@consiliency/agent-board-schema 1.44.0 → 1.48.0

package/tests/agent_board_ownerless_renew_quota.test.sql

@@ -0,0 +1,551 @@
+-- #388 — the ownerless quota must CONVERGE an agent already over it, not merely bound new
+-- acquisitions. The renew-side guard: while the holder is over quota, a renew may not POSTPONE a
+-- deadline. It still succeeds, the lease already held is preserved to the microsecond, and the only
+-- thing withheld is more time — so each claim lapses at its own expiry, the count falls, and the
+-- guard releases at the ceiling.
+--
+-- SCOPED, AND THE SCOPE IS ASSERTED HERE RATHER THAN PROMISED IN PROSE. That convergence holds
+-- against an agent whose boards do not opt out. It does NOT hold against one whose board is flipped
+-- to `claim_policy = 'advisory'` and back, which an owner may do at will and which an agent that
+-- created its own board may do to itself. ORQ-11/12 perform that flip-flop and pin both halves: the
+-- horizon survives the revert, and the census cannot see that it was taken.
+--
+-- ORQ-1 IS THE ASSERTION THIS FILE EXISTS FOR, and it is written as the attack #388 describes: an
+-- agent that is already over the ceiling asks for +400 days, which before this migration it got,
+-- and could get again forever. It asserts an EXACT resulting timestamp rather than an error,
+-- because a raise is the design this deliberately did not choose (see the migration header; #387's
+-- ORT-3 records the same reasoning for the TTL half and is likewise unchanged by this file).
+--
+-- ORQ-5 IS THE DISCRIMINATING TWIN AND THE HARDEST ONE TO GET RIGHT. A guard that froze EVERY
+-- ownerless renew would satisfy ORQ-1 and destroy the feature, and the obvious twin — an agent well
+-- under the quota renews normally, ORQ-6 — cannot see the mutation that actually threatens this
+-- design: `> quota` weakened to `>= quota`, which is ACQUIRE's refusal predicate and reads as a
+-- harmless unification. Under `>=` an agent sitting legitimately AT the ceiling is frozen and
+-- walked down to 49 — a legal population shrunk rather than an illegal one converged. Only an agent
+-- holding EXACTLY the quota can catch it, so this file builds one.
+--
+-- THE NEAR-MISS ROWS ARE ORQ-5's OTHER HALF. The AT agent is given four rows that differ from a
+-- counted row in exactly one conjunct of the shared count predicate — a set released_at, a
+-- non-active status, a lapsed lease, and an owned resource kind. Dropping any conjunct from
+-- `_claimgate_active_ownerless_claims()` puts the AT agent at 51, freezes it, and fails ORQ-5 by
+-- name. Without them the helper's predicate would be pinned only by the census's own fixture, in a
+-- different file, against a different surface.
+--
+-- ORQ-13 IS THE FIXED POINT, and it is the assertion that separates this design from a guard that
+-- latches. Release one claim, and the SAME claim that was frozen a moment ago extends normally.
+-- A guard reading a constant, or reading a count captured once, passes everything above and fails
+-- here.
+--
+-- WHY A NEW FILE RATHER THAN MORE OF agent_board_ownerless_renew_ttl.test.sql. That file's fixture
+-- is one agent holding a handful of claims, and it flips the guard flag and the board policy
+-- mid-file as its own assertions require. This property needs three agents, three boards, ~104
+-- claim rows and an exact-51 population held stable across a dozen assertions; interleaving the
+-- two fixtures would make
+-- each file's flag state a function of the other's line order. The runner discovers `*.test.sql` by
+-- scanning the directory (scripts/run-agent-board-schema-tests.sh), so a new file needs no
+-- registration.
+--
+-- SCOPING. The guard flag is fleet-wide state shared with every other test, so this file SETS it
+-- explicitly rather than inheriting whatever ran before — an inherited `false` would make every
+-- assertion here pass vacuously against a completely unguarded function. Every count is keyed to
+-- this file's agent ids for the same reason.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(31);
+
+-- ---------------------------------------------------------------------------
+-- Fixture.
+--   over  — quota + 1 counted claims: filler (sized off the quota helper) + one per assertion
+--           below, one of them on an ADVISORY board, one with NO thread, and one on a board the
+--           over agent OWNS. Over by exactly 1, so ORQ-13's single release lands it exactly ON the
+--           ceiling.
+--   at    — exactly quota counted claims, plus four NEAR-MISS rows (ORQ-5's other half).
+--   under — three counted claims, one per ownerless kind.
+-- Every counted row is inserted with an expiry expressed against now(), which is transaction-stable
+-- — so every assertion below can demand an EXACT timestamp rather than a window.
+-- ---------------------------------------------------------------------------
+create temp table _orq (
+  sfx text,
+  over_agent uuid, at_agent uuid, under_agent uuid,
+  over_user uuid, at_user uuid, under_user uuid,
+  board uuid, thread uuid, adv_board uuid, adv_thread uuid,
+  esc_board uuid, esc_thread uuid
+) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_over uuid := gen_random_uuid();
+  v_at uuid := gen_random_uuid();
+  v_under uuid := gen_random_uuid();
+  v_over_user uuid;
+  v_at_user uuid;
+  v_under_user uuid;
+  v_board uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_adv_board uuid := gen_random_uuid();
+  v_adv_thread uuid := gen_random_uuid();
+  v_esc_board uuid;
+  v_esc_thread uuid := gen_random_uuid();
+begin
+  -- All three agents renew AS THEMSELVES, so all three need an auth identity: renew_claim resolves
+  -- the actor from the session and refuses a token it does not own (42501).
+  v_over_user  := public.ensure_github_user('orq-over-'  || v_sfx, 'orq-over-'  || v_sfx || '@example.test', 'orq-over-'  || v_sfx, 'ORQ Over');
+  v_at_user    := public.ensure_github_user('orq-at-'    || v_sfx, 'orq-at-'    || v_sfx || '@example.test', 'orq-at-'    || v_sfx, 'ORQ At Quota');
+  v_under_user := public.ensure_github_user('orq-under-' || v_sfx, 'orq-under-' || v_sfx || '@example.test', 'orq-under-' || v_sfx, 'ORQ Under');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_over,  'agent', 'orq-over-'  || v_sfx, 'ORQ Over',     'active', v_over_user,  v_over_user),
+         (v_at,    'agent', 'orq-at-'    || v_sfx, 'ORQ At Quota', 'active', v_at_user,    v_at_user),
+         (v_under, 'agent', 'orq-under-' || v_sfx, 'ORQ Under',    'active', v_under_user, v_under_user);
+
+  -- An INHERIT board (the default) and a permanently ADVISORY one, both inserted directly: these
+  -- two only need to EXIST in a given policy state, and BCP owns the subject of who may set one.
+  -- The third board below is different and is created through the RPC on purpose — ORQ-11 is about
+  -- an owner exercising that gate, so a direct insert would prove nothing there.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, claim_policy)
+  values (v_board,     'orq-'     || v_sfx, 'ORQ Board',          v_over, 'inherit'),
+         (v_adv_board, 'orq-adv-' || v_sfx, 'ORQ Advisory Board', v_over, 'advisory');
+
+  -- A THIRD board, created through create_board BY THE OVER AGENT ITSELF rather than inserted.
+  -- That is load-bearing for ORQ-11/12: create_board seeds the creator's OWNER membership, and
+  -- set_board_claim_policy is gated on exactly that membership. So the escape hatch those
+  -- assertions document needs no accomplice — the agent that is over quota can be the owner who
+  -- opts its own board out. Inserting this board directly would seed no membership and would make
+  -- the escape look like it required a cooperating third party, which is a weaker and false claim.
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_over_user::text, true);
+  select board_id into v_esc_board
+    from agent_board.create_board(v_over, 'orq-esc-' || v_sfx, 'ORQ Escape Board', 'owner-toggled opt-out', '{}'::jsonb, 'private');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values (v_thread,     'coordination', v_over, 'ORQ thread',          v_board),
+         (v_adv_thread, 'coordination', v_over, 'ORQ advisory thread', v_adv_board),
+         (v_esc_thread, 'coordination', v_over, 'ORQ escape thread',   v_esc_board);
+
+  insert into _orq values (v_sfx, v_over, v_at, v_under, v_over_user, v_at_user, v_under_user,
+                           v_board, v_thread, v_adv_board, v_adv_thread, v_esc_board, v_esc_thread);
+end $$;
+
+-- The guard must be ON or every assertion below passes against an unguarded function.
+insert into agent_board.claimgate_enforcement_flags(scope_key, enabled)
+values ('ownerless_guards', true)
+on conflict (scope_key) do update set enabled = true;
+
+-- OVER: quota + 1 counted claims. Six are named because an assertion drives each; the rest are
+-- filler sized off the quota helper so this file does not carry a second copy of the number.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+select (select over_agent from _orq), (select thread from _orq), 'file',
+       'orq-over-filler-' || (select sfx from _orq) || '-' || g, now() + interval '10 days'
+  from generate_series(1, agent_board._claimgate_ownerless_quota() - 6) g;
+
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+values
+  -- ORQ-1: the headline freeze.
+  ((select over_agent from _orq), (select thread from _orq),     'file',   'orq-over-file-'     || (select sfx from _orq), now() + interval '10 days'),
+  -- ORQ-4: a SHORTER ask must still be honoured, and ORQ-8 re-uses it once the flag is off.
+  ((select over_agent from _orq), (select thread from _orq),     'file',   'orq-over-shorten-'  || (select sfx from _orq), now() + interval '10 days'),
+  -- ORQ-3: NO thread — must fall back to 'inherit' and stay governed, not escape by omission.
+  ((select over_agent from _orq), null,                          'file',   'orq-over-nothread-' || (select sfx from _orq), now() + interval '10 days'),
+  -- ORQ-2: the other two kinds. ORQ-13 later re-uses the tool claim for the fixed point.
+  ((select over_agent from _orq), (select thread from _orq),     'tool',   'orq-over-tool-'     || (select sfx from _orq), now() + interval '10 days'),
+  ((select over_agent from _orq), (select thread from _orq),     'custom', 'orq-over-custom-'   || (select sfx from _orq), now() + interval '10 days'),
+  -- ORQ-9: on the ADVISORY board. COUNTED all the same — the opt-out gates whether a guard RUNS,
+  -- never whether the row counts — but not converged.
+  ((select over_agent from _orq), (select adv_thread from _orq), 'file',   'orq-over-adv-'      || (select sfx from _orq), now() + interval '10 days'),
+  -- ORQ-11/12: on the board the OVER AGENT OWNS, so it can toggle the opt-out itself.
+  ((select over_agent from _orq), (select esc_thread from _orq), 'file',   'orq-over-escape-'   || (select sfx from _orq), now() + interval '10 days');
+
+-- AT: exactly quota counted claims, at a SHORTER horizon than the over agent's so ORQ-5 can ask
+-- for MORE time and observe that it is granted. Asking for less would be satisfied by a frozen
+-- function too, and would prove nothing.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+select (select at_agent from _orq), (select thread from _orq), 'file',
+       'orq-at-filler-' || (select sfx from _orq) || '-' || g, now() + interval '1 day'
+  from generate_series(1, agent_board._claimgate_ownerless_quota() - 1) g;
+
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+values ((select at_agent from _orq), (select thread from _orq), 'file', 'orq-at-probe-' || (select sfx from _orq), now() + interval '1 day');
+
+-- AT: four NEAR-MISS rows. Each differs from a counted row in EXACTLY ONE conjunct of
+-- _claimgate_active_ownerless_claims(), so dropping that conjunct puts this agent at quota + 1,
+-- freezes it, and fails ORQ-5 naming itself. A near-miss differing in two dimensions would survive
+-- the mutation and prove nothing.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, status, released_at, lease_expires_at)
+values
+  -- released_at is null
+  ((select at_agent from _orq), (select thread from _orq), 'file',    'orq-at-nm-released-' || (select sfx from _orq), 'active',  now(), now() + interval '1 day'),
+  -- status = 'active'
+  ((select at_agent from _orq), (select thread from _orq), 'file',    'orq-at-nm-status-'   || (select sfx from _orq), 'expired', null,  now() + interval '1 day'),
+  -- lease_expires_at > now()
+  ((select at_agent from _orq), (select thread from _orq), 'file',    'orq-at-nm-lease-'    || (select sfx from _orq), 'active',  null,  now() - interval '1 hour'),
+  -- resource_kind in ('file','tool','custom') — an OWNED kind, governed by the fleet gate and not
+  -- by this quota at all.
+  ((select at_agent from _orq), (select thread from _orq), 'machine', 'orq-at-nm-kind-'     || (select sfx from _orq), 'active',  null,  now() + interval '1 day');
+
+-- UNDER: three counted claims, one per ownerless kind.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+values
+  ((select under_agent from _orq), (select thread from _orq), 'file',   'orq-under-probe-'  || (select sfx from _orq), now() + interval '1 day'),
+  ((select under_agent from _orq), (select thread from _orq), 'tool',   'orq-under-tool-'   || (select sfx from _orq), now() + interval '1 day'),
+  ((select under_agent from _orq), (select thread from _orq), 'custom', 'orq-under-custom-' || (select sfx from _orq), now() + interval '1 day');
+
+-- The lease tokens, by role. Captured once so every assertion below names a claim rather than
+-- re-deriving it from a key that a canonicalising renew is allowed to rewrite.
+create temp table _tok (name text primary key, tok uuid) on commit drop;
+insert into _tok
+select replace(split_part(c.resource_key, '-' || (select sfx from _orq), 1), 'orq-', ''), c.lease_token
+  from agent_board.claims c
+ where c.resource_key in (
+   'orq-over-file-'     || (select sfx from _orq),
+   'orq-over-shorten-'  || (select sfx from _orq),
+   'orq-over-nothread-' || (select sfx from _orq),
+   'orq-over-tool-'     || (select sfx from _orq),
+   'orq-over-custom-'   || (select sfx from _orq),
+   'orq-over-adv-'      || (select sfx from _orq),
+   'orq-over-escape-'   || (select sfx from _orq),
+   'orq-at-probe-'      || (select sfx from _orq),
+   'orq-under-probe-'   || (select sfx from _orq));
+
+-- Act as the OVER agent for ORQ-1..4 and ORQ-9.
+do $$
+begin
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select over_user from _orq)::text, true);
+end $$;
+
+-- ---------------------------------------------------------------------------
+-- ORQ-1: THE POINT. An agent already over the ceiling asks for +400 days. Before this migration it
+-- got +400 days and could repeat that forever; #387's TTL cap alone would give it +30 days, which
+-- still never converges. It gets back exactly the lease it already held.
+--
+-- lives_ok, not a `do $$ perform … $$` block: the mutation this assertion most needs to catch is a
+-- "hardening" into a raise, and a raise inside a do-block ABORTS the transaction and truncates the
+-- run instead of failing here by name (#113).
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-file')::text, (now() + interval '400 days')::text),
+  'ORQ-1a: an over-quota renew still SUCCEEDS — convergence by refusal would kill live work, which is the design #387 rejected and this file does not resurrect');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-file')),
+  now() + interval '10 days',
+  'ORQ-1 THE POINT: the over-quota renew did not POSTPONE anything — the lease it already held comes back to the microsecond, so the claim lapses on its own schedule and the agent converges');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-2: THE OTHER TWO KINDS. Every other assertion here drives `file`; in the TTL half, dropping
+-- 'tool' or 'custom' from the kind list passed the entire battery (ORT-9). Exercised behaviourally,
+-- because the defect is "this kind is not converged" and only a timestamp observation sees it.
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-tool')::text, (now() + interval '400 days')::text),
+  'ORQ-2a: a tool renew by an over-quota agent succeeds');
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-custom')::text, (now() + interval '400 days')::text),
+  'ORQ-2b: a custom renew by an over-quota agent succeeds');
+
+select is(
+  (select string_agg(c.resource_kind || '=' || (c.lease_expires_at = now() + interval '10 days')::text, ', ' order by c.resource_kind)
+     from agent_board.claims c
+    where c.lease_token in (select tok from _tok where name in ('over-tool', 'over-custom'))),
+  'custom=true, tool=true',
+  'ORQ-2: tool and custom are frozen at renew too — dropping either from the kind list leaves two thirds of the class unconverged and passes every file-driven assertion here');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-3: A CLAIM WITH NO THREAD IS STILL CONVERGED. The board opt-out is resolved from the claim's
+-- thread, so a claim with none must fall back to 'inherit' rather than escaping by omission —
+-- otherwise `and v_thread_id is not null` in the guard buys an agent an unbounded renewal.
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-nothread')::text, (now() + interval '400 days')::text),
+  'ORQ-3a: a threadless renew by an over-quota agent succeeds');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-nothread')),
+  now() + interval '10 days',
+  'ORQ-3: a claim with NO thread is still frozen — the board opt-out cannot be obtained by omitting the thread');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-4: SHORTENING IS STILL ALLOWED. The clamp is least(), not an assignment: an over-quota agent
+-- asking for LESS time is converging voluntarily and must be taken at its word. An assignment of
+-- the current expiry passes ORQ-1 and silently lengthens this lease from one hour back to ten days.
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-shorten')::text, (now() + interval '1 hour')::text),
+  'ORQ-4a: an over-quota agent may still renew for a SHORTER term');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-shorten')),
+  now() + interval '1 hour',
+  'ORQ-4: a shorter ask is honoured exactly — the guard is least(requested, held), not a rewrite to the held value, which would hand back time the agent tried to give up');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-5: THE DISCRIMINATING TWIN. An agent at EXACTLY the quota is at the ceiling, not over it, and
+-- renews normally, and it fails when `> quota` is weakened to `>= quota` — acquire's own refusal
+-- predicate, which reads as a harmless unification and would walk a legal population down to 49.
+--
+-- NOT the only assertion that catches that, and an earlier version of this comment said it was.
+-- The mutation was measured: `>` -> `>=` fails ORQ-5 AND ORQ-13, because ORQ-13 releases one claim
+-- to put the agent exactly at the ceiling and so builds the same boundary fixture a second time.
+-- Being pinned twice is stronger than the claim was; naming the wrong count still sends the next
+-- reader to the wrong test.
+--
+-- It is also where the four near-miss rows pay off: drop any conjunct from the shared count and
+-- this agent is at 51 and frozen.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform set_config('request.jwt.claim.sub', (select at_user from _orq)::text, true);
+end $$;
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'at-probe')::text, (now() + interval '5 days')::text),
+  'ORQ-5a: an agent holding exactly the quota can renew');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'at-probe')),
+  now() + interval '5 days',
+  'ORQ-5 THE TWIN: an agent at EXACTLY the quota is EXTENDED in full (+1d becomes +5d) — >= instead of > freezes it, and every other assertion here still passes');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-6: the ordinary twin. An agent well under the quota is untouched, so a guard that converged
+-- by freezing everything fails here as well as at ORQ-5.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform set_config('request.jwt.claim.sub', (select under_user from _orq)::text, true);
+end $$;
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'under-probe')::text, (now() + interval '5 days')::text),
+  'ORQ-6a: an under-quota renew succeeds');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'under-probe')),
+  now() + interval '5 days',
+  'ORQ-6: an agent well under the quota renews with its horizon untouched — a guard that froze every ownerless renew would satisfy ORQ-1 and destroy the feature');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-7: the operator carve-out. service_role is exempt here exactly as it is on the TTL cap and at
+-- acquire, so an operator can still extend an over-quota agent's lease deliberately — and, since
+-- service_role skips the TTL cap too, lands the full +400 days rather than the 30-day horizon.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform set_config('request.jwt.claims', '', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform set_config('request.jwt.claim.role', '', true);
+end $$;
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-file')::text, (now() + interval '400 days')::text),
+  'ORQ-7a: service_role can renew an over-quota agent''s claim');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-file')),
+  now() + interval '400 days',
+  'ORQ-7: service_role is EXEMPT from the convergence clamp, the same carve-out it has at acquire and on the TTL cap — an operator extension is not frozen');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-8: one flag governs every ownerless guard. With ownerless_guards off, convergence stops —
+-- so the operator switch means the same thing on both write paths and for both the cap and the
+-- quota, rather than half-latching.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'ownerless_guards';
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select over_user from _orq)::text, true);
+end $$;
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-shorten')::text, (now() + interval '400 days')::text),
+  'ORQ-8a: with the guards off an over-quota renew succeeds');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-shorten')),
+  now() + interval '400 days',
+  'ORQ-8: with ownerless_guards OFF the renew is NOT frozen (and not TTL-clamped) — one flag governs the quota clamp exactly as it governs the cap');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-9: the board opt-out reaches the quota clamp too. A board coordinating its own locking
+-- (claim_policy='advisory') asked us not to enforce, and converging its claims would break that
+-- promise — refusing to extend a lease someone else's mutex already granted. The row still COUNTS
+-- toward the ceiling, which is why the census reports claims_on_advisory_boards separately: it is
+-- exactly the share this guard cannot reach.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'ownerless_guards';
+end $$;
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-adv')::text, (now() + interval '400 days')::text),
+  'ORQ-9a: an advisory-board renew by an over-quota agent succeeds');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-adv')),
+  now() + interval '400 days',
+  'ORQ-9: a claim on a claim_policy=advisory board is NOT frozen — the opt-out reaches the quota clamp exactly as it reaches the TTL cap (both are skipped, hence the full +400 days), which is the same bug one layer down had it been acquire-only');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-10: THE CENSUS AND THE ENFORCER AGREE. #393's view keeps its own copy of the count predicate
+-- deliberately — its four near-miss rows are what make each conjunct of the READER individually
+-- mutation-visible, and routing its headline through the helper would erase that. So the two are
+-- pinned EQUAL here instead, which is the property that actually matters: a census whose arithmetic
+-- differs from the enforcer's is silently answering a different question.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(l.label || '=' || v.active_ownerless_claims || '/' || agent_board._claimgate_active_ownerless_claims(v.agent_id), ', ' order by l.label)
+     from agent_board.v_ownerless_claim_quota v
+     join (values ((select over_agent from _orq), 'over'),
+                  ((select at_agent from _orq), 'at'),
+                  ((select under_agent from _orq), 'under')) as l(id, label) on l.id = v.agent_id),
+  format('at=%s/%s, over=%s/%s, under=3/3',
+         agent_board._claimgate_ownerless_quota(), agent_board._claimgate_ownerless_quota(),
+         agent_board._claimgate_ownerless_quota() + 1, agent_board._claimgate_ownerless_quota() + 1),
+  'ORQ-10: the #393 census view and the shared enforcement count agree on all three fixture agents — the two predicates are separate text and this is what stops them drifting');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-11/12: THE ESCAPE HATCH. THIS ASSERTION DOCUMENTS A LIMITATION ON PURPOSE — it is not an
+-- accident and it is not a defect being hidden. Read the migration header first; this is the
+-- executable half of the paragraph that scopes the convergence claim.
+--
+-- The advisory carve-out is resolved at RENEW TIME against the board's CURRENT policy, and
+-- set_board_claim_policy is owner-settable. So an owner can flip to 'advisory', let the over-quota
+-- agent renew every claim to the full horizon, and flip back — repeatedly, before expiry. The
+-- monotone clamp guarantees convergence against an agent whose boards do not opt out; it guarantees
+-- NOTHING against one whose board owner cooperates, and the flip-flop can be repeated forever.
+--
+-- AND THE AGENT CAN BE ITS OWN OWNER, which is why the fixture builds this board through
+-- create_board rather than inserting it. create_board seeds the creator's owner membership and
+-- set_board_claim_policy is gated on exactly that, so no accomplice is required — an agent that
+-- creates a board holds the switch that exempts its own claims. That is the strong form of the
+-- limitation, and asserting the weak form (a cooperating third party) would understate it.
+--
+-- The carve-out is NOT removed in response. A board coordinating through someone else's mutex asked
+-- us not to enforce, and refusing to extend a lease that mutex granted would break the promise the
+-- opt-out makes. The exemption is deliberate; what was wrong was the CLAIM made about it, which is
+-- corrected in prose and pinned here so the correction cannot silently rot (rule 5).
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  format($$ select * from agent_board.set_board_claim_policy(%L::uuid, 'advisory') $$,
+         (select esc_board from _orq)::text),
+  'ORQ-11a: the OVER-QUOTA AGENT ITSELF may opt its own board out — create_board made it the owner, and set_board_claim_policy is gated on owner membership, so the escape needs no accomplice');
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-escape')::text, (now() + interval '400 days')::text),
+  'ORQ-11b: and during that window the over-quota renew takes the FULL horizon');
+
+select lives_ok(
+  format($$ select * from agent_board.set_board_claim_policy(%L::uuid, 'inherit') $$,
+         (select esc_board from _orq)::text),
+  'ORQ-11c: the board is flipped straight back to inherit');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-escape')),
+  now() + interval '400 days',
+  'ORQ-11 THE ESCAPE HATCH: reverting to inherit does NOT take the horizon back — the +400 day lease survives the revert, so an owner who flips advisory/inherit before each expiry keeps an over-quota agent over quota forever. Convergence is guaranteed only against an agent whose boards do not opt out');
+
+-- The second half, kept HERE rather than in the census file. The escape and its invisibility are
+-- one defect: the census resolves board policy at QUERY time (OQ-29's subject), so once the board
+-- is back to 'inherit' this claim contributes ZERO to claims_on_advisory_boards while the overage
+-- it produced is still counted. An operator reading the census sees an agent over quota with no
+-- advisory share — the exact shape that says "this one is a squatter, act on it" — and the column
+-- built to explain the exemption reports none. Splitting the two halves across two files would put
+-- the escape and the reason it is invisible where a future edit to one cannot see the other.
+select is(
+  (select 'advisory=' || v.claims_on_advisory_boards || ', overage=' || v.overage || ', blocked=' || v.acquire_blocked::text
+     from agent_board.v_ownerless_claim_quota v where v.agent_id = (select over_agent from _orq)),
+  'advisory=1, overage=1, blocked=true',
+  'ORQ-12: after the revert the escaped claim is INVISIBLE to the census — claims_on_advisory_boards counts only the one still on an advisory board, not the one that used the exemption and gave it back, so the overage it bought reads as unexplained squatting');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-13: THE FIXED POINT. Release ONE claim, and the agent is at the ceiling rather than over it —
+-- the same tool claim that was frozen at ORQ-2 now extends in full. A guard that latched, read a
+-- constant, or captured the count once passes everything above and fails here.
+-- ---------------------------------------------------------------------------
+update agent_board.claims
+   set status = 'released', released_at = now()
+ where resource_key = 'orq-over-filler-' || (select sfx from _orq) || '-1';
+
+select lives_ok(
+  format($$ select * from agent_board.renew_claim(%L::uuid, %L::timestamptz) $$,
+         (select tok from _tok where name = 'over-tool')::text, (now() + interval '20 days')::text),
+  'ORQ-13a: after releasing one claim the renew succeeds');
+
+select is(
+  (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-tool')),
+  now() + interval '20 days',
+  'ORQ-13 THE FIXED POINT: one release puts the agent AT the ceiling and the previously frozen claim extends in full (+10d becomes +20d) — convergence stops at the quota, it does not run to zero');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-14: CLASS, catalog-derived. Which functions can move a claim's lease_expires_at? #388's own
+-- text asserts "acquire_claim/renew_claim are the only SQL writers" — a recorded fact, which rule 5
+-- says is a claim about the moment it was written. Derived here instead, so a third writer that
+-- needs this guard fails a test and NAMES ITSELF rather than relying on someone remembering.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~ '(lease_expires_at\s*=[^=]|insert into agent_board\.claims\s*\([^)]*lease_expires_at)'),
+  'acquire_claim, renew_claim',
+  'ORQ-14 CLASS: acquire_claim and renew_claim are the ONLY functions that write a claim lease — a new one names itself here instead of quietly inheriting an unconverged renewal path');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-15/14: CLASS, one definition of the count. Three hand-copies of a predicate across two
+-- enforcers and a census is rule 1's own failure shape, so acquire's inline count was extracted
+-- into _claimgate_active_ownerless_claims() and both paths now ask it. ORQ-15 is the exact-set scan
+-- (a fourth site that re-derives the count names itself); ORQ-16 is the positive pair, scored on
+-- BOTH functions because asserting only that renew uses the helper would pass if acquire silently
+-- stopped using it.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~ 'count\(\*\)[^;]*from agent_board\.claims'),
+  '_claimgate_active_ownerless_claims',
+  'ORQ-15 CLASS: exactly ONE function counts rows of agent_board.claims — an enforcement path that re-derives the ownerless count instead of asking the helper fails here and names itself');
+
+select is(
+  (select string_agg(p.proname || '=' || (agent_board_test.stripped_body(p.oid, true) ~ '_claimgate_active_ownerless_claims')::text, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname in ('acquire_claim', 'renew_claim')),
+  'acquire_claim=true, renew_claim=true',
+  'ORQ-16 CLASS: BOTH enforcement paths ask the shared count — scored on the pair, because pinning renew alone would pass if acquire reverted to its own copy');
+
+-- ---------------------------------------------------------------------------
+-- ORQ-17: the helper is service_role-only, and DELIBERATELY narrower than its sibling
+-- _claimgate_ownerless_quota() (granted to authenticated). That one returns a constant; this one
+-- reads agent_board.claims under security invoker, so an authenticated caller would receive its own
+-- RLS-filtered count wearing the name of the fleet-wide quota count — a confident, plausible, wrong
+-- number, which is the #367 shape the census header describes one layer down. Asserted positively
+-- on all three roles rather than by the absence of a grant.
+-- ---------------------------------------------------------------------------
+select is(
+  format('anon=%s, authenticated=%s, service_role=%s',
+         has_function_privilege('anon',          'agent_board._claimgate_active_ownerless_claims(uuid)', 'execute')::text,
+         has_function_privilege('authenticated', 'agent_board._claimgate_active_ownerless_claims(uuid)', 'execute')::text,
+         has_function_privilege('service_role',  'agent_board._claimgate_active_ownerless_claims(uuid)', 'execute')::text),
+  'anon=false, authenticated=false, service_role=true',
+  'ORQ-17: the shared count is service_role only — it reads claims under security invoker, so an authenticated grant would hand a caller its own RLS-filtered count under a fleet-wide name');
+
+select * from finish();
+rollback;