@consiliency/agent-board-schema 1.45.0 → 1.50.0

package/tests/isolation/expected/fleet_domain_no_downgrade_demote_race.out

@@ -0,0 +1,447 @@
+Parsed test spec with 7 sessions
+
+starting permutation: rl_begin rl_lock rm_begin rm_move rl_demote rl_commit rm_commit chk
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_lock: 
+  select id from agent_board.fleet_machines
+   where id = 'c3970000-0000-4000-8000-000000000001' for update;
+
+id                                  
+------------------------------------
+c3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000002',
+      'nodowngrade-iso-machine-moved', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_demote: 
+  update agent_board.fleet_trust_domains
+     set lifecycle_state = 'pending', approved_at = null, updated_at = now()
+   where id = 'd3970000-0000-4000-8000-000000000002';
+
+step rl_commit: COMMIT;
+step rm_move: <... completed>
+ERROR:  re-registration would move machine into a less approved trust domain (destination d3970000-0000-4000-8000-000000000002, current d3970000-0000-4000-8000-000000000001) — measured after the move, from one snapshot
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000001|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rm_begin rm_move rm_commit chk
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000002',
+      'nodowngrade-iso-machine-moved', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000002
+(1 row)
+
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000002|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rl_begin rl_relocate_dest rm_begin rm_move_current rl_demote_current rl_commit rm_commit chk
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_relocate_dest: 
+  update agent_board.fleet_machines
+     set trust_domain_id = 'd3970000-0000-4000-8000-000000000002', updated_at = now()
+   where id = 'c3970000-0000-4000-8000-000000000001';
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_demote_current: 
+  update agent_board.fleet_trust_domains
+     set lifecycle_state = 'pending', approved_at = null, updated_at = now()
+   where id = 'd3970000-0000-4000-8000-000000000001';
+
+step rl_commit: COMMIT;
+step rm_move_current: <... completed>
+ERROR:  re-registration would move machine into a less approved trust domain (destination d3970000-0000-4000-8000-000000000001, current d3970000-0000-4000-8000-000000000002) — measured after the move, from one snapshot
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000002|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rl_begin rl_relocate_dest rm_begin rm_move_current rl_commit rm_commit chk
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_relocate_dest: 
+  update agent_board.fleet_machines
+     set trust_domain_id = 'd3970000-0000-4000-8000-000000000002', updated_at = now()
+   where id = 'c3970000-0000-4000-8000-000000000001';
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_commit: COMMIT;
+step rm_move_current: <... completed>
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000001|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rl_begin rl_lock rm_begin rm_move_current rl_relocate_x rl_demote_current rl_commit rm_commit chk
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_lock: 
+  select id from agent_board.fleet_machines
+   where id = 'c3970000-0000-4000-8000-000000000001' for update;
+
+id                                  
+------------------------------------
+c3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_relocate_x: 
+  update agent_board.fleet_machines
+     set trust_domain_id = 'd3970000-0000-4000-8000-000000000003', updated_at = now()
+   where id = 'c3970000-0000-4000-8000-000000000001';
+
+step rl_demote_current: 
+  update agent_board.fleet_trust_domains
+     set lifecycle_state = 'pending', approved_at = null, updated_at = now()
+   where id = 'd3970000-0000-4000-8000-000000000001';
+
+step rl_commit: COMMIT;
+step rm_move_current: <... completed>
+ERROR:  re-registration would move machine into a less approved trust domain (destination d3970000-0000-4000-8000-000000000001, current d3970000-0000-4000-8000-000000000003) — measured after the move, from one snapshot
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000003|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rl_begin rl_lock rm_begin rm_move_current rl_relocate_x rl_commit rm_commit chk
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_lock: 
+  select id from agent_board.fleet_machines
+   where id = 'c3970000-0000-4000-8000-000000000001' for update;
+
+id                                  
+------------------------------------
+c3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_relocate_x: 
+  update agent_board.fleet_machines
+     set trust_domain_id = 'd3970000-0000-4000-8000-000000000003', updated_at = now()
+   where id = 'c3970000-0000-4000-8000-000000000001';
+
+step rl_commit: COMMIT;
+step rm_move_current: <... completed>
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000001|a3970000-0000-4000-8000-000000000001|active       |active      
+(1 row)
+
+
+starting permutation: rc_begin rc_reclaim rm_begin rm_move_current rc_commit rm_commit chk
+step rc_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rc_reclaim: 
+  select owner_agent_id, trust_domain_id
+    from agent_board.reclaim_fleet_machine(
+      'c3970000-0000-4000-8000-000000000001', 'a3970000-0000-4000-8000-000000000003',
+      'a3970000-0000-4000-8000-000000000002', 'iso reclaim vs register',
+      'd3970000-0000-4000-8000-000000000004');
+
+owner_agent_id                      |trust_domain_id                     
+------------------------------------+------------------------------------
+a3970000-0000-4000-8000-000000000003|d3970000-0000-4000-8000-000000000004
+(1 row)
+
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rc_commit: COMMIT;
+step rm_move_current: <... completed>
+ERROR:  machine fingerprint is registered to another owner
+step rm_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000004|a3970000-0000-4000-8000-000000000003|active       |active      
+(1 row)
+
+
+starting permutation: rm_begin rm_move_current rc_begin rc_reclaim rm_commit rc_commit chk
+step rm_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm_move_current: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000001',
+      'nodowngrade-iso-machine-relabelled', 'sha256:nodowngrade-iso', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000001
+(1 row)
+
+step rc_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rc_reclaim: 
+  select owner_agent_id, trust_domain_id
+    from agent_board.reclaim_fleet_machine(
+      'c3970000-0000-4000-8000-000000000001', 'a3970000-0000-4000-8000-000000000003',
+      'a3970000-0000-4000-8000-000000000002', 'iso reclaim vs register',
+      'd3970000-0000-4000-8000-000000000004');
+ <waiting ...>
+step rm_commit: COMMIT;
+step rc_reclaim: <... completed>
+owner_agent_id                      |trust_domain_id                     
+------------------------------------+------------------------------------
+a3970000-0000-4000-8000-000000000003|d3970000-0000-4000-8000-000000000004
+(1 row)
+
+step rc_commit: COMMIT;
+step chk: 
+  select fm.trust_domain_id, fm.owner_agent_id, fm.lifecycle_state as machine_state,
+         ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.id = 'c3970000-0000-4000-8000-000000000001';
+
+trust_domain_id                     |owner_agent_id                      |machine_state|domain_state
+------------------------------------+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000004|a3970000-0000-4000-8000-000000000003|active       |active      
+(1 row)
+
+
+starting permutation: rf_begin rf_register rm2_begin rm2_register rl_begin rl_demote_race_dest rl_commit rf_commit rm2_commit chkf
+step rf_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rf_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000005',
+      'nodowngrade-iso-fresh-winner', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000005
+(1 row)
+
+step rm2_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm2_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000006',
+      'nodowngrade-iso-fresh-loser', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_demote_race_dest: 
+  update agent_board.fleet_trust_domains
+     set lifecycle_state = 'quarantined', approved_at = null, updated_at = now()
+   where id = 'd3970000-0000-4000-8000-000000000006';
+
+step rl_commit: COMMIT;
+step rf_commit: COMMIT;
+step rm2_register: <... completed>
+ERROR:  concurrent registration of machine fingerprint sha256:nodowngrade-iso-fresh — retry
+step rm2_commit: COMMIT;
+step chkf: 
+  select fm.trust_domain_id, fm.lifecycle_state as machine_state, ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.machine_fingerprint = 'sha256:nodowngrade-iso-fresh';
+
+trust_domain_id                     |machine_state|domain_state
+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000005|active       |pending     
+(1 row)
+
+
+starting permutation: rf_begin rf_register rm2_begin rm2_register rl_begin rl_promote_race_src rl_commit rf_commit rm2_commit chkf
+step rf_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rf_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000005',
+      'nodowngrade-iso-fresh-winner', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000005
+(1 row)
+
+step rm2_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm2_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000006',
+      'nodowngrade-iso-fresh-loser', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+ <waiting ...>
+step rl_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rl_promote_race_src: 
+  update agent_board.fleet_trust_domains
+     set lifecycle_state = 'active', approved_at = now(), updated_at = now()
+   where id = 'd3970000-0000-4000-8000-000000000005';
+
+step rl_commit: COMMIT;
+step rf_commit: COMMIT;
+step rm2_register: <... completed>
+ERROR:  concurrent registration of machine fingerprint sha256:nodowngrade-iso-fresh — retry
+step rm2_commit: COMMIT;
+step chkf: 
+  select fm.trust_domain_id, fm.lifecycle_state as machine_state, ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.machine_fingerprint = 'sha256:nodowngrade-iso-fresh';
+
+trust_domain_id                     |machine_state|domain_state
+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000005|active       |active      
+(1 row)
+
+
+starting permutation: rf_begin rf_register rf_commit rm2_begin rm2_register rm2_commit chkf
+step rf_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rf_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000005',
+      'nodowngrade-iso-fresh-winner', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000005
+(1 row)
+
+step rf_commit: COMMIT;
+step rm2_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rm2_register: 
+  select trust_domain_id
+    from agent_board.register_fleet_machine(
+      'a3970000-0000-4000-8000-000000000001', 'd3970000-0000-4000-8000-000000000006',
+      'nodowngrade-iso-fresh-loser', 'sha256:nodowngrade-iso-fresh', 'portal',
+      jsonb_build_object('redacted', true));
+
+trust_domain_id                     
+------------------------------------
+d3970000-0000-4000-8000-000000000006
+(1 row)
+
+step rm2_commit: COMMIT;
+step chkf: 
+  select fm.trust_domain_id, fm.lifecycle_state as machine_state, ftd.lifecycle_state as domain_state
+    from agent_board.fleet_machines fm
+    join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+   where fm.machine_fingerprint = 'sha256:nodowngrade-iso-fresh';
+
+trust_domain_id                     |machine_state|domain_state
+------------------------------------+-------------+------------
+d3970000-0000-4000-8000-000000000006|active       |pending     
+(1 row)
+

package/tests/isolation/specs/claimpolicy_acquire_revert_race.spec

@@ -0,0 +1,118 @@
+# Consiliency/message-board#405 — an acquire whose snapshot predates a committed
+# advisory -> inherit revert must NOT bank a full-horizon ownerless lease.
+#
+# WHY ACQUIRE IS THE WORSE HALF OF THIS FAMILY. #406's cap reset clamps the
+# board's EXISTING ownerless claims on a revert. On this path there is no claim
+# yet: the acquire inserts AFTER the revert committed, so there is nothing for
+# the reset to reach even in principle. Whatever horizon a stale 'advisory' read
+# lets through is banked outright.
+#
+# AND IT IS THE PATH THE FIRST DESIGN MISSED. That design said the board lock
+# goes "before the agent-scoped lock". acquire_claim's agent-scoped quota lock
+# lives INSIDE the branch that a stale 'advisory' read SKIPS ENTIRELY, so on the
+# dangerous path it is never reached and ordering against it means nothing. This
+# spec drives exactly that branch: the acquirer reads 'advisory' unless it is
+# made to wait, and if it reads 'advisory' it takes no lock at all.
+#
+# THE INTERLEAVE. w (the board owner) opens a transaction and reverts the board
+# to 'inherit', holding the board-scoped advisory lock until commit. a then asks
+# for a 400-day 'file' lease. Under READ COMMITTED a's snapshot at that moment
+# still shows 'advisory'.
+#
+# WHAT THE FIX PRODUCES (this golden): a's acquire prints `<waiting ...>` on w's
+# lock; after w commits, a RE-READS the policy in a fresh statement, sees
+# 'inherit', and the ownerless TTL cap rejects the 400-day horizon with
+# `ERROR: ownerless claim lease horizon exceeds cap`. The checker sees ZERO
+# claims.
+#
+# MUTATION SIGNAL (verified in the PR): delete the `perform
+# agent_board._claimgate_lock_board_policy(v_board_id)` line from acquire_claim
+# -> a never waits, resolves the stale 'advisory', skips the whole ownerless
+# block and INSERTS. The golden diverges on the missing `<waiting ...>`, on the
+# missing error, and on the checker (1 claim, over-cap lease = t).
+#
+# THE TWIN IS NOT OPTIONAL. A guard that simply over-serialises — or one that
+# resolved every board to 'inherit' — would pass the race permutation and break
+# the feature. The second permutation runs the SAME acquire with no writer at
+# all: the board is still 'advisory', so the 400-day lease must be GRANTED, with
+# no wait anywhere in the trace.
+#
+# Sessions run as `authenticated` (service_role is exempt from these guards
+# entirely, so a service_role probe would prove nothing).
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000a1');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000001', 'agent', 'agent',
+          'cpr-acq-owner', 'CPR Acquire Owner', 'active',
+          '40500000-0000-4000-8000-0000000000a1', '40500000-0000-4000-8000-0000000000a1');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000001',
+    'cpr-acq-board', 'CPR Acquire Board',
+    'message-board#405 acquire stale-policy probe', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000010', 'coordination',
+          '40500000-0000-4000-8000-000000000001', 'CPR acquire thread',
+          (select id from agent_board.boards where slug = 'cpr-acq-board'));
+  -- The board starts OPTED OUT. Written directly rather than through the RPC so the setup does not
+  -- depend on the very gate this spec exercises; the RPC's own transitions are BCP's job.
+  update agent_board.boards set claim_policy = 'advisory' where slug = 'cpr-acq-board';
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = '40500000-0000-4000-8000-000000000001';
+  delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000010';
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.boards where slug = 'cpr-acq-board';
+  delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000001';
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000a1';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# w: the board owner reverting the opt-out. Holds the board policy lock until commit.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-acq-board'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+# a: the in-flight acquire. 400 days is far past the 30-day ownerless TTL cap, so the horizon it
+# gets is a direct readout of which policy it resolved.
+session "a"
+step "a_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "a_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+}
+step "a_commit" { COMMIT; }
+
+# checker: a count and a boolean, never a timestamp — a golden with a clock in it is not a golden.
+session "chk"
+step "chk" {
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+}
+
+# THE RACE: the acquire is issued while the revert is uncommitted.
+permutation "w_begin" "w_flip" "a_begin" "a_acq" "w_commit" "a_commit" "chk"
+
+# THE TWIN: no revert at all. The board is advisory, so the opt-out must still WORK — the 400-day
+# lease is granted and nothing waits. A guard that over-serialises, or one that resolved every
+# board to 'inherit', fails here and passes the permutation above.
+permutation "a_begin" "a_acq" "a_commit" "chk"