@consiliency/agent-board-schema 1.48.0 → 1.50.0

package/tests/isolation/expected/claimpolicy_renew_revert_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 3 sessions
+
+starting permutation: w_begin w_flip w_mark r_begin r_renew w_commit r_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-ren-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step w_mark: 
+  insert into public.cpr_renew_mark(lease)
+  select lease_expires_at from agent_board.claims where id = '40500000-0000-4000-8000-000000000030';
+
+step r_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step r_renew: 
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f1', now() + interval '400 days');
+ <waiting ...>
+step w_commit: COMMIT;
+step r_renew: <... completed>
+resource_key
+------------
+cpr-ren-key 
+(1 row)
+
+step r_commit: COMMIT;
+step chk: 
+  select (c.lease_expires_at > now() + interval '31 days') as over_cap_lease,
+         (c.lease_expires_at = (select m.lease from public.cpr_renew_mark m)) as lease_kept_by_revert
+    from agent_board.claims c
+   where c.id = '40500000-0000-4000-8000-000000000030';
+
+over_cap_lease|lease_kept_by_revert
+--------------+--------------------
+f             |t                   
+(1 row)
+
+
+starting permutation: r_begin r_renew r_commit chk
+step r_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step r_renew: 
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f1', now() + interval '400 days');
+
+resource_key
+------------
+cpr-ren-key 
+(1 row)
+
+step r_commit: COMMIT;
+step chk: 
+  select (c.lease_expires_at > now() + interval '31 days') as over_cap_lease,
+         (c.lease_expires_at = (select m.lease from public.cpr_renew_mark m)) as lease_kept_by_revert
+    from agent_board.claims c
+   where c.id = '40500000-0000-4000-8000-000000000030';
+
+over_cap_lease|lease_kept_by_revert
+--------------+--------------------
+t             |                    
+(1 row)
+

package/tests/isolation/expected/claimpolicy_writer_keyshare.out

@@ -0,0 +1,49 @@
+Parsed test spec with 3 sessions
+
+starting permutation: t_begin t_keyshare w_begin w_flip t_acq w_commit t_commit chk
+step t_begin: BEGIN;
+step t_keyshare: select slug from agent_board.boards where slug = 'cpr-ks-board' for key share;
+slug        
+------------
+cpr-ks-board
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000e1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-ks-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step t_acq: 
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000e1';
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-ks-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000060');
+ <waiting ...>
+step w_commit: COMMIT;
+step t_acq: <... completed>
+resource_key
+------------
+cpr-ks-key  
+(1 row)
+
+step t_commit: COMMIT;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims,
+         (select claim_policy from agent_board.boards where slug = 'cpr-ks-board') as policy
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000005'
+     and status = 'active' and released_at is null;
+
+claims    |policy 
+----------+-------
+cpr-ks-key|inherit
+(1 row)
+

package/tests/isolation/specs/claimpolicy_acquire_revert_race.spec

@@ -0,0 +1,118 @@
+# Consiliency/message-board#405 — an acquire whose snapshot predates a committed
+# advisory -> inherit revert must NOT bank a full-horizon ownerless lease.
+#
+# WHY ACQUIRE IS THE WORSE HALF OF THIS FAMILY. #406's cap reset clamps the
+# board's EXISTING ownerless claims on a revert. On this path there is no claim
+# yet: the acquire inserts AFTER the revert committed, so there is nothing for
+# the reset to reach even in principle. Whatever horizon a stale 'advisory' read
+# lets through is banked outright.
+#
+# AND IT IS THE PATH THE FIRST DESIGN MISSED. That design said the board lock
+# goes "before the agent-scoped lock". acquire_claim's agent-scoped quota lock
+# lives INSIDE the branch that a stale 'advisory' read SKIPS ENTIRELY, so on the
+# dangerous path it is never reached and ordering against it means nothing. This
+# spec drives exactly that branch: the acquirer reads 'advisory' unless it is
+# made to wait, and if it reads 'advisory' it takes no lock at all.
+#
+# THE INTERLEAVE. w (the board owner) opens a transaction and reverts the board
+# to 'inherit', holding the board-scoped advisory lock until commit. a then asks
+# for a 400-day 'file' lease. Under READ COMMITTED a's snapshot at that moment
+# still shows 'advisory'.
+#
+# WHAT THE FIX PRODUCES (this golden): a's acquire prints `<waiting ...>` on w's
+# lock; after w commits, a RE-READS the policy in a fresh statement, sees
+# 'inherit', and the ownerless TTL cap rejects the 400-day horizon with
+# `ERROR: ownerless claim lease horizon exceeds cap`. The checker sees ZERO
+# claims.
+#
+# MUTATION SIGNAL (verified in the PR): delete the `perform
+# agent_board._claimgate_lock_board_policy(v_board_id)` line from acquire_claim
+# -> a never waits, resolves the stale 'advisory', skips the whole ownerless
+# block and INSERTS. The golden diverges on the missing `<waiting ...>`, on the
+# missing error, and on the checker (1 claim, over-cap lease = t).
+#
+# THE TWIN IS NOT OPTIONAL. A guard that simply over-serialises — or one that
+# resolved every board to 'inherit' — would pass the race permutation and break
+# the feature. The second permutation runs the SAME acquire with no writer at
+# all: the board is still 'advisory', so the 400-day lease must be GRANTED, with
+# no wait anywhere in the trace.
+#
+# Sessions run as `authenticated` (service_role is exempt from these guards
+# entirely, so a service_role probe would prove nothing).
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000a1');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000001', 'agent', 'agent',
+          'cpr-acq-owner', 'CPR Acquire Owner', 'active',
+          '40500000-0000-4000-8000-0000000000a1', '40500000-0000-4000-8000-0000000000a1');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000001',
+    'cpr-acq-board', 'CPR Acquire Board',
+    'message-board#405 acquire stale-policy probe', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000010', 'coordination',
+          '40500000-0000-4000-8000-000000000001', 'CPR acquire thread',
+          (select id from agent_board.boards where slug = 'cpr-acq-board'));
+  -- The board starts OPTED OUT. Written directly rather than through the RPC so the setup does not
+  -- depend on the very gate this spec exercises; the RPC's own transitions are BCP's job.
+  update agent_board.boards set claim_policy = 'advisory' where slug = 'cpr-acq-board';
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = '40500000-0000-4000-8000-000000000001';
+  delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000010';
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.boards where slug = 'cpr-acq-board';
+  delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000001';
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000a1';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# w: the board owner reverting the opt-out. Holds the board policy lock until commit.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-acq-board'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+# a: the in-flight acquire. 400 days is far past the 30-day ownerless TTL cap, so the horizon it
+# gets is a direct readout of which policy it resolved.
+session "a"
+step "a_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "a_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+}
+step "a_commit" { COMMIT; }
+
+# checker: a count and a boolean, never a timestamp — a golden with a clock in it is not a golden.
+session "chk"
+step "chk" {
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+}
+
+# THE RACE: the acquire is issued while the revert is uncommitted.
+permutation "w_begin" "w_flip" "a_begin" "a_acq" "w_commit" "a_commit" "chk"
+
+# THE TWIN: no revert at all. The board is advisory, so the opt-out must still WORK — the 400-day
+# lease is granted and nothing waits. A guard that over-serialises, or one that resolved every
+# board to 'inherit', fails here and passes the permutation above.
+permutation "a_begin" "a_acq" "a_commit" "chk"

package/tests/isolation/specs/claimpolicy_board_scope.spec

@@ -0,0 +1,115 @@
+# Consiliency/message-board#405 — the policy lock is BOARD-SCOPED. Two boards
+# must not serialise against each other.
+#
+# WHY THIS IS ITS OWN SPEC. Every other spec in this family passes just as well
+# with a GLOBAL lock key, and a global key would be a fleet-wide serialisation
+# point on the hottest write path in the schema — every ownerless acquire and
+# every renew queued behind every other board's policy flip. "It waits when it
+# should" and "it does not wait when it should not" are different claims, and
+# only the second one fails on a constant key.
+#
+# BOTH DIRECTIONS IN ONE FILE, so the probe is discriminating rather than merely
+# green:
+#
+#   permutation 1 (SAME board)      — the acquirer must WAIT on the flip.
+#   permutation 2 (DIFFERENT board) — the acquirer must NOT wait, and its board
+#                                     is still 'advisory', so its 400-day lease
+#                                     is granted.
+#
+# MUTATION SIGNAL (measured, not predicted): replace the board id in
+# `_claimgate_lock_board_policy`'s key with a constant -> permutation 2 gains a
+# `<waiting ...>` line and the golden diverges. Permutation 1 is UNCHANGED by that
+# mutation, which is exactly why it cannot stand alone.
+#
+# w COMMITS BEFORE a2 in permutation 2, and that ordering is about the mutant rather
+# than the fix: with a constant key and a2 committing first, nothing ever releases the
+# lock a2 is queued on and isolationtester spends its full 300-second cancel timeout
+# before producing the diff. Committing w first leaves the independence claim intact --
+# a2 still runs its whole acquire while w's flip is uncommitted -- and makes the mutant
+# fail in a second.
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000c1');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000003', 'agent', 'agent',
+          'cpr-scope-owner', 'CPR Scope Owner', 'active',
+          '40500000-0000-4000-8000-0000000000c1', '40500000-0000-4000-8000-0000000000c1');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000003', 'cpr-scope-b1', 'CPR Scope B1',
+    'message-board#405 board-scope probe (flipped board)', jsonb_build_object(), 'private');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000003', 'cpr-scope-b2', 'CPR Scope B2',
+    'message-board#405 board-scope probe (untouched board)', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000041', 'coordination',
+          '40500000-0000-4000-8000-000000000003', 'CPR scope thread b1',
+          (select id from agent_board.boards where slug = 'cpr-scope-b1')),
+         ('40500000-0000-4000-8000-000000000042', 'coordination',
+          '40500000-0000-4000-8000-000000000003', 'CPR scope thread b2',
+          (select id from agent_board.boards where slug = 'cpr-scope-b2'));
+  update agent_board.boards set claim_policy = 'advisory' where slug in ('cpr-scope-b1', 'cpr-scope-b2');
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = '40500000-0000-4000-8000-000000000003';
+  delete from agent_board.threads where id in ('40500000-0000-4000-8000-000000000041',
+                                               '40500000-0000-4000-8000-000000000042');
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
+  delete from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2');
+  delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000003';
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000c1';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# w reverts board 1, and holds its policy lock until commit.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+# a1 acquires on the FLIPPED board: it must wait, then be refused by the TTL cap.
+session "a1"
+step "a1_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "a1_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b1', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000041');
+}
+step "a1_commit" { COMMIT; }
+
+# a2 acquires on the OTHER board: it must not wait at all, and its opt-out still stands.
+session "a2"
+step "a2_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "a2_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b2', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000042');
+}
+step "a2_commit" { COMMIT; }
+
+session "chk"
+step "chk" {
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+}
+
+# SAME BOARD: waits, then the revert's 'inherit' refuses the 400-day horizon.
+permutation "w_begin" "w_flip" "a1_begin" "a1_acq" "w_commit" "a1_commit" "chk"
+
+# DIFFERENT BOARD: no wait anywhere, and board 2's opt-out grants the 400-day lease while board 1's
+# flip is still in flight. A constant lock key turns this into a wait and fails the golden.
+permutation "w_begin" "w_flip" "a2_begin" "a2_acq" "w_commit" "a2_commit" "chk"

package/tests/isolation/specs/claimpolicy_claimrow_lock_order.spec

@@ -0,0 +1,200 @@
+# Consiliency/message-board#405 — the CLAIM-ROW side of the lock order, measured.
+# #405's acceptance names two adjacent paths by name: the thread-insert
+# `FOR KEY SHARE` on `boards` (measured in claimpolicy_writer_keyshare.spec) and
+# `reclaim_fleet_machine`. This is the second one, plus the general question it
+# is an instance of.
+#
+# THE QUESTION. Every path this issue touches now takes the board policy advisory
+# lock and THEN a `claims` row lock: acquire's sweep, renew's UPDATE, and #400's
+# cap reset are all after it. A cycle needs someone going the other way — holding
+# a claims row lock and then wanting the board lock. `reclaim_fleet_machine` is
+# the obvious candidate, because #150 MUST-FIX 2 made it RELEASE the squatter's
+# active machine claim, so it genuinely holds claims row locks while also holding
+# `fleet_machines ... for update`.
+#
+# PERMUTATION 1 — reclaim vs the policy writer. Measured result: NO contention in
+# either direction. Reclaim's rows are `resource_kind = 'machine'` and #400's cap
+# reset touches only the ownerless kinds, so the two hold disjoint rows; and
+# reclaim never enters a policy path, so it never wants the advisory lock. The
+# trace has no `<waiting ...>` at all, which is the observation this permutation
+# exists to record.
+#
+# PERMUTATION 2 — THE PROBE THAT MAKES PERMUTATION 1 EVIDENCE. A permutation that
+# never waits proves nothing on its own: it looks identical to a probe pointed at
+# the wrong subject. So this one CONSTRUCTS the inversion, in the shape #405 asks
+# for (PR #397 injected the reverted lock and observed 40P01). A session takes a
+# plain `select ... for update` on the claim row and THEN calls `renew_claim`,
+# which wants the board lock; the writer holds the board lock and wants that same
+# row through the cap reset. PostgreSQL reports `deadlock detected` — so the cycle
+# is REAL, and permutation 1's silence is a fact about which locks these paths
+# actually take rather than a fact about the probe.
+#
+# AND WHAT IS ACTUALLY TRUE ABOUT REACHING IT, corrected. An earlier version of
+# this paragraph said "no session can assemble permutation 2". That is FALSE, and
+# it was false in two independent ways; both were measured against this bundle
+# rather than argued, and both produced a real `deadlock detected`.
+#
+# It rested on two premises. The first was "no function in agent_board takes a
+# claims row lock (CPR-14)" — but CPR-14 only ever asked about an EXPLICIT
+# locking clause. `update agent_board.claims` takes row locks too, and FIVE
+# functions do it. The ordered premise that does hold is CPR-14a's: of those
+# five, the three that also want the board lock take the BOARD LOCK FIRST, and
+# the other two (reclaim_fleet_machine, release_claim) never want it at all. So
+# no single function inverts. The second premise was privilege: `select … for
+# update` on claims really is refused 42501 to `authenticated` and to
+# `service_role` alike, and `anon` cannot even SELECT (CPR-15/16 run the
+# statement rather than asserting a proxy for it). But that closes only the
+# DIRECT SPELLING.
+#
+# WHAT A SESSION CAN STILL DO IS COMPOSE. A definer function's `update` takes row
+# locks scoped to the CALLING transaction, and they outlive the call. So a
+# multi-statement transaction on a DIRECT database connection assembles the cycle
+# out of granted RPCs, with no table privilege and no hand-written `for update`:
+#
+#   as authenticated:  release_claim(<token>)  then  renew_claim(<other>, …)
+#                      against a concurrent set_board_claim_policy  -> 40P01
+#   as service_role:   renew_claim(<token>, …) then a DIRECT call to
+#                      _claimgate_lock_board_policy               -> 40P01
+#
+# The service_role path is CLOSED as of 20261001000100, which revokes that direct
+# grant (CPR-22 pins the now-empty ACL, CPR-22a pins that the definer callers
+# still work). The authenticated composition remains assemblable.
+#
+# AND IT IS A RESIDUAL ONLY UNDER A STATED ACCESS BOUNDARY. The boundary this
+# repository actually ships, checked rather than assumed: every shipped client
+# reaches the schema through PostgREST via @supabase/supabase-js — there is no
+# direct Postgres driver (`pg`, Pool, a postgresql:// connection) anywhere in
+# packages/*/src or supabase/functions. PostgREST runs one RPC per transaction,
+# and the control below measures that shape as safe. A deployment that adds
+# DIRECT authenticated-role sessions re-opens this; under that deployment it is
+# unclosed rather than residual, and what it yields is 40P01 — a detected
+# deadlock that aborts one side — not an authority bypass or a stale-policy read.
+#
+# SO THE ACCURATE CLAIM IS NARROWER, and it is a claim about the TRANSACTION
+# rather than about privilege. No single RPC can assemble the inversion, and one
+# RPC per transaction — PostgREST's model, which is how every shipped client
+# reaches this schema — is safe. Measured as a control: the identical call
+# sequence with a COMMIT between each RPC produces no deadlock and both calls
+# succeed. Only a caller holding a direct connection across a multi-statement
+# transaction can assemble it, and what it gets is 40P01 — a DETECTED DEADLOCK
+# that aborts one side, not an authority bypass or a stale-policy read. The two
+# shipped paths still agree on board-then-row.
+#
+# The deadlock victim is `w_flip` on every run: it enters the wait first, so its
+# deadlock_timeout fires first and PostgreSQL aborts the detecting backend. That
+# is what makes this golden stable; the ITER=10 gate is what checks the claim.
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000f9');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000009', 'agent', 'agent',
+          'cpr-inv-owner', 'CPR Inversion Owner', 'active',
+          '40500000-0000-4000-8000-0000000000f9', '40500000-0000-4000-8000-0000000000f9');
+  -- The operator and the arbitrated new owner for the reclaim leg.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id) values
+    ('40500000-0000-4000-8000-00000000000a', 'agent', 'cpr-inv-operator', 'CPR Inversion Operator', 'active', null),
+    ('40500000-0000-4000-8000-00000000000b', 'agent', 'cpr-inv-newowner', 'CPR Inversion New Owner', 'active', null);
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('40500000-0000-4000-8000-0000000000d0', 'cpr-inv-domain', 'CPR Inversion Domain', 'tailnet',
+          '40500000-0000-4000-8000-000000000009', 'active', now());
+  insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+                                         lifecycle_state, enrollment_source, enrolled_at, revoked_at, metadata)
+  values ('40500000-0000-4000-8000-0000000000c0', '40500000-0000-4000-8000-0000000000d0',
+          '40500000-0000-4000-8000-000000000009', 'cpr-inv-m', 'sha256:cpr-inv-m',
+          'active', 'portal', now(), null, jsonb_build_object('redacted', true, 'metadata-safe', true));
+
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000009', 'cpr-inv-board', 'CPR Inversion Board',
+    'message-board#405 claim-row lock-order probe', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000090', 'coordination',
+          '40500000-0000-4000-8000-000000000009', 'CPR inversion thread',
+          (select id from agent_board.boards where slug = 'cpr-inv-board'));
+  update agent_board.boards set claim_policy = 'advisory' where slug = 'cpr-inv-board';
+  -- The OWNERLESS claim #400's reset will clamp on the revert.
+  insert into agent_board.claims(id, agent_id, thread_id, resource_kind, resource_key, lease_token, lease_expires_at)
+  values ('40500000-0000-4000-8000-000000000091', '40500000-0000-4000-8000-000000000009',
+          '40500000-0000-4000-8000-000000000090', 'file', 'cpr-inv-key',
+          '40500000-0000-4000-8000-0000000000f8', now() + interval '400 days');
+  -- The MACHINE claim reclaim_fleet_machine releases (#150 MUST-FIX 2). Different kind, so the
+  -- reset never sees it -- which is exactly the disjointness permutation 1 measures.
+  insert into agent_board.claims(id, agent_id, resource_kind, resource_key, lease_token, lease_expires_at)
+  values ('40500000-0000-4000-8000-000000000092', '40500000-0000-4000-8000-000000000009',
+          'machine', 'sha256:cpr-inv-m', '40500000-0000-4000-8000-0000000000f7', now() + interval '1 hour');
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id in ('40500000-0000-4000-8000-000000000009',
+                                                    '40500000-0000-4000-8000-00000000000b');
+  delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000090';
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug = 'cpr-inv-board');
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug = 'cpr-inv-board');
+  delete from agent_board.boards where slug = 'cpr-inv-board';
+  delete from agent_board.fleet_revocation_events where subject_id = '40500000-0000-4000-8000-0000000000c0';
+  delete from agent_board.fleet_machine_agents where machine_id = '40500000-0000-4000-8000-0000000000c0';
+  delete from agent_board.fleet_machines where id = '40500000-0000-4000-8000-0000000000c0';
+  delete from agent_board.fleet_trust_domains where id = '40500000-0000-4000-8000-0000000000d0';
+  delete from agent_board.agents where id in ('40500000-0000-4000-8000-000000000009',
+                                              '40500000-0000-4000-8000-00000000000a',
+                                              '40500000-0000-4000-8000-00000000000b');
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000f9';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# rc: the operator reclaim. Holds fleet_machines FOR UPDATE and the machine claim's row lock.
+session "rc"
+step "rc_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "rc_reclaim" {
+  select owner_agent_id
+    from agent_board.reclaim_fleet_machine(
+      '40500000-0000-4000-8000-0000000000c0', '40500000-0000-4000-8000-00000000000b',
+      '40500000-0000-4000-8000-00000000000a', 'message-board#405 lock-order probe');
+}
+step "rc_commit"  { COMMIT; }
+
+# x: the constructed inversion — a claims row lock taken BEFORE entering renew_claim. Only the
+# connecting role can do this; CPR-14/15/16 pin that no function and no grantable role can.
+session "x"
+step "x_begin"   { BEGIN; }
+step "x_rowlock" { select resource_key from agent_board.claims where id = '40500000-0000-4000-8000-000000000091' for update; }
+step "x_renew"   {
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f8', now() + interval '400 days');
+}
+step "x_commit"  { COMMIT; }
+
+# w: the policy writer. Board advisory lock, then boards FOR NO KEY UPDATE, then the cap reset's
+# UPDATE on this board's ownerless claims.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-inv-board'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+session "chk"
+step "chk" {
+  select (select claim_policy from agent_board.boards where slug = 'cpr-inv-board') as policy,
+         (select owner_agent_id from agent_board.fleet_machines
+           where id = '40500000-0000-4000-8000-0000000000c0') as machine_owner;
+}
+
+# 1. reclaim_fleet_machine holding its claims row locks, and the policy writer running anyway.
+# Disjoint kinds, and reclaim never wants the board lock: no wait in either direction.
+permutation "rc_begin" "rc_reclaim" "w_begin" "w_flip" "rc_commit" "w_commit" "chk"
+
+# 2. The inversion, constructed: claims row lock -> board lock versus board lock -> claims row lock.
+# `deadlock detected` is the point. It is unreachable through any grantable role, which is what
+# makes permutation 1's silence a property of the code rather than of the probe.
+permutation "x_begin" "x_rowlock" "w_begin" "w_flip" "x_renew" "w_commit" "x_commit" "chk"