@consiliency/agent-board-schema 1.44.0 → 1.48.0

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 142)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 146)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(142);
+    expect(manifest.migrationCount).toBe(146);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -271,6 +271,39 @@ describe('manifest integrity', () => {
       // agent_liveness_summary() always emits reporting_agents beside the stale count so a caller
       // cannot render "0 stale" as "all clear".
       '20260924000100_agent_board_agent_liveness_denominator.sql',
+      // #373 OWNERLESSRENEWTTL. _claimgate_ownerless_ttl_cap bounded a file/tool/custom lease at
+      // ACQUIRE and nowhere else, so an agent could renew past the 30-day cap indefinitely and the
+      // advertised bound did not exist. renew_claim now clamps (rather than raises -- a raise would
+      // kill a live lease) under acquire's own four conditions, so one operator flag governs both
+      // paths and an advisory board is exempt on both.
+      '20260925000100_agent_board_ownerless_renew_ttl_cap.sql',
+      // #388 OWNERLESSQUOTACENSUS. The quota bounds new acquisitions and never CONVERGES an agent
+      // already over it: renew does not check it (deliberately -- refusing would kill a live
+      // lease), so an agent over the ceiling renews forever and stays over. Three real routes in:
+      // claims taken while ownerless_guards was off, claims taken under an advisory board later
+      // set back to inherit, and a quota lowered afterwards. v_ownerless_claim_quota +
+      // ownerless_quota_census() are READ-ONLY: they count with acquire_claim's own predicate and
+      // always emit the population beside the finding, so "0 over quota" can never be read as
+      // "all clear" the way #367's zero rows were. Enforcement is deferred to a product decision.
+      '20260926000100_agent_board_ownerless_quota_census.sql',
+      // #395 FLEETDOMAINNODOWNGRADE. register_fleet_machine's on-conflict branch MOVES the machine
+      // (trust_domain_id = excluded), the destination gate admits a never-approved 'pending' domain,
+      // lifecycle_state is deliberately not updated (#141) and fleet_machine_agents keys on
+      // machine_id -- so an owner re-registering their own fingerprint relocated a still-'active',
+      // still-BOUND machine into a domain nobody approved, and evaluate_fleet_sender_policy never
+      // reads the domain. The move is now refused when the destination's approval rank
+      // (active=2 > pending=1 > quarantined=suspended=revoked=0) is LOWER than the machine's
+      // current domain's; equal ranks, upgrades and first registrations are unaffected.
+      '20260927000100_agent_board_fleet_domain_no_downgrade.sql',
+      // #388 OWNERLESSQUOTACONVERGE. The enforcement half the census deferred. renew_claim now
+      // asks the quota too, and while the holder is OVER it a renew may not POSTPONE a deadline:
+      // it still succeeds and the held lease is preserved exactly, so each claim lapses on its own
+      // schedule and the count falls to the ceiling. NOT a raise (that kills live work, the design
+      // #387 rejected) and NOT a short grace horizon (an agent at 60 just renews all 60 hourly and
+      // never converges). `> quota`, not acquire's `>= quota`, so an agent legitimately AT the
+      // ceiling is untouched. acquire's inline count is extracted into
+      // _claimgate_active_ownerless_claims() so the two enforcement paths cannot drift.
+      '20260928000100_agent_board_ownerless_quota_renew_convergence.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_fleet_machine_hijack.test.sql

@@ -17,7 +17,15 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(14);
+-- #395 (from assertion 15) — a re-registration may not MOVE the machine into a LESS APPROVED
+-- trust domain. Assertion 28 (#397 round 4) gates the concurrency-safety property structurally:
+-- the post-move decision must read both ranks in ONE statement, which no behavioural test can
+-- check. Same function, same conflict branch, so the assertions live here rather than in
+-- a parallel file. The approval ordering is active=2 > pending=1 > quarantined=suspended=
+-- revoked=0, defined once in agent_board._fleet_trust_domain_approval_rank and pinned against
+-- the column CHECK below, so a new lifecycle value fails an assertion and names itself.
+
+select plan(28);
 
 select has_function(
   'agent_board', 'register_fleet_machine',
@@ -185,6 +193,267 @@ select ok(
   're-register does not clear revoked_at of a revoked machine'
 );
 
+------------------------------------------------------------------------------------------
+-- #395 — the no-downgrade guard on the domain MOVE.
+--
+-- Own fixture, own fingerprints: the block above ends with its machine deliberately revoked,
+-- and reusing it would make every result below depend on that state.
+--   nodown-active-1 / nodown-active-2 : two ACTIVE domains owned by owner A (equal rank)
+--   nodown-pending                    : a PENDING domain owned by owner A (lower rank)
+------------------------------------------------------------------------------------------
+
+create temp table _nodown_fx (
+  owner_a uuid,
+  active_1 uuid,
+  active_2 uuid,
+  pending uuid,
+  machine_active uuid
+) on commit drop;
+
+grant all on table _nodown_fx to authenticated, service_role;
+
+do $$
+declare
+  v_owner_a uuid := (select owner_a from _hijack_fx);
+  v_active_1 uuid;
+  v_active_2 uuid;
+  v_pending uuid;
+  v_machine uuid;
+begin
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('fleet-nodown-active-1', 'No-downgrade Active 1', 'tailnet', v_owner_a, 'active', now()),
+    ('fleet-nodown-active-2', 'No-downgrade Active 2', 'tailnet', v_owner_a, 'active', now()),
+    ('fleet-nodown-pending', 'No-downgrade Pending', 'external', v_owner_a, 'pending', null);
+
+  select id into v_active_1 from agent_board.fleet_trust_domains where slug = 'fleet-nodown-active-1';
+  select id into v_active_2 from agent_board.fleet_trust_domains where slug = 'fleet-nodown-active-2';
+  select id into v_pending from agent_board.fleet_trust_domains where slug = 'fleet-nodown-pending';
+
+  -- The bound machine the move would relocate: owner A, ACTIVE domain, lifecycle active.
+  select machine_id
+    into v_machine
+    from agent_board.register_fleet_machine(
+      v_owner_a, v_active_1, 'nodown-claw', 'sha256:fleet-nodown-active', 'portal', '{"redacted":true}'::jsonb
+    );
+
+  insert into _nodown_fx(owner_a, active_1, active_2, pending, machine_active)
+  values (v_owner_a, v_active_1, v_active_2, v_pending, v_machine);
+end
+$$;
+
+-- (15)(16) The defect: re-registering an ACTIVE-domain machine into a PENDING domain is refused,
+-- 42501, with a message that names the reason (not #141's ownership message).
+-- MUTATION PIN: deleting the `and v_dest_rank >= (select ... )` conjunct from the ON CONFLICT
+-- DO UPDATE's WHERE lets the move proceed → the call lives → (15) and (16) flip.
+select throws_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _nodown_fx),
+       (select pending from _nodown_fx),
+       'nodown-claw-moved',
+       'sha256:fleet-nodown-active',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  '42501',
+  NULL,
+  'a re-registration into a LESS approved (pending) domain raises 42501'
+);
+select throws_like(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _nodown_fx),
+       (select pending from _nodown_fx),
+       'nodown-claw-moved',
+       'sha256:fleet-nodown-active',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  '%less approved trust domain%',
+  'the refusal names the downgrade, not #141 ownership'
+);
+
+-- (17) And it is a REFUSAL, not a partial write: the machine is still in the active domain.
+-- MUTATION PIN: same as (15) — with the conjunct gone the domain becomes the pending one.
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-nodown-active'),
+  (select active_1 from _nodown_fx),
+  'the refused move leaves trust_domain_id on the active domain'
+);
+
+-- (18)(19) THE TWIN. A guard that refused every move would pass (15)-(17) and break a legitimate
+-- relocation. An EQUALLY approved destination (active → active) must still work, and must
+-- actually MOVE the row.
+-- MUTATION PIN: `v_dest_rank >= (...)` → `v_dest_rank > (...)` refuses the equal-rank move →
+-- (18) raises and (19) still reads active_1.
+select lives_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _nodown_fx),
+       (select active_2 from _nodown_fx),
+       'nodown-claw-relocated',
+       'sha256:fleet-nodown-active',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'a re-registration into an EQUALLY approved (active) domain still succeeds'
+);
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-nodown-active'),
+  (select active_2 from _nodown_fx),
+  'the equal-rank relocation actually moved the machine'
+);
+
+-- (20)(21) A FIRST registration has no current domain, so the guard cannot reach it: registering
+-- a NEW fingerprint directly into a PENDING domain is unaffected and still succeeds.
+-- MUTATION PIN: narrowing the destination gate to `ftd.lifecycle_state = 'active'` refuses it →
+-- (20) raises and (21) finds no row.
+select lives_ok(
+  $$ create temp table _nodown_fresh as
+       select * from agent_board.register_fleet_machine(
+         (select owner_a from _nodown_fx),
+         (select pending from _nodown_fx),
+         'nodown-fresh',
+         'sha256:fleet-nodown-fresh',
+         'portal',
+         '{"redacted":true}'::jsonb
+       ) $$,
+  'a FIRST registration into a pending domain is unaffected and succeeds'
+);
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-nodown-fresh'),
+  (select pending from _nodown_fx),
+  'the first registration landed in the pending domain it named'
+);
+
+-- (22)(23) An UPGRADE (pending → active) is permitted, and lands.
+-- MUTATION PIN: `v_dest_rank >= (...)` → `v_dest_rank = (...)` permits only equal ranks →
+-- (22) raises and (23) still reads the pending domain.
+select lives_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _nodown_fx),
+       (select active_1 from _nodown_fx),
+       'nodown-fresh-promoted',
+       'sha256:fleet-nodown-fresh',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'a re-registration into a MORE approved (active) domain succeeds'
+);
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-nodown-fresh'),
+  (select active_1 from _nodown_fx),
+  'the upgrade actually moved the machine into the active domain'
+);
+
+-- (24) #141 SURVIVES the two-reason refusal. The do-update now matches no row for TWO reasons,
+-- and the function re-reads the conflicting row to name the right one — so the cross-owner case
+-- must still raise the OWNERSHIP message, not the downgrade one. (Assertion (1) pins only the
+-- errcode, which both branches share.)
+-- MUTATION PIN: inverting the disambiguation test (`v_existing.owner_agent_id <> v_actor_agent_id`
+-- → `=`) makes the cross-owner case emit the downgrade message → (24) flips.
+select throws_like(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_b from _hijack_fx),
+       (select domain_b from _hijack_fx),
+       'owner-b-steal-again',
+       'sha256:fleet-hijack-fixture',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  '%registered to another owner%',
+  'a cross-owner conflict still raises #141''s ownership message, not the downgrade one'
+);
+
+-- (25) FAIL CLOSED. A lifecycle value the ordering does not know ranks NULL, and a NULL rank
+-- makes the `>=` conjunct not-true — i.e. refuse — rather than fail open.
+-- MUTATION PIN: `else null` → `else 0` in _fleet_trust_domain_approval_rank flips this.
+select is(
+  agent_board._fleet_trust_domain_approval_rank('not-a-lifecycle-state'),
+  NULL::integer,
+  'an unranked lifecycle value ranks NULL (the rank comparison then refuses)'
+);
+
+-- (26) CLASS (rule 1): the ordering is derived against the COLUMN CHECK, not against a list
+-- written here. Every value the CHECK admits appears with its rank; a new admitted value appears
+-- as `<value>=UNRANKED` and fails this assertion BY NAME, and a changed rank fails it too.
+-- MUTATION PIN: changing `when 'quarantined' then 0` to `then 1` flips this.
+select is(
+  (select string_agg(
+            s.state || '=' || coalesce(agent_board._fleet_trust_domain_approval_rank(s.state)::text, 'UNRANKED'),
+            ', ' order by s.state)
+     from (
+       select (regexp_matches(pg_get_constraintdef(c.oid), '''([a-z_]+)''::text', 'g'))[1] as state
+         from pg_constraint c
+        where c.conrelid = 'agent_board.fleet_trust_domains'::regclass
+          and c.contype = 'c'
+          and pg_get_constraintdef(c.oid) ~ 'lifecycle_state = ANY'
+     ) s),
+  'active=2, pending=1, quarantined=0, revoked=0, suspended=0',
+  'class: every CHECK-admitted domain lifecycle value has its approval rank (a new one names itself)'
+);
+
+-- (27) CLASS (rule 1): catalog-derived — register_fleet_machine + reclaim_fleet_machine are the
+-- ONLY writers of fleet_machines.trust_domain_id, so a future third writer that could move a
+-- machine appears here BY NAME and has to answer for this guard. Mirrors the owner_agent_id pin
+-- in agent_board_fleet_machine_reclaim.test.sql; register matches on the INSERT column-list
+-- disjunct (an upsert's text is `do update set`, never `update agent_board.fleet_machines`) and
+-- reclaim on the UPDATE disjunct. Read through stripped_body so a COMMENT quoting the assignment
+-- cannot satisfy it.
+-- MUTATION PIN: removing `trust_domain_id = coalesce(p_new_trust_domain_id, fm.trust_domain_id)`
+-- from reclaim_fleet_machine's UPDATE drops it from this list → flips.
+select is(
+  (
+    select string_agg(proname, ', ' order by proname)
+      from (
+        select p.proname
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and (
+             agent_board_test.stripped_body(p.oid) ~ 'insert into agent_board\.fleet_machines\s*\([^)]*trust_domain_id'
+             or agent_board_test.stripped_body(p.oid) ~ 'update agent_board\.fleet_machines[^;]*trust_domain_id\s*='
+           )
+      ) writers
+  ),
+  'reclaim_fleet_machine, register_fleet_machine',
+  'class: register + reclaim are the only writers of fleet_machines.trust_domain_id (a new writer names itself)'
+);
+
+------------------------------------------------------------------------------------------
+-- (28) SINGLE SNAPSHOT (#397 round 4) — STRUCTURAL, because it cannot be behavioural.
+--
+-- The safety property of this guard is that the post-move decision reads the LANDED domain's
+-- rank and the SOURCE domain's rank from ONE snapshot. Under READ COMMITTED that is true of one
+-- statement and FALSE of two: PostgreSQL explicitly permits another transaction to commit between
+-- successive commands, so a split read reintroduces exactly the cross-time comparison that
+-- rounds 1-3 of #397 each closed one instance of.
+--
+-- No pgTAP or isolation case can catch the split. Both reads see identical state single-session,
+-- and no permutation can interleave between two statements of a function that is not blocked
+-- there — so a behavioural test would pass on the split form. That is what makes this the ONE
+-- property that would otherwise ship argued rather than gated (rule 2), and structural is how
+-- this repo gates what it cannot derive behaviourally.
+--
+-- WHAT THE REGEX ESTABLISHES, precisely: a `select` whose text reaches BOTH rank calls and the
+-- `into v_landed_rank, v_source_rank` target list WITHOUT crossing a `;`. Statement termination
+-- is the `;`, so "no `;` between them" IS "same statement" — a scan that merely counted two rank
+-- calls would pass on the split form and prove nothing. Read through stripped_body, so a comment
+-- quoting the statement (or a string literal containing it) cannot satisfy it.
+--
+-- MUTATION PIN: split the single SELECT into two SELECTs assigning the same two variables — the
+-- values are identical, every other assertion and every isolation permutation stays green, and
+-- this assertion alone flips.
+------------------------------------------------------------------------------------------
+select ok(
+  (select agent_board_test.stripped_body(p.oid) ~
+            'select[^;]*_fleet_trust_domain_approval_rank\s*\([^;]*_fleet_trust_domain_approval_rank\s*\([^;]*into\s+v_landed_rank\s*,\s*v_source_rank[^;]*;'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname = 'register_fleet_machine'),
+  'single snapshot: the post-move decision reads the landed and source ranks in ONE statement'
+);
+
 select * from finish();
 
 rollback;

package/tests/agent_board_fleet_machine_reclaim.test.sql

@@ -32,6 +32,9 @@
 --   * reclaim validates the new owner and the provenance agent exist (22, 23).
 --   * CLASS (rule #1 / EC-4): register_fleet_machine + reclaim_fleet_machine are the ONLY writers of
 --     fleet_machines.owner_agent_id (25) — catalog-derived, so a future owner-writer names itself.
+--   * #395 EXEMPTION (30): reclaim did NOT gain register's no-downgrade guard because its own
+--     destination gate is strictly stronger (active-only). Asserted positively — a PENDING domain
+--     the new owner owns is still refused — PIN: widen the lifecycle conjunct ⇒ (30) fails.
 --
 -- Tests run as session_user=postgres ⇒ _is_service_role() is true; probes and the authz assertion
 -- flip to role=authenticated (jwt claims) to exercise the principal / body guard.
@@ -41,7 +44,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(29);
+select plan(30);
 
 -- (1) Shape.
 select has_function(
@@ -98,7 +101,10 @@ begin
   insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
   values
     ('reclaim-domain-old', 'Reclaim Domain Old', 'tailnet', v_squatter, 'active', now()),
-    ('reclaim-domain-new', 'Reclaim Domain New', 'tailnet', v_new_owner, 'active', now());
+    ('reclaim-domain-new', 'Reclaim Domain New', 'tailnet', v_new_owner, 'active', now()),
+    -- #395 exemption pin (assertion 30): a PENDING domain the NEW OWNER owns — the only thing
+    -- separating it from dom_new is its lifecycle, so a refusal there is about approval alone.
+    ('reclaim-domain-new-pending', 'Reclaim Domain New (pending)', 'tailnet', v_new_owner, 'pending', null);
   select id into v_dom_old from agent_board.fleet_trust_domains where slug = 'reclaim-domain-old';
   select id into v_dom_new from agent_board.fleet_trust_domains where slug = 'reclaim-domain-new';
 
@@ -504,6 +510,26 @@ select is(
   'defensive: reclaim does not revoke the new owner''s own existing binding'
 );
 
+------------------------------------------------------------------------------------------
+-- (30) #395 EXEMPTION, ASSERTED POSITIVELY. register_fleet_machine gained a no-downgrade guard
+-- (20260927000100); reclaim_fleet_machine is the other writer of fleet_machines.trust_domain_id
+-- and did NOT gain one. The reason is that its destination gate is STRICTLY STRONGER, not weaker:
+-- p_new_trust_domain_id must be lifecycle_state = 'active' AND owned by the new owner, so its
+-- destination is always the top rank and it cannot express a downgrade. Rule 1 says an exemption
+-- is asserted positively rather than left as an absence: a PENDING destination — owned by the new
+-- owner, so ONLY its lifecycle differs from the accepted dom_new of (19) — is refused 42501.
+-- Appended rather than filed next to (24) so the existing assertions keep their TAP numbers.
+-- MUTATION PIN: weakening the lifecycle conjunct (`ftd.lifecycle_state = 'active'` →
+-- `ftd.lifecycle_state in ('active','pending')`) admits it → no raise → this flips.
+------------------------------------------------------------------------------------------
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_machine(%L::uuid, %L::uuid, %L::uuid, 'pending destination domain', %L::uuid) $$,
+    (select m3 from _reclaim_fx), (select new_owner from _reclaim_fx), (select operator from _reclaim_fx),
+    (select id from agent_board.fleet_trust_domains where slug = 'reclaim-domain-new-pending')),
+  '42501', NULL,
+  'validate: a PENDING destination domain is rejected even though the new owner owns it (#395 exemption)'
+);
+
 select * from finish();
 
 rollback;