@consiliency/agent-board-schema 1.28.0 → 1.38.0

package/tests/agent_board_fk_lock_edges.test.sql

@@ -0,0 +1,422 @@
+-- Consiliency/message-board#281 pgTAP: the FK-IMPLIED lock edges that no body
+-- scan can see, and the ABBA cycles they expose.
+--
+-- THE DEFECT THIS FILE EXISTS FOR. Every lock-order guard in this repo found
+-- locks by scanning a function body for the literal text `for update` /
+-- `for share`. A lock PostgreSQL takes on our behalf through a FOREIGN KEY never
+-- appears in that text. So `agent_board_signer_lifecycle.test.sql` section 9,
+-- whose comment claimed "any function that row-locks BOTH agents and
+-- board_memberships takes the board advisory lock", was structurally unable to
+-- deliver that closure: it saw 3 members where the FK-aware derivation sees 28.
+-- One of the 25 it could not see -- `_upsert_board_membership_state`, the funnel
+-- every membership writer goes through -- is one half of a live ABBA against
+-- `onboard_federated_fleet_agent` (FKL-11).
+--
+-- WHAT IS ASSERTED HERE, AND WHAT IS NOT.
+--   * The detector is agent_board_test.lock_edges(), defined in
+--     tests/fixtures/test-prereqs.sql. Its header states exactly which parts are
+--     catalog-derived (pg_constraint / pg_attribute / pg_class, by OID) and which
+--     are regexes over agent_board_test.stripped_body(). Read it before reading a
+--     green run here as a closure claim.
+--   * FKL-9/10/11 are EXACT SETS of a state that is KNOWN-BAD and deliberately
+--     NOT FIXED in this change (#281 splits the tooling from the ordering
+--     decision on purpose -- adding an ordering change to a lock-order PR under
+--     review is how the #269 F4 deadlock shipped). They are written as exact sets
+--     rather than as a "no cycles" claim marked `# TODO`, because the suite runner
+--     EXCLUDES `# TODO` lines from its failure grep: a TODO-marked "no cycles"
+--     assertion would let a NEW cycle ship silently. An exact set makes a new
+--     member fail and NAME ITSELF while the known ones stay pinned.
+--   * FKL-12..16 are the mutation pins for the detector's six acquisition shapes.
+--     They use PROBE functions created inside this transaction, so each shape is
+--     exercised by a body written to exercise exactly it -- and the fk-insert
+--     probe carries the contrast that IS this issue's deliverable: the old text
+--     scan reports nothing, the new detector reports the edge.
+--
+-- ORDERING INSIDE THIS FILE IS LOAD-BEARING. The probes are agent_board functions
+-- and would join the class and cycle sets, so every exact-set assertion runs
+-- BEFORE any probe is created.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(16);
+
+-- ---------------------------------------------------------------------------
+-- The derivation, materialized once. `first_path` is the position PATH of the
+-- first acquisition (the caller's call-site offset prepended to the callee's own
+-- offset, so ordering survives nesting); `strongest` is the strongest mode the
+-- function takes on that relation anywhere, which over-reports conflicts rather
+-- than under-reporting them.
+-- ---------------------------------------------------------------------------
+create temp table _le on commit drop as select * from agent_board_test.lock_edges();
+create temp table _cl on commit drop as select * from agent_board_test.fn_call_closure();
+
+create temp table _acq on commit drop as
+select fn_oid, fn_name, fn_sig, rel_oid, rel_name,
+       min(path) as first_path,
+       (array_agg(lock_mode order by agent_board_test.row_lock_rank(lock_mode) desc))[1] as strongest
+  from _le
+ group by fn_oid, fn_name, fn_sig, rel_oid, rel_name;
+
+-- Advisory serialisation: `_lock_board_authority_ceiling` is the mutual-exclusion
+-- lever section 9 requires of its members. Two routes that both take it cannot
+-- interleave, so their ordering disagreement is not a cycle.
+create temp table _adv on commit drop as
+select root_oid, bool_or(reached_name = '_lock_board_authority_ceiling') as adv
+  from _cl group by root_oid;
+
+create temp table _abba on commit drop as
+select fa.fn_name as f, ga.fn_name as g,
+       fa.rel_name as rel_a, fb.rel_name as rel_b,
+       fa.strongest as f_a, fb.strongest as f_b,
+       ga.strongest as g_a, gb.strongest as g_b,
+       (coalesce(af.adv, false) and coalesce(ag.adv, false)) as both_advisory
+  from _acq fa
+  join _acq fb on fb.fn_oid = fa.fn_oid and fb.rel_oid <> fa.rel_oid
+              and fa.first_path < fb.first_path
+  join _acq ga on ga.rel_oid = fa.rel_oid and ga.fn_oid <> fa.fn_oid
+  join _acq gb on gb.fn_oid = ga.fn_oid and gb.rel_oid = fb.rel_oid
+              and gb.first_path < ga.first_path
+  left join _adv af on af.root_oid = fa.fn_oid
+  left join _adv ag on ag.root_oid = ga.fn_oid
+ where agent_board_test.row_locks_conflict(fa.strongest, ga.strongest)
+   and agent_board_test.row_locks_conflict(fb.strongest, gb.strongest)
+   and fa.fn_oid < ga.fn_oid;
+
+-- ===========================================================================
+-- FKL-1: the FK edges the whole derivation rests on. If one is renamed or
+-- dropped the class silently empties and every other assertion here passes
+-- VACUOUSLY, so assert them POSITIVELY by name rather than by absence.
+-- ===========================================================================
+select is(
+  (select string_agg(c.conname, ', ' order by c.conname)
+     from pg_constraint c
+    where c.contype = 'f'
+      and ((c.confrelid = 'agent_board.agents'::regclass
+            and c.conrelid in ('agent_board.board_membership_events'::regclass,
+                               'agent_board.board_memberships'::regclass))
+        or (c.confrelid = 'agent_board.boards'::regclass
+            and c.conrelid = 'agent_board.board_memberships'::regclass))),
+  'board_membership_events_agent_id_fkey, board_memberships_agent_id_fkey, '
+  || 'board_memberships_board_id_fkey, board_memberships_created_by_agent_id_fkey',
+  'FKL-1: the invisible FK edges (membership_events->agents, memberships->agents/boards) all exist');
+
+-- ===========================================================================
+-- FKL-2: the row-lock conflict matrix. Without it the cycle enumeration is
+-- worthless: over a schema this FK-dense, a mode-blind ABBA search reports every
+-- pair of functions that INSERT into two tables in opposite order, and two
+-- FOR KEY SHARE locks never conflict. The pair that matters for #281 is
+-- (key share, update) -- an FK-implied lock against an explicit one.
+-- ===========================================================================
+select is(
+  (select string_agg(a || '/' || b || '=' || agent_board_test.row_locks_conflict(a, b)::text, ' ' order by a, b)
+     from unnest(array['key share','share','no key update','update']) a,
+          unnest(array['key share','share','no key update','update']) b),
+  'key share/key share=false key share/no key update=false key share/share=false key share/update=true '
+  || 'no key update/key share=false no key update/no key update=true no key update/share=true no key update/update=true '
+  || 'share/key share=false share/no key update=true share/share=false share/update=true '
+  || 'update/key share=true update/no key update=true update/share=true update/update=true',
+  'FKL-2: the row-lock conflict matrix is PostgreSQL''s, incl. KEY SHARE conflicting only with UPDATE');
+
+-- ===========================================================================
+-- FKL-3 / FKL-4: THE BLIND SPOT AND ITS CLOSURE, on the real function.
+--
+-- `_emit_membership_event` inserts into board_membership_events and therefore
+-- row-locks the subject's `agents` row FOR KEY SHARE. It never NAMES agents.
+-- FKL-3 asserts the old detector's blindness POSITIVELY (its two section-9
+-- regexes, verbatim, both false); FKL-4 asserts the new detector's exact edge
+-- set. The two together are the contrast this issue asked for.
+-- ===========================================================================
+select is(
+  (select (agent_board_test.stripped_body(p.oid) ~ 'agent_board\.agents[^;]*for (update|share)')::text
+          || '/' ||
+          (agent_board_test.stripped_body(p.oid) ~ '\magents\M')::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_emit_membership_event'),
+  'false/false',
+  'FKL-3: the section-9 text scan finds no agents lock in _emit_membership_event -- it never names agents');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _le e where e.fn_name = '_emit_membership_event' and e.own),
+  'agent_board.agents key share via fk-insert:board_membership_events_agent_id_fkey'
+  || ' | agent_board.boards key share via fk-insert:board_membership_events_board_id_fkey',
+  'FKL-4: the FK detector reports the agents KEY SHARE the text scan cannot see, named by constraint');
+
+-- ===========================================================================
+-- FKL-5: POSITION PATHS THROUGH A CALLEE. `join_board` takes both locks inside
+-- ONE call to `_upsert_board_membership_state`, so comparing bare call-site
+-- offsets ties and the ordering that decides the cycle is invisible. The path
+-- array must resolve it to memberships-BEFORE-agents.
+-- ===========================================================================
+select is(
+  (select case when m.first_path < a.first_path then 'memberships-first' else 'agents-first' end
+          || ' (' || m.strongest || '/' || a.strongest || ')'
+     from _acq m join _acq a on a.fn_oid = m.fn_oid
+    where m.fn_name = 'join_board'
+      and m.rel_name = 'agent_board.board_memberships'
+      and a.rel_name = 'agent_board.agents'),
+  'memberships-first (update/key share)',
+  'FKL-5: join_board''s order is resolved THROUGH the callee frame, not by a tied call-site offset');
+
+-- ===========================================================================
+-- FKL-6 / FKL-7 / FKL-8: the three ways this detector could under-report
+-- SILENTLY. Each is a tripwire that is true today and fails loudly the day it
+-- stops being, rather than a caveat in prose.
+-- ===========================================================================
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.prosqlbody is not null),
+  '',
+  'FKL-6: no agent_board function has a BEGIN ATOMIC body -- readable since message-board#293, but only as a DEPARSED tree this detector''s positional/path semantics have never been exercised against');
+
+select is(
+  (select coalesce(string_agg(distinct e.fn_name, ', ' order by e.fn_name), '')
+     from _le e join pg_proc p on p.oid = e.fn_oid
+    where agent_board_test.stripped_body(p.oid) ~* '\mexecute\M'),
+  '',
+  'FKL-7: no function with a lock edge uses dynamic SQL, which the position analysis cannot read');
+
+select is(
+  (select coalesce(string_agg(distinct e.fn_name, ', ' order by e.fn_name), '')
+     from _le e
+    where e.fn_oid in (select t.tgfoid from pg_trigger t
+                         join pg_class cl on cl.oid = t.tgrelid
+                         join pg_namespace n on n.oid = cl.relnamespace
+                        where not t.tgisinternal and n.nspname = 'agent_board')),
+  '',
+  'FKL-8: no trigger function on an agent_board table takes a lock edge -- trigger locks are NOT folded in');
+
+-- ===========================================================================
+-- FKL-9: THE CLASS section 9 could not compute. Every function whose lock graph
+-- contains BOTH agents and board_memberships, with the order it takes them and
+-- whether the board advisory lock serialises it. Section 9's text scan sees
+-- three of these; the FK-aware derivation sees 28.
+--
+-- This is an exact set of a KNOWN-BAD state. 25 of the 28 are `[unserialised]`
+-- and disagree with each other about the order. #281 stops here deliberately:
+-- the ordering fix is a separate decision. Do not "green" this by editing the
+-- expectation -- a changed member means the lock graph changed.
+-- ===========================================================================
+select is(
+  (select array_agg(m order by m) from (
+     select distinct a.fn_name || ': ' ||
+            case when a.first_path < b.first_path
+                 then 'agents(' || a.strongest || ') then memberships(' || b.strongest || ')'
+                 else 'memberships(' || b.strongest || ') then agents(' || a.strongest || ')' end ||
+            case when coalesce(v.adv, false) then ' [advisory]' else ' [unserialised]' end as m
+       from _acq a
+       join _acq b on b.fn_oid = a.fn_oid
+       left join _adv v on v.root_oid = a.fn_oid
+      where a.rel_name = 'agent_board.agents'
+        and b.rel_name = 'agent_board.board_memberships') z),
+  array[
+    '_enroll_federated_identity_once: agents(key share) then memberships(key share) [unserialised]',
+    '_redeem_fleet_invite_for_agent: memberships(key share) then agents(key share) [unserialised]',
+    '_redeem_invite_for_agent: memberships(key share) then agents(key share) [unserialised]',
+    '_redeem_unbounded_invite_for_agent: memberships(key share) then agents(key share) [unserialised]',
+    '_upsert_board_membership_state: memberships(update) then agents(key share) [unserialised]',
+    '_upsert_delivery_recipient: memberships(key share) then agents(key share) [unserialised]',
+    'create_tasking_delivery: agents(key share) then memberships(key share) [unserialised]',
+    'enroll_federated_identity: agents(update) then memberships(key share) [unserialised]',
+    'grant_board_role: agents(share) then memberships(update) [advisory]',
+    'invite_board_member: memberships(update) then agents(key share) [unserialised]',
+    'join_board: memberships(update) then agents(key share) [unserialised]',
+    'leave_board: memberships(update) then agents(key share) [unserialised]',
+    'onboard_federated_fleet_agent: agents(update) then memberships(update) [advisory]',
+    'post_board_message: agents(key share) then memberships(key share) [unserialised]',
+    'redeem_invite_link: memberships(key share) then agents(key share) [unserialised]',
+    'request_join_board: memberships(update) then agents(key share) [unserialised]',
+    'resolve_board_request: memberships(update) then agents(key share) [unserialised]',
+    'send_direct_message: agents(key share) then memberships(key share) [unserialised]',
+    'send_multicast_message: agents(key share) then memberships(key share) [unserialised]',
+    'signed_create_tasking_delivery: agents(key share) then memberships(key share) [unserialised]',
+    'signed_grant_board_role: agents(share) then memberships(update) [advisory]',
+    'signed_post_board_message: agents(key share) then memberships(key share) [unserialised]',
+    'signed_send_direct_message: agents(key share) then memberships(key share) [unserialised]',
+    'signed_send_multicast_message: agents(key share) then memberships(key share) [unserialised]',
+    'subscribe_callback_endpoint: memberships(key share) then agents(key share) [unserialised]',
+    'unsubscribe_callback_endpoint: memberships(key share) then agents(key share) [unserialised]',
+    'update_board_membership: memberships(update) then agents(key share) [unserialised]'
+  ]::text[],
+  'FKL-9: the agents+board_memberships lock class, FK edges included (section 9''s text scan sees 3 of these)');
+
+-- ===========================================================================
+-- FKL-10: every RELATION PAIR that some pair of routes acquires in opposite
+-- orders with CONFLICTING modes and no shared advisory lock. Pinned at the
+-- relation-pair level rather than the function-pair level (146 of those today)
+-- because a pair of tables entering this set is the reviewable event.
+--
+-- KNOWN-BAD and deliberately not fixed -- see the file header. ONE pair has been
+-- removed since: #281 R1 fixed `agent_board.tasks <-> agent_board.threads` by
+-- agreeing on threads-before-tasks in append_task_event and
+-- _upsert_delivery_recipient (migration 20260913000100). That took the row count
+-- from 186 to 146 -- exactly the 40 rows on that pair, with no other pair moving
+-- by a single row -- and this array from 27 entries to 26. The ordering itself is
+-- pinned as a class in agent_board_task_thread_lock_order.test.sql (TT-1), which
+-- is what makes a REGRESSION fail there and name the function, rather than only
+-- failing here as an opaque re-appearance of the pair.
+-- ===========================================================================
+select is(
+  (select array_agg(p order by p) from (
+     select distinct least(rel_a, rel_b) || ' <-> ' || greatest(rel_a, rel_b) as p
+       from _abba where not both_advisory) z),
+  array[
+    'agent_board.agent_signing_keys <-> agent_board.agents',
+    'agent_board.agent_signing_keys <-> agent_board.board_memberships',
+    'agent_board.agent_signing_keys <-> agent_board.fleet_machine_agents',
+    'agent_board.agent_signing_keys <-> agent_board.fleet_machines',
+    'agent_board.agent_signing_keys <-> agent_board.fleet_trust_domains',
+    'agent_board.agents <-> agent_board.board_invite_tokens',
+    'agent_board.agents <-> agent_board.board_memberships',
+    'agent_board.agents <-> agent_board.boards',
+    'agent_board.agents <-> agent_board.delegation_grants',
+    'agent_board.agents <-> agent_board.fleet_machine_agents',
+    'agent_board.agents <-> agent_board.fleet_machines',
+    'agent_board.agents <-> agent_board.fleet_trust_domains',
+    'agent_board.agents <-> agent_board.identity_providers',
+    'agent_board.agents <-> auth.users',
+    'agent_board.board_invite_tokens <-> agent_board.boards',
+    'agent_board.board_invite_tokens <-> agent_board.fleet_machines',
+    'agent_board.board_invite_tokens <-> agent_board.fleet_trust_domains',
+    'agent_board.board_memberships <-> agent_board.boards',
+    'agent_board.boards <-> auth.users',
+    'agent_board.callback_endpoints <-> agent_board.callback_outbox_events',
+    'agent_board.fleet_harness_registrations <-> agent_board.fleet_machine_agents',
+    'agent_board.fleet_machine_agents <-> agent_board.fleet_repo_scopes',
+    'agent_board.fleet_machine_agents <-> agent_board.fleet_trust_domains',
+    'agent_board.fleet_machines <-> auth.users',
+    'agent_board.fleet_trust_domains <-> auth.users',
+    'agent_board.identity_providers <-> auth.users'
+  ]::text[],
+  'FKL-10: the relation pairs held in opposite orders with conflicting modes and no shared advisory lock');
+
+-- ===========================================================================
+-- FKL-11: THE CYCLE #281 WAS FILED FOR, asserted as a concrete claim rather
+-- than as a member of the set above. `_upsert_board_membership_state` is the
+-- funnel every membership writer goes through; its `agents` edge is FK-implied
+-- and invisible to section 9. `onboard_federated_fleet_agent` takes the same two
+-- relations in the opposite order, explicitly, with FOR UPDATE.
+-- ===========================================================================
+select is(
+  (select f || ' ' || rel_a || '(' || f_a || ')->' || rel_b || '(' || f_b || ') ABBA '
+          || g || ' ' || rel_b || '(' || g_b || ')->' || rel_a || '(' || g_a || ') advisory=' || both_advisory::text
+     from _abba
+    where f = '_upsert_board_membership_state' and g = 'onboard_federated_fleet_agent'
+      and least(rel_a, rel_b) = 'agent_board.agents'
+      and greatest(rel_a, rel_b) = 'agent_board.board_memberships'),
+  '_upsert_board_membership_state agent_board.board_memberships(update)->agent_board.agents(key share)'
+  || ' ABBA onboard_federated_fleet_agent agent_board.agents(update)->agent_board.board_memberships(update)'
+  || ' advisory=false',
+  'FKL-11: the #281 ABBA is present and unserialised -- reported, NOT fixed here');
+
+-- ===========================================================================
+-- THE PROBES. From here on, agent_board gains four functions that exist only to
+-- exercise one acquisition shape each. They are never CALLED -- the detector
+-- reads bodies -- and the transaction is rolled back. Every exact-set assertion
+-- above has already run.
+-- ===========================================================================
+
+-- Shape (iv): the acquisition that no body scan can see. Its ONLY contact with
+-- agent_board.agents is the foreign key on the table it inserts into.
+create function agent_board._probe281_fk_insert(p_board uuid, p_agent uuid)
+returns void language plpgsql as $probe$
+begin
+  insert into agent_board.board_membership_events (board_id, agent_id, event_kind, result_state)
+  values (p_board, p_agent, 'probe281', 'joined');
+end;
+$probe$;
+
+-- Shapes (ii) + (v): the UPDATE row-locks board_memberships itself, and because
+-- the SET re-points agent_id it also locks the NEW agents row. It must NOT be
+-- credited with the board_id or created_by_agent_id parents -- those columns are
+-- not in the SET, and crediting every FK of an updated table is what turns this
+-- detector into a cycle-fabricator.
+create function agent_board._probe281_fk_update(p_id uuid, p_agent uuid)
+returns void language plpgsql as $probe$
+begin
+  update agent_board.board_memberships set agent_id = p_agent where id = p_id;
+end;
+$probe$;
+
+-- Shapes (iii) + (vi): DELETE row-locks the deleted rows, and locks the
+-- REFERENCING child rows in a mode that follows confdeltype -- no action => KEY
+-- SHARE (restrict takes the same branch), set null => the child row is updated,
+-- cascade => the child row is deleted.
+create function agent_board._probe281_fk_delete(p_id uuid, p_scope uuid)
+returns void language plpgsql as $probe$
+begin
+  delete from agent_board.board_memberships where id = p_id;
+  delete from agent_board.fleet_repo_scopes where id = p_scope;
+end;
+$probe$;
+
+-- Shape (i): an explicit row lock, with its MODE captured rather than reduced to
+-- a boolean -- a downgrade from FOR UPDATE to FOR SHARE changes which pairs
+-- conflict, so a mode-less detector cannot enumerate cycles at all.
+create function agent_board._probe281_textual(p_agent uuid)
+returns void language plpgsql as $probe$
+begin
+  perform 1 from agent_board.agents a where a.id = p_agent for share;
+end;
+$probe$;
+
+-- The derivation, re-evaluated ONCE now that the probes exist. (Re-evaluating it
+-- per assertion is correct but costs a full re-scan of every body each time.)
+create temp table _lep on commit drop as select * from agent_board_test.lock_edges();
+
+-- FKL-12/13: the CONTRAST, on a body built to isolate it. Same two claims as
+-- FKL-3/FKL-4, but on a function whose every other line is inert, so a pass
+-- cannot be borrowed from some other statement in a large real body.
+select is(
+  (select (agent_board_test.stripped_body(p.oid) ~ 'agent_board\.agents[^;]*for (update|share)')::text
+          || '/' ||
+          (agent_board_test.stripped_body(p.oid) ~ 'agent_board\.board_memberships[^;]*for (update|share)')::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_probe281_fk_insert'),
+  'false/false',
+  'FKL-12: the section-9 text scan reports the fk-insert probe as locking NOTHING');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe281_fk_insert'),
+  'agent_board.agents key share via fk-insert:board_membership_events_agent_id_fkey'
+  || ' | agent_board.boards key share via fk-insert:board_membership_events_board_id_fkey',
+  'FKL-13: the FK detector reports both FK-implied KEY SHARE edges of that same probe');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe281_fk_update'),
+  'agent_board.agents key share via fk-update:board_memberships_agent_id_fkey'
+  || ' | agent_board.board_memberships update via write-update',
+  'FKL-14: an FK re-point locks the new parent and the updated table -- and ONLY the re-pointed FK');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe281_fk_delete'),
+  'agent_board.board_invite_redemptions key share via fk-delete:board_invite_redemptions_membership_id_fkey'
+  || ' | agent_board.board_memberships update via write-delete'
+  || ' | agent_board.callback_subscriptions key share via fk-delete:callback_subscriptions_board_membership_fkey'
+  || ' | agent_board.delivery_recipients key share via fk-delete:delivery_recipients_board_membership_fkey'
+  || ' | agent_board.fleet_machine_agents no key update via fk-delete:fleet_machine_agents_repo_scope_id_fkey'
+  || ' | agent_board.fleet_repo_scopes update via write-delete'
+  || ' | agent_board.fleet_revocation_events update via fk-delete:fleet_revocation_events_repo_scope_id_fkey'
+  || ' | agent_board.fleet_trust_sets update via fk-delete:fleet_trust_sets_repo_scope_id_fkey',
+  'FKL-15: DELETE locks the deleted rows and the referencing children, in the mode confdeltype implies');
+
+select is(
+  (select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+                     order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+     from _lep e where e.fn_name = '_probe281_textual'),
+  'agent_board.agents share via textual',
+  'FKL-16: an explicit row lock is reported with its MODE, not as a boolean');
+
+select * from finish();
+
+rollback;