@consiliency/agent-board-schema 1.23.0 → 1.25.0

package/src/tooling.test.mjs

@@ -5,7 +5,8 @@ import { join } from 'node:path';
 import { loadManifest, loadOrderedMigrations, sha256 } from './index.js';
 import { materialize } from './materialize.js';
 import { plan } from './plan.js';
-import { check, EXIT } from './check.js';
+import { check, EXIT, POSTURE_ACTIONS } from './check.js';
+import { COLLISION_REMEDIATIONS } from './index.js';
 
 const manifest = loadManifest();
 const ordered = loadOrderedMigrations();
@@ -37,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 = 122)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 125)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(122);
+    expect(manifest.migrationCount).toBe(125);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -199,7 +200,239 @@ describe('plan / check postures + exit codes (SemVer contract)', () => {
     expect(check({ applied }).exitCode).toBe(11);
   });
   it('exit-code map is a frozen SemVer surface', () => {
-    expect(EXIT).toEqual({ exact: 0, behind: 10, ahead: 11, divergent: 12, error: 13 });
+    expect(EXIT).toEqual({ exact: 0, behind: 10, ahead: 11, divergent: 12, error: 13, collision: 14 });
+  });
+
+  // VERSION COLLISION (message-board#217). Supabase keys schema_migrations on the
+  // 14-digit version prefix alone, so an adopter migration authored at a bundle
+  // migration's version makes the bundle's file skip SILENTLY -- no error, and
+  // schema_version still reports the bundle's number. The reported case is real:
+  // consiliency-portal recorded 20260809000100 as reconcile_panel_schema_drift.
+  // The adopter's own migration occupies the bundle's version, so the bundle's
+  // file was skipped. Two DISTINCT states matter, and conflating them is the
+  // defect a review seat caught: the collision ROW is permanent (Supabase keys
+  // schema_migrations on version, which is its primary key), so reporting on the
+  // row alone would fail a fully-healed database forever -- and an adopter forced
+  // to ignore exit 14 stops seeing genuine behind/divergent states too.
+  const portalHistory = (opts = {}) => ({
+    applied: [
+      ...ordered
+        .filter((m) => m.id !== '20260809000100_agent_board_consent_gating')
+        .filter((m) => opts.healed || m.id !== '20260905000100_agent_board_consent_gating_reconcile')
+        .map((m) => ({ id: m.id, sha256: m.sha256 })),
+      { id: '20260809000100_reconcile_panel_schema_drift', sha256: 'aa' },
+    ],
+  });
+
+  it('collision when an adopter migration occupies a bundle version and is unhealed', () => {
+    const c = check(portalHistory());
+    expect(c.posture).toBe('collision');
+    expect(c.exitCode).toBe(14);
+  });
+
+  it('collision names BOTH sides, so the report is an instruction not a puzzle', () => {
+    expect(plan(portalHistory()).collisions).toEqual([
+      {
+        version: '20260809000100',
+        expected: '20260809000100_agent_board_consent_gating',
+        recordedAs: '20260809000100_reconcile_panel_schema_drift',
+        remediatedBy: '20260905000100_agent_board_consent_gating_reconcile',
+      },
+    ]);
+  });
+
+  it('collision outranks behind — "behind" invites re-applying, which is the no-op that leaves the DB wrong', () => {
+    const p = plan(portalHistory());
+    expect(p.perId.filter((r) => r.action === 'pending').map((r) => r.id)).toContain(
+      '20260809000100_agent_board_consent_gating',
+    );
+    expect(p.posture).toBe('collision');
+  });
+
+  it('a HEALED database reports exact/0 — not merely "not collision"', () => {
+    // Asserting "not collision / not 14" was too weak and a review seat broke it:
+    // both halves of a remediated pair are PERMANENT (the bundle migration can
+    // never be applied on that database because its version is taken, and the
+    // adopter's row can never be removed), so leaving them in the counts gated
+    // the healed database at behind/10 forever — a different permanent red than
+    // the one being fixed. The claim is exact/0, so that is what is asserted.
+    const p = plan(portalHistory({ healed: true }));
+    expect(p.collisions).toEqual([]);
+    expect(p.collisionsRemediated.map((c) => c.expected)).toEqual([
+      '20260809000100_agent_board_consent_gating',
+    ]);
+    expect(p.counts.pending ?? 0).toBe(0);
+    expect(p.ahead).toEqual([]);
+    expect(p.posture).toBe('exact');
+    expect(check(portalHistory({ healed: true })).exitCode).toBe(0);
+  });
+
+  it('a NULL migration name is indeterminate, not a collision', () => {
+    // schema_migrations.name is nullable, and the documented psql recipe renders
+    // such a row as `<version>_`. A substring test for '_' called that a named
+    // row and invented a collision from a legitimate history.
+    const applied = [
+      ...ordered
+        .filter((m) => m.id !== '20260809000100_agent_board_consent_gating')
+        .map((m) => ({ id: m.id, sha256: m.sha256 })),
+      { id: '20260809000100_', sha256: 'aa' },
+    ];
+    const p = plan({ applied });
+    expect(p.collisions).toEqual([]);
+    expect(check({ applied }).exitCode).toBe(10); // behind, which is true: the DDL is absent
+  });
+
+  it('a DIVERGENT healer does not remediate — it is not the migration we shipped', () => {
+    // The database applied something under the healer's id that is not this
+    // bundle's bytes, so nothing here can claim the skipped DDL was restored.
+    // Posture already goes divergent, but reporting the collision as REMEDIATED
+    // would be the same false-success the detector exists to prevent.
+    const healer = '20260905000100_agent_board_consent_gating_reconcile';
+    const applied = [
+      ...ordered
+        .filter((m) => m.id !== '20260809000100_agent_board_consent_gating')
+        .map((m) => ({ id: m.id, sha256: m.id === healer ? 'deadbeef' : m.sha256 })),
+      { id: '20260809000100_reconcile_panel_schema_drift', sha256: 'aa' },
+    ];
+    const p = plan({ applied });
+    expect(p.collisionsRemediated).toEqual([]);
+    expect(p.collisions).toHaveLength(1);
+    expect(p.posture).toBe('collision');
+  });
+
+  it('an UNKNOWN healer digest still remediates — digest-less histories are supported', () => {
+    // normalizeHistory accepts entries without a digest. Requiring one would
+    // strand those adopters in the permanent red this design removes.
+    const applied = [
+      ...ordered.filter((m) => m.id !== '20260809000100_agent_board_consent_gating').map((m) => m.id),
+      '20260809000100_reconcile_panel_schema_drift',
+    ];
+    const p = plan({ applied });
+    expect(p.collisionsRemediated).toHaveLength(1);
+    expect(p.collisions).toEqual([]);
+  });
+
+  it('the healer being present is what clears it — not merely being declared', () => {
+    // Same declaration, healer unapplied: still live. Without this the previous
+    // test would pass on a map lookup rather than on the database's actual state.
+    expect(plan(portalHistory()).collisionsRemediated).toEqual([]);
+    expect(plan(portalHistory()).collisions).toHaveLength(1);
+  });
+
+  it('a bare-version history is indeterminate, not one collision per bundled migration', () => {
+    // normalizeHistory accepts plain version strings. Such an entry carries no
+    // name, so it cannot be told apart from the bundle's own migration at that
+    // version — reporting it as a collision turns a supported input shape into a
+    // wall of false positives.
+    const p = plan({ applied: ordered.map((m) => m.id.split('_')[0]) });
+    expect(p.collisions).toEqual([]);
+  });
+
+  it('an unrelated adopter migration is NOT a collision, even with a bundle migration pending', () => {
+    // The history MUST have something pending as well as something ahead. A first
+    // draft of this test used an exact history plus one extra entry, and a mutation
+    // that reported every ahead entry as a collision SURVIVED it: with nothing
+    // pending there is no cross-product to over-report, so the assertion passed
+    // while checking nothing. A negative assertion driven by a clean input proves
+    // nothing (CLAUDE.md rule 2).
+    const applied = [
+      ...ordered
+        .filter((m) => m.id !== '20260809000100_agent_board_consent_gating')
+        .map((m) => ({ id: m.id, sha256: m.sha256 })),
+      { id: '99999999999999_extra', sha256: 'ff' },
+    ];
+    const p = plan({ applied });
+    expect(p.perId.some((r) => r.action === 'pending')).toBe(true); // the input is not clean
+    expect(p.ahead).toContain('99999999999999_extra');
+    expect(p.collisions).toEqual([]);
+    expect(p.posture).toBe('behind');
+  });
+});
+
+// OPERATOR GUIDANCE. Checks EXIT and POSTURE_ACTIONS agree with each other.
+//
+// This is NOT the completeness guard, and an earlier version of this comment
+// claimed it was. EXIT is a SECOND hand list, not the catalog: a posture added to
+// plan() without an EXIT entry passes everything here, falls through check()'s
+// `EXIT[p.posture] ?? EXIT.error` to exit 13, and prints no action. The real
+// catalog is the set of values plan() assigns, and scripts/check-posture-consumers.mjs
+// reads it from there -- and also holds the live-drift consumer to using
+// POSTURE_ACTIONS, which no test in this package can see. That script runs in
+// `schema:verify`. What follows is the in-package half: the two tables stay
+// consistent, and the collision action never tells an operator to re-apply.
+describe('every posture has operator guidance', () => {
+  const postures = Object.keys(EXIT).filter((k) => k !== 'error');
+
+  it('EXIT and POSTURE_ACTIONS cover the same postures', () => {
+    expect(Object.keys(POSTURE_ACTIONS).sort()).toEqual(postures.sort());
+  });
+
+  it('every non-exact posture has a non-empty action', () => {
+    for (const posture of postures) {
+      if (posture === 'exact') {
+        expect(POSTURE_ACTIONS.exact).toBeNull(); // nothing to do is not a missing action
+        continue;
+      }
+      expect(typeof POSTURE_ACTIONS[posture]).toBe('string');
+      expect(POSTURE_ACTIONS[posture].length).toBeGreaterThan(20);
+    }
+  });
+
+  it("the collision action does NOT tell an operator to re-apply", () => {
+    // Re-applying is the no-op that leaves the database wrong: the version is taken.
+    expect(POSTURE_ACTIONS.collision).toMatch(/no-op|not simply re-apply|Do NOT/i);
+  });
+});
+
+// COLLISION REMEDIATION (message-board#217). The reconcile migration's whole
+// no-op-on-a-healthy-database property rests on its join_board body being
+// byte-identical to the one in the migration an affected database skipped. The
+// PR asserted that in prose and nothing checked it -- the exact shape this repo
+// keeps getting caught by. The digest tests freeze each file's bytes, which is
+// not the same claim: two files can both be frozen and still differ.
+describe('collision remediation is real, not merely declared', () => {
+  const read = (id) =>
+    readFileSync(new URL(`../migrations/${id}.sql`, import.meta.url), 'utf8');
+  const joinBoardBlock = (sql) => {
+    const start = sql.search(/create or replace function agent_board\.join_board\b/i);
+    const rest = sql.slice(start + 10);
+    const next = rest.search(/create or replace function agent_board\./i);
+    return (next === -1 ? rest : rest.slice(0, next)).trimEnd();
+  };
+
+  it('every declared remediation names migrations that exist in the bundle', () => {
+    const ids = new Set(ordered.map((m) => m.id));
+    for (const [skipped, healer] of Object.entries(COLLISION_REMEDIATIONS)) {
+      expect(ids.has(skipped)).toBe(true);
+      expect(ids.has(healer)).toBe(true);
+      // The healer must come LATER, or it cannot run after the skip.
+      expect(healer > skipped).toBe(true);
+    }
+  });
+
+  it('the healer restates the skipped function BYTE-IDENTICALLY, so a healthy DB is a true no-op', () => {
+    const skipped = joinBoardBlock(read('20260809000100_agent_board_consent_gating'));
+    const healer = joinBoardBlock(read('20260905000100_agent_board_consent_gating_reconcile'));
+    expect(healer.length).toBeGreaterThan(1000);
+    expect(healer).toBe(skipped);
+  });
+
+  it('the healer touches ONLY the stale function, so it cannot clobber a later definition', () => {
+    // resolve_board_request and update_board_membership are superseded by
+    // 20260819000100 and 20260813000100. Restating them here would re-apply the
+    // older bodies over the newer ones on every healthy database.
+    const sql = read('20260905000100_agent_board_consent_gating_reconcile');
+    const defined = [...sql.matchAll(/create or replace function agent_board\.(\w+)/gi)].map((m) => m[1]);
+    expect(defined).toEqual(['join_board']);
+  });
+
+  it('the healer adds no grant, revoke or comment — create-or-replace preserves the ACL', () => {
+    const sql = read('20260905000100_agent_board_consent_gating_reconcile')
+      .split('\n').filter((l) => !l.trimStart().startsWith('--')).join('\n');
+    expect(sql).not.toMatch(/\bgrant\b/i);
+    expect(sql).not.toMatch(/\brevoke\b/i);
+    expect(sql).not.toMatch(/comment\s+on/i);
+    expect(sql).not.toMatch(/drop\s+function/i);
   });
 });
 

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -12,7 +12,7 @@
 -- runtime backstop at all.
 --
 -- WHAT THE FIX IS. Each positional assertion now locates its markers on
--- `pg_temp._stripped_body(<fn>)` -- prosrc with dollar-quoted blocks, single-quoted
+-- `agent_board_test.stripped_body(<fn>)` -- prosrc with dollar-quoted blocks, single-quoted
 -- literals, line comments and block comments removed in ONE alternation pass. The
 -- regex is copied BYTE-FOR-BYTE from agent_board_federated_lock_order_class.test.sql,
 -- where its three failure modes were found the hard way: a block comment whose body
@@ -123,24 +123,23 @@ create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
-select plan(52);
+select plan(54);
 
 -- ---------------------------------------------------------------------------
--- The stripped-body reader every positional assertion below uses. A shared SQL
--- include is not workable in this harness -- the runner pipes
--- `begin; \i <file>; rollback;` into psql, so there is no reliable relative
--- include path -- so it is defined ONCE here instead of being copy-pasted into
--- nine call sites, which would guarantee drift. The regex is byte-identical to
--- agent_board_federated_lock_order_class.test.sql; see the header.
+-- The stripped-body reader every positional assertion below uses is
+-- agent_board_test.stripped_body(), defined ONCE for the whole suite in
+-- tests/fixtures/test-prereqs.sql (the runner applies that fixture before any
+-- test, so it needs no include path).
+--
+-- It used to be a local regex copied here and kept byte-identical to
+-- agent_board_federated_lock_order_class.test.sql so the two could not drift.
+-- They could not drift, and they were both WRONG: no regular expression can
+-- match a NESTED block comment, and `/* note /* x */ <code> */` therefore hid
+-- <code> from both files at once (message-board#199) -- 52/52 and 15/15 green
+-- with the boards lock genuinely relocated. The shared helper is a character
+-- scanner for that reason; see its header for the full enumeration of escape
+-- hatches and which ones a regex can and cannot close.
 -- ---------------------------------------------------------------------------
-create function pg_temp._stripped_body(p_fn regprocedure) returns text
-language sql stable as $strip$
-  select regexp_replace(p.prosrc,
-           $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-           ' ', 'g')
-    from pg_proc p
-   where p.oid = p_fn;
-$strip$;
 
 select has_table('agent_board', 'fleet_onboarding_invite_bounds', 'immutable fleet invite bounds table exists');
 select has_pk('agent_board', 'fleet_onboarding_invite_bounds', 'fleet invite bounds are keyed by invite id');
@@ -248,38 +247,22 @@ select ok(
   'binding revocation is a permanent tombstone'
 );
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
-    'from agent_board.fleet_machines m'
+  strpos(lower(agent_board_test.stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure)), 'from agent_board.fleet_machines m'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
-    'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure)), 'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
-    'from agent_board.fleet_machines m'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
-    'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure)), 'from agent_board.fleet_machines m'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure)), 'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
   ),
   'exact binding revocation locks the machine before the binding [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
 );
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'where fm.id = p_machine_id for update'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'where fm.id = p_machine_id for update'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ),
   'atomic onboarding locks the machine before its enrolled agent [CONFIRMATORY: atomic_fleet_binding_revoke.spec and atomic_fleet_lifecycle_races.spec both discriminate the inversion]'
 );
@@ -299,7 +282,7 @@ select ok(
 -- does not fail the claim.
 select ok(
   (with b as (
-     select pg_temp._stripped_body(
+     select agent_board_test.stripped_body(
        'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure) as t),
    p as (
      select t,
@@ -318,20 +301,12 @@ select ok(
   'agent fleet revocation takes its machine locks before the agent lock [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
 );
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
-    'from agent_board.agents a where a.id = p_agent_id for update'
+  strpos(lower(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)), 'from agent_board.agents a where a.id = p_agent_id for update'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
-    'from agent_board.agent_signing_keys'
+  and strpos(lower(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)), 'from agent_board.agent_signing_keys'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
-    'from agent_board.agents a where a.id = p_agent_id for update'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
-    'from agent_board.agent_signing_keys'
+  and strpos(lower(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)), 'from agent_board.agents a where a.id = p_agent_id for update'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)), 'from agent_board.agent_signing_keys'
   ),
   'subtree primitive locks the agent before signing keys [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
 );
@@ -359,20 +334,12 @@ select ok(
 -- not-found case fail instead of pass; the other eight positional claims in this
 -- file already carried them.
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
-    'update agent_board.agents'
+  strpos(lower(agent_board_test.stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure)), 'update agent_board.agents'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
-    'update agent_board.agent_credentials'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure)), 'update agent_board.agent_credentials'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
-    'update agent_board.agents'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
-    'update agent_board.agent_credentials'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure)), 'update agent_board.agents'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure)), 'update agent_board.agent_credentials'
   ),
   'legacy authenticated revoke_agent preserves agent-before-credential ordering [HISTORICAL: legacy platform-admin path, no live fleet counterparty and no isolation spec]'
 );
@@ -404,10 +371,18 @@ select ok(
     like '%from auth.users u where u.id = v_owner_user_id for update%fleet_human_revocations%r.issuer = p_issuer and r.subject = p_subject%',
   'identity enrollment locks the human owner and rejects durable total revocation'
 );
+-- LITERALS KEPT (the `true` second argument): every marker below is itself a
+-- string literal in the body -- `''federation''`, `''object''`, the
+-- `'{federation,replay,issuer}'` path, the raise message. Stripping literals here
+-- would delete the very text being located and make the `not like` vacuously true
+-- forever. Comments (all forms, INCLUDING NESTED) are still removed, so the
+-- message-board#196 comment masks are closed; a literal mask is inherent to a
+-- literal marker, which is why the isolation spec and not this line is the
+-- load-bearing guard.
 select ok(
-  pg_get_functiondef('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure)
+  agent_board_test.stripped_body('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure, true)
     like '%from auth.users u where u.id = p_owner_user_id for update%where a.owner_user_id = p_owner_user_id%jsonb_typeof(a.metadata -> ''federation'') = ''object''%not exists (%from agent_board.enrollment_federation_audit e%where e.agent_id = a.id%stable federation evidence not found for every linked agent%insert into agent_board.fleet_human_revocations%issuer, subject, owner_user_id%on conflict (issuer, subject) do nothing%where owner_user_id = p_owner_user_id%order by id%'
-    and pg_get_functiondef('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure)
+    and agent_board_test.stripped_body('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure, true)
       not like '%metadata #>> ''{federation,replay,issuer}''%',
   'total human revocation requires per-agent audit evidence before marking and enumeration'
 );
@@ -458,16 +433,10 @@ select ok(
 -- Ordering, not mere presence: the lock has to be held BEFORE the authorization
 -- decision reads the (possibly absent) ceiling, and BEFORE the writer upserts it.
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'agent_board._grant_within_ceiling('
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the board ceiling lock before evaluating creator authority [REDUNDANT: implied by the advisory-before-boards and boards-before-ceiling-read claims below; an advisory moved between those two points violates the real ordering and still passes THIS one]'
 );
@@ -479,16 +448,10 @@ select ok(
 -- that catches the inversion; it is deliberately separate from the "before the
 -- ceiling read" assertion below, because that one passes in BOTH orders.
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ),
@@ -508,34 +471,22 @@ select ok(
 -- ordering nothing else states, because the boards lock is taken for board liveness,
 -- not for the ceiling. Pin the ordering so a refactor that moves it is not silent.
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'from agent_board.boards b
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
-    'agent_board._grant_within_ceiling('
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the boards row FOR UPDATE before it reads the ceiling [CONFIRMATORY FOR FLAT MASKS ONLY: agent_board_federated_lock_order_class.test.sql EC-3 fails by name on the comment/literal mutants, but it carries the SAME strip, so a NESTED block comment takes this assertion and EC-3 green together -- see #199 in the header; atomic_fleet_authority_races.spec pins the OUTCOME only when this lock and the advisory are BOTH gone, and atomic_fleet_board_archive.spec BLOCKS rather than failing by name]'
 );
 select ok(
-  strpos(
-    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(p_board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.set_board_authority_ceiling(uuid,text,uuid)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(p_board_id)'
   ) > 0
-  and strpos(
-    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
-    'perform agent_board._lock_board_authority_ceiling(p_board_id)'
-  ) < strpos(
-    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
-    'insert into agent_board.board_authority_ceilings'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.set_board_authority_ceiling(uuid,text,uuid)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(p_board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.set_board_authority_ceiling(uuid,text,uuid)'::regprocedure)), 'insert into agent_board.board_authority_ceilings'
   ),
   'the ceiling setter holds the same lock before its owner gate and upsert [BACKSTOP: tests/isolation/specs/ceiling_setter_lock_before_upsert.spec]'
 );
@@ -550,12 +501,22 @@ select ok(
 select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below are string literals in the expected array, never invoked
   (select array_agg(entry order by entry) from (
      select 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '') || ' => ' ||
-            case when strpos(p.prosrc, '_lock_board_authority_ceiling') > 0
+            -- CALL SHAPE, not strpos on a bare name: this is the dangerous
+            -- direction -- a reader that DROPS the lock but keeps a variable named
+            -- after it would still print "serialized".
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_lock_board_authority_ceiling\s*\(` also matches
+      -- `zz_other._lock_board_authority_ceiling(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+            case when agent_board_test.stripped_body(p.oid) ~* '\magent_board\._lock_board_authority_ceiling\s*\('
                  then 'serialized' else 'UNSERIALIZED' end as entry
        from pg_proc p
        join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
-        and strpos(p.prosrc, '_grant_within_ceiling') > 0
+        and strpos(lower(agent_board_test.stripped_body(p.oid)), '_grant_within_ceiling') > 0
    ) readers),
   array[
     'agent_board._redeem_unbounded_invite_for_agent(text,uuid) => UNSERIALIZED',
@@ -594,11 +555,18 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
        from pg_proc p
        join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
-        and (strpos(p.prosrc, 'fleet_onboarding_invite_bounds') > 0
-          or strpos(p.prosrc, 'fleet_human_revocations') > 0
-          or strpos(p.prosrc, 'fleet_revocation_events') > 0
-          or strpos(p.prosrc, '_lock_board_authority_ceiling') > 0
-          or strpos(p.prosrc, 'board_authority_ceilings:') > 0)
+        -- The first four markers are CODE (relation and function names), so the
+        -- body is read with literals stripped. The fifth is the advisory-lock key
+        -- prefix, which exists ONLY as a string literal
+        -- (`hashtextextended('agent_board.board_authority_ceilings:' || ...)`), so
+        -- that one predicate must KEEP literals or _lock_board_authority_ceiling --
+        -- the single function this migration creates -- silently leaves the class.
+        -- Comments are stripped in both modes.
+        and (strpos(lower(agent_board_test.stripped_body(p.oid)), 'fleet_onboarding_invite_bounds') > 0
+          or strpos(lower(agent_board_test.stripped_body(p.oid)), 'fleet_human_revocations') > 0
+          or strpos(lower(agent_board_test.stripped_body(p.oid)), 'fleet_revocation_events') > 0
+          or strpos(lower(agent_board_test.stripped_body(p.oid)), '_lock_board_authority_ceiling') > 0
+          or strpos(agent_board_test.stripped_body(p.oid, true), 'board_authority_ceilings:') > 0)
    ) definers),
   array[
     'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
@@ -611,13 +579,57 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
     'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
     'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
-    'agent_board.reclaim_fleet_machine(uuid,uuid,uuid,text,uuid) [definer] => service_role',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',
     'agent_board.revoke_human_subtree(uuid,uuid,text) [definer] => service_role',
-    'agent_board.set_board_authority_ceiling(uuid,text) [definer] => authenticated,service_role'
+    'agent_board.set_board_authority_ceiling(uuid,text,uuid) [definer] => authenticated,service_role'
   ]::text[],
   'every function on this migration set''s surface is declared with its definer flag and exact EXECUTE grantees'
 );
 
+-- WHAT THE message-board#196 CONVERSION REMOVED FROM THE CLASS ABOVE, and why
+-- it is restated here instead of being silently dropped.
+--
+-- reclaim_fleet_machine was a member of that class while the predicate read RAW
+-- prosrc -- and ONLY because a `--` comment in its body says "no
+-- fleet_revocation_events row is written per binding". It was in the surface
+-- class for SAYING IT IS NOT ON THE SURFACE. Reading the stripped body removes
+-- it, which is correct: it touches none of the five surfaces.
+--
+-- Its exact-grantee pin was real coverage, though, and an accidental member's
+-- coverage is still coverage. Per CLAUDE.md rule 1 an exemption is asserted
+-- POSITIVELY, never by absence of a match, so the claim it used to carry is
+-- restated as its own assertion.
+select is(
+  (select coalesce((
+     select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee, 0)), 'PUBLIC'), ','
+              order by coalesce(pg_get_userbyid(nullif(a.grantee, 0)), 'PUBLIC'))
+       from aclexplode(p.proacl) a
+      where a.privilege_type = 'EXECUTE'
+        and a.grantee <> p.proowner), '(none)')
+     || case when p.prosecdef then ' [definer]' else ' [invoker]' end
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      -- identity by OID + identity-arguments, never by a rendered regprocedure:
+      -- this file puts agent_board on search_path, so `oid::regprocedure::text`
+      -- renders UNQUALIFIED and an 'agent_board.…' comparison silently matches
+      -- nothing (measured: this assertion read NULL until it was written this way).
+      and 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '')
+          = 'agent_board.reclaim_fleet_machine(uuid,uuid,uuid,text,uuid)'),
+  'service_role [definer]',
+  'reclaim_fleet_machine -- off this surface once comments are stripped -- keeps its service_role-only definer grant'
+);
+
+
+-- The schema-qualified call anchor above treats `agent_board._lock_board_authority_ceiling` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_lock_board_authority_ceiling'),
+  1,
+  'agent_board._lock_board_authority_ceiling has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select * from finish();
 rollback;