@consiliency/agent-board-schema 1.28.0 → 1.38.0

package/tests/agent_board_claim_subject_gate.test.sql

@@ -0,0 +1,1025 @@
+-- Consiliency/message-board#291 — a claim is a LOCK, never a KEY; and the key it hands out is
+-- never taken back, which is a RULING rather than an accident.
+--
+-- Sibling of agent_board_receipt_subject_gate.test.sql (#287). Three properties share this file
+-- because two of them pull against each other and the third is what makes the pair safe:
+--
+--   THE GATE       a service_role caller may no longer name a THIRD PARTY in a thread-bound
+--                  acquire_claim unless that agent already passes the thread-access predicate.
+--                  Before 20260914000100, `acquire_claim(B,'file',k,…, p_thread_id => T)` under
+--                  service_role wrote a claims row for an agent B with no relationship to T --
+--                  and because a claims row IS an inherit-mode disjunct, B then passed the
+--                  predicate. Measured false -> true, for thread access AND (through the thread
+--                  disjunct of _current_agent_can_access_task) for task access.
+--
+--   THE GRANDFATHER  the claims disjunct STAYS, unfiltered. It keys on (thread_id, agent_id)
+--                  and NOT on `status` or `lease_expires_at`, so a RELEASED or LONG-EXPIRED
+--                  claim still grants access, permanently. The owner ratified this on #291 and
+--                  REJECTED both alternatives (filter the disjunct; re-mechanise the access).
+--                  Three flows assert it POSITIVELY -- released by the holder, expired by time,
+--                  and released by an OPERATOR through reclaim_fleet_machine -- because a
+--                  well-meaning "cleanup" of the disjunct is what they exist to stop.
+--
+--   THE SCOPE      the gate applies ONLY when the claim is bound to a thread. A machine /
+--                  repository / repo_file / ownerless claim stores thread_id = null, is a
+--                  disjunct of nothing, and mints no access; _agent_can_access_thread answers
+--                  false for a null thread, so an unconditional gate would refuse every fleet
+--                  claim in existence. That capability is pinned positively (16-18), because
+--                  the failure mode of this fix is not "the hole stays open", it is "the hole
+--                  closes and takes a working feature with it".
+--
+-- HOW THE GRANDFATHER FLOWS ARE BUILT, and why the obvious version of them is VACUOUS. The
+-- claim holder must ALREADY have access to acquire the claim -- that is the gate. So a flow
+-- that acquires a claim and then releases it proves nothing: the route that let it acquire is
+-- still there and still grants access, and a mutation that filters the disjunct on `status`
+-- stays GREEN. (Measured: the first draft of this file had exactly that shape, and mutations f
+-- and g produced ran=50, notok=0.) Each flow therefore REMOVES the other route first -- the
+-- agent is a task ASSIGNEE, and the task is reassigned away, exactly as #287 flow B does -- and
+-- asserts in between that the claim is now the ONLY thing granting access. Only then does
+-- releasing/expiring it test anything.
+--
+-- THE FIRST-ACCESS QUESTION, settled before the gate was written. If claiming were how an agent
+-- came to SEE a task, gating on prior access would break the product. It is not, and the proof
+-- is structural rather than a survey: for a non-service_role caller
+-- `_current_agent_can_access_thread(T)` REDUCES to `_agent_can_access_thread(T, current_agent_id())`
+-- and `_resolved_actor_agent_id` forces the subject to equal `current_agent_id()`, so the gate
+-- re-evaluates an expression the function has just proved true. Assertions 24-27 measure that on
+-- the shapes. The legitimate dispatch pattern -- DELIVER first (inbox item), then claim --
+-- survives and is asserted at 19-23.
+--
+-- The file runs as the postgres db role and simulates callers the way
+-- agent_board_receipt_subject_gate.test.sql does: request.jwt.claim.role / .sub. With NO role
+-- claim `_is_service_role()` is ALREADY true for session_user postgres, so the service_role
+-- claim is set explicitly wherever it matters rather than relied on implicitly.
+--
+-- ============================================================================
+-- ONE PROPERTY THIS FILE DELIBERATELY DOES NOT CLAIM
+-- ============================================================================
+-- The migration places the gate BEFORE the expiry sweep, and an earlier draft of both the
+-- migration header and this file called that "predicate before side effects: a refused caller
+-- must not reach the sweep or the denial leaks observable state". THAT CLAIM IS FALSE, and it
+-- was caught by its own mutation rather than by reading: moving the gate to sit BELOW the sweep
+-- (mutation e) produced ran=60, notok=0.
+--
+-- The reason is statement atomicity. `raise exception` unwinds the entire function call, so
+-- EVERY write the function made before raising is rolled back regardless of where the check
+-- sits. A refused caller therefore observes no state change no matter what -- which means the
+-- property is real but is NOT a consequence of gate placement, and no test can pin placement
+-- through it. The placement is kept because it matches the convention CLAIMGATE/ENFORCE states
+-- two blocks below in the same function, not because a test defends it.
+--
+-- What IS asserted here is the pair 12-15: a refused acquire leaves a stale sibling row
+-- untouched (13, true by atomicity), AND an ALLOWED acquire on the same key really does sweep
+-- it (15). 15 is the positive control without which 13 is indistinguishable from a fixture that
+-- never reaches the sweep at all.
+--
+-- ============================================================================
+-- MUTATION EVIDENCE — measured, not predicted, and re-measured after each plan change.
+-- All 63 assertions RAN in every row below (`ran=63`); a truncated plan is the failure mode
+-- this table exists to rule out, and it is checked per row rather than inferred.
+-- ============================================================================
+--   a  delete the subject-gate `if` from acquire_claim
+--        -> not ok 2, 3, 4, 5, 6 (the mint reopens), 51 (the class assertion names it),
+--           61, 62 (the changed codes fall back to 23503), and 13, 14, 18, 25, 26, 27 as CASCADE -- once the stranger holds a claim it has access,
+--           so the later refusals stop refusing. The cascade is recorded, not filtered.
+--   b  re-add `_is_service_role() or` to _agent_can_access_thread
+--        -> not ok 1, 2, 3, 4, 5, 6, 13, 14, 18, 19, 25, 26, 27, 61, 62  -- the gate goes vacuous;
+--           assertion 1 is the one that exists for this and reds FIRST
+--   c  drop `v_thread_id is not null` from the gate (unconditional in THREAD PRESENCE)
+--        -> not ok 16, 17 (every fleet/ownerless claim refused -- the capability pin), 26, and
+--           63, which is the assertion that pins the changed-code boundary: with the gate
+--           unconditional, a THREAD-LESS claim for a nonexistent subject answers 42501 instead
+--           of the 23503 it still answers today
+--   d  hoist the gate ABOVE the session thread check
+--        -> not ok 25  -- an authenticated caller now hears the SUBJECT message instead of the
+--           session one; the two 42501s stop being ordered
+--   e  move the gate BELOW the expiry sweep
+--        -> ran=63, notok=0.  THE PROPERTY IS NOT PINNED AND THE HEADER CLAIM WAS WRONG -- see
+--           "ONE PROPERTY THIS FILE DELIBERATELY DOES NOT CLAIM" above. Recorded as a mutation
+--           that produced NO failure rather than dropped, because that is the finding.
+--   f  add `and c.status = 'active'` to the claims disjunct of _agent_can_access_thread
+--        -> not ok 37, 49  -- the RATIFIED released-claim permanence collapses in flow R and in
+--           the operator-release flow M
+--   g  add `and c.lease_expires_at > now()` to the claims disjunct
+--        -> not ok 43  -- the RATIFIED expired-claim permanence collapses in flow E
+--   x  remove the claims disjunct from _agent_can_access_thread entirely
+--        -> not ok 34, 37, 40, 43, 46, 49  -- all three flows lose access the moment the task
+--           assignment is taken away. This is what proves 34/40/46 are load-bearing rather than
+--           decorative: without them f and g would have nothing to collapse.
+--   h  release_claim also `set agent_id = <another real agent>` (re-key an existing row)
+--        -> not ok 36 (the positive exemption assertion), 37 (cascade: the row is no longer the
+--           holder's). The re-key uses a REAL agent id so the call still succeeds -- an invalid
+--           uuid would have reded 35 on the FK and told us nothing about the exemption.
+--   i  renew_claim also `set thread_id = <another real thread>`
+--        -> not ok 42 (the positive exemption assertion), 43 (cascade)
+--   j  reclaim_fleet_machine also `set agent_id = p_new_owner_agent_id`
+--        -> not ok 48 (the positive exemption assertion), 49 (cascade)
+--   y  remove the expiry sweep from acquire_claim
+--        -> not ok 14, 15  -- the positive CONTROL for the sweep. Without y, assertion 13 is
+--           indistinguishable from a fixture that never reaches the sweep at all.
+--   s  remove the `_is_service_role() or` from _current_agent_can_access_thread (over-revoke:
+--      "fixing" the no-short-circuit invariant by deleting it everywhere)
+--        -> not ok 60 (the named over-revoke guard) + 25 cascades: every service_role caller in
+--           the file loses its session check, which is exactly the damage the guard predicts
+--   k1 a NEW writer spelled `merge into agent_board.claims`
+--        -> not ok 50 (names it), 51, 52
+--   k2 a NEW writer spelled `update only agent_board.claims`
+--        -> not ok 50
+--   k3 a NEW writer spelled `delete from only "agent_board" . "claims"`
+--        -> not ok 50, 52
+--   k4 the EXISTING member acquire_claim's own insert respelled
+--      `insert into "agent_board"."claims"` -- rule 2: mutate a member, do not only add one
+--        -> ran=63, notok=0, and that is the CORRECT outcome: the scan must still see the
+--           member. The green is only evidence because the contrast was measured directly --
+--           the shipped creator pattern matches that spelling (true) while the same pattern
+--           without its quoted-identifier arm does not (false), i.e. under the narrower pattern
+--           acquire_claim would have DROPPED OUT of assertion 50's set and reded it.
+--   l  a claims reaper (`delete from agent_board.claims`)
+--        -> not ok 50, 52
+--   m  a TRUNCATE-based claims reaper (`truncate table agent_board.claims`)
+--        -> not ok 50, 52.  Before `truncate` joined assertion 50's alternation this reded only
+--           52, while 50's own message claimed to name every WRITER -- a claim wider than its
+--           query, caught by this mutation.
+--   z1 a TRUNCATE-based claims reaper spelled `truncate table only agent_board.claims`
+--        -> not ok 50, 52.  It was GREEN until the keyword order was fixed (panel CR, codex
+--           finding). The alternation was `truncate(\s+only)?\s+(table\s+)?`, i.e. ONLY
+--           before TABLE; PostgreSQL's syntax is `TRUNCATE [ TABLE ] [ ONLY ] name` -- TABLE
+--           FIRST. Measured on PG17 against the OLD pattern: `truncate agent_board.claims`
+--           true, `truncate only …` true, `truncate table …` true, `truncate table only …`
+--           FALSE -- an equally legal spelling, silently invisible, defeating the permanence
+--           guarantee the ruling depends on. Now `(\s+table)?(\s+only)?`, which takes both
+--           keywords in the legal order, either alone, or neither. The IDENTICAL defect was
+--           already merged on main in agent_board_receipt_subject_gate.test.sql (transplanted
+--           from #287 with the rest of the pattern); both are fixed here, and its mutation l2
+--           pins the twin.
+--   n  a NEW inserter that CALLS _agent_can_access_thread and IGNORES the result
+--        -> not ok 50, 51.  51 matches the REFUSING form, so a bare call does not satisfy it.
+--   o  `grant insert on agent_board.claims to public`
+--        -> not ok 53, 55, 57, 58  -- both privilege arms
+--   p  `grant insert` to a BRAND-NEW role
+--        -> not ok 58 only.  has_table_privilege(service_role,INSERT) stayed FALSE, so the
+--           effective arm alone would have shipped this green -- this is why the set form exists
+--   q  `grant insert` to a role, then that role granted TO service_role (role MEMBERSHIP)
+--        -> not ok 53, 58.  The ACL names only the member role, so the set form reports the
+--           wrong subject; has_table_privilege(service_role) is the one that answers the real
+--           question -- this is why the effective arm exists
+--   r  `revoke select on claims from service_role` (over-revoke guard)
+--        -> not ok 54
+--   t  a function that WRITES threads.access_mode
+--        -> not ok 29  -- the restricted-unreachable finding stops being true
+--   u  `grant update on agent_board.threads to service_role`
+--        -> not ok 30  -- the other leg of the same finding
+--   v  a NEW writer on a DIFFERENT table named `claims_archive`
+--        -> ran=60, notok=0.  A NEGATIVE pin: the guard must stay GREEN, or a future author who
+--           adds a claims_archive table gets a FALSE accusation, and the natural response to a
+--           guard that cries wolf is to loosen it.
+--   v-control  a REAL claims writer added in the same transaction as v
+--        -> not ok 50.  Without this, v's green is indistinguishable from a pattern that matches
+--           nothing at all; a negative pin needs a positive control beside it.
+--
+-- THE PATTERN MATRIX, measured on this cluster rather than reasoned about: 22 claims-specific
+-- spellings, 11 that MUST match (plain insert, merge, `merge into only`, `update only`,
+-- `delete from only` with a quoted+spaced schema dot, quoted schema.table, quoted table alone,
+-- `truncate table`, `truncate only`, `truncate table only`, and a newline between the table
+-- name and the next clause) and 11 that MUST NOT (`claims_archive` bare / schema-qualified /
+-- quoted / truncated-table-only, `claims_archive` unqualified truncate, `claims2`,
+-- `old_claims`, `reclaims`, `agent_board.reclaims`, `delete from reclaims`, and a plain SELECT,
+-- which is a read and not a write). 22/22 correct. The three TRUNCATE rows are the ones the
+-- first version got wrong (see z1).
+-- The `reclaims` cases are the LEFT-boundary check and they are not hypothetical: the mandatory
+-- `\s+` after the verb is the only thing refusing them, and `reclaim_fleet_machine` already
+-- lives in this schema.
+--
+-- ============================================================================
+-- WHAT THE CATALOG SCANS COVER, stated exactly rather than generously
+-- ============================================================================
+-- They are REGEXes over stripped function source, so their completeness is the completeness of
+-- the pattern and a spelling the pattern does not know is a SILENT miss. The pattern is
+-- transplanted from #287's FINAL form with `read_receipts` -> `claims`, so it covers ONLY,
+-- MERGE, double-quoted identifier parts and whitespace around the schema dot -- all
+-- VERIFIED-LEGAL spellings on PG17, each of which was invisible to that pattern's earlier
+-- drafts.
+--
+-- The right-hand boundary is an ALTERNATION, not a trailing \M, and the reason is subtle enough
+-- to restate: `_` is a word character in Postgres regex, so `claims\M` correctly refuses
+-- `claims_archive`; but `"claims"\M` FAILS, because after `"` no word ends there. Writing
+-- `"?claims"?\M` happens to work only because the optional `"?` backtracks to empty, i.e. on
+-- the quoted form it silently stops requiring the closing quote. The alternation states the two
+-- cases separately: unquoted ends at \M, quoted ends at its own mandatory closing quote.
+--
+-- The LEFT boundary is the mandatory `\s+` after the verb, and it is what refuses `reclaims`,
+-- `old_claims` and `agent_board.reclaims` -- re-verified over claims-specific spellings rather
+-- than inherited from the receipts file, because `reclaims` is a real English word that a
+-- future table could plausibly be called and `reclaim_fleet_machine` already lives in this
+-- schema.
+--
+-- ONE KNOWN BLIND SPOT, NOW CLOSED (message-board#293). A function declared with an
+-- SQL-standard `BEGIN ATOMIC` body keeps its body in pg_proc.prosqlbody and leaves prosrc
+-- EMPTY. agent_board_test.stripped_body used to read prosrc only, so it returned '' for such a
+-- function and NOTHING matched -- a writer written that way was invisible to assertions 29, 50,
+-- 51 and 52 alike. It was fixed suite-wide rather than here, because a local patch would have
+-- fixed one caller and left the other 21 open. stripped_body now falls back to the deparsed
+-- prosqlbody and RAISES on a body it cannot read at all; the fallback is pinned by SQLBODY-1..-11
+-- in agent_board_source_strip_helper.test.sql, including SQLBODY-11, which is this file's own
+-- exact-set scan shape. Note what that does NOT say: the scans below are still regexes, and the
+-- text they now read for such a function is Postgres' DEPARSE of it, not the author's source.
+--
+-- What keeps the completeness claim honest despite that is the SECOND LEG: no grantee holds a
+-- write privilege on agent_board.claims by ANY route (53-59), so an unmatched writer would have
+-- to be a SECURITY DEFINER function -- exactly the population these scan -- and the exact-set
+-- shape means a widened pattern fails LOUDLY and names what it caught rather than passing.
+--
+-- THE EXEMPTIONS ARE ASSERTED POSITIVELY (CLAUDE.md rule 1). Three of the four claims writers
+-- are exempt from carrying the subject gate, and the exemption is not "they look harmless": it
+-- is the claim that NONE of them creates or re-keys a (thread_id, agent_id) pair. Each is
+-- called and its resulting row inspected -- release_claim (36), renew_claim (42),
+-- reclaim_fleet_machine (48) -- rather than argued from the absence of a regex match.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(63);
+
+create temp table _csg (
+  thread_plain  uuid,
+  thread_task   uuid,
+  thread_rel    uuid,
+  thread_exp    uuid,
+  thread_mach   uuid,
+  agent_owner   uuid,
+  agent_strange uuid,
+  agent_inbox   uuid,
+  agent_rel     uuid,
+  agent_exp     uuid,
+  agent_mowner  uuid,
+  agent_mnew    uuid,
+  user_owner    uuid,
+  user_strange  uuid,
+  task_id       uuid,
+  task_rel      uuid,
+  task_exp      uuid,
+  task_mach     uuid,
+  message_id    uuid,
+  machine_id    uuid,
+  machine_fp    text,
+  stale_claim   uuid,
+  sfx           text
+) on commit drop;
+
+-- Claim captures land in a table that EXISTS BEFORE any RPC runs. `create temp table _x as
+-- select * from <rpc>(...)` inside lives_ok looks equivalent, but when the call raises the table
+-- is never created and the NEXT assertion -- a plain select from it -- errors and aborts the
+-- whole file, so the remaining assertions never run (#113, observed on #287). lives_ok's
+-- subtransaction contains the raise; a missing row then reads as null and FAILS a named
+-- assertion instead of killing the plan.
+--
+-- Assertions that read a captured row must be written so that a MISSING row is a FAILURE. An
+-- assertion of the form is(<col>, null, …) passes on a missing row and is therefore blind to a
+-- refused call -- assertion 17 was that shape in the first draft, and mutation c (which refuses
+-- the very call it captures) left it GREEN. It now asserts a compound that is null when the row
+-- is missing and true only when the row exists AND has the shape claimed.
+create temp table _csg_claim (
+  label             text primary key,
+  claim_id          uuid,
+  task_id           uuid,
+  thread_id         uuid,
+  agent_id          uuid,
+  resource_kind     text,
+  resource_key      text,
+  status            text,
+  lease_token       uuid,
+  lease_expires_at  timestamptz,
+  released_at       timestamptz,
+  created_at        timestamptz,
+  updated_at        timestamptz
+) on commit drop;
+
+do $$
+declare
+  v_sfx     text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_u_owner uuid;
+  v_u_stran uuid;
+  v_u_inbox uuid;
+  v_u_rel   uuid;
+  v_u_exp   uuid;
+  v_u_mown  uuid;
+  v_u_mnew  uuid;
+  v_owner   uuid := gen_random_uuid();
+  v_strange uuid := gen_random_uuid();
+  v_inbox   uuid := gen_random_uuid();
+  v_rel     uuid := gen_random_uuid();
+  v_exp     uuid := gen_random_uuid();
+  v_mowner  uuid := gen_random_uuid();
+  v_mnew    uuid := gen_random_uuid();
+  v_t_plain uuid := gen_random_uuid();
+  v_t_task  uuid := gen_random_uuid();
+  v_t_rel   uuid := gen_random_uuid();
+  v_t_exp   uuid := gen_random_uuid();
+  v_t_mach  uuid := gen_random_uuid();
+  v_task    uuid := gen_random_uuid();
+  v_tk_rel  uuid := gen_random_uuid();
+  v_tk_exp  uuid := gen_random_uuid();
+  v_tk_mach uuid := gen_random_uuid();
+  v_msg     uuid := gen_random_uuid();
+  v_dom     uuid;
+  v_mach    uuid;
+  v_fp      text;
+  v_stale   uuid := gen_random_uuid();
+begin
+  v_u_owner := public.ensure_github_user('csg-owner-' || v_sfx, 'csg-owner-' || v_sfx || '@example.test', 'csg-owner-' || v_sfx, 'CSG Owner');
+  v_u_stran := public.ensure_github_user('csg-stran-' || v_sfx, 'csg-stran-' || v_sfx || '@example.test', 'csg-stran-' || v_sfx, 'CSG Stranger');
+  v_u_inbox := public.ensure_github_user('csg-inbox-' || v_sfx, 'csg-inbox-' || v_sfx || '@example.test', 'csg-inbox-' || v_sfx, 'CSG Inbox');
+  v_u_rel   := public.ensure_github_user('csg-rel-'   || v_sfx, 'csg-rel-'   || v_sfx || '@example.test', 'csg-rel-'   || v_sfx, 'CSG Release Flow');
+  v_u_exp   := public.ensure_github_user('csg-exp-'   || v_sfx, 'csg-exp-'   || v_sfx || '@example.test', 'csg-exp-'   || v_sfx, 'CSG Expiry Flow');
+  v_u_mown  := public.ensure_github_user('csg-mown-'  || v_sfx, 'csg-mown-'  || v_sfx || '@example.test', 'csg-mown-'  || v_sfx, 'CSG Machine Owner');
+  v_u_mnew  := public.ensure_github_user('csg-mnew-'  || v_sfx, 'csg-mnew-'  || v_sfx || '@example.test', 'csg-mnew-'  || v_sfx, 'CSG Machine New Owner');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_owner,   'agent', 'csg-owner-' || v_sfx, 'CSG Owner',     'active', v_u_owner, v_u_owner),
+    (v_strange, 'agent', 'csg-stran-' || v_sfx, 'CSG Stranger',  'active', v_u_stran, v_u_stran),
+    (v_inbox,   'agent', 'csg-inbox-' || v_sfx, 'CSG Inbox',     'active', v_u_inbox, v_u_inbox),
+    (v_rel,     'agent', 'csg-rel-'   || v_sfx, 'CSG RelFlow',   'active', v_u_rel,   v_u_rel),
+    (v_exp,     'agent', 'csg-exp-'   || v_sfx, 'CSG ExpFlow',   'active', v_u_exp,   v_u_exp),
+    (v_mowner,  'agent', 'csg-mown-'  || v_sfx, 'CSG MachOwner', 'active', v_u_mown,  v_u_mown),
+    (v_mnew,    'agent', 'csg-mnew-'  || v_sfx, 'CSG MachNew',   'active', v_u_mnew,  v_u_mnew);
+
+  -- Five inherit threads (access_mode defaults to 'inherit'; see 29-31 for why there is no
+  -- 'restricted' thread here -- one cannot be created through any shipped path). Every thread
+  -- is created by v_owner, so no grandfather-flow agent gets the CREATOR disjunct for free.
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, last_message_sequence)
+  values
+    (v_t_plain, 'coordination', v_owner, 'CSG plain thread',   9),
+    (v_t_task,  'task',         v_owner, 'CSG task thread',    9),
+    (v_t_rel,   'task',         v_owner, 'CSG release thread', 9),
+    (v_t_exp,   'task',         v_owner, 'CSG expiry thread',  9),
+    (v_t_mach,  'task',         v_owner, 'CSG machine thread', 9);
+
+  -- The grandfather flows lean on the TASK disjunct as the route that will be taken away, so
+  -- each flow agent is an ASSIGNEE and never a creator.
+  insert into agent_board.tasks(id, thread_id, created_by_agent_id, assigned_agent_id, title, status, priority, orchestration_mode)
+  values
+    (v_task,    v_t_task, v_owner, v_owner,  'CSG task',         'pending', 'medium', 'distributed'),
+    (v_tk_rel,  v_t_rel,  v_owner, v_rel,    'CSG release task', 'pending', 'medium', 'distributed'),
+    (v_tk_exp,  v_t_exp,  v_owner, v_exp,    'CSG expiry task',  'pending', 'medium', 'distributed'),
+    (v_tk_mach, v_t_mach, v_owner, v_mowner, 'CSG machine task', 'pending', 'medium', 'distributed');
+
+  -- The message the delivery-first dispatch flow (19-23) is delivered from.
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+  values (v_msg, v_t_plain, v_owner, 1, 'comment', 'csg plain post');
+
+  -- A STALE ACTIVE claim on the (kind, key) the sweep assertions contend for.
+  insert into agent_board.claims(id, agent_id, resource_kind, resource_key, status, lease_expires_at)
+  values (v_stale, v_owner, 'file', 'csg-swept-' || v_sfx, 'active', now() - interval '1 hour');
+
+  -- Fleet fixture for the reclaim_fleet_machine exemption + the operator-release flow (44-49).
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('csg-domain-' || v_sfx, 'CSG Domain', 'tailnet', v_mowner, 'active', now())
+  returning id into v_dom;
+
+  select machine_id into v_mach
+    from agent_board.register_fleet_machine(v_mowner, v_dom, 'csg-m1-' || v_sfx, 'sha256:csg-m1-' || v_sfx, 'portal', '{"redacted":true}'::jsonb);
+  select machine_fingerprint into v_fp from agent_board.fleet_machines where id = v_mach;
+
+  insert into _csg values
+    (v_t_plain, v_t_task, v_t_rel, v_t_exp, v_t_mach,
+     v_owner, v_strange, v_inbox, v_rel, v_exp, v_mowner, v_mnew,
+     v_u_owner, v_u_stran,
+     v_task, v_tk_rel, v_tk_exp, v_tk_mach,
+     v_msg, v_mach, v_fp, v_stale, v_sfx);
+end
+$$;
+
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- ============================================================================
+-- 1-6. THE GATE: service_role cannot mint a claim for an agent with no access
+-- ============================================================================
+-- Assertion 1 is the VACUITY GUARD and it is deliberately evaluated UNDER a service_role claim:
+-- _agent_can_access_thread must carry NO _is_service_role() bypass, or the gate below is a
+-- no-op while every allow-side assertion in this file stays green.
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_plain from _csg), (select agent_strange from _csg)),
+  false,
+  'invariant: _agent_can_access_thread answers about the SUBJECT under a service_role claim (no short-circuit)');
+
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_strange from _csg), 'file', 'csg-mint-1',
+       now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  '42501',
+  'claim subject has no access to thread',
+  'service_role CANNOT mint a thread-bound claim for an agent with no access to the thread');
+
+select is(
+  (select count(*)::int from agent_board.claims c
+    where c.thread_id = (select thread_plain from _csg)
+      and c.agent_id = (select agent_strange from _csg)),
+  0,
+  'the refused call wrote NO claims row for the named stranger');
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_plain from _csg), (select agent_strange from _csg)),
+  false,
+  'the stranger still has no thread access after the refused call (the false->true transition is closed)');
+
+-- The task-BOUND shape reaches the same gate: v_thread_id is resolved from the task, so naming
+-- a task rather than a thread is not a way round it.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_strange from _csg), 'file', 'csg-mint-2',
+       now() + interval '1 hour', (select task_id from _csg), null, '{}'::jsonb) $$,
+  '42501',
+  'claim subject has no access to thread',
+  'the p_task_id shape reaches the same gate -- naming a task instead of a thread is not a bypass');
+
+select is(
+  (select count(*)::int from agent_board.claims c
+    where c.task_id = (select task_id from _csg)
+      and c.agent_id = (select agent_strange from _csg)),
+  0,
+  'the refused task-bound call wrote NO claims row either');
+
+-- ============================================================================
+-- 7-11. The allow side, and the error codes the gate must not usurp
+-- ============================================================================
+-- NOT the whole error-code story, and this pointer is here so a reader does not conclude that
+-- it is: the gate DOES change one code, deliberately, and that change is pinned at 61-63.
+-- #113: every call goes through lives_ok and the assertions read the captured row. A bare
+-- is((select ... from acquire_claim(...))) would ABORT the whole file on a raise, emitting no
+-- `not ok` -- an over-refusing gate would then look like a pass.
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'owner-plain', * from agent_board.acquire_claim(
+         (select agent_owner from _csg), 'file', 'csg-allow-1',
+         now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  'service_role claims on behalf of the thread creator [call succeeds]');
+
+select is(
+  (select agent_id from _csg_claim where label = 'owner-plain'),
+  (select agent_owner from _csg),
+  'the claim subject is the named agent');
+
+select is(
+  (select thread_id from _csg_claim where label = 'owner-plain'),
+  (select thread_plain from _csg),
+  'the claim is bound to the named thread -- this row IS the access disjunct the gate governs');
+
+-- ORDERING, leg 1: the gate sits AFTER the task lookup, so a nonexistent task still answers
+-- P0002 rather than being turned into a 42501.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_owner from _csg), 'file', 'csg-allow-2',
+       now() + interval '1 hour', '00000000-0000-0000-0000-0000000000ff'::uuid, null, '{}'::jsonb) $$,
+  'P0002',
+  'task not found',
+  'a nonexistent task still answers P0002 -- the subject gate did not usurp the lookup error');
+
+-- ORDERING, leg 2: 23505 is still reachable. This is the shape scripts/client-smoke/
+-- two-agent-claim.ts asserts, so a gate that turned a conflict into a 42501 would break it.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_owner from _csg), 'file', 'csg-allow-1',
+       now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  '23505',
+  'conflicting active claim',
+  'a conflicting active claim still answers 23505 -- the two-agent-claim smoke keeps its shape');
+
+-- ============================================================================
+-- 12-15. The expiry sweep, both ways
+-- ============================================================================
+-- 13 is a statement about ATOMICITY, not about gate placement -- see "ONE PROPERTY THIS FILE
+-- DELIBERATELY DOES NOT CLAIM" in the header. 15 is the positive control that makes 13 mean
+-- anything: without it, "the stale row is still active" is equally satisfied by a fixture that
+-- never reaches the sweep at all.
+select lives_ok(
+  $$ do $do$
+     begin
+       begin
+         perform * from agent_board.acquire_claim(
+           (select agent_strange from _csg), 'file',
+           (select 'csg-swept-' || sfx from _csg),
+           now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb);
+       exception when sqlstate '42501' then null;
+       end;
+     end $do$ $$,
+  'a REFUSED mint contends for the same (kind, key) as a stale ACTIVE claim [call refused, contained]');
+
+select is(
+  (select status from agent_board.claims where id = (select stale_claim from _csg)),
+  'active',
+  'the refused mint changed NO state -- the stale sibling row is untouched (statement atomicity: the raise unwinds the call)');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'sweeper', * from agent_board.acquire_claim(
+         (select agent_owner from _csg), 'file',
+         (select 'csg-swept-' || sfx from _csg),
+         now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  'CONTROL: an ALLOWED mint for the same (kind, key) [call succeeds]');
+
+select is(
+  (select status from agent_board.claims where id = (select stale_claim from _csg)),
+  'expired',
+  'CONTROL: the allowed mint DID sweep the stale row -- so 13 is atomicity, not a fixture that misses the sweep');
+
+-- ============================================================================
+-- 16-18. THE SCOPE: a thread-less claim mints nothing, so it is NOT gated
+-- ============================================================================
+-- This is the capability pin. `machine` / `repository` / `repo_file` / ownerless claims carry
+-- thread_id = null, are a disjunct of nothing, and must stay acquirable for ANY named agent.
+-- _agent_can_access_thread(null, a) is false, so a gate that dropped its `v_thread_id is not
+-- null` guard would refuse every fleet claim in existence while every assertion above stayed
+-- green.
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'strange-machine', * from agent_board.acquire_claim(
+         (select agent_strange from _csg), 'machine',
+         (select 'csg-fp-' || sfx from _csg),
+         now() + interval '1 hour', null, null, '{}'::jsonb) $$,
+  'a THREAD-LESS fleet claim is still acquirable for an agent with no thread access [call succeeds]');
+
+-- Compound, not is(thread_id, null): a MISSING capture row would satisfy the null form and hide
+-- a refused call. This is null when the row is absent and true only when it exists AND is
+-- thread-less.
+select is(
+  (select claim_id is not null and thread_id is null from _csg_claim where label = 'strange-machine'),
+  true,
+  'the thread-less claim EXISTS and stores thread_id = null -- it is a disjunct of nothing');
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_plain from _csg), (select agent_strange from _csg)),
+  false,
+  'and it mints no access: the stranger still cannot reach the thread');
+
+-- ============================================================================
+-- 19-23. DELIVERY-FIRST DISPATCH SURVIVES
+-- ============================================================================
+-- The pattern the gate could plausibly have broken: an orchestrator claiming on behalf of a
+-- worker. It survives because delivery is what grants access -- an inbox_items row is itself a
+-- disjunct -- and the claim then records a lock on something the subject can already see.
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_plain from _csg), (select agent_inbox from _csg)),
+  false,
+  'dispatch precondition: before delivery, the worker has no access to the thread');
+
+with dr as (
+  insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id)
+  select 'direct', (select agent_inbox from _csg), 'message', (select message_id from _csg)
+  returning id
+)
+insert into agent_board.inbox_items(delivery_recipient_id, recipient_agent_id, delivery_mode, source_kind, source_message_id, subject)
+select dr.id, (select agent_inbox from _csg), 'direct', 'message', (select message_id from _csg), 'csg delivery' from dr;
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_plain from _csg), (select agent_inbox from _csg)),
+  true,
+  'delivery grants access: the inbox_items row is itself an inherit-mode disjunct');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'dispatch', * from agent_board.acquire_claim(
+         (select agent_inbox from _csg), 'file', 'csg-dispatch-1',
+         now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  'DISPATCH: service_role claims on behalf of a worker that was DELIVERED to first [call succeeds]');
+
+select is(
+  (select agent_id from _csg_claim where label = 'dispatch'),
+  (select agent_inbox from _csg),
+  'DISPATCH: the claim subject is the worker, not the caller');
+
+select is(
+  (select thread_id from _csg_claim where label = 'dispatch'),
+  (select thread_plain from _csg),
+  'DISPATCH: and it is bound to the delivered thread');
+
+-- ============================================================================
+-- 24-28. The authenticated path is unchanged, and never offered first access
+-- ============================================================================
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select user_strange from _csg)::text, true);
+
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_owner from _csg), 'file', 'csg-auth-1',
+       now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  '42501',
+  'p_agent_id must match current_agent_id()',
+  'authenticated still cannot name a third party at all -- refused before the subject gate');
+
+-- ORDERING, leg 3: the SESSION check still fires before the SUBJECT gate, so an authenticated
+-- caller with no access hears the session message. Hoisting the gate above it changes this.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_strange from _csg), 'file', 'csg-auth-2',
+       now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  '42501',
+  'thread not accessible to current agent',
+  'an authenticated agent claiming its OWN name on an inaccessible thread still hears the SESSION message');
+
+-- The claim-as-first-access question, measured on the task-key shape too: acquiring is not how
+-- an authenticated agent comes to see a task, and never was.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_strange from _csg), 'task', (select task_id from _csg)::text,
+       now() + interval '1 hour', null, null, '{}'::jsonb) $$,
+  '42501',
+  'task not accessible to current agent',
+  'claiming a task resource is NOT a first-access route for authenticated -- it never was');
+
+-- The task half of what the mint used to hand out: _current_agent_can_access_task accepts
+-- thread access as a disjunct, so the closed mint closes task access too.
+select is(
+  agent_board._current_agent_can_access_task((select task_id from _csg)),
+  false,
+  'the stranger has no TASK access either -- the mint used to confer this too, through the thread disjunct');
+
+select set_config('request.jwt.claim.sub', (select user_owner from _csg)::text, true);
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'authenticated-self', * from agent_board.acquire_claim(
+         (select agent_owner from _csg), 'file', 'csg-auth-3',
+         now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  'authenticated claims for ITSELF on a thread it can reach, unchanged [call succeeds]');
+
+-- ============================================================================
+-- 29-31. WHY THIS DISJUNCTION IS THE WHOLE ACCESS STORY (carried forward from #291)
+-- ============================================================================
+-- `access_mode = 'restricted'` is unreachable through the shipped API, so the thread_memberships
+-- branch of the predicate is dead and the inherit seven-way OR governs EVERY thread. Three legs,
+-- because no one of them is sufficient: nothing WRITES the column, nothing may write the TABLE,
+-- and the column's default is the other value.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select is(
+  (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and lower(agent_board_test.stripped_body(p.oid, true)) ~ 'access_mode'),
+  '_agent_can_access_thread',
+  'catalog: the ONLY agent_board function that so much as mentions threads.access_mode is the predicate that READS it');
+
+select is(
+  (select coalesce(string_agg(distinct coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type,
+                              ', ' order by coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type),
+                   '(none)')
+     from pg_class c
+     cross join aclexplode(c.relacl) a
+     left join pg_roles g on g.oid = a.grantee
+    where c.oid = 'agent_board.threads'::regclass
+      and a.privilege_type <> 'SELECT'
+      and coalesce(g.rolname, 'PUBLIC') <> 'postgres'),
+  '(none)',
+  'catalog: NO grantee may write agent_board.threads directly either -- so access_mode cannot be set by any route');
+
+select is(
+  (select column_default from information_schema.columns
+    where table_schema = 'agent_board' and table_name = 'threads' and column_name = 'access_mode'),
+  '''inherit''::text',
+  'and every thread is created as inherit -- the per-thread ACL added in #27 is dormant, so this gate is the access model, not one branch of it');
+
+-- ============================================================================
+-- 32-37. GRANDFATHER FLOW R — released by its holder
+-- ============================================================================
+-- The route that will be taken away is the TASK ASSIGNMENT. Assertion 34 is what makes 37 mean
+-- something: it establishes that once the assignment is gone, the CLAIM is the only thing left
+-- granting access. Without 34, releasing the claim would prove nothing because the assignment
+-- would still be there.
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_rel from _csg), (select agent_rel from _csg)),
+  true,
+  'flow R precondition: the assignee reaches its task thread through the task disjunct');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'rel', * from agent_board.acquire_claim(
+         (select agent_rel from _csg), 'file', 'csg-rel-1',
+         now() + interval '1 hour', null, (select thread_rel from _csg), '{}'::jsonb) $$,
+  'flow R: the assignee takes a thread-bound claim [call succeeds]');
+
+update agent_board.tasks
+   set assigned_agent_id = (select agent_owner from _csg)
+ where id = (select task_rel from _csg);
+
+select is(
+  (select agent_board._agent_can_access_thread((select thread_rel from _csg), (select agent_rel from _csg))
+      and not exists (
+        select 1 from agent_board.tasks t
+         where t.thread_id = (select thread_rel from _csg)
+           and (t.created_by_agent_id = (select agent_rel from _csg)
+                or t.assigned_agent_id = (select agent_rel from _csg)))),
+  true,
+  'flow R: after reassignment the task disjunct is GONE and the ACTIVE claim is the only thing granting access');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'rel-released', * from agent_board.release_claim(
+         (select lease_token from _csg_claim where label = 'rel')) $$,
+  'flow R: release_claim releases it [call succeeds]');
+
+select is(
+  (select agent_id::text || '|' || thread_id::text || '|' || status
+     from _csg_claim where label = 'rel-released'),
+  (select agent_rel::text || '|' || thread_rel::text || '|released' from _csg),
+  'EXEMPTION release_claim: it flips status and NEVER re-keys (thread_id, agent_id)');
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_rel from _csg), (select agent_rel from _csg)),
+  true,
+  'GRANDFATHER (RATIFIED #291): a RELEASED claim still grants thread access -- the disjunct is deliberately not filtered on status');
+
+-- ============================================================================
+-- 38-43. GRANDFATHER FLOW E — expired by time
+-- ============================================================================
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_exp from _csg), (select agent_exp from _csg)),
+  true,
+  'flow E precondition: the assignee reaches its task thread through the task disjunct');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'exp', * from agent_board.acquire_claim(
+         (select agent_exp from _csg), 'file', 'csg-exp-1',
+         now() + interval '1 hour', null, (select thread_exp from _csg), '{}'::jsonb) $$,
+  'flow E: the assignee takes a thread-bound claim [call succeeds]');
+
+update agent_board.tasks
+   set assigned_agent_id = (select agent_owner from _csg)
+ where id = (select task_exp from _csg);
+
+select is(
+  (select agent_board._agent_can_access_thread((select thread_exp from _csg), (select agent_exp from _csg))
+      and not exists (
+        select 1 from agent_board.tasks t
+         where t.thread_id = (select thread_exp from _csg)
+           and (t.created_by_agent_id = (select agent_exp from _csg)
+                or t.assigned_agent_id = (select agent_exp from _csg)))),
+  true,
+  'flow E: after reassignment the task disjunct is GONE and the ACTIVE claim is the only thing granting access');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'exp-renewed', * from agent_board.renew_claim(
+         (select lease_token from _csg_claim where label = 'exp'),
+         now() + interval '2 hours') $$,
+  'flow E: renew_claim extends the lease [call succeeds]');
+
+select is(
+  (select agent_id::text || '|' || thread_id::text
+     from _csg_claim where label = 'exp-renewed'),
+  (select agent_exp::text || '|' || thread_exp::text from _csg),
+  'EXEMPTION renew_claim: it extends the lease and NEVER re-keys (thread_id, agent_id)');
+
+update agent_board.claims
+   set lease_expires_at = now() - interval '30 days'
+ where id = (select claim_id from _csg_claim where label = 'exp');
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_exp from _csg), (select agent_exp from _csg)),
+  true,
+  'GRANDFATHER (RATIFIED #291): a LONG-EXPIRED claim still grants thread access -- the disjunct is deliberately not filtered on lease_expires_at');
+
+-- ============================================================================
+-- 44-49. GRANDFATHER FLOW M — released by an OPERATOR, without the holder asking
+-- ============================================================================
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_mach from _csg), (select agent_mowner from _csg)),
+  true,
+  'flow M precondition: the machine owner reaches its task thread through the task disjunct');
+
+select lives_ok(
+  $$ insert into _csg_claim
+       select 'mach', * from agent_board.acquire_claim(
+         (select agent_mowner from _csg), 'machine', (select machine_fp from _csg),
+         now() + interval '1 hour', null, (select thread_mach from _csg), '{}'::jsonb) $$,
+  'flow M: the machine owner takes a THREAD-BOUND machine claim [call succeeds]');
+
+update agent_board.tasks
+   set assigned_agent_id = (select agent_owner from _csg)
+ where id = (select task_mach from _csg);
+
+select is(
+  (select agent_board._agent_can_access_thread((select thread_mach from _csg), (select agent_mowner from _csg))
+      and not exists (
+        select 1 from agent_board.tasks t
+         where t.thread_id = (select thread_mach from _csg)
+           and (t.created_by_agent_id = (select agent_mowner from _csg)
+                or t.assigned_agent_id = (select agent_mowner from _csg)))),
+  true,
+  'flow M: after reassignment the task disjunct is GONE and the ACTIVE claim is the only thing granting access');
+
+select lives_ok(
+  $$ create temp table _csg_reclaim on commit drop as
+     select * from agent_board.reclaim_fleet_machine(
+       (select machine_id from _csg), (select agent_mnew from _csg), (select agent_mnew from _csg),
+       'csg reclaim', null) $$,
+  'flow M: an operator reclaims the machine for a new owner [call succeeds]');
+
+select is(
+  (select c.agent_id::text || '|' || c.thread_id::text || '|' || c.status
+     from agent_board.claims c
+    where c.id = (select claim_id from _csg_claim where label = 'mach')),
+  (select agent_mowner::text || '|' || thread_mach::text || '|released' from _csg),
+  'EXEMPTION reclaim_fleet_machine: it releases the prior holder''s claim and NEVER re-keys (thread_id, agent_id)');
+
+select is(
+  agent_board._agent_can_access_thread(
+    (select thread_mach from _csg), (select agent_mowner from _csg)),
+  true,
+  'GRANDFATHER (RATIFIED #291): a claim released BY THE OPERATOR still grants the prior holder thread access');
+
+-- ============================================================================
+-- 50-59. Catalog-derived class + the privilege legs
+-- ============================================================================
+-- The completeness claim is "acquire_claim is the ONLY route to a claims row", backed from BOTH
+-- sides: the catalog function scan, and the effective-privilege assertions after it (no role
+-- holds a write privilege by ANY route, so a direct write is impossible and the SECURITY
+-- DEFINER bodies are the whole surface).
+select is(
+  (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and lower(agent_board_test.stripped_body(p.oid, true))
+          ~ '(insert\s+into|merge\s+into|update|delete\s+from|truncate)(\s+table)?(\s+only)?\s+(("?agent_board"?\s*\.\s*)?claims\M|("?agent_board"?\s*\.\s*)?"claims")'),
+  'acquire_claim,reclaim_fleet_machine,release_claim,renew_claim',
+  'catalog: these four are the ONLY agent_board functions that write claims (insert/merge/update/delete/TRUNCATE) -- a new writer names itself here');
+
+select is(
+  (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and lower(agent_board_test.stripped_body(p.oid, true))
+          ~ '(insert\s+into|merge\s+into)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?claims\M|("?agent_board"?\s*\.\s*)?"claims")'
+      and lower(agent_board_test.stripped_body(p.oid))
+          !~ 'not\s+agent_board\._agent_can_access_thread\s*\('),
+  '(none)',
+  'catalog: every function that CREATES a claims row contains a REFUSING reference to _agent_can_access_thread (source shape only -- assertion 2 is what proves it refuses)');
+
+-- WHAT 51 DOES AND DOES NOT ESTABLISH. It matches `not agent_board._agent_can_access_thread(`
+-- in the creator's body -- a source SHAPE, so it sees the refusing form rather than a bare
+-- mention, but it cannot see whether the branch raises or whether the result is discarded. The
+-- BEHAVIOUR is assertion 2. Mutation a reds both, so the pair is class-half plus
+-- behavioural-half rather than redundant.
+
+-- The permanence half of the grandfather, asserted rather than asserted-about: if a future
+-- migration adds a claim reaper, "the access is permanent" stops being true and this names it.
+-- TRUNCATE is in the alternation because it removes every row without a DELETE: the assertion
+-- claims permanence, so scanning only `delete from` would have claimed more than it checked.
+select is(
+  (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and lower(agent_board_test.stripped_body(p.oid, true))
+          ~ '(delete\s+from|merge\s+into|truncate)(\s+table)?(\s+only)?\s+(("?agent_board"?\s*\.\s*)?claims\M|("?agent_board"?\s*\.\s*)?"claims")'),
+  '(none)',
+  'catalog: NOTHING REAPS -- no agent_board function deletes or truncates a claims row, which is what makes the ratified permanence true by construction');
+
+-- EFFECTIVE privilege, not the direct grant. information_schema.role_table_grants filtered on
+-- `grantee = '<role>'` shows only grants made TO THAT NAME, so `grant insert on
+-- agent_board.claims to public` hands service_role a working INSERT while a direct-grantee
+-- query stays green -- the #118 PUBLIC fail-open class. has_table_privilege resolves PUBLIC and
+-- role membership, so it answers the question the message actually asks.
+select is(
+  (select string_agg(priv, ',' order by priv)
+     from unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE', 'REFERENCES']) as priv
+    where has_table_privilege('service_role', 'agent_board.claims', priv)),
+  null,
+  'service_role holds NO effective write privilege on claims, by any route incl. PUBLIC');
+
+select ok(
+  has_table_privilege('service_role', 'agent_board.claims', 'SELECT'),
+  'service_role does hold SELECT on claims (the read path is not over-revoked)');
+
+select is(
+  (select string_agg(priv, ',' order by priv)
+     from unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE', 'REFERENCES']) as priv
+    where has_table_privilege('authenticated', 'agent_board.claims', priv)),
+  null,
+  'authenticated holds NO effective write privilege on claims, by any route incl. PUBLIC');
+
+select ok(
+  has_table_privilege('authenticated', 'agent_board.claims', 'SELECT'),
+  'authenticated does hold SELECT on claims (the read path is not over-revoked)');
+
+select is(
+  (select string_agg(priv, ',' order by priv)
+     from unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE', 'REFERENCES', 'SELECT']) as priv
+    where has_table_privilege('public', 'agent_board.claims', priv)),
+  null,
+  'PUBLIC holds NO privilege at all on claims -- no role gains a write through it');
+
+-- THE SET FORM -- and why BOTH arms are needed, measured rather than assumed. The
+-- has_table_privilege assertions above are a HAND LIST of two grantees (CLAUDE.md rule 1): an
+-- INSERT granted to `anon`, or to a brand-new role, self-names NOWHERE in them. This arm is the
+-- rule-1-correct shape -- the set of grantees holding any non-SELECT privilege, derived from the
+-- ACL, so a new grantee FAILS THIS AND NAMES ITSELF. Neither subsumes the other: a grant to a
+-- new role reds only this arm (mutation p), and a grant reaching a role through role MEMBERSHIP
+-- reds only the effective arm on the subject that matters (mutation q).
+--
+-- The ACL is read through aclexplode(pg_class.relacl) rather than
+-- information_schema.role_table_grants, because that view is filtered to roles the CURRENT user
+-- can see -- a privilege-dependent visibility filter has no place inside a completeness claim.
+-- `postgres` (the table owner) is the one exemption and it is stated POSITIVELY below.
+select is(
+  (select coalesce(string_agg(distinct coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type,
+                              ', ' order by coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type),
+                   '(none)')
+     from pg_class c
+     cross join aclexplode(c.relacl) a
+     left join pg_roles g on g.oid = a.grantee
+    where c.oid = 'agent_board.claims'::regclass
+      and a.privilege_type <> 'SELECT'
+      and coalesce(g.rolname, 'PUBLIC') <> 'postgres'),
+  '(none)',
+  'catalog: NO grantee holds a non-SELECT privilege on claims -- a new one names itself here');
+
+select ok(
+  has_table_privilege('postgres', 'agent_board.claims', 'INSERT')
+    and has_table_privilege('postgres', 'agent_board.claims', 'DELETE'),
+  'the one excluded grantee, postgres, is the table OWNER and does hold the full ACL as expected');
+
+-- ============================================================================
+-- 60. The over-revoke guard on the invariant itself
+-- ============================================================================
+-- The no-short-circuit rule belongs to the SUBJECT predicate (assertion 1). "Fixing" it by
+-- deleting the short-circuit everywhere would break every live service_role caller, so the
+-- session predicate must KEEP its own.
+select is(
+  agent_board._current_agent_can_access_thread((select thread_plain from _csg)),
+  true,
+  'the _is_service_role() short-circuit is PRESERVED in the session predicate where it belongs');
+
+-- ============================================================================
+-- 61-63. THE ONE ERROR CODE THIS CHANGE DOES ALTER -- stated as a decision, not hidden
+-- ============================================================================
+-- An earlier draft of the migration header claimed the gate "preserves every existing error
+-- code". THAT IS FALSE. For a SERVICE_ROLE caller on a THREAD-BOUND claim, everything the gate
+-- refuses used to run all the way to the INSERT and surface as a foreign-key violation.
+-- Measured, by restoring the pre-fix definition (20260825000100) inside a rolled-back
+-- transaction and calling both versions:
+--
+--                                                    PRE-fix                  POST-fix
+--   nonexistent p_thread_id, valid subject   23503 claims_thread_id_fkey  ->  42501
+--   nonexistent subject, valid thread        23503 claims_agent_id_fkey   ->  42501
+--   nonexistent subject, THREAD-LESS claim   23503 claims_agent_id_fkey   ->  23503 (unchanged)
+--
+-- It is ONE rule with two observable instances, not two changes: the gate raises 42501 whenever
+-- the named subject fails the predicate for the bound thread, and a nonexistent thread and a
+-- nonexistent agent both make that predicate false. The third row is the negative control that
+-- the change is confined to thread-BOUND claims -- the gate does not swallow the FK generally.
+--
+-- 23503 IS NOT RESTORED, DELIBERATELY. Preserving it would require probing thread existence
+-- BEFORE the access gate, which tells a caller with no access whether a thread id exists.
+-- 42501 is the better posture: it is the same answer for "no such thread" and "not your thread",
+-- which is what a caller with no access should hear. `authenticated` is unaffected -- its
+-- session check already answered 42501 for a nonexistent thread, because
+-- _agent_can_access_thread is false for one.
+--
+-- MUTATION COVERAGE, measured rather than predicted -- an earlier draft of this paragraph said
+-- mutation a reds all three, and it does NOT. `a` (delete the gate) reds 61 and 62, which fall
+-- back to 23503. It leaves 63 GREEN, correctly: 63 is a CONTROL, and a thread-less claim
+-- answers 23503 with or without the gate. What reds 63 is mutation `c` (make the gate
+-- unconditional in thread presence), which drags the thread-less path into the gate and turns
+-- its 23503 into a 42501. So 61/62 are pinned by a and 63 is pinned by c.
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select agent_owner from _csg), 'file', 'csg-code-1',
+       now() + interval '1 hour', null, '00000000-0000-0000-0000-0000000000ee'::uuid, '{}'::jsonb) $$,
+  '42501',
+  'claim subject has no access to thread',
+  'CHANGED CODE: a nonexistent p_thread_id answers 42501 for service_role, where it used to reach the insert and answer 23503');
+
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       '00000000-0000-0000-0000-0000000000dd'::uuid, 'file', 'csg-code-2',
+       now() + interval '1 hour', null, (select thread_plain from _csg), '{}'::jsonb) $$,
+  '42501',
+  'claim subject has no access to thread',
+  'CHANGED CODE: a nonexistent named SUBJECT answers 42501 too -- same rule, second instance');
+
+select throws_ok(
+  $$ select * from agent_board.acquire_claim(
+       '00000000-0000-0000-0000-0000000000dd'::uuid, 'file', 'csg-code-3',
+       now() + interval '1 hour', null, null, '{}'::jsonb) $$,
+  '23503',
+  'insert or update on table "claims" violates foreign key constraint "claims_agent_id_fkey"',
+  'CONTROL: a THREAD-LESS claim for a nonexistent subject still answers 23503 -- the change is confined to thread-bound claims');
+
+select * from finish();
+
+rollback;