v_writer_owner, 'rowid-writer-' || s, 'ROWID Writer',
+      'create_board raw writer', '{}'::jsonb, 'private'
+    );
+
+  -- Writer 3: one removed and one left target sharing an unlimited member link.
+  select board_id into v_redeem_board
+    from agent_board.create_board(
+      v_redeem_owner, 'rowid-redeem-' || s, 'ROWID Redeem',
+      'invite redemption raw writer', '{}'::jsonb, 'private'
+    );
+  insert into agent_board.board_memberships(
+    board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    (v_redeem_board, v_redeem_removed, 'removed', 'member', v_redeem_owner,
+      timestamptz '2019-07-01', timestamptz '2019-07-01'),
+    (v_redeem_board, v_redeem_left, 'left', 'member', v_redeem_owner,
+      timestamptz '2019-07-02', timestamptz '2019-07-02');
+  select code into v_redeem_code
+    from agent_board.create_invite_link(
+      v_redeem_board, 'member', 'joined', null, null, v_redeem_owner, '{}'::jsonb
+    );
+
+  -- Writer 4: any pre-existing row must suppress FEDSESSION auto-join.
+  select board_id into v_fed_board
+    from agent_board.create_board(
+      v_fed_owner, 'rowid-fed-' || s, 'ROWID Fed',
+      'fedsession raw writer', '{}'::jsonb, 'private'
+    );
+  insert into agent_board.board_memberships(
+    board_id, agent_id, membership_state, role, created_by_agent_id, created_at
+  )
+  values (
+    v_fed_board, v_fed_agent, 'invited', 'member', v_fed_owner,
+    timestamptz '2019-08-01'
+  );
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id
+  )
+  values (
+    'https://rowid-fed-' || s || '.test', 'message-board', true, true,
+    '{human}', v_fed_board
+  )
+  returning id into v_fed_provider;
+
+  -- Equal-timestamp standing arrangements. Both pairs are removed+left, so
+  -- R-LINK-7 says "removed" regardless of which UUID sorts higher.
+  select board_id into v_standing_a_board
+    from agent_board.create_board(
+      v_standing_a_owner, 'rowid-standing-a-' || s, 'ROWID Standing A',
+      'removed id high', '{}'::jsonb, 'open'
+    );
+  select board_id into v_standing_b_board
+    from agent_board.create_board(
+      v_standing_b_owner, 'rowid-standing-b-' || s, 'ROWID Standing B',
+      'left id high', '{}'::jsonb, 'open'
+    );
+
+  -- A: low LEFT is inserted first; high REMOVED must win the total order.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000101', v_standing_a_board, v_standing_a_agent,
+      'left', 'admin', v_standing_a_owner, timestamptz '2020-01-01', timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000101', v_standing_a_board, v_standing_a_agent,
+      'removed', 'admin', v_standing_a_owner, timestamptz '2020-01-01', timestamptz '2020-01-01');
+
+  -- B: low REMOVED is inserted first; high LEFT must win the total order, while
+  -- the R-LINK-7 set predicate must still preserve removed standing.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000102', v_standing_b_board, v_standing_b_agent,
+      'removed', 'admin', v_standing_b_owner, timestamptz '2020-01-01', timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000102', v_standing_b_board, v_standing_b_agent,
+      'left', 'admin', v_standing_b_owner, timestamptz '2020-01-01', timestamptz '2020-01-01');
+
+  -- EC-MBROWID-3 exact duplicate shape: removed+active at equal created_at.
+  -- The active row is the current standing under R-LINK-7 in BOTH ID arrangements.
+  select board_id into v_active_a_board
+    from agent_board.create_board(
+      v_active_a_owner, 'rowid-active-a-' || s, 'ROWID Active A',
+      'active id high', '{}'::jsonb, 'private'
+    );
+  select board_id into v_active_b_board
+    from agent_board.create_board(
+      v_active_b_owner, 'rowid-active-b-' || s, 'ROWID Active B',
+      'removed id high', '{}'::jsonb, 'private'
+    );
+  select board_id into v_active_c_board
+    from agent_board.create_board(
+      v_active_c_owner, 'rowid-active-c-' || s, 'ROWID Active C',
+      'removed id high invite-only', '{}'::jsonb, 'invite_only'
+    );
+  select board_id into v_pending_board
+    from agent_board.create_board(
+      v_active_a_owner, 'rowid-pending-' || s, 'ROWID Pending',
+      'active standing excludes stale pending rows', '{}'::jsonb, 'private'
+    );
+
+  -- A: low REMOVED inserted before high ACTIVE.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000201', v_active_a_board, v_active_a_agent,
+      'removed', 'observer', v_active_a_owner, timestamptz '2020-01-01', timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000201', v_active_a_board, v_active_a_agent,
+      'joined', 'admin', v_active_a_owner, null, timestamptz '2020-01-01');
+
+  -- B: low ACTIVE inserted before high REMOVED.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000202', v_active_b_board, v_active_b_agent,
+      'joined', 'admin', v_active_b_owner, null, timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000202', v_active_b_board, v_active_b_agent,
+      'removed', 'observer', v_active_b_owner, timestamptz '2020-01-01', timestamptz '2020-01-01');
+
+  -- C: the same low-ACTIVE/high-REMOVED shape on invite_only joinability.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000203', v_active_c_board, v_active_c_agent,
+      'joined', 'member', v_active_c_owner, null, timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000203', v_active_c_board, v_active_c_agent,
+      'removed', 'observer', v_active_c_owner, timestamptz '2020-01-01', timestamptz '2020-01-01');
+
+  -- Pending-list duplicate: ACTIVE is lowest, REMOVED is higher, and a stale
+  -- REQUESTED row is highest. A bare UUID order exposes the stale request;
+  -- active-preferring selection excludes the agent from the pending list.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at
+  )
+  values
+    ('00000000-0000-4000-8000-000000000204', v_pending_board, v_pending_agent,
+      'joined', 'member', v_active_a_owner, null, timestamptz '2020-01-01'),
+    ('eeeeeeee-eeee-4eee-8eee-000000000204', v_pending_board, v_pending_agent,
+      'removed', 'member', v_active_a_owner, timestamptz '2020-01-01', timestamptz '2020-01-01'),
+    ('ffffffff-ffff-4fff-8fff-000000000204', v_pending_board, v_pending_agent,
+      'requested', 'member', v_active_a_owner, null, timestamptz '2020-01-01');
+
+  insert into _rowid_fixture values (
+    v_removed_board, v_removed_creator,
+    v_left_board, v_left_creator,
+    v_no_row_board, v_no_row_creator,
+    v_requested_board, v_requested_creator,
+    v_invited_board, v_invited_creator,
+    v_mixed_board, v_mixed_creator,
+    v_writer_board, v_writer_owner, v_writer_owner_user,
+    v_redeem_board, v_redeem_owner, v_redeem_removed, v_redeem_left, v_redeem_code,
+    v_fed_board, v_fed_agent, v_fed_provider,
+    v_standing_a_board, v_standing_a_owner, v_standing_a_agent, v_standing_a_user,
+      'ffffffff-ffff-4fff-8fff-000000000101',
+    v_standing_b_board, v_standing_b_owner, v_standing_b_agent, v_standing_b_user,
+      'ffffffff-ffff-4fff-8fff-000000000102',
+    v_active_a_board, v_active_a_owner, v_active_a_owner_user,
+      v_active_a_agent, v_active_a_agent_user, 'ffffffff-ffff-4fff-8fff-000000000201',
+    v_active_b_board, v_active_b_owner, v_active_b_agent, v_active_b_agent_user,
+      '00000000-0000-4000-8000-000000000202',
+    v_active_c_board, v_active_c_owner, v_active_c_agent, v_active_c_agent_user,
+      '00000000-0000-4000-8000-000000000203',
+    v_pending_board, v_pending_agent
+  );
+end
+$$;
+
+-- 1. Initial service-role posture control.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: fixture and structural block really runs as service_role');
+
+-- 2. Catalog-derived inventory: seven membership readers plus the two task/message idempotency
+-- readers. request_join_board joined the set in MBCONSENT-B(iii): its Option-3 active-member
+-- no-op reads board_memberships with the created_at DESC + id DESC tiebreak like the others.
+select is(
+  (select array_agg(proname order by proname)
+     from _rowid_function_order_counts),
+  array[
+    '_active_board_membership_id',
+    '_upsert_board_membership_state',
+    'create_tasking_delivery',
+    'join_board',
+    'list_board_pending_memberships',
+    'post_board_message',
+    'request_join_board',
+    'resolve_board_request',
+    'update_board_membership'
+  ]::text[],
+  'live catalog exposes seven membership readers plus two task/message idempotency readers');
+
+-- 3-10. COUNT-EQUALITY, never substring containment.
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = '_active_board_membership_id'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = '_active_board_membership_id'),
+  '_active_board_membership_id: every created_at DESC site has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = '_upsert_board_membership_state'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = '_upsert_board_membership_state'),
+  '_upsert_board_membership_state: every created_at DESC site has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'create_tasking_delivery'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'create_tasking_delivery'),
+  'create_tasking_delivery: its tasks idempotency read has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'join_board'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'join_board'),
+  'join_board: every created_at DESC site has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'list_board_pending_memberships'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'list_board_pending_memberships'),
+  'list_board_pending_memberships: BOTH created_at DESC sites have the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'post_board_message'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'post_board_message'),
+  'post_board_message: its messages idempotency read has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'resolve_board_request'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'resolve_board_request'),
+  'resolve_board_request: every created_at DESC site has the id DESC tiebreak');
+select is(
+  (select created_at_desc_count from _rowid_function_order_counts
+    where proname = 'update_board_membership'),
+  (select total_order_count from _rowid_function_order_counts
+    where proname = 'update_board_membership'),
+  'update_board_membership: BOTH created_at DESC sites have the id DESC tiebreak');
+
+-- 11. The live view is catalog-derived too; its last definer uses DROP + CREATE.
+with d as (
+  select pg_get_viewdef(c.oid, true) as def
+  from pg_class c
+  join pg_namespace n on n.oid = c.relnamespace
+  where n.nspname = 'agent_board'
+    and c.relname = 'v_board_directory'
+    and c.relkind = 'v'
+)
+select is(
+  (select count(*)::int from d, regexp_matches(def, 'created_at\s+desc', 'gi')),
+  (select count(*)::int
+     from d, regexp_matches(
+       def,
+       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
+       'gi'
+     )),
+  'v_board_directory live catalog definition gives its membership read the id DESC tiebreak');
+
+-- 12. EC-MBROWID-3 requires set-based removed standing, not one selected row.
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '\s+', ' ', 'g') ~*
+      'exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s*=\s*''removed''.*\)\s+and\s+not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\)'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = 'agent_board'
+       and p.proname = '_upsert_board_membership_state'
+     limit 1),
+  '_upsert_board_membership_state carries the R-LINK-7 removed-and-no-active set predicate');
+
+-- 13. Bootstrap must carry the same R-LINK-7 shape.
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '\s+', ' ', 'g') ~*
+      'not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\).*\)\s+and\s+not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s*=\s*''removed'''
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = 'agent_board'
+       and p.proname = 'bootstrap_board_owner_memberships'
+     limit 1),
+  'bootstrap_board_owner_memberships guard is no-active AND no-removed, not any-row');
+
+-- 14. MBROWID does not change the API/read-model schema version.
+select is(agent_board.get_schema_version(), 8, 'agent_board schema_version remains 8');
+
+-- 15-19. ALLOW: preserve assertion-23 leave-again recovery end to end.
+select lives_ok(
+  (select format(
+    $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'left')$q$,
+    left_board, left_creator
+  ) from _rowid_fixture),
+  'left recovery: creator can leave the first time');
+select lives_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    left_board, left_creator
+  ) from _rowid_fixture),
+  'left recovery: creator can rejoin before the recovery repro');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.left_board and bm.agent_id = f.left_creator
+    where bm.membership_state in ('joined', 'subscribed')),
+  'member',
+  'left recovery: ROLERESET rejoin clamps the sole creator to member');
+select lives_ok(
+  (select format(
+    $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'left')$q$,
+    left_board, left_creator
+  ) from _rowid_fixture),
+  'left recovery: creator can leave again before bootstrap');
+select lives_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  'bootstrap service-role sweep runs');
+
+-- 20-21. DENY: a removed creator is not resurrected.
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.removed_board and bm.agent_id = f.removed_creator),
+  1,
+  'removed creator keeps exactly one row after bootstrap (no resurrection duplicate)');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.removed_board and bm.agent_id = f.removed_creator
+    where bm.membership_state in ('joined', 'subscribed')),
+  0,
+  'removed creator keeps zero active rows after bootstrap');
+
+-- 22-25. ALLOW: left recovery and no-row bootstrap purpose remain intact.
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.left_board and bm.agent_id = f.left_creator),
+  2,
+  'left creator recovery produces the normal historical-left plus active pair');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.left_board and bm.agent_id = f.left_creator
+    where bm.membership_state in ('joined', 'subscribed') and bm.role = 'owner'),
+  1,
+  'left creator recovery restores exactly one active owner');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.no_row_board and bm.agent_id = f.no_row_creator),
+  1,
+  'no-row creator gets exactly one membership from bootstrap');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.no_row_board and bm.agent_id = f.no_row_creator
+    where bm.membership_state = 'joined' and bm.role = 'owner'),
+  1,
+  'no-row creator is still seeded as joined owner');
+
+-- 26-29. The plan rules clearly: requested-only and invited-only still re-seed.
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.requested_board and bm.agent_id = f.requested_creator),
+  2,
+  'requested-only creator is re-seeded (R-LINK-7 is not an any-row guard)');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.requested_board and bm.agent_id = f.requested_creator
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'requested-only creator gets exactly one active row, never a second active row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.invited_board and bm.agent_id = f.invited_creator),
+  2,
+  'invited-only creator is re-seeded (R-LINK-7 is not an any-row guard)');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.invited_board and bm.agent_id = f.invited_creator
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'invited-only creator gets exactly one active row, never a second active row');
+
+-- 30-31. Historical removed+left is still removed standing and is suppressed.
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.mixed_board and bm.agent_id = f.mixed_creator),
+  2,
+  'removed+left creator pair gets no third bootstrap row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.mixed_board and bm.agent_id = f.mixed_creator
+    where bm.membership_state in ('joined', 'subscribed')),
+  0,
+  'removed+left creator pair stays non-active');
+
+-- 32-33. Writer 1 kept raw: genuine create_board cannot duplicate its owner seed.
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.writer_board and bm.agent_id = f.writer_owner),
+  1,
+  'create_board fresh-board writer creates exactly one membership row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.writer_board and bm.agent_id = f.writer_owner
+    where bm.membership_state in ('joined', 'subscribed') and bm.role = 'owner'),
+  1,
+  'create_board fresh-board writer creates exactly one active owner row');
+
+-- 34-36. DENY twin for bootstrap, with both authenticated controls.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config(
+  'request.jwt.claim.sub',
+  (select writer_owner_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: authenticated bootstrap block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select writer_owner from _rowid_fixture),
+  'control: authenticated bootstrap actor resolves to the expected agent');
+select throws_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  '42501',
+  'bootstrap_board_owner_memberships is service_role-only',
+  'authenticated caller cannot invoke the bootstrap repair writer');
+
+-- 37. Back to service role before internal raw-writer probes.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: invite and FEDSESSION writer block really runs as service_role');
+
+-- 38-44. Writer 3 kept raw: removed DENY plus left ALLOW, never two active rows.
+select throws_ok(
+  (select format(
+    $q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$,
+    redeem_code, redeem_removed
+  ) from _rowid_fixture),
+  '42501',
+  'invite is not usable',
+  'invite redemption refuses a removed agent via R-LINK-7');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.redeem_board and bm.agent_id = f.redeem_removed),
+  1,
+  'refused removed redemption leaves exactly the original row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.redeem_board and bm.agent_id = f.redeem_removed
+    where bm.membership_state in ('joined', 'subscribed')),
+  0,
+  'refused removed redemption leaves zero active rows');
+select lives_ok(
+  (select format(
+    $q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$,
+    redeem_code, redeem_left
+  ) from _rowid_fixture),
+  'invite redemption still admits a voluntarily-left agent');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.redeem_board and bm.agent_id = f.redeem_left),
+  2,
+  'left redemption produces the normal historical-left plus active pair');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.redeem_board and bm.agent_id = f.redeem_left
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'left redemption creates exactly one active row, never a second active row');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.redeem_board and bm.agent_id = f.redeem_left
+    where bm.membership_state in ('joined', 'subscribed')),
+  'member',
+  'left redemption preserves the member preset');
+
+-- 45-47. Writer 4 kept raw: any pre-existing row suppresses auto-join.
+select lives_ok(
+  (select format(
+    $q$select agent_board._fedsession_autojoin_default_board(p, %L::uuid)
+         from agent_board.identity_providers p where p.id = %L$q$,
+    fed_agent, fed_provider
+  ) from _rowid_fixture),
+  'FEDSESSION auto-join helper treats a pre-existing row as a non-fatal skip');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.fed_board and bm.agent_id = f.fed_agent),
+  1,
+  'FEDSESSION any-row guard leaves exactly the pre-existing row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.fed_board and bm.agent_id = f.fed_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  0,
+  'FEDSESSION any-row guard creates no active duplicate');
+
+-- 48-53. Joinability agrees with R-LINK-7 removed standing in both UUID arrangements.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config(
+  'request.jwt.claim.sub',
+  (select standing_a_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: standing arrangement A joinability block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select standing_a_agent from _rowid_fixture),
+  'control: standing arrangement A resolves the expected actor');
+select throws_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    standing_a_board, standing_a_agent
+  ) from _rowid_fixture),
+  'P0002',
+  'board is not joinable by this agent',
+  'joinability reads removed standing when the removed row has the higher UUID');
+-- Restore the pair if current main incorrectly admitted the LEFT row.
+update agent_board.board_memberships bm
+   set membership_state = case
+         when bm.id = '00000000-0000-4000-8000-000000000101' then 'left'
+         else 'removed'
+       end,
+       role = 'admin',
+       left_at = timestamptz '2020-01-01'
+  from _rowid_fixture f
+ where bm.board_id = f.standing_a_board
+   and bm.agent_id = f.standing_a_agent;
+
+select set_config(
+  'request.jwt.claim.sub',
+  (select standing_b_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: standing arrangement B joinability block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select standing_b_agent from _rowid_fixture),
+  'control: standing arrangement B resolves the expected actor');
+select throws_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    standing_b_board, standing_b_agent
+  ) from _rowid_fixture),
+  'P0002',
+  'board is not joinable by this agent',
+  'joinability keeps removed standing when the left row has the higher UUID');
+update agent_board.board_memberships bm
+   set membership_state = case
+         when bm.id = '00000000-0000-4000-8000-000000000102' then 'removed'
+         else 'left'
+       end,
+       role = 'admin',
+       left_at = timestamptz '2020-01-01'
+  from _rowid_fixture f
+ where bm.board_id = f.standing_b_board
+   and bm.agent_id = f.standing_b_agent;
+
+-- 54. Service-role control for grant and mutator standing probes.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: grant and mutator standing block really runs as service_role');
+
+-- 55-56. grant_board_role agrees: neither removed+left pair is active.
+select throws_ok(
+  (select format(
+    $q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$,
+    standing_a_board, standing_a_agent, standing_a_owner
+  ) from _rowid_fixture),
+  'P0002',
+  'grantee has no membership on this board',
+  'grant_board_role rejects arrangement A because removed+left has no active row');
+select throws_ok(
+  (select format(
+    $q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$,
+    standing_b_board, standing_b_agent, standing_b_owner
+  ) from _rowid_fixture),
+  'P0002',
+  'grantee has no membership on this board',
+  'grant_board_role rejects arrangement B because removed+left has no active row');
+
+-- 57-64. Mutator agreement + behavioral total-order proof in both arrangements.
+select lives_ok(
+  (select format(
+    $q$select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, 'joined', %L::uuid)$q$,
+    standing_a_board, standing_a_agent, standing_a_owner
+  ) from _rowid_fixture),
+  'mutator re-entry succeeds for arrangement A');
+select is(
+  (select bm.id
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_a_board and bm.agent_id = f.standing_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  (select standing_a_expected_id from _rowid_fixture),
+  'arrangement A mutator updates the explicit higher UUID row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_a_board and bm.agent_id = f.standing_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'arrangement A mutator leaves exactly one active row');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_a_board and bm.agent_id = f.standing_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  'member',
+  'arrangement A removed-standing re-entry clamps role to member');
+
+select lives_ok(
+  (select format(
+    $q$select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, 'joined', %L::uuid)$q$,
+    standing_b_board, standing_b_agent, standing_b_owner
+  ) from _rowid_fixture),
+  'mutator re-entry succeeds for arrangement B');
+select is(
+  (select bm.id
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_b_board and bm.agent_id = f.standing_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  (select standing_b_expected_id from _rowid_fixture),
+  'arrangement B mutator updates the explicit higher UUID row');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_b_board and bm.agent_id = f.standing_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'arrangement B mutator leaves exactly one active row');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_b_board and bm.agent_id = f.standing_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  'member',
+  'arrangement B removed-standing re-entry clamps role to member');
+
+-- 65-66. ALLOW twin: after re-entry, the grant filter admits the active row.
+select lives_ok(
+  (select format(
+    $q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$,
+    standing_a_board, standing_a_agent, standing_a_owner
+  ) from _rowid_fixture),
+  'grant_board_role admits the active arrangement-A row after re-entry');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.standing_a_board and bm.agent_id = f.standing_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  'admin',
+  'grant_board_role ALLOW really updates the active row');
+
+-- 67-69. ALLOW twin for joinability, with both authenticated controls.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config(
+  'request.jwt.claim.sub',
+  (select standing_a_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: active joinability ALLOW block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select standing_a_agent from _rowid_fixture),
+  'control: active joinability ALLOW block resolves the expected actor');
+select lives_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    standing_a_board, standing_a_agent
+  ) from _rowid_fixture),
+  'joinability admits the same pair after it has one active row');
+
+-- 70. Service-role control for exact removed+active duplicate probes.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: removed+active duplicate block really runs as service_role');
+
+-- 71-78. EC-MBROWID-3: active standing wins over historical removed in both
+-- explicit-ID arrangements. The mutator must not attempt to activate the removed row
+-- and collide with the one-active-row partial unique index.
+select lives_ok(
+  (select format(
+    $q$select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, 'subscribed', null)$q$,
+    active_a_board, active_a_agent
+  ) from _rowid_fixture),
+  'removed+active arrangement A mutator follows active standing without unique violation');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_a_board and bm.agent_id = f.active_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'removed+active arrangement A retains exactly one active row');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_a_board and bm.agent_id = f.active_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  'admin',
+  'removed+active arrangement A preserves active-to-active admin role');
+select is(
+  (select id
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_a_board and bm.agent_id = f.active_a_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  (select active_a_expected_id from _rowid_fixture),
+  'removed+active arrangement A retains the explicit active membership identity');
+
+select lives_ok(
+  (select format(
+    $q$select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, 'subscribed', null)$q$,
+    active_b_board, active_b_agent
+  ) from _rowid_fixture),
+  'removed+active arrangement B mutator follows active standing without unique violation');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_b_board and bm.agent_id = f.active_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  1,
+  'removed+active arrangement B retains exactly one active row');
+select is(
+  (select role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_b_board and bm.agent_id = f.active_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  'admin',
+  'removed+active arrangement B preserves active-to-active admin role');
+select is(
+  (select id
+     from agent_board.board_memberships bm
+     join _rowid_fixture f
+       on bm.board_id = f.active_b_board and bm.agent_id = f.active_b_agent
+    where bm.membership_state in ('joined', 'subscribed')),
+  (select active_b_expected_id from _rowid_fixture),
+  'removed+active arrangement B retains the explicit active membership identity');
+
+-- 79-84. LOW ACTIVE + HIGH REMOVED: private view, joinability, and
+-- update_board_membership must all follow the active row.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config(
+  'request.jwt.claim.sub',
+  (select active_b_agent_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: private low-active/high-removed block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select active_b_agent from _rowid_fixture),
+  'control: private low-active/high-removed block resolves the expected actor');
+select is(
+  (select d.current_membership_state
+     from agent_board.v_board_directory d
+     join _rowid_fixture f on d.board_id = f.active_b_board),
+  'subscribed',
+  'v_board_directory prefers the low-ID active row over the high-ID removed row');
+select lives_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    active_b_board, active_b_agent
+  ) from _rowid_fixture),
+  'idempotent join_board succeeds for a private board with low-ID active standing');
+select lives_ok(
+  (select format(
+    $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'joined')$q$,
+    active_b_board, active_b_agent
+  ) from _rowid_fixture),
+  'update_board_membership authorizes the low-ID active row, not the high-ID removed row');
+select is(
+  (select bm.membership_state
+     from agent_board.board_memberships bm
+     join _rowid_fixture f on bm.id = f.active_b_expected_id),
+  'joined',
+  'update_board_membership changes the intended low-ID active row');
+
+-- 85-87. The same broken arrangement is idempotently joinable on invite_only.
+select set_config(
+  'request.jwt.claim.sub',
+  (select active_c_agent_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: invite-only low-active/high-removed block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select active_c_agent from _rowid_fixture),
+  'control: invite-only low-active/high-removed block resolves the expected actor');
+select lives_ok(
+  (select format(
+    $q$select agent_board.join_board(%L::uuid, %L::uuid, 'joined')$q$,
+    active_c_board, active_c_agent
+  ) from _rowid_fixture),
+  'idempotent join_board succeeds for invite_only with low-ID active standing');
+
+-- 88-92. Mirror proof: HIGH ACTIVE + LOW REMOVED also resolves active, so an
+-- implementation cannot repair the bug by flipping bare UUID direction.
+select set_config(
+  'request.jwt.claim.sub',
+  (select active_a_agent_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: mirror high-active/low-removed block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select active_a_agent from _rowid_fixture),
+  'control: mirror high-active/low-removed block resolves the expected actor');
+select is(
+  (select d.current_membership_state
+     from agent_board.v_board_directory d
+     join _rowid_fixture f on d.board_id = f.active_a_board),
+  'subscribed',
+  'v_board_directory also resolves the mirror high-ID active arrangement');
+select lives_ok(
+  (select format(
+    $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'joined')$q$,
+    active_a_board, active_a_agent
+  ) from _rowid_fixture),
+  'update_board_membership follows the active row in the mirror arrangement');
+select is(
+  (select bm.membership_state
+     from agent_board.board_memberships bm
+     join _rowid_fixture f on bm.id = f.active_a_expected_id),
+  'joined',
+  'mirror update_board_membership changes the intended high-ID active row');
+
+-- 93-95. Pending selection must suppress stale non-active rows whenever an
+-- active membership exists for the same agent.
+select set_config(
+  'request.jwt.claim.sub',
+  (select active_a_owner_user from _rowid_fixture)::text,
+  true
+);
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: pending-list active-preference block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select active_a_owner from _rowid_fixture),
+  'control: pending-list active-preference block resolves the expected owner');
+select is(
+  (select count(*)::int
+     from agent_board.list_board_pending_memberships(
+       (select pending_board from _rowid_fixture)
+     ) p
+     join _rowid_fixture f on p.agent_id = f.pending_agent),
+  0,
+  'pending-list selection prefers active standing over stale removed/requested rows');
+
+-- 96-98. Standing agreement: the earlier mutator proof, the active-state
+-- grant filter, and joinability all recognize arrangement B as active.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: active standing agreement grant block runs as service_role');
+select lives_ok(
+  (select format(
+    $q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$,
+    active_b_board, active_b_agent, active_b_owner
+  ) from _rowid_fixture),
+  'grant_board_role state filter agrees the low-ID row is an active membership');
+select is(
+  (select bm.role
+     from agent_board.board_memberships bm
+     join _rowid_fixture f on bm.id = f.active_b_expected_id),
+  'member',
+  'grant_board_role updates the same active row used by mutator and joinability');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;