@consiliency/agent-board-schema 1.28.0 → 1.35.0

package/tests/isolation/expected/ledger_authority_revoke.out

@@ -1,4 +1,4 @@
-Parsed test spec with 7 sessions
+Parsed test spec with 10 sessions
 
 starting permutation: ugrant_begin ugrant_grant revoke_begin revoke_agent ugrant_commit revoke_commit check
 step ugrant_begin: 
@@ -481,3 +481,221 @@ grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outsta
 admin       |active      |                1|              0|            0|                    1
 (1 row)
 
+
+starting permutation: cboard_begin cboard_create revoke_begin revoke_agent cboard_commit revoke_commit cbcheck
+step cboard_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step cboard_create: 
+  select c.slug
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k280-iso-fresh', 'K280 ISO Fresh') c;
+
+slug          
+--------------
+k280-iso-fresh
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+ <waiting ...>
+step cboard_commit: COMMIT;
+step revoke_agent: <... completed>
+subject_kind
+------------
+agent       
+(1 row)
+
+step revoke_commit: COMMIT;
+step cbcheck: 
+  select
+    (select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
+    (select count(*) from agent_board.board_memberships bm
+       join agent_board.boards b on b.id = bm.board_id
+      where b.slug = 'k280-iso-fresh') as fresh_seats,
+    (select name from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
+    (select visibility from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
+
+fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
+------------+-----------+-------------------+-------------------------+------------+-----------------
+           1|          1|K276 ISO Board     |private                  |active      |                1
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent cboard_begin cboard_create revoke_commit cboard_commit cbcheck
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step cboard_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step cboard_create: 
+  select c.slug
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k280-iso-fresh', 'K280 ISO Fresh') c;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step cboard_create: <... completed>
+ERROR:  fleet_revoked: create_board is not permitted for a fleet-revoked agent
+step cboard_commit: COMMIT;
+step cbcheck: 
+  select
+    (select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
+    (select count(*) from agent_board.board_memberships bm
+       join agent_board.boards b on b.id = bm.board_id
+      where b.slug = 'k280-iso-fresh') as fresh_seats,
+    (select name from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
+    (select visibility from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
+
+fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
+------------+-----------+-------------------+-------------------------+------------+-----------------
+           0|          0|K276 ISO Board     |private                  |active      |                1
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent creopen_begin creopen_call revoke_commit creopen_commit cbcheck
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step creopen_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step creopen_call: 
+  select c.name, c.visibility
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k276-iso-board', 'K280 ISO REOPENED',
+      null, null, 'open') c;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step creopen_call: <... completed>
+ERROR:  fleet_revoked: create_board is not permitted for a fleet-revoked agent
+step creopen_commit: COMMIT;
+step cbcheck: 
+  select
+    (select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
+    (select count(*) from agent_board.board_memberships bm
+       join agent_board.boards b on b.id = bm.board_id
+      where b.slug = 'k280-iso-fresh') as fresh_seats,
+    (select name from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
+    (select visibility from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
+
+fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
+------------+-----------+-------------------+-------------------------+------------+-----------------
+           0|          0|K276 ISO Board     |private                  |active      |                1
+(1 row)
+
+
+starting permutation: creopen_begin creopen_call revoke_begin revoke_agent creopen_commit revoke_commit cbcheck
+step creopen_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step creopen_call: 
+  select c.name, c.visibility
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k276-iso-board', 'K280 ISO REOPENED',
+      null, null, 'open') c;
+
+name             |visibility
+-----------------+----------
+K280 ISO REOPENED|open      
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+ <waiting ...>
+step creopen_commit: COMMIT;
+step revoke_agent: <... completed>
+subject_kind
+------------
+agent       
+(1 row)
+
+step revoke_commit: COMMIT;
+step cbcheck: 
+  select
+    (select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
+    (select count(*) from agent_board.board_memberships bm
+       join agent_board.boards b on b.id = bm.board_id
+      where b.slug = 'k280-iso-fresh') as fresh_seats,
+    (select name from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
+    (select visibility from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
+
+fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
+------------+-----------+-------------------+-------------------------+------------+-----------------
+           0|          0|K280 ISO REOPENED  |open                     |active      |                1
+(1 row)
+

package/tests/isolation/expected/task_thread_lock_order.out

@@ -0,0 +1,203 @@
+Parsed test spec with 5 sessions
+
+starting permutation: probe_begin probe_threads append_begin append_run probe_tasks probe_commit append_commit check
+step probe_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step probe_threads: 
+  select count(*)::int as locked_threads from (
+    select 1 from agent_board.threads t
+     where t.id = '7a820000-0000-4000-8000-000000000001' for update) s;
+
+locked_threads
+--------------
+             1
+(1 row)
+
+step append_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step append_run: 
+  select e.event_sequence,
+         (e.thread_id = '7a820000-0000-4000-8000-000000000001') as thread_is_task_thread
+    from agent_board.append_task_event(
+           '7a830000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'commented') e;
+ <waiting ...>
+step probe_tasks: 
+  select count(*)::int as locked_tasks from (
+    select 1 from agent_board.tasks tk
+     where tk.id = '7a830000-0000-4000-8000-000000000001' for update) s;
+
+locked_tasks
+------------
+           1
+(1 row)
+
+step probe_commit: COMMIT;
+step append_run: <... completed>
+event_sequence|thread_is_task_thread
+--------------+---------------------
+             1|t                    
+(1 row)
+
+step append_commit: COMMIT;
+step check: 
+  select (select array_agg(te.event_sequence order by te.event_sequence)
+            from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001') as event_sequences,
+         (select count(*)::int from agent_board.messages
+           where thread_id = '7a820000-0000-4000-8000-000000000001') as messages,
+         (select count(*)::int from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001'
+             and te.thread_id <> '7a820000-0000-4000-8000-000000000001') as events_on_wrong_thread;
+
+event_sequences|messages|events_on_wrong_thread
+---------------+--------+----------------------
+{1}            |       0|                     0
+(1 row)
+
+
+starting permutation: append_begin append_run post_begin post_run append_commit post_commit check
+step append_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step append_run: 
+  select e.event_sequence,
+         (e.thread_id = '7a820000-0000-4000-8000-000000000001') as thread_is_task_thread
+    from agent_board.append_task_event(
+           '7a830000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'commented') e;
+
+event_sequence|thread_is_task_thread
+--------------+---------------------
+             1|t                    
+(1 row)
+
+step post_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step post_run: 
+  select m.message_sequence,
+         (m.task_id = '7a830000-0000-4000-8000-000000000001') as task_attached
+    from agent_board.post_message(
+           '7a820000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'r1 iso body',
+           'comment',
+           '7a830000-0000-4000-8000-000000000001') m;
+ <waiting ...>
+step append_commit: COMMIT;
+step post_run: <... completed>
+message_sequence|task_attached
+----------------+-------------
+               1|t            
+(1 row)
+
+step post_commit: COMMIT;
+step check: 
+  select (select array_agg(te.event_sequence order by te.event_sequence)
+            from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001') as event_sequences,
+         (select count(*)::int from agent_board.messages
+           where thread_id = '7a820000-0000-4000-8000-000000000001') as messages,
+         (select count(*)::int from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001'
+             and te.thread_id <> '7a820000-0000-4000-8000-000000000001') as events_on_wrong_thread;
+
+event_sequences|messages|events_on_wrong_thread
+---------------+--------+----------------------
+{1}            |       1|                     0
+(1 row)
+
+
+starting permutation: post_begin post_run append_begin append_run post_commit append_commit check
+step post_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step post_run: 
+  select m.message_sequence,
+         (m.task_id = '7a830000-0000-4000-8000-000000000001') as task_attached
+    from agent_board.post_message(
+           '7a820000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'r1 iso body',
+           'comment',
+           '7a830000-0000-4000-8000-000000000001') m;
+
+message_sequence|task_attached
+----------------+-------------
+               1|t            
+(1 row)
+
+step append_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step append_run: 
+  select e.event_sequence,
+         (e.thread_id = '7a820000-0000-4000-8000-000000000001') as thread_is_task_thread
+    from agent_board.append_task_event(
+           '7a830000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'commented') e;
+ <waiting ...>
+step post_commit: COMMIT;
+step append_run: <... completed>
+event_sequence|thread_is_task_thread
+--------------+---------------------
+             1|t                    
+(1 row)
+
+step append_commit: COMMIT;
+step check: 
+  select (select array_agg(te.event_sequence order by te.event_sequence)
+            from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001') as event_sequences,
+         (select count(*)::int from agent_board.messages
+           where thread_id = '7a820000-0000-4000-8000-000000000001') as messages,
+         (select count(*)::int from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001'
+             and te.thread_id <> '7a820000-0000-4000-8000-000000000001') as events_on_wrong_thread;
+
+event_sequences|messages|events_on_wrong_thread
+---------------+--------+----------------------
+{1}            |       1|                     0
+(1 row)
+
+
+starting permutation: append_begin append_run append2_begin append2_run append_commit append2_commit check
+step append_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step append_run: 
+  select e.event_sequence,
+         (e.thread_id = '7a820000-0000-4000-8000-000000000001') as thread_is_task_thread
+    from agent_board.append_task_event(
+           '7a830000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'commented') e;
+
+event_sequence|thread_is_task_thread
+--------------+---------------------
+             1|t                    
+(1 row)
+
+step append2_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step append2_run: 
+  select e.event_sequence
+    from agent_board.append_task_event(
+           '7a830000-0000-4000-8000-000000000001',
+           '7a810000-0000-4000-8000-000000000001',
+           'status_changed') e;
+ <waiting ...>
+step append_commit: COMMIT;
+step append2_run: <... completed>
+event_sequence
+--------------
+             2
+(1 row)
+
+step append2_commit: COMMIT;
+step check: 
+  select (select array_agg(te.event_sequence order by te.event_sequence)
+            from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001') as event_sequences,
+         (select count(*)::int from agent_board.messages
+           where thread_id = '7a820000-0000-4000-8000-000000000001') as messages,
+         (select count(*)::int from agent_board.task_events te
+           where te.task_id = '7a830000-0000-4000-8000-000000000001'
+             and te.thread_id <> '7a820000-0000-4000-8000-000000000001') as events_on_wrong_thread;
+
+event_sequences|messages|events_on_wrong_thread
+---------------+--------+----------------------
+{1,2}          |       0|                     0
+(1 row)
+

package/tests/isolation/specs/enroll_identity_board_owner_lock_order.spec

@@ -60,12 +60,13 @@ setup
   -- Materialize the owner auth.users row the enrollment will derive, so the guard
   -- holds the SAME row (a race to INSERT it would block on the unique index, not on
   -- the lock order under test).
+  -- #246: through the shared derivation helper, deliberately. The point of this row is
+  -- that it is the SAME row the enrollment will resolve to; a copied expression here
+  -- would silently stop matching the moment the derivation moved, and this spec would
+  -- go on "passing" while holding a lock on an unrelated row.
   create table lo194_owner as
   select agent_board._ensure_agent_auth_user(
-    'fed-human-' || substr(
-      encode(extensions.digest(
-        convert_to('https://lo194-iso.test' || '|' || 'iso-human', 'UTF8'), 'sha256'), 'hex'),
-      1, 32)) as uid;
+    agent_board._federated_identity_slug('https://lo194-iso.test', 'iso-human')) as uid;
 }
 
 # Holds the human owner row, so the enrollment parks on it in either schema.

package/tests/isolation/specs/fedsession_provider_absent_owner_lock.spec

@@ -22,12 +22,12 @@
 
 setup
 {
+  -- #246: through the shared derivation helper, deliberately -- see the note in
+  -- enroll_identity_board_owner_lock_order.spec. The row must be the one the path under
+  -- test would resolve to, not a copy of an expression that can drift away from it.
   create table lo193_owner as
   select agent_board._ensure_agent_auth_user(
-    'fed-human-' || substr(
-      encode(extensions.digest(
-        convert_to('https://lo193-iso.test' || '|' || 'iso-orphan', 'UTF8'), 'sha256'), 'hex'),
-      1, 32)) as uid;
+    agent_board._federated_identity_slug('https://lo193-iso.test', 'iso-orphan')) as uid;
 }
 
 # Holds the human owner row that the absent-provider path must never reach.

package/tests/isolation/specs/ledger_authority_revoke.spec

@@ -31,6 +31,20 @@
 # MUTATION-VERIFIED: dropping `for share` from _assert_actor_not_fleet_revoked (leaving the
 # ledger read unlocked) changes permutations 2 and 4 — the authority write no longer waits.
 # Clean schema -> byte-identical across 10 runs.
+#
+# #280 RE-RAN THAT MUTATION and measured which of the four new permutations it moves. The result
+# is the honest form of this migration's lock claim, so it is recorded here rather than argued:
+#   * Permutations 9 and 10 (the FRESH-BOARD branch) are BYTE-IDENTICAL with the lock removed.
+#     That is expected and is the point: the owner-seat INSERT's FK already holds KEY SHARE on
+#     the actor's agents row before the gate runs, so the FK — not the FOR SHARE — is what makes
+#     that branch wait. These two permutations pin the OUTCOME (blocks, fails closed, no board
+#     and no seat) and CANNOT pin the lock. Nothing here should be read as though they do.
+#   * Permutations 11 and 12 (the SLUG-COLLISION branch) BOTH move. With the lock removed,
+#     permutation 11 stops waiting entirely and the reopen SUCCEEDS on its pre-revocation
+#     snapshot: the check row goes from `K276 ISO Board | private` to `K280 ISO REOPENED | open`
+#     — a ledger-revoked owner reopening an existing board and making it publicly visible across
+#     a committing revocation. That is the TOCTOU the FOR SHARE closes, and permutation 11 is the
+#     only place in this spec where the lock itself is discriminated.
 
 setup
 {
@@ -96,6 +110,11 @@ teardown
                         where board_id = '27720000-0000-4000-8000-000000000001');
   delete from agent_board.board_invite_tokens
    where board_id = '27720000-0000-4000-8000-000000000001';
+  delete from agent_board.board_membership_events
+   where board_id in (select id from agent_board.boards where slug like 'k280-iso-%');
+  delete from agent_board.board_memberships
+   where board_id in (select id from agent_board.boards where slug like 'k280-iso-%');
+  delete from agent_board.boards where slug like 'k280-iso-%';
   delete from agent_board.board_membership_events
    where board_id = '27720000-0000-4000-8000-000000000001';
   delete from agent_board.fleet_revocation_events
@@ -220,6 +239,74 @@ step "redeem2_link" {
 }
 step "redeem2_commit" { COMMIT; }
 
+# ---------------------------------------------------------------------------------------------
+# #280 — create_board. TWO sessions, because the function is two operations behind one name and
+# the FOR SHARE means something different on each branch (see 20260911000100's header).
+#
+#   cboard  — the FRESH-BOARD branch. The owner seat INSERT takes FK KEY SHARE on the actor's
+#             agents row BEFORE the gate runs, so the FK — not the gate — is what makes this
+#             branch wait. Permutations 9 and 10 therefore pin the OUTCOME (blocks, then fails
+#             closed, leaving NO board and NO seat) and structurally cannot pin the lock.
+#   creopen — the SLUG-COLLISION branch, re-opening the board the actor already owns. The boards
+#             UPDATE does not touch created_by_agent_id, so no FK fires and the gate's FOR SHARE
+#             is the ONLY agents lock on that path. Permutation 11 is the genuine lock
+#             discriminator this migration has and the mint path could not provide: remove the
+#             FOR SHARE and the reopen stops waiting and SUCCEEDS on its own snapshot.
+# ---------------------------------------------------------------------------------------------
+session "cboard"
+step "cboard_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+}
+step "cboard_create" {
+  select c.slug
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k280-iso-fresh', 'K280 ISO Fresh') c;
+}
+step "cboard_commit" { COMMIT; }
+
+session "creopen"
+step "creopen_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+}
+# p_metadata is passed as NULL below rather than as an empty-object jsonb literal, and this note
+# lives OUTSIDE the step for the same reason: the isolationtester spec lexer matches BRACES to
+# delimit a step body, so an empty-object literal anywhere inside the SQL closes the step early
+# and the parse dies on the next quote. create_board coalesces a null p_metadata to that same
+# empty object, so the call is identical. (Backticks break the lexer here too.)
+step "creopen_call" {
+  select c.name, c.visibility
+    from agent_board.create_board(
+      '27710000-0000-4000-8000-000000000001', 'k276-iso-board', 'K280 ISO REOPENED',
+      null, null, 'open') c;
+}
+step "creopen_commit" { COMMIT; }
+
+# The #280 state row. Kept separate from "check" so the existing golden rows keep their shape and
+# a diff in permutations 1-8 can only be a real change.
+session "cbcheck"
+step "cbcheck" {
+  select
+    (select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
+    (select count(*) from agent_board.board_memberships bm
+       join agent_board.boards b on b.id = bm.board_id
+      where b.slug = 'k280-iso-fresh') as fresh_seats,
+    (select name from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
+    (select visibility from agent_board.boards
+      where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
+}
+
 session "check"
 step "check" {
   select
@@ -288,3 +375,31 @@ permutation "revoke_begin" "revoke_agent" "revoke_commit" "redeem_begin" "redeem
 #    but a creator holding K links has K independent windows. outstanding_link_uses = 1 in the
 #    check row is the byte that says exactly one slipped.
 permutation "revoke_begin" "revoke_agent" "redeem_begin" "redeem_link" "redeem2_begin" "redeem2_link" "revoke_commit" "redeem_commit" "redeem2_commit" "check"
+
+# 9. #280, FRESH branch, create first. The revocation must WAIT rather than commit underneath a
+#    board creation that has already run its gate. The board stands and the revocation lands
+#    after it -- a creation that beat the revocation, the same outcome as a creation a
+#    millisecond earlier. What makes the revoker wait here is the seat INSERT's FK KEY SHARE on
+#    the actor's agents row, not the gate; recorded so nobody reads this permutation as a lock
+#    pin for the FOR SHARE.
+permutation "cboard_begin" "cboard_create" "revoke_begin" "revoke_agent" "cboard_commit" "revoke_commit" "cbcheck"
+
+# 10. #280's OWN interleaving, FRESH branch: the revocation is in flight when create_board runs.
+#     The creation blocks, then observes the committed revocation and fails closed -- fresh_boards
+#     and fresh_seats are both 0, so the boards INSERT, the owner seat and the owner_seed event
+#     all rolled back together. Before 20260911000100 this permutation COMPLETED the creation:
+#     create_board read no ledger at all, so there was nothing to see. This is the OUTCOME pin.
+permutation "revoke_begin" "revoke_agent" "cboard_begin" "cboard_create" "revoke_commit" "cboard_commit" "cbcheck"
+
+# 11. #280, SLUG-COLLISION branch, revoke in flight -- THE LOCK DISCRIMINATOR. The boards UPDATE
+#     leaves created_by_agent_id alone, so no FK takes an agents lock and the gate's FOR SHARE is
+#     the only one on this path. The reopen blocks on it, then fails closed, leaving the existing
+#     board's name and visibility untouched. Drop the FOR SHARE from
+#     _assert_actor_not_fleet_revoked and this permutation stops waiting and SUCCEEDS on its own
+#     pre-revocation snapshot -- which permutations 9 and 10 cannot show, and neither can the
+#     mint path (permutation 5), where the FK always gets there first.
+permutation "revoke_begin" "revoke_agent" "creopen_begin" "creopen_call" "revoke_commit" "creopen_commit" "cbcheck"
+
+# 12. ...and the collision branch write-first, for the pair: the reopen is authorized and stands,
+#     the revocation waits on the share-locked agents row and lands after it.
+permutation "creopen_begin" "creopen_call" "revoke_begin" "revoke_agent" "creopen_commit" "revoke_commit" "cbcheck"