@consiliency/agent-board-schema 1.57.0 → 1.59.0

package/migrations/20261008000100_agent_board_hosted_delegates.sql

@@ -0,0 +1,3152 @@
+-- HOSTED (v11) SL-2: hosted board delegates -- the delegate database role, delegate rows and
+-- instances, the exchange and tombstone RPCs, add_delegate_to_board, the delegate read
+-- predicates and policies, and the addressing refusals. schema_version stays 8.
+--
+-- THE CONTRACT is the "Hosted board MCP server and delegates (HOSTED)" section of
+-- specs/agent-client-contract.md, accepted by the owner on 2026-10-01 (EC-HOSTED-1,
+-- plans/evidence/hosted/contract-acceptance.md). Every rule below cites it by its decision
+-- number (D1-D16) or section. Where this file and the contract differ, the contract wins and
+-- the difference is a defect here.
+--
+-- Sources read, each at its LATEST definition (found from the catalog of a replay of this
+-- tree, pg_get_functiondef, never from a migration file alone -- several are uppercase):
+--   * current_agent_id                     -- 20260920000100
+--   * _upsert_board_membership_state       -- 20260917000100
+--   * _emit_membership_event               -- 20260807000100
+--   * _board_membership_events_provenance_guard, _membership_consent_present,
+--     _membership_consent_kind, board_membership_events -- 20260806000100
+--   * update_board_membership              -- 20260813000100
+--   * post_message                         -- 20260814000100
+--   * grant_board_role, create_board, bootstrap_board_owner_memberships,
+--     _fedsession_autojoin_default_board, _redeem_unbounded_invite_for_agent,
+--     create_task, _append_task_event, delegate_task, raise_escalation,
+--     _upsert_delivery_recipient, _upsert_inbox_item, _resolve_addressing_recipient_rows,
+--     _addressing_agent_ids_or_raise, get_bundle_compatibility -- their latest definitions,
+--     each redefined below VERBATIM from the catalog plus the marked HOSTED lines.
+--   * _federated_identity_slug, enroll_federated_human -- 20260916000100 (the owner uid).
+--   * _ensure_agent_auth_user              -- 20260512000000 (redefined in section 5, fix lane:
+--     the miss path serialised per slug).
+--   * revoke_human_subtree, revoke_agent   -- read for the exchange's owner-liveness lock order;
+--     not redefined.
+--
+-- WHAT IS DELIBERATELY NOT HERE: the Edge Functions (SL-4), the strict audience helper (SL-3),
+-- the hosted handler (SL-6). Rate limiting is in the exchange Edge Function, before this RPC
+-- (D9), because a rate bump inside a refused RPC would roll back with it.
+--
+-- REDEFINITIONS AND ACLs. Every redefined function is `create or replace`, which keeps its ACL
+-- and COMMENT (AGENTS.md: only DROP discards them). No function is dropped here. Every NEW
+-- function has its EXECUTE stated below: revoked from PUBLIC (agent_board_pubexec_class), and
+-- granted to exactly the role the contract names.
+
+-- =============================================================================
+-- 1. The delegate database role (IF-0-HOSTED-5, §The delegate database role)
+-- =============================================================================
+-- Roles are CLUSTER-level, so two databases on one cluster share it: create it only if
+-- absent, and grant it to `authenticator` only if that role exists and is not already a
+-- member. Plain PostgreSQL, the pgTAP replay and an adopter without Supabase roles therefore
+-- apply cleanly, and a second database on the same cluster skips both steps. The migration
+-- role needs CREATEROLE the first time the role is created on a cluster (measured, contract).
+--
+-- NOLOGIN, NOINHERIT, no superuser, no BYPASSRLS, a member of NO role (never `authenticated`,
+-- which would inherit every authenticated grant). PostgREST switches to it from the board
+-- credential's `role` claim.
+do $role$
+begin
+  if not exists (select 1 from pg_catalog.pg_roles where rolname = 'agent_board_delegate') then
+    create role agent_board_delegate nologin noinherit nosuperuser nobypassrls nocreatedb nocreaterole;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'authenticator')
+     and not pg_catalog.pg_has_role('authenticator', 'agent_board_delegate', 'MEMBER') then
+    grant agent_board_delegate to authenticator;
+  end if;
+end
+$role$;
+
+grant usage on schema agent_board to agent_board_delegate;
+
+-- =============================================================================
+-- 2. The delegate fact (D11, §Delegate rows and instances)
+-- =============================================================================
+-- A separate boolean, not a new agent_kind: a new enum value cannot be used in the
+-- transaction that adds it, and kind is coupled to agent_type by a trigger and a CHECK. A
+-- delegate row keeps kind = 'agent' and agent_type = 'agent'.
+alter table agent_board.agents
+  add column if not exists is_delegate boolean not null default false;
+
+-- Every existing row is a non-delegate. The default does the backfill; this asserts it.
+do $backfill$
+begin
+  if exists (select 1 from agent_board.agents where is_delegate) then
+    raise exception 'HOSTED backfill: an existing agents row has is_delegate = true';
+  end if;
+end
+$backfill$;
+
+comment on column agent_board.agents.is_delegate is
+  'HOSTED (D11): the delegate fact. True only for a hosted delegate instance''s agent, set by exchange_delegate_credential''s first-use insert and never changed afterwards (trg_agents_is_delegate_immutable). Not granted to authenticated or agent_board_delegate.';
+
+-- It never changes on an existing row.
+create or replace function agent_board._agents_is_delegate_immutable()
+returns trigger
+language plpgsql
+set search_path = ''
+as $fn$
+begin
+  if new.is_delegate is distinct from old.is_delegate then
+    raise exception 'agents.is_delegate never changes on an existing row'
+      using errcode = '23514';
+  end if;
+  return new;
+end;
+$fn$;
+
+revoke all on function agent_board._agents_is_delegate_immutable() from public;
+
+comment on function agent_board._agents_is_delegate_immutable() is
+  'HOSTED (D11): trigger function refusing any UPDATE that changes agents.is_delegate. A delegate never becomes a keyed agent and a keyed agent never becomes a delegate. EXECUTE revoked from PUBLIC; a trigger function needs none at fire time.';
+
+drop trigger if exists trg_agents_is_delegate_immutable on agent_board.agents;
+create trigger trg_agents_is_delegate_immutable
+  before update of is_delegate on agent_board.agents
+  for each row execute function agent_board._agents_is_delegate_immutable();
+
+-- =============================================================================
+-- 3. delegate_instances and the credential columns (IF-0-HOSTED-6)
+-- =============================================================================
+create table if not exists agent_board.delegate_instances (
+  instance_id text primary key
+    check (instance_id ~ '^[A-Za-z0-9_-]{16,128}$'),
+  -- The auth user id of the owner's human principal, derived exactly as
+  -- enroll_federated_human derives it (never the raw Portal sub). Never changes.
+  owner_user_id uuid not null,
+  -- Null until the first exchange; then never changes.
+  agent_id uuid unique references agent_board.agents(id),
+  client_id text check (client_id is null or char_length(client_id) between 1 and 512),
+  grant_id text check (grant_id is null or grant_id ~ '^[A-Za-z0-9_-]{16,128}$'),
+  generation bigint check (generation is null or generation between 1 and 9007199254740991),
+  -- The canonical slot URL, or null for the base URL (D8).
+  slot_resource text,
+  client_change_generation bigint
+    check (client_change_generation is null or client_change_generation between 1 and 9007199254740991),
+  tombstoned_at timestamptz,
+  tombstone_reason text
+    check (tombstone_reason is null
+           or tombstone_reason in ('owner_revoked', 'owner_retired_after_upgrade', 'owner_account_closed', 'portal_admin')),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint delegate_instances_tombstone_shape
+    check ((tombstoned_at is null) = (tombstone_reason is null))
+);
+
+-- D8: a slot belongs to one instance.
+create unique index if not exists idx_agent_board_delegate_instances_slot_unique
+  on agent_board.delegate_instances (slot_resource)
+  where slot_resource is not null;
+
+-- D13: the per-owner live-instance count.
+create index if not exists idx_agent_board_delegate_instances_owner_live
+  on agent_board.delegate_instances (owner_user_id)
+  where tombstoned_at is null;
+
+alter table agent_board.delegate_instances enable row level security;
+revoke all on table agent_board.delegate_instances from public, anon, authenticated, service_role, agent_board_delegate;
+-- READ for service_role only, so the operator check (scripts/check-delegate-tombstones.mjs,
+-- SL-4) can list which instances the board has tombstoned. Never a write: the two RPCs are the
+-- only writers. service_role has BYPASSRLS, so no policy is needed.
+grant select on table agent_board.delegate_instances to service_role;
+
+comment on table agent_board.delegate_instances is
+  'HOSTED (IF-0-HOSTED-6): one row per hosted delegate instance, keyed by the Portal''s instance_id. Written ONLY by exchange_delegate_credential and tombstone_delegate_instance (both service_role-only SECURITY DEFINER). RLS on with zero policies; SELECT for service_role only (the operator check), no other API-role grant. A tombstone (tombstoned_at) is set once and never cleared: the exchange refuses the id forever.';
+
+alter table agent_board.agent_credentials
+  add column if not exists grant_id text,
+  add column if not exists generation bigint;
+
+comment on column agent_board.agent_credentials.grant_id is
+  'HOSTED (IF-0-HOSTED-6): for a hosted delegate''s credential, the Portal grant it was issued under. Null for every other credential.';
+comment on column agent_board.agent_credentials.generation is
+  'HOSTED (IF-0-HOSTED-6): for a hosted delegate''s credential, the grant generation it was issued at. A higher generation''s exchange revokes every lower one. Null for every other credential.';
+
+-- =============================================================================
+-- 4. The allow set (§The allow set) -- ONE SQL-visible list
+-- =============================================================================
+-- The class tests read this table; nothing else is the list. Section 13 GRANTS FROM it, so a
+-- grant cannot exist without a row here unless someone adds it by hand, which the class
+-- assertion (agent_board_delegate_role_class.test.sql) names.
+--   kind      : rpc | ambient_rpc | predicate | read_view | read_table
+--   name      : the function or relation name, unqualified (schema agent_board)
+--   signature : for a function, name(oidvectortypes(proargtypes)); for a relation, the name
+create table if not exists agent_board.delegate_allowed_operations (
+  kind text not null check (kind in ('rpc', 'ambient_rpc', 'predicate', 'read_view', 'read_table')),
+  name text not null,
+  signature text not null,
+  reason text not null check (char_length(btrim(reason)) > 0),
+  primary key (kind, signature)
+);
+
+alter table agent_board.delegate_allowed_operations enable row level security;
+revoke all on table agent_board.delegate_allowed_operations from public, anon, authenticated, service_role, agent_board_delegate;
+
+comment on table agent_board.delegate_allowed_operations is
+  'HOSTED (IF-0-HOSTED-5): the delegate allow set, the ONE list of what agent_board_delegate may execute (rpc, ambient_rpc, predicate) and select (read_view, read_table). The migration grants from it; agent_board_delegate_role_class asserts has_function_privilege / has_table_privilege iff listed. Widening it is an additive contract change. RLS on, no API-role grants.';
+
+insert into agent_board.delegate_allowed_operations(kind, name, signature, reason) values
+  ('rpc', 'post_board_message',
+   'post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb)',
+   'post to a board by id (tools post_board_message, post_board)'),
+  ('rpc', 'post_board_message',
+   'post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb)',
+   'the by-slug overload; both overloads must agree, or the boundary test refuses the name'),
+  ('rpc', 'post_message',
+   'post_message(uuid, uuid, text, text, uuid, jsonb)',
+   'reply in a thread (tool post_message)'),
+  ('rpc', 'create_or_find_thread',
+   'create_or_find_thread(uuid, text, text, text, jsonb)',
+   'the thread a board post needs (tools create_or_find_thread, post_board)'),
+  ('ambient_rpc', 'get_schema_version',
+   'get_schema_version()',
+   'the schema preflight state() runs before every client operation'),
+  ('predicate', 'current_agent_id',
+   'current_agent_id()',
+   'invoked by the delegate predicates and the board_memberships delegate policy'),
+  ('predicate', '_delegate_visible_board_ids',
+   '_delegate_visible_board_ids()',
+   'D14: the boards the caller is joined or subscribed on, computed once per query'),
+  ('predicate', '_delegate_visible_agent',
+   '_delegate_visible_agent(uuid)',
+   'invoked by the delegate agents policy'),
+  ('read_view', 'v_agent_dashboard', 'v_agent_dashboard',
+   'ambient: resolveActingAgentId reads it on every session refresh'),
+  ('read_view', 'v_board_feed', 'v_board_feed', 'read the board feed'),
+  ('read_view', 'v_thread_feed', 'v_thread_feed', 'read a thread'),
+  ('read_view', 'v_agent_inbox', 'v_agent_inbox', 'read its own inbox'),
+  ('read_view', 'v_board_memberships', 'v_board_memberships', 'read its own memberships'),
+  ('read_table', 'boards', 'boards', 'read closure: v_board_feed, v_agent_inbox, v_board_memberships'),
+  ('read_table', 'board_memberships', 'board_memberships', 'read closure: v_board_memberships'),
+  ('read_table', 'agents', 'agents', 'read closure: every view (the eight authenticated columns only)'),
+  ('read_table', 'messages', 'messages', 'read closure: v_board_feed, v_thread_feed'),
+  ('read_table', 'delivery_recipients', 'delivery_recipients', 'read closure: v_board_feed'),
+  ('read_table', 'inbox_items', 'inbox_items', 'read closure: v_board_feed, v_agent_inbox, v_agent_dashboard'),
+  ('read_table', 'tasks', 'tasks', 'read closure: v_agent_dashboard'),
+  ('read_table', 'task_events', 'task_events', 'read closure: v_agent_dashboard'),
+  ('read_table', 'claims', 'claims', 'read closure: v_agent_dashboard'),
+  ('read_table', 'escalations', 'escalations', 'read closure: v_agent_dashboard'),
+  ('read_table', 'signature_evidence', 'signature_evidence', 'read closure: v_thread_feed, v_agent_dashboard'),
+  ('read_table', 'presence', 'presence', 'read closure: v_agent_dashboard (left join; policy is false)'),
+  ('read_table', 'agent_signing_keys', 'agent_signing_keys', 'read closure: v_thread_feed, v_agent_dashboard (left joins; policy is false)')
+on conflict do nothing;
+
+-- =============================================================================
+-- 5. Identity helpers
+-- =============================================================================
+-- One auth user per instance: 'delegate-' || the first 32 hex characters of sha256 over the
+-- netstring <len>:<iss>:<len>:<instance_id>, the _federated_identity_slug construction with a
+-- different prefix. Injective, and never equal to a human's 'fed-human-' handle.
+create or replace function agent_board._delegate_instance_slug(p_issuer text, p_instance_id text)
+returns text
+language plpgsql
+immutable
+set search_path = ''
+as $fn$
+begin
+  if p_issuer is null or p_issuer = '' or p_instance_id is null or p_instance_id = '' then
+    raise exception 'delegate instance slug requires a non-empty issuer and instance id'
+      using errcode = '22023';
+  end if;
+  return 'delegate-' || substr(
+    encode(
+      extensions.digest(
+        convert_to(
+          length(p_issuer)::text      || ':' || p_issuer || ':' ||
+          length(p_instance_id)::text || ':' || p_instance_id,
+          'UTF8'),
+        'sha256'),
+      'hex'),
+    1, 32);
+end;
+$fn$;
+
+revoke all on function agent_board._delegate_instance_slug(text, text) from public;
+
+comment on function agent_board._delegate_instance_slug(text, text) is
+  'HOSTED: the handle and auth-user slug of a hosted delegate instance: ''delegate-'' || first 32 hex of sha256(netstring(iss, instance_id)). Injective; never a fed-human- handle. EXECUTE to no role; definers reach it as owner.';
+
+-- ONE AUTH USER PER SLUG, for every caller. _ensure_agent_auth_user (latest definition
+-- 20260512000000, unchanged since) looked up by email and then inserted, so two transactions
+-- provisioning one slug at once each created an auth user: measured for two first exchanges of
+-- one owner (hosted_delegate_first_exchange_race, SL-2), and the same shape exists for every
+-- one of its callers, found from the catalog (pg_proc.prosrc), not from memory:
+-- provision_agent, mint_delegated_child, enroll_federated_human and its
+-- _enroll_federated_human_after_revocation_gate, enroll_federated_identity and
+-- _enroll_federated_identity_once, onboard_federated_fleet_agent, exchange_delegate_credential
+-- and tombstone_delegate_instance. The exchange's owner advisory lock covered only the last
+-- two, so a first human enroll racing a first delegate exchange of the same (iss, sub) still
+-- produced two owners (hosted_delegate_owner_provisioning_race). The class is closed here,
+-- once, for all of them.
+--
+-- LOCK ON MISS, not before the lookup. A transaction-scoped advisory lock keyed by the slug is
+-- taken only when the first lookup finds no user; the lookup is then repeated (a new statement,
+-- so under READ COMMITTED a new snapshot that sees a user committed while this waited) before
+-- inserting. Taking it before every lookup would invert against callers that already hold the
+-- user's auth.users row FOR UPDATE and then reach this function again for the SAME slug
+-- (enroll_federated_identity locks the owner's row and then calls
+-- _enroll_federated_identity_once, which provisions the owner slug again), while the exchange
+-- holds the slug lock and then wants that row (its own FOR KEY SHARE, and the agents FK). On a
+-- hit nothing is locked, and a user that exists cannot be in anyone's miss path, so a holder of
+-- the row never waits here. The one wait this adds is a second provisioner of a slug whose
+-- first provisioner has not committed -- where a unique index on email, if the auth schema has
+-- one, already waits today.
+--
+-- create or replace keeps the ACL ({postgres=X, service_role=X}) and the (absent) COMMENT; the
+-- revoke and grant below restate the ACL so this file says what it is.
+create or replace function agent_board._ensure_agent_auth_user(p_slug text)
+returns uuid
+language plpgsql
+security definer
+set search_path = ''
+as $function$
+declare
+  v_email text := format('agent+%s@agent-board.local', p_slug);
+  v_user_id uuid;
+begin
+  select u.id
+    into v_user_id
+    from auth.users u
+   where lower(u.email) = v_email
+   limit 1;
+
+  if v_user_id is not null then
+    return v_user_id;
+  end if;
+
+  -- HOSTED: the miss path is serialised per slug, and the lookup repeated under the lock.
+  perform pg_catalog.pg_advisory_xact_lock(
+    pg_catalog.hashtextextended('agent_board.ensure_agent_auth_user:' || v_email, 0));
+
+  select u.id
+    into v_user_id
+    from auth.users u
+   where lower(u.email) = v_email
+   limit 1;
+
+  if v_user_id is not null then
+    return v_user_id;
+  end if;
+
+  v_user_id := gen_random_uuid();
+
+  insert into auth.users (
+    id,
+    instance_id,
+    email,
+    email_confirmed_at,
+    encrypted_password,
+    created_at,
+    updated_at,
+    raw_app_meta_data,
+    raw_user_meta_data,
+    aud,
+    role
+  )
+  values (
+    v_user_id,
+    '00000000-0000-0000-0000-000000000000',
+    v_email,
+    now(),
+    '',
+    now(),
+    now(),
+    jsonb_build_object('provider', 'agent_board', 'providers', jsonb_build_array('agent_board')),
+    jsonb_build_object('slug', p_slug, 'issuer', 'agent_board.provision_agent'),
+    'authenticated',
+    'authenticated'
+  );
+
+  insert into auth.identities (
+    id,
+    user_id,
+    provider_id,
+    provider,
+    identity_data,
+    last_sign_in_at,
+    created_at,
+    updated_at
+  )
+  values (
+    gen_random_uuid(),
+    v_user_id,
+    p_slug,
+    'agent_board',
+    jsonb_build_object('sub', p_slug, 'slug', p_slug),
+    now(),
+    now(),
+    now()
+  )
+  on conflict do nothing;
+
+  return v_user_id;
+end;
+$function$;
+
+revoke all on function agent_board._ensure_agent_auth_user(text) from public, anon, authenticated;
+grant execute on function agent_board._ensure_agent_auth_user(text) to service_role;
+
+-- The delegate's principal: the agent whose auth user owns the subject's instance. NULL for a
+-- non-delegate. A definer because delegate_instances has RLS on and no grants; EXECUTE goes to
+-- no role (the guard trigger runs it in its definer caller's context, as owner).
+create or replace function agent_board._delegate_principal_agent_id(p_agent_id uuid)
+returns uuid
+language sql
+stable
+security definer
+set search_path = ''
+as $fn$
+  select owner_agent.id
+    from agent_board.delegate_instances di
+    join agent_board.agents d on d.id = di.agent_id and d.is_delegate
+    join agent_board.agents owner_agent on owner_agent.auth_user_id = di.owner_user_id
+   where di.agent_id = p_agent_id
+   limit 1
+$fn$;
+
+revoke all on function agent_board._delegate_principal_agent_id(uuid) from public, anon, authenticated, service_role;
+
+comment on function agent_board._delegate_principal_agent_id(uuid) is
+  'HOSTED (D2, D15): the agent id of a hosted delegate''s principal -- the agent whose auth_user_id is the delegate instance''s owner_user_id -- or NULL for a non-delegate. Read by the emitter, the provenance guard, the membership sink, update_board_membership and post_message. EXECUTE to no role.';
+
+-- The placement / role-writer class refusal, for every direct board_memberships writer that
+-- bypasses the sink (§What stays refused for a delegate). One shared helper so the class
+-- assertion has a single schema-qualified marker to look for.
+create or replace function agent_board._refuse_delegate_membership_target(p_agent_id uuid, p_operation text)
+returns void
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $fn$
+begin
+  if exists (select 1 from agent_board.agents a where a.id = p_agent_id and a.is_delegate) then
+    raise exception '% cannot place or raise a hosted delegate; add_delegate_to_board is its only way onto a board',
+      coalesce(nullif(btrim(p_operation), ''), 'this operation')
+      using errcode = '42501';
+  end if;
+end;
+$fn$;
+
+revoke all on function agent_board._refuse_delegate_membership_target(uuid, text) from public, anon, authenticated, service_role;
+
+comment on function agent_board._refuse_delegate_membership_target(uuid, text) is
+  'HOSTED (placement and role-writer classes): raises 42501 when the target is a hosted delegate. Called by every direct board_memberships writer other than the sink (whose own rule is D15). is_delegate never changes, so the unlocked read has no TOCTOU. EXECUTE to no role.';
+
+-- The D16 addressing refusal, for every writer of an addressee column.
+create or replace function agent_board._refuse_delegate_addressee(p_agent_id uuid, p_board_id uuid, p_what text)
+returns void
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $fn$
+begin
+  if p_agent_id is null then
+    return;
+  end if;
+  if exists (select 1 from agent_board.agents a where a.id = p_agent_id and a.is_delegate)
+     and (
+       p_board_id is null
+       or not exists (
+         select 1
+           from agent_board.board_memberships bm
+          where bm.board_id = p_board_id
+            and bm.agent_id = p_agent_id
+            and bm.membership_state in ('joined', 'subscribed')
+       )
+     ) then
+    raise exception 'a hosted delegate is addressed only through a board it is active on (%)',
+      coalesce(nullif(btrim(p_what), ''), 'addressing')
+      using errcode = '42501';
+  end if;
+end;
+$fn$;
+
+revoke all on function agent_board._refuse_delegate_addressee(uuid, uuid, text) from public, anon, authenticated, service_role;
+
+comment on function agent_board._refuse_delegate_addressee(uuid, uuid, text) is
+  'HOSTED (D16): raises 42501 when p_agent_id is a hosted delegate and p_board_id is null or a board it is not joined/subscribed on. Task and escalation assignment and task delegation pass a null board, so they are always refused for a delegate. Called by every writer of tasks.assigned_agent_id, escalations.assigned_agent_id, delegations.delegated_to_agent_id, delivery_recipients.recipient_agent_id and inbox_items.recipient_agent_id. EXECUTE to no role.';
+
+-- =============================================================================
+-- 6. The delegate read predicates (D14, §The read closure)
+-- =============================================================================
+-- Every delegate read requires the delegate's CURRENT active membership of the row's board,
+-- and a row's board comes ONLY from delivery_recipients.board_id, never from the thread's
+-- first-board-wins stamp. Authorship, recipiency, assignment and creation grant nothing.
+-- SECURITY DEFINER (the caller sees only its own board_memberships rows), STABLE, EXECUTE to
+-- agent_board_delegate only. Called directly, each answers only what selecting the rows already
+-- answers.
+-- THE BOARD SET, ONCE PER QUERY. The policies compare a row's board with this array through
+-- an uncorrelated scalar subquery, `coalesce((select agent_board._delegate_visible_board_ids()),
+-- '{}'::uuid[])`, which the planner evaluates ONCE per query (an InitPlan). The contract's first
+-- form called a per-row definer predicate for every row, re-resolving current_agent_id() each
+-- time: 7.7 s for one page of a 500-post board, against 234 ms for this form, with the same
+-- meaning (plans/evidence/hosted/sl2-schema-evidence.md; the differential test is
+-- agent_board_delegate_role_class.test.sql). Authorised by the team lead; SL-8 amends the
+-- contract text.
+create or replace function agent_board._delegate_visible_board_ids()
+returns uuid[]
+language sql
+stable
+security definer
+set search_path = ''
+as $fn$
+  select coalesce(array_agg(bm.board_id order by bm.board_id), '{}'::uuid[])
+    from agent_board.board_memberships bm
+   where bm.agent_id = agent_board.current_agent_id()
+     and bm.membership_state in ('joined', 'subscribed')
+$fn$;
+
+-- agents: the caller itself; a CURRENT co-member (joined/subscribed on a board the caller is
+-- active on); or the author of a message already visible to the caller (v_board_feed and
+-- v_thread_feed inner-join the author, so a departed author would otherwise drop the message).
+create or replace function agent_board._delegate_visible_agent(p_agent_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $fn$
+  with me as (select agent_board.current_agent_id() as id)
+  select exists (select 1 from me where me.id = p_agent_id)
+      or exists (
+           select 1
+             from me
+             join agent_board.board_memberships mine
+               on mine.agent_id = me.id
+              and mine.membership_state in ('joined', 'subscribed')
+             join agent_board.board_memberships other
+               on other.board_id = mine.board_id
+              and other.agent_id = p_agent_id
+              and other.membership_state in ('joined', 'subscribed')
+         )
+      or exists (
+           select 1
+             from me
+             join agent_board.board_memberships mine
+               on mine.agent_id = me.id
+              and mine.membership_state in ('joined', 'subscribed')
+             join agent_board.delivery_recipients dr
+               on dr.board_id = mine.board_id
+             join agent_board.messages m
+               on m.id = dr.source_message_id
+            where m.author_agent_id = p_agent_id
+         )
+$fn$;
+
+revoke all on function agent_board._delegate_visible_board_ids() from public, anon, authenticated, service_role;
+revoke all on function agent_board._delegate_visible_agent(uuid) from public, anon, authenticated, service_role;
+
+comment on function agent_board._delegate_visible_board_ids() is
+  'HOSTED (D14) delegate predicate: the boards the caller is joined or subscribed on, as an array the delegate policies read once per query through an uncorrelated subquery. EXECUTE to agent_board_delegate only (allow set, kind predicate).';
+comment on function agent_board._delegate_visible_agent(uuid) is
+  'HOSTED (D14) delegate predicate for agents: the caller itself, a current co-member on a board the caller is active on, or the author of a message visible to the caller. EXECUTE to agent_board_delegate only (allow set, kind predicate).';
+
+-- =============================================================================
+-- 7. exchange_delegate_credential (IF-0-HOSTED-7, §The exchange; D8, D13)
+-- =============================================================================
+-- Called by the delegate-exchange Edge Function AFTER it has verified the Portal token (RS256,
+-- iss, the strict audience helper, lifetime, token class, resource and instance claim) and
+-- rate-limited per owner and per instance (D9). service_role only. Its arguments come from
+-- that JWKS-verified token, not from any user: the enroll_federated_human trust shape.
+--
+-- p_claims, the shape this RPC accepts (frozen here for SL-4):
+--   {
+--     "iss":   <the verified issuer>,
+--     "sub":   <the verified owner subject>,
+--     "slot_resource": <the token's canonical resource when it is a SLOT, or null when it is
+--                       the base URL; the Edge Function has already refused anything else>,
+--     "agent_board_delegate_instance": <the instance claim, verbatim>
+--   }
+-- Every refusal raises with the refusal CODE as the message (the Edge Function maps it to
+-- `403 {"error": <code>}`): instance_revoked, owner_inactive, owner_mismatch, agent_inactive,
+-- instance_cap, resource_mismatch, slot_in_use, generation_superseded, grant_conflict,
+-- client_mismatch (errcode 42501), and claims_malformed (22023) for a shape the Edge Function
+-- should already have refused.
+create or replace function agent_board.exchange_delegate_credential(p_claims jsonb)
+returns table(agent_id uuid, auth_user_id uuid, credential_id uuid, expires_at timestamptz)
+language plpgsql
+security definer
+set search_path = ''
+as $fn$
+#variable_conflict use_column
+declare
+  v_iss text;
+  v_sub text;
+  v_slot text;
+  v_claim jsonb;
+  v_instance_id text;
+  v_grant_id text;
+  v_generation bigint;
+  v_client_id text;
+  v_change jsonb;
+  v_change_gen bigint;
+  v_owner uuid;
+  v_owner_slug text;
+  v_row agent_board.delegate_instances%rowtype;
+  v_first boolean;
+  v_live integer;
+  v_slug text;
+  v_auth uuid;
+  v_agent uuid;
+  v_status text;
+  v_credential uuid;
+  v_expires timestamptz;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'exchange_delegate_credential is service_role-only' using errcode = '42501';
+  end if;
+
+  -- SHAPE. The Edge Function refuses every malformed token first; this is the database's own
+  -- refusal of the same shape, so a caller that skips it cannot write a malformed instance.
+  if jsonb_typeof(p_claims) is distinct from 'object'
+     or jsonb_typeof(p_claims -> 'iss') is distinct from 'string'
+     or jsonb_typeof(p_claims -> 'sub') is distinct from 'string'
+     or coalesce(p_claims ->> 'iss', '') = ''
+     or coalesce(p_claims ->> 'sub', '') = ''
+     or jsonb_typeof(p_claims -> 'slot_resource') not in ('string', 'null')
+     or jsonb_typeof(p_claims -> 'agent_board_delegate_instance') is distinct from 'object' then
+    raise exception 'claims_malformed' using errcode = '22023';
+  end if;
+  v_iss := p_claims ->> 'iss';
+  v_sub := p_claims ->> 'sub';
+  v_slot := p_claims ->> 'slot_resource';
+  v_claim := p_claims -> 'agent_board_delegate_instance';
+
+  -- The instance claim: exactly these seven fields, each of its type.
+  if (select array_agg(k order by k) from jsonb_object_keys(v_claim) k)
+       is distinct from array['client_change', 'client_id', 'generation', 'grant_id', 'instance_id', 'owner_sub', 'status']
+     or jsonb_typeof(v_claim -> 'instance_id') is distinct from 'string'
+     or (v_claim ->> 'instance_id') !~ '^[A-Za-z0-9_-]{16,128}$'
+     or jsonb_typeof(v_claim -> 'grant_id') is distinct from 'string'
+     or (v_claim ->> 'grant_id') !~ '^[A-Za-z0-9_-]{16,128}$'
+     or jsonb_typeof(v_claim -> 'generation') is distinct from 'number'
+     or (v_claim ->> 'generation') !~ '^[1-9][0-9]{0,15}$'
+     or jsonb_typeof(v_claim -> 'owner_sub') is distinct from 'string'
+     or (v_claim ->> 'owner_sub') is distinct from v_sub
+     or jsonb_typeof(v_claim -> 'client_id') is distinct from 'string'
+     or char_length(v_claim ->> 'client_id') not between 1 and 512
+     or jsonb_typeof(v_claim -> 'status') is distinct from 'string'
+     or (v_claim ->> 'status') not in ('active', 'revoked')
+     or jsonb_typeof(v_claim -> 'client_change') not in ('object', 'null') then
+    raise exception 'claims_malformed' using errcode = '22023';
+  end if;
+  v_generation := (v_claim ->> 'generation')::bigint;
+  if v_generation > 9007199254740991 then
+    raise exception 'claims_malformed' using errcode = '22023';
+  end if;
+  v_instance_id := v_claim ->> 'instance_id';
+  v_grant_id := v_claim ->> 'grant_id';
+  v_client_id := v_claim ->> 'client_id';
+
+  v_change := case when jsonb_typeof(v_claim -> 'client_change') = 'object' then v_claim -> 'client_change' end;
+  if v_change is not null then
+    if (select array_agg(k order by k) from jsonb_object_keys(v_change) k)
+         is distinct from array['confirmed_at', 'confirmed_generation', 'from_client_id']
+       or jsonb_typeof(v_change -> 'from_client_id') is distinct from 'string'
+       or jsonb_typeof(v_change -> 'confirmed_at') is distinct from 'number'
+       or (v_change ->> 'confirmed_at') !~ '^[0-9]{1,16}$'
+       or jsonb_typeof(v_change -> 'confirmed_generation') is distinct from 'number'
+       or (v_change ->> 'confirmed_generation') !~ '^[1-9][0-9]{0,15}$'
+       or (v_change ->> 'confirmed_generation')::bigint > 9007199254740991 then
+      raise exception 'claims_malformed' using errcode = '22023';
+    end if;
+    v_change_gen := (v_change ->> 'confirmed_generation')::bigint;
+  end if;
+
+  if v_slot is not null and v_slot !~ '^https://[^/?#@[:space:]]+(/[^?#[:space:]]*)?/s/[A-Za-z0-9_-]{22,64}$' then
+    raise exception 'claims_malformed' using errcode = '22023';
+  end if;
+
+  -- A token the Portal itself reports revoked is refused, and changes nothing here: only a
+  -- Portal revocation (tombstone_delegate_instance) tombstones.
+  if v_claim ->> 'status' <> 'active' then
+    raise exception 'instance_revoked' using errcode = '42501';
+  end if;
+
+  -- THE OWNER LOCK, before anything else. A transaction-scoped advisory lock keyed by the
+  -- owner's identity serialises every exchange of one owner: it is what serialises D13's count
+  -- below, and tombstone_delegate_instance takes it too, in the same position, so the order is
+  -- always: owner lock, then the owner's auth.users row, then the instance row. It was first
+  -- added for the owner-provisioning race (two first exchanges each creating an auth user for
+  -- one owner, measured by hosted_delegate_first_exchange_race); that class is now closed for
+  -- every caller inside _ensure_agent_auth_user itself (section 5), which this lock alone could
+  -- not do: a first human enroll never takes it.
+  --
+  -- THE OWNER, derived exactly as enroll_federated_human derives the human's auth user, from
+  -- the verified issuer and subject. The raw sub is never stored or compared.
+  v_owner_slug := agent_board._federated_identity_slug(v_iss, v_sub);
+  perform pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended('agent_board.delegate_owner:' || v_owner_slug, 0));
+  v_owner := agent_board._ensure_agent_auth_user(v_owner_slug);
+
+  -- THE OWNER MUST BE LIVE (fix N2). enroll_federated_human refuses a durably revoked human
+  -- (fleet_human_revocations (iss, sub)) and a non-active human row, and so does this: a
+  -- revoked human whose Portal still signs tokens must not bring up a NEW delegate instance, and
+  -- a suspended owner's existing delegates must not keep exchanging. Refused owner_inactive,
+  -- before the instance row is touched (so it wins over every instance-level code, including a
+  -- tombstone), and nothing is tombstoned.
+  --
+  -- UNDER THE OWNER'S auth.users ROW LOCK, which revoke_human_subtree takes FOR UPDATE first and
+  -- holds while it writes the marker and revokes every agent it then lists. FOR KEY SHARE
+  -- conflicts with that and with nothing an ordinary auth.users update takes. Without it an
+  -- exchange reads the marker before the revocation commits, and the revocation's agent list
+  -- (read once, at its loop) misses the delegate this exchange creates: an active delegate of a
+  -- revoked human, or a fresh credential for a delegate the revocation just revoked
+  -- (hosted_delegate_owner_revoke_race). revoke_human_subtree never takes the owner advisory
+  -- lock or an instance row, so no cycle closes. revoke_agent (suspension) does not take this
+  -- row and does not touch delegate credentials; an exchange racing it is simply ordered before
+  -- it.
+  --
+  -- The owner's human row is the agents row whose auth_user_id is the owner uid
+  -- (idx_agent_board_agents_auth_user_id_unique: at most one), the row enroll_federated_human
+  -- creates. None is not a refusal: an owner the board has never enrolled as a human is allowed
+  -- here, as before (it cannot add a delegate to a board without a session of its own).
+  perform 1 from auth.users u where u.id = v_owner for key share;
+  if exists (
+       select 1 from agent_board.fleet_human_revocations r
+        where r.issuer = v_iss and r.subject = v_sub
+     )
+     or exists (
+       select 1 from agent_board.agents a
+        where a.auth_user_id = v_owner and a.status <> 'active'
+     ) then
+    raise exception 'owner_inactive' using errcode = '42501';
+  end if;
+
+  -- INSERT-THEN-LOCK. A bare `select ... for update` locks nothing when the row does not yet
+  -- exist, so two first exchanges would both create an agent. Inserting first makes the
+  -- second block on the primary key until the first commits; both then lock the same row.
+  insert into agent_board.delegate_instances(instance_id, owner_user_id)
+  values (v_instance_id, v_owner)
+  on conflict (instance_id) do nothing;
+
+  select * into v_row
+    from agent_board.delegate_instances di
+   where di.instance_id = v_instance_id
+   for update;
+
+  -- A tombstone is permanent, whatever else the token says.
+  if v_row.tombstoned_at is not null then
+    raise exception 'instance_revoked' using errcode = '42501';
+  end if;
+  if v_row.owner_user_id is distinct from v_owner then
+    raise exception 'owner_mismatch' using errcode = '42501';
+  end if;
+
+  -- FIRST EXCHANGE is decided UNDER the lock, by whether the row has an agent yet -- never by
+  -- whether this transaction's insert happened: the loser of two concurrent first exchanges
+  -- finds the winner's agent after it blocks, and takes the ordinary path.
+  v_first := v_row.agent_id is null;
+
+  if not v_first then
+    select a.status into v_status from agent_board.agents a where a.id = v_row.agent_id;
+    if v_status is distinct from 'active' then
+      -- Revoked by revoke_agent_subtree or revoke_human_subtree, or suspended. Refused, and
+      -- NOT tombstoned: only a Portal revocation tombstones.
+      raise exception 'agent_inactive' using errcode = '42501';
+    end if;
+  else
+    -- D13: at most 20 live instances per owner. The owner lock taken at the top serialises two
+    -- first exchanges of DIFFERENT instances of one owner (their instance rows are different
+    -- rows), so the count cannot be passed twice.
+    select count(*) into v_live
+      from agent_board.delegate_instances di
+     where di.owner_user_id = v_owner
+       and di.tombstoned_at is null
+       and di.instance_id <> v_instance_id;
+    if v_live >= 20 then
+      raise exception 'instance_cap' using errcode = '42501';
+    end if;
+  end if;
+
+  -- THE RESOURCE (D8), S = the recorded slot_resource.
+  if not v_first then
+    if v_row.slot_resource is not null then
+      if v_slot is distinct from v_row.slot_resource then
+        raise exception 'resource_mismatch' using errcode = '42501';
+      end if;
+    elsif v_slot is not null and not (v_generation > v_row.generation) then
+      -- The one move, base URL -> slot, needs a new grant (a strictly higher generation).
+      raise exception 'resource_mismatch' using errcode = '42501';
+    end if;
+  end if;
+
+  -- THE CLIENT AND GENERATION, r = recorded generation, g = the token's, C = the recorded
+  -- client_change_generation.
+  if not v_first then
+    if v_generation < v_row.generation then
+      raise exception 'generation_superseded' using errcode = '42501';
+    elsif v_generation = v_row.generation then
+      if v_grant_id is distinct from v_row.grant_id then
+        raise exception 'grant_conflict' using errcode = '42501';
+      end if;
+      if v_client_id is distinct from v_row.client_id
+         or v_change_gen is distinct from v_row.client_change_generation then
+        raise exception 'client_mismatch' using errcode = '42501';
+      end if;
+    elsif v_client_id is distinct from v_row.client_id then
+      -- g > r from another client: only with the owner's confirmation of a client change made
+      -- AFTER the last binding the board saw (r < confirmed_generation <= g). from_client_id
+      -- is recorded for audit but not compared: the board may have missed an intermediate
+      -- reconnect.
+      if v_change_gen is null
+         or not (v_row.generation < v_change_gen and v_change_gen <= v_generation) then
+        raise exception 'client_mismatch' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  -- FIRST USE: the instance's own auth user and agents row. One auth user per instance.
+  if v_first then
+    v_slug := agent_board._delegate_instance_slug(v_iss, v_instance_id);
+    -- A second agent on this auth user is impossible: idx_agent_board_agents_auth_user_id_unique
+    -- refuses the insert (23505), and the whole exchange with it.
+    v_auth := agent_board._ensure_agent_auth_user(v_slug);
+    insert into agent_board.agents(
+      agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id, is_delegate, metadata)
+    values (
+      'agent', 'agent', v_slug, 'Hosted assistant ' || left(v_instance_id, 8), 'active',
+      v_auth, v_owner, true,
+      jsonb_build_object('hosted_delegate', jsonb_build_object('instance_id', v_instance_id)))
+    returning id into v_agent;
+  else
+    v_agent := v_row.agent_id;
+    select a.auth_user_id into v_auth from agent_board.agents a where a.id = v_agent;
+  end if;
+
+  begin
+    update agent_board.delegate_instances di
+       set agent_id = v_agent,
+           client_id = v_client_id,
+           grant_id = v_grant_id,
+           generation = v_generation,
+           slot_resource = coalesce(di.slot_resource, v_slot),
+           client_change_generation = v_change_gen,
+           updated_at = now()
+     where di.instance_id = v_instance_id;
+  exception when unique_violation then
+    -- D8: a slot belongs to one instance. Raising aborts the whole call, so nothing in this
+    -- transaction is kept.
+    raise exception 'slot_in_use' using errcode = '42501';
+  end;
+
+  -- A higher generation supersedes every lower one, in this transaction.
+  if not v_first and v_generation > v_row.generation then
+    update agent_board.agent_credentials ac
+       set revoked_at = now(),
+           updated_at = now(),
+           metadata = coalesce(ac.metadata, '{}'::jsonb)
+             || jsonb_build_object('revocationReason', 'generation_superseded', 'supersededByGeneration', v_generation)
+     where ac.agent_id = v_agent
+       and ac.revoked_at is null
+       and coalesce(ac.generation, 0) < v_generation;
+  end if;
+
+  -- The board credential row. No refresh token exists for it: the hash is random and never
+  -- disclosed, so the refresh path can never match it. expires_at <= now() + 900 s, and the
+  -- Edge Function mints exp = min(iat + 900, expires_at).
+  v_expires := now() + interval '900 seconds';
+  insert into agent_board.agent_credentials(
+    agent_id, refresh_token_hash, hash_version, credential_label, expires_at, metadata, grant_id, generation)
+  values (
+    v_agent,
+    extensions.digest(extensions.gen_random_bytes(32), 'sha256'),
+    1,
+    'hosted-delegate',
+    v_expires,
+    jsonb_build_object(
+      'source', 'exchange_delegate_credential',
+      'instance_id', v_instance_id,
+      'client_id', v_client_id,
+      'client_change', coalesce(v_change, 'null'::jsonb)),
+    v_grant_id,
+    v_generation)
+  returning id into v_credential;
+
+  return query select v_agent, v_auth, v_credential, v_expires;
+end;
+$fn$;
+
+revoke all on function agent_board.exchange_delegate_credential(jsonb) from public, anon, authenticated;
+grant execute on function agent_board.exchange_delegate_credential(jsonb) to service_role;
+
+comment on function agent_board.exchange_delegate_credential(jsonb) is
+  'HOSTED (IF-0-HOSTED-7): turns a verified Portal delegate access token into a board credential row, in one transaction: under the owner lock and the owner''s auth.users row (FOR KEY SHARE), refuse a durably revoked or non-active owner (owner_inactive); insert-then-lock the instance; refuse a tombstone, another owner, an inactive agent, a 21st live instance (D13), a resource other than the recorded one (D8), a lower generation, an equal generation with another grant, and a client change without the owner''s confirmation; create the agent and auth user on first use; revoke lower generations; issue a credential with expires_at <= now()+900s. Returns (agent_id, auth_user_id, credential_id, expires_at). service_role only; called by the delegate-exchange Edge Function after it verified the token and rate-limited (D9).';
+
+-- =============================================================================
+-- 8. tombstone_delegate_instance (IF-0-HOSTED-8, D10)
+-- =============================================================================
+create or replace function agent_board.tombstone_delegate_instance(
+  p_instance_id text, p_issuer text, p_owner_sub text, p_reason text)
+returns table(instance_id text, tombstoned_at timestamptz, first boolean)
+language plpgsql
+security definer
+set search_path = ''
+as $fn$
+#variable_conflict use_column
+declare
+  v_owner uuid;
+  v_owner_slug text;
+  v_inserted boolean;
+  v_row agent_board.delegate_instances%rowtype;
+  v_board uuid;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'tombstone_delegate_instance is service_role-only' using errcode = '42501';
+  end if;
+  if p_instance_id is null or p_instance_id !~ '^[A-Za-z0-9_-]{16,128}$'
+     or coalesce(p_issuer, '') = '' or coalesce(p_owner_sub, '') = ''
+     or p_reason is null
+     or p_reason not in ('owner_revoked', 'owner_retired_after_upgrade', 'owner_account_closed', 'portal_admin') then
+    raise exception 'revocation_malformed' using errcode = '22023';
+  end if;
+
+  -- The owner lock, then the owner, exactly as the exchange takes and derives them (same key,
+  -- same position: before the instance row), so a revocation and an exchange of a new owner's
+  -- instance never provision two auth users for one owner.
+  v_owner_slug := agent_board._federated_identity_slug(p_issuer, p_owner_sub);
+  perform pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended('agent_board.delegate_owner:' || v_owner_slug, 0));
+  v_owner := agent_board._ensure_agent_auth_user(v_owner_slug);
+
+  -- A revocation BEFORE the first exchange creates the tombstoned row, so the first exchange
+  -- is refused. Insert-then-lock, as the exchange does, so a concurrent exchange serialises.
+  insert into agent_board.delegate_instances as di(instance_id, owner_user_id, tombstoned_at, tombstone_reason)
+  values (p_instance_id, v_owner, now(), p_reason)
+  on conflict (instance_id) do nothing
+  returning true into v_inserted;
+
+  if v_inserted then
+    return query select p_instance_id, now(), true;
+    return;
+  end if;
+
+  select * into v_row
+    from agent_board.delegate_instances di
+   where di.instance_id = p_instance_id
+   for update;
+
+  if v_row.owner_user_id is distinct from v_owner then
+    raise exception 'owner_mismatch' using errcode = '42501';
+  end if;
+
+  -- Idempotent: the key is the instance, and a tombstone is permanent.
+  if v_row.tombstoned_at is not null then
+    return query select v_row.instance_id, v_row.tombstoned_at, false;
+    return;
+  end if;
+
+  update agent_board.delegate_instances di
+     set tombstoned_at = now(),
+         tombstone_reason = p_reason,
+         updated_at = now()
+   where di.instance_id = p_instance_id;
+
+  if v_row.agent_id is not null then
+    update agent_board.agent_credentials ac
+       set revoked_at = coalesce(ac.revoked_at, now()),
+           updated_at = now(),
+           metadata = coalesce(ac.metadata, '{}'::jsonb)
+             || jsonb_build_object('revocationReason', 'instance_tombstoned', 'tombstoneReason', p_reason)
+     where ac.agent_id = v_row.agent_id
+       and ac.revoked_at is null;
+
+    -- Every active membership ends through update_board_membership(..., 'left') under
+    -- service_role, so each ends with an append-only operator_removal event.
+    for v_board in
+      select bm.board_id
+        from agent_board.board_memberships bm
+       where bm.agent_id = v_row.agent_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by bm.board_id
+    loop
+      perform agent_board.update_board_membership(v_board, v_row.agent_id, 'left');
+    end loop;
+
+    update agent_board.agents a
+       set status = 'revoked', updated_at = now()
+     where a.id = v_row.agent_id
+       and a.status <> 'revoked';
+  end if;
+
+  return query select p_instance_id, now(), true;
+end;
+$fn$;
+
+revoke all on function agent_board.tombstone_delegate_instance(text, text, text, text) from public, anon, authenticated;
+grant execute on function agent_board.tombstone_delegate_instance(text, text, text, text) to service_role;
+
+comment on function agent_board.tombstone_delegate_instance(text, text, text, text) is
+  'HOSTED (IF-0-HOSTED-8, D10): tombstones a hosted delegate instance, idempotently and permanently. Before the first exchange it creates the tombstoned row; otherwise, in one transaction, it revokes every credential, ends every active membership through update_board_membership(..., ''left'') (operator_removal events) and moves the agent to revoked. A revocation naming an existing instance of another owner raises owner_mismatch. Returns (instance_id, tombstoned_at, first). service_role only; called by the delegate-revoke Edge Function with the verified revocation JWT''s iss, owner_sub and reason.';
+
+-- =============================================================================
+-- 9. add_delegate_to_board (IF-0-HOSTED-12, A5; D2, D15)
+-- =============================================================================
+create or replace function agent_board.add_delegate_to_board(p_agent_id uuid, p_board_id uuid)
+returns table(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, role text)
+language plpgsql
+security definer
+set search_path = ''
+as $fn$
+#variable_conflict use_column
+declare
+  v_actor uuid := agent_board.current_agent_id();
+  v_target agent_board.agents%rowtype;
+  v_instance agent_board.delegate_instances%rowtype;
+  v_m agent_board.board_memberships%rowtype;
+begin
+  -- OWNER ONLY, from the session. A caller-supplied owner is never read.
+  if v_actor is null then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  select * into v_target from agent_board.agents a where a.id = p_agent_id;
+  if not found or not v_target.is_delegate then
+    raise exception 'add_delegate_to_board adds only a hosted delegate' using errcode = '42501';
+  end if;
+
+  -- LOCK ORDER, each step before the next: the board advisory lock (this function row-locks both
+  -- agents and board_memberships, so it is serialised against onboarding as grant_board_role is,
+  -- agent_board_signer_lifecycle section 9, and like grant_board_role it takes the lock before
+  -- any row lock); the owner's agents row (the fleet-ledger gate, FOR SHARE); the delegate's
+  -- instance row (FOR SHARE, so a concurrent tombstone, which holds it FOR UPDATE, either commits
+  -- first or waits for this placement); the owner's membership; the delegate's, in the sink.
+  -- tombstone_delegate_instance takes its own owner-keyed advisory lock (a different key), then
+  -- the instance row, and never the board advisory lock or the owner's agents row, so the
+  -- instance row is the only lock the two share and no cycle closes between them.
+  perform agent_board._lock_board_authority_ceiling(p_board_id);
+  perform agent_board._assert_actor_not_fleet_revoked(v_actor, 'add_delegate_to_board');
+
+  select * into v_instance
+    from agent_board.delegate_instances di
+   where di.agent_id = p_agent_id
+   for share;
+  if not found or v_instance.tombstoned_at is not null or v_target.status <> 'active' then
+    raise exception 'the hosted delegate instance is not live' using errcode = '42501';
+  end if;
+  if v_instance.owner_user_id is distinct from (select a.auth_user_id from agent_board.agents a where a.id = v_actor) then
+    raise exception 'only the delegate''s owner may add it to a board' using errcode = '42501';
+  end if;
+
+  if not exists (select 1 from agent_board.boards b where b.id = p_board_id and b.status = 'active') then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+
+  -- D12 ordering: hold the owner's active membership row (shared) so a concurrent owner
+  -- departure either commits first (and the authority check below fails) or waits for this
+  -- placement and then cascades it.
+  perform 1
+     from agent_board.board_memberships bm
+    where bm.board_id = p_board_id
+      and bm.agent_id = v_actor
+      and bm.membership_state in ('joined', 'subscribed')
+    for share;
+
+  -- UNDER THE OWNER'S OWN INVITE AUTHORITY: the gate create_invite_link applies before minting
+  -- a member link, which places its redeemer straight into `joined`, as this does.
+  if not agent_board._grant_within_ceiling(v_actor, p_board_id, 'member') then
+    raise exception 'adding a delegate requires the owner''s own member-invite authority on this board'
+      using errcode = '42501';
+  end if;
+
+  -- R-LINK-7: a removed delegate stays removed (the set predicate every way back applies).
+  if exists (
+       select 1 from agent_board.board_memberships bm
+        where bm.board_id = p_board_id and bm.agent_id = p_agent_id and bm.membership_state = 'removed'
+     )
+     and not exists (
+       select 1 from agent_board.board_memberships bm
+        where bm.board_id = p_board_id and bm.agent_id = p_agent_id and bm.membership_state in ('joined', 'subscribed')
+     ) then
+    raise exception 'a removed delegate stays removed; a board admin must lift the removal' using errcode = '42501';
+  end if;
+
+  -- D15: the ONE setter of the admission flag. The sink reads it, with the owner's session,
+  -- and refuses a delegate placement without both. Cleared before returning.
+  perform pg_catalog.set_config('agent_board.delegate_admission', p_agent_id::text, true);
+  select * into v_m
+    from agent_board._upsert_board_membership_state(p_board_id, p_agent_id, 'joined', v_actor);
+  perform pg_catalog.set_config('agent_board.delegate_admission', '', true);
+
+  -- CONSENT (D2): the emitter recorded the placement as principal-authored, with the owner as
+  -- actor. The consent predicate must agree, or nothing is kept.
+  if not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+    raise exception 'admitting % requires an act by that agent', p_agent_id
+      using errcode = '42501';
+  end if;
+
+  return query select v_m.id, v_m.board_id, v_m.agent_id, v_m.membership_state, v_m.role;
+end;
+$fn$;
+
+revoke all on function agent_board.add_delegate_to_board(uuid, uuid) from public, anon, service_role;
+grant execute on function agent_board.add_delegate_to_board(uuid, uuid) to authenticated;
+
+comment on function agent_board.add_delegate_to_board(uuid, uuid) is
+  'HOSTED (IF-0-HOSTED-12, A5): the ONLY way a hosted delegate joins a board. The caller (from the session) must be the instance''s owner, hold member-invite authority on the board (_grant_within_ceiling(caller, board, ''member'')) and not be fleet-revoked; the instance must be live; a removed delegate stays removed (R-LINK-7). Writes `joined` as member through the sink under the D15 admission flag, recorded principal-authored / principal_placement with the owner as actor, and requires _membership_consent_present. EXECUTE for authenticated.';
+
+-- =============================================================================
+-- 10. principal-authored in the ledger (D2, §Joining a board and consent)
+-- =============================================================================
+-- The enum CHECK gains the value. The provenance/actor CHECK gains one arm, APPENDED after the
+-- existing three so their order is unchanged (agent_board_consent_substrate regex-pins
+-- target-authored.*operator-designated.*board-authored). Re-adding a CHECK validates every
+-- existing row, and none can be principal-authored yet.
+alter table agent_board.board_membership_events
+  drop constraint if exists board_membership_events_provenance_check;
+alter table agent_board.board_membership_events
+  add constraint board_membership_events_provenance_check
+  check (provenance in ('board-authored', 'operator-designated', 'target-authored', 'principal-authored'));
+
+alter table agent_board.board_membership_events
+  drop constraint if exists board_membership_events_provenance_actor;
+alter table agent_board.board_membership_events
+  add constraint board_membership_events_provenance_actor check (
+       (provenance = 'target-authored'     and actor_agent_id is not null and actor_agent_id = agent_id)
+    or (provenance = 'operator-designated' and actor_agent_id is null)
+    or (provenance = 'board-authored'      and actor_agent_id is not null and actor_agent_id <> agent_id)
+    or (provenance = 'principal-authored'  and actor_agent_id is not null and actor_agent_id <> agent_id)
+  );
+
+-- =============================================================================
+-- 11. Redefinitions (each verbatim from the catalog plus its marked HOSTED lines)
+-- =============================================================================
+-- Order: the identity rule, the ledger (guard, emitter, readers), the sink and its callers,
+-- the direct writers, the addressing writers, attribution, the compatibility report.
+
+CREATE OR REPLACE FUNCTION agent_board.current_agent_id()
+ RETURNS uuid
+ LANGUAGE sql
+ STABLE SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+  with credential_claim as (
+    -- #341: read BOTH sources. PostgREST sets the per-claim GUC; Realtime sets only the
+    -- whole-JSON one. Reading a single source made the credential branch dead code for every
+    -- Realtime subscriber. Mirrors auth.uid(), which has always coalesced for the same reason.
+    select coalesce(
+             nullif(current_setting('request.jwt.claim.agent_credential_id', true), ''),
+             -- The OUTER nullif is not redundant, and its absence was a transport inconsistency
+             -- caught by a test: the per-claim arm maps '' to absent, so without this the same
+             -- logical claim ("" ) would be ABSENT on one transport and a malformed credential
+             -- that DENIES on the other. Same input, different answer by transport, which is the
+             -- exact bug class #341 is about. Empty means absent on both, matching what omission
+             -- already permits.
+             nullif(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'agent_credential_id', '')
+           ) as credential_id_text
+  )
+  select a.id
+    from agent_board.agents a
+    cross join credential_claim cc
+   where a.auth_user_id = auth.uid()
+     and a.status = 'active'
+     and (
+       -- HOSTED (IF-0-HOSTED-6): a hosted delegate NEVER takes the null-claim branch. Its
+       -- credential claim is mandatory, so a delegate board token with the claim stripped
+       -- resolves to NULL. Every other row behaves exactly as before.
+       (cc.credential_id_text is null and not a.is_delegate)
+       or (
+         cc.credential_id_text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+         and exists (
+           select 1
+             from agent_board.agent_credentials ac
+            -- TEXT comparison, never a cast of the untrusted claim: a malformed value must DENY,
+            -- not raise. `ac.id::text` is canonical lowercase, hence lower() on the claim.
+            where ac.id::text = lower(cc.credential_id_text)
+              and ac.agent_id = a.id
+              and ac.revoked_at is null
+              and (ac.expires_at is null or ac.expires_at > now())
+         )
+       )
+     )
+   limit 1;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._board_membership_events_provenance_guard()
+ RETURNS trigger
+ LANGUAGE plpgsql
+AS $function$
+begin
+  if NEW.provenance = 'target-authored'
+     and NEW.actor_agent_id is distinct from NEW.agent_id then
+    raise exception 'substrate CHECK refuses target-authored actor <> subject'
+      using errcode = '23514';
+  end if;
+  if NEW.provenance = 'operator-designated'
+     and NEW.actor_agent_id is not null then
+    raise exception 'substrate CHECK refuses operator-designated non-null actor'
+      using errcode = '23514';
+  end if;
+  if NEW.provenance = 'board-authored'
+     and (NEW.actor_agent_id is null or NEW.actor_agent_id = NEW.agent_id) then
+    raise exception 'substrate CHECK refuses board-authored actor = subject'
+      using errcode = '23514';
+  end if;
+  -- HOSTED (D2): what the CHECK arm cannot say. The subject must have the delegate fact and
+  -- the actor must be its principal. _delegate_principal_agent_id returns NULL for a
+  -- non-delegate, so `is distinct from` refuses both a wrong actor and a non-delegate subject.
+  if NEW.provenance = 'principal-authored'
+     and (NEW.actor_agent_id is null
+          or NEW.actor_agent_id is distinct from agent_board._delegate_principal_agent_id(NEW.agent_id)) then
+    raise exception 'substrate CHECK refuses principal-authored actor that is not the subject''s principal'
+      using errcode = '23514';
+  end if;
+  return NEW;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._emit_membership_event(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_event_kind text DEFAULT NULL::text)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_actor_id uuid := agent_board.current_agent_id();
+  v_prov text;
+  v_event_actor uuid;
+  v_event_kind text;
+begin
+  -- Provenance is DERIVED HERE from the session and NEVER from a caller-supplied argument.
+  -- A caller-supplied id is an ASSERTION about who acted; the session is EVIDENCE. Keying off
+  -- the argument would let any caller mint a `target-authored` event -- the one provenance
+  -- that means "the subject consented".
+  --
+  -- service_role is ALWAYS operator-designated, even when a subject resolves from its token.
+  -- An operator acting while some agent id happens to be resolvable is still an operator
+  -- placement, and recording it as the subject's own act launders exactly what this ledger
+  -- exists to distinguish.
+  if agent_board._is_service_role() then
+    v_prov := 'operator-designated';
+    v_event_actor := null;
+  elsif v_actor_id is not null and v_actor_id = p_agent_id then
+    v_prov := 'target-authored';
+    v_event_actor := p_agent_id;
+  -- HOSTED (D2): the owner acting on ITS OWN hosted delegate is the delegate's principal, and
+  -- its act is the delegate's consent. Derived here, never supplied: the subject must have the
+  -- delegate fact AND the session must be the agent whose auth user owns the subject's
+  -- instance. An owner acting on a non-delegate stays board-authored below.
+  elsif v_actor_id is not null
+    and v_actor_id = agent_board._delegate_principal_agent_id(p_agent_id) then
+    v_prov := 'principal-authored';
+    v_event_actor := v_actor_id;
+  elsif v_actor_id is not null then
+    v_prov := 'board-authored';
+    v_event_actor := v_actor_id;
+  else
+    -- Unresolved, non-service actor. GATENULL should have refused upstream; if it did not,
+    -- fail CLOSED rather than invent a provenance for an unattributable write.
+    raise exception 'membership change has no attributable actor'
+      using errcode = '42501';
+  end if;
+
+  -- The KIND may be supplied by the caller; the PROVENANCE never can. The frozen mapping
+  -- names specific kinds for the raw writers -- owner_seed, consent_link_redeem,
+  -- operator_repair -- which a generic (provenance, state) derivation cannot produce. Letting
+  -- the caller name the kind while the security-critical field stays derived keeps the
+  -- vocabulary honest without reopening the forge: a wrong kind mislabels an event, a wrong
+  -- provenance would fabricate consent.
+  v_event_kind := coalesce(p_event_kind, case
+    when v_prov = 'target-authored' and p_membership_state in ('joined', 'subscribed') then 'consent_self_join'
+    when v_prov = 'target-authored' and p_membership_state = 'requested'               then 'consent_join_request'
+    when v_prov = 'target-authored' and p_membership_state = 'invited'                 then 'consent_self_invite'
+    when v_prov = 'target-authored' and p_membership_state in ('left', 'removed')      then 'self_withdraw'
+    when v_prov = 'board-authored'  and p_membership_state = 'invited'                 then 'invite_offer'
+    when v_prov = 'board-authored'  and p_membership_state = 'requested'               then 'request_manufactured'
+    when v_prov = 'board-authored'  and p_membership_state in ('joined', 'subscribed') then 'resolution'
+    when v_prov = 'board-authored'  and p_membership_state in ('left', 'removed')      then 'eviction'
+    when v_prov = 'operator-designated' and p_membership_state in ('joined', 'subscribed') then 'operator_designation'
+    when v_prov = 'operator-designated' and p_membership_state in ('left', 'removed')      then 'operator_removal'
+    -- Operator writes to a PENDING state are NEUTRAL, and must not borrow a grant kind.
+    -- `operator_repair` denotes bootstrap's grant; letting it be the catch-all made an ordinary
+    -- service-role write to `invited`/`requested` read as a repair-grant. Bootstrap still gets
+    -- operator_repair -- it passes the kind explicitly.
+    when v_prov = 'operator-designated' and p_membership_state = 'invited'                 then 'invite_offer'
+    when v_prov = 'operator-designated' and p_membership_state = 'requested'               then 'request_manufactured'
+    -- HOSTED (D2): a principal places or withdraws; it never offers or requests on the
+    -- delegate's behalf, so a pending state has no principal kind and raises below.
+    when v_prov = 'principal-authored' and p_membership_state in ('joined', 'subscribed') then 'principal_placement'
+    when v_prov = 'principal-authored' and p_membership_state in ('left', 'removed')      then 'principal_withdraw'
+    -- No catch-all. The (provenance, state) space is fully enumerated above, so reaching here
+    -- means a state was added without deciding what it MEANS. Fail loudly rather than silently
+    -- labelling it -- a wrong kind in an append-only ledger cannot be corrected later.
+    else null
+  end);
+
+  if v_event_kind is null then
+    raise exception 'no event kind for provenance % with resulting state %', v_prov, p_membership_state
+      using errcode = '22023';
+  end if;
+
+  insert into agent_board.board_membership_events(
+    board_id, agent_id, event_kind, result_state, provenance, actor_agent_id)
+  values (p_board_id, p_agent_id, v_event_kind, p_membership_state, v_prov, v_event_actor);
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._membership_consent_present(p_board_id uuid, p_agent_id uuid)
+ RETURNS boolean
+ LANGUAGE sql
+ STABLE SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+  select coalesce(
+    (
+      -- An operator-designated event counts as consent ONLY when it is an actual
+      -- PLACEMENT (joined|subscribed). It previously counted for ANY non-removal state,
+      -- so a bare operator `invited` OFFER -- an invitation the subject had never seen,
+      -- let alone answered -- made this predicate return true. This function's whole
+      -- contract is "did this subject consent", and it is the frozen interface
+      -- (IF-0-MBCONSENT-1) every future caller reads, so a pending offer must be NEUTRAL
+      -- here exactly as a board-authored offer already is.
+      select case
+               when e.result_state in ('left', 'removed') then false
+               when e.provenance = 'target-authored' then true
+               when e.provenance = 'operator-designated'
+                    and e.result_state in ('joined', 'subscribed') then true
+               -- HOSTED (D2): a principal's PLACEMENT is the delegate's consent, the same rule
+               -- as an operator's. A principal withdrawal is a removal (first arm).
+               when e.provenance = 'principal-authored'
+                    and e.result_state in ('joined', 'subscribed') then true
+             end
+        from agent_board.board_membership_events e
+        join agent_board.boards b on b.id = e.board_id
+       where e.board_id = p_board_id
+         and e.agent_id = p_agent_id
+         -- An EXPIRED join request is NEUTRAL, not a refusal: it leaves the candidate set so an
+         -- earlier genuine grant beneath it still stands. Treating it as a removal would silently
+         -- revoke the membership of someone who joined and LATER also filed a request.
+         -- This is the ONE place created_at is correct: ordering uses seq because created_at is
+         -- transaction_timestamp() and ties within a transaction, but AGE is a wall-clock question.
+         and not (
+           e.provenance = 'target-authored'
+           and e.result_state = 'requested'
+           and e.created_at < now() - make_interval(days => b.join_request_ttl_days)
+         )
+         and (
+           e.result_state in ('left', 'removed')
+           or e.provenance = 'target-authored'
+           or (e.provenance = 'operator-designated'
+               and e.result_state in ('joined', 'subscribed'))
+           or (e.provenance = 'principal-authored'
+               and e.result_state in ('joined', 'subscribed'))
+         )
+       order by e.seq desc
+       limit 1
+    ),
+    false
+  );
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._membership_consent_kind(p_board_id uuid, p_agent_id uuid)
+ RETURNS text
+ LANGUAGE sql
+ STABLE SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+  select (
+    -- MUST mirror _membership_consent_present exactly: an operator-designated event counts
+    -- only when it is an actual PLACEMENT (joined|subscribed), never a pending offer. These
+    -- two functions are read as a pair -- `_present` for the boolean, `_kind` for the reason --
+    -- so a narrowing applied to only one makes them disagree about the SAME event. That is
+    -- precisely what happened: `_present` was narrowed and this twin was not, so a pending
+    -- operator invite read present=false but kind='operator'.
+    select case
+             when e.result_state in ('left', 'removed') then null
+             when e.provenance = 'target-authored' then 'target'
+             when e.provenance = 'operator-designated'
+                  and e.result_state in ('joined', 'subscribed') then 'operator'
+             -- HOSTED (D2): mirrors _membership_consent_present exactly.
+             when e.provenance = 'principal-authored'
+                  and e.result_state in ('joined', 'subscribed') then 'principal'
+           end
+      from agent_board.board_membership_events e
+      join agent_board.boards b on b.id = e.board_id
+     where e.board_id = p_board_id
+       and e.agent_id = p_agent_id
+       -- An EXPIRED join request is NEUTRAL, not a refusal: it leaves the candidate set so an
+       -- earlier genuine grant beneath it still stands. Treating it as a removal would silently
+       -- revoke the membership of someone who joined and LATER also filed a request.
+       -- This is the ONE place created_at is correct: ordering uses seq because created_at is
+       -- transaction_timestamp() and ties within a transaction, but AGE is a wall-clock question.
+       and not (
+         e.provenance = 'target-authored'
+         and e.result_state = 'requested'
+         and e.created_at < now() - make_interval(days => b.join_request_ttl_days)
+       )
+       and (
+         e.result_state in ('left', 'removed')
+         or e.provenance = 'target-authored'
+         or (e.provenance = 'operator-designated'
+             and e.result_state in ('joined', 'subscribed'))
+         or (e.provenance = 'principal-authored'
+             and e.result_state in ('joined', 'subscribed'))
+       )
+     order by e.seq desc
+     limit 1
+  );
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._upsert_board_membership_state(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb, p_membership_id uuid DEFAULT NULL::uuid, p_event_kind text DEFAULT NULL::text)
+ RETURNS agent_board.board_memberships
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_metadata jsonb;
+  -- EC-MBROWID-3: currently-removed standing (R-LINK-7 set form), not a single row.
+  v_currently_removed boolean;
+  v_prior_state text;
+  -- #317: the resolved next membership_state, computed ONCE and then both written and compared.
+  -- An earlier draft wrote the guard as a CASE in the SET clause and RESTATED the same predicate
+  -- to decide whether to emit. The two agreed, and nothing asserted they must: dropping
+  -- `subscribed` from the emit copy alone re-created the false-ledger defect verbatim, and adding
+  -- `removed` to it alone silently dropped a real state change from an append-only ledger. Both
+  -- left the entire suite green. Deriving once removes the possibility rather than testing for it.
+  v_next_state text;
+  v_offer_noop boolean := false;
+  -- HOSTED (D15, D12)
+  v_is_delegate boolean;
+  v_delegate_id uuid;
+begin
+  if p_membership_state not in ('requested', 'invited', 'joined', 'subscribed', 'left', 'removed') then
+    raise exception 'invalid board membership state' using errcode = '22023';
+  end if;
+
+  -- HOSTED (D15): THE SINK RULE. A hosted delegate is placed into an active or pending state
+  -- ONLY by add_delegate_to_board, and the sink proves it with two facts, both required:
+  --   1. the transaction-local setting agent_board.delegate_admission names this target. Only
+  --      add_delegate_to_board sets it (set_config(..., true)), after its owner, R-LINK-7 and
+  --      authority checks, and clears it before returning. The sink only READS it;
+  --   2. the session is the target's principal. service_role has no resolved actor, so a
+  --      service_role caller fails this even if it could set the flag.
+  -- A move to `left` or `removed` needs neither: removals, the D12 cascade and the tombstone
+  -- run without it. The entrypoints that bypass this sink carry the class refusal instead
+  -- (agent_board._refuse_delegate_membership_target).
+  v_is_delegate := coalesce((select a.is_delegate from agent_board.agents a where a.id = p_agent_id), false);
+  if v_is_delegate
+     and p_membership_state in ('joined', 'subscribed', 'invited', 'requested')
+     and (
+       coalesce(current_setting('agent_board.delegate_admission', true), '') <> p_agent_id::text
+       or agent_board.current_agent_id() is null
+       or agent_board.current_agent_id() is distinct from agent_board._delegate_principal_agent_id(p_agent_id)
+     ) then
+    raise exception 'a hosted delegate joins a board only through add_delegate_to_board'
+      using errcode = '42501';
+  end if;
+
+  -- Metadata must be a JSON OBJECT. Previously a scalar/array was stored verbatim on insert and
+  -- concatenated on update; the reserved-key strip below iterates keys, so a non-object would raise
+  -- an opaque internal error. Fail explicitly instead. Reachable from the CLI `--metadata`, which
+  -- parses arbitrary JSON — this is a deliberate, declared behavior change for ALL mutator callers.
+  if jsonb_typeof(coalesce(p_metadata, '{}'::jsonb)) <> 'object' then
+    raise exception 'board membership metadata must be a JSON object' using errcode = '22023';
+  end if;
+
+  -- Reserved namespace: `ops_*` keys are operational state (the retention sweep's skip marker
+  -- `ops_retained_at`, read for board_memberships at 20260513000001:122) and must never be writable
+  -- by a caller whose own row they govern. Strip them from caller input; operational writers set
+  -- the column directly.
+  select coalesce(jsonb_object_agg(e.key, e.value), '{}'::jsonb)
+    into v_metadata
+    from jsonb_each(coalesce(p_metadata, '{}'::jsonb)) as e(key, value)
+   where e.key not like 'ops\_%';
+
+  -- EC-MBROWID-3 / R-LINK-7: currently-removed standing is the SET predicate
+  -- (exists removed AND no active), not a single total-ordered row. A higher-id
+  -- removed row can coexist with an active row; inferring "removed" from the
+  -- total-order winner alone would then try to activate the removed row and
+  -- collide with idx_agent_board_board_memberships_active_unique (23505).
+  -- Capture standing before the row lock so the predicate is independent of
+  -- which physical row the active-preferring SELECT below returns.
+  v_currently_removed :=
+    exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state = 'removed'
+    ) and not exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state in ('joined', 'subscribed')
+    );
+
+  -- Duplicate-aware ACTIVE-row selection (3a): prefer an active row when one
+  -- exists, then total-order by created_at desc, id desc. A pure total-order
+  -- can select a higher-id REMOVED row while an ACTIVE row still exists.
+  -- When v_currently_removed, no active row exists and the total-order pick is
+  -- non-active (re-entry clamp applies below).
+  -- When the caller names a row it has already validated AND LOCKED, act on THAT row. The
+  -- active-preferring pick below is right when the sink chooses for itself, but wrong when a
+  -- caller validated a specific one: rejecting a pending request would lock and mutate the
+  -- subject's ACTIVE membership instead, downgrading a real member (#109).
+  if p_membership_id is not null then
+    select *
+      into v_membership
+      from agent_board.board_memberships bm
+     where bm.id = p_membership_id
+       and bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     for update;
+
+    if v_membership.id is null then
+      raise exception 'membership row % not found for this subject', p_membership_id
+        using errcode = 'P0002';
+    end if;
+  else
+    select *
+      into v_membership
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1
+     for update;
+  end if;
+
+  -- The PRIOR state, captured before the update below overwrites v_membership. The emitter
+  -- cannot see it, and without it a joined<->subscribed self-toggle is indistinguishable from
+  -- a fresh join.
+  v_prior_state := v_membership.membership_state;
+
+  if v_membership.id is null then
+    -- INSERT branch intentionally omits `role` so a no-prior-row entry takes the table default
+    -- (20260717000100:13-15). Do not write role here — an explicit write is wrong.
+    insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, left_at, metadata)
+    values (
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      p_created_by_agent_id,
+      case when p_membership_state in ('left', 'removed') then now() else null end,
+      v_metadata
+    )
+    returning * into v_membership;
+  else
+    -- THE #317 RULE, in one place. `invited` and `requested` are OFFERS: they describe a
+    -- membership that does not yet exist. Applying one to a membership that DOES exist
+    -- (`joined`/`subscribed`) leaves the state alone -- the offer is already satisfied and the
+    -- stronger standing wins. Every other transition is untouched, including joined <-> subscribed,
+    -- active -> left/removed, and re-entry from any non-active state.
+    v_next_state := case
+                      when p_membership_state in ('invited', 'requested')
+                       and v_membership.membership_state in ('joined', 'subscribed')
+                        then v_membership.membership_state
+                      else p_membership_state
+                    end;
+
+    -- Suppressed iff the state did not move AND the caller asked for something else. The second
+    -- conjunct matters: join_board and update_board_membership both permit joined -> joined, which
+    -- also does not move the state but IS the caller getting what they asked for, and still emits.
+    v_offer_noop := v_next_state is not distinct from v_membership.membership_state
+                    and p_membership_state is distinct from v_next_state;
+
+    update agent_board.board_memberships bm
+       -- #317: AN INVITE MUST NOT WEAKEN AN ACTIVE MEMBERSHIP.
+       --
+       -- Reproduced on production and again in a scratch database: an agent JOINED since
+       -- 2026-08-05 was moved back to `invited` by a single invite_offer, because this UPDATE
+       -- set the requested state unconditionally. The row was never deleted -- it was
+       -- DOWNGRADED, and the agent silently lost board delivery while both sides saw a board
+       -- that merely looked quiet.
+       --
+       -- This is NOT #109 and the #109 guard does not cover it. #109 was the sink acting on the
+       -- WRONG ROW (an active row when a pending one had been validated), fixed by the
+       -- p_membership_id targeting above. This is the RIGHT row moved in the WRONG DIRECTION,
+       -- so it needs a direction rule, not a selection rule.
+       --
+       -- The rule: `invited` and `requested` are OFFERS -- they describe a membership that does
+       -- not yet exist. Applying an offer to one that DOES exist (`joined`/`subscribed`) leaves
+       -- the state alone: the offer is already satisfied and the stronger standing wins. Every
+       -- other transition is untouched, including joined <-> subscribed, active -> left/removed,
+       -- and re-entry from any non-active state.
+       --
+       -- A no-op rather than an exception, deliberately: invite is idempotent by design (the
+       -- MBCONSENT invite flow re-offers freely) and raising here would break callers that
+       -- succeed today.
+       --
+       -- "No-op" IS COLUMN-SCOPED, and saying so is the difference between a true claim and a
+       -- comfortable one. What a suppressed offer preserves is the AUTHORITY-BEARING state:
+       -- membership_state, left_at, and role. The row is still WRITTEN -- created_by_agent_id,
+       -- metadata and updated_at all follow the ordinary path below. That is pre-existing
+       -- behaviour this change does not alter: created_by_agent_id is audit provenance surfaced
+       -- as created_by_handle (20260507000000:85-87), not authority, and the metadata merge is
+       -- what every other caller gets. Making a suppressed offer skip the UPDATE entirely would
+       -- be defensible and is deliberately NOT done here -- it would change metadata semantics
+       -- for a path unrelated to the defect, in a fix meant to be narrow. Both the preserved
+       -- columns and the written ones are asserted, so the scope is a fact rather than a promise.
+       -- v_next_state, derived above. NOTE the deliberate asymmetry with the two CASEs below:
+       -- `role` and `left_at` still key off p_membership_state, the caller's REQUEST, and that is
+       -- correct rather than an oversight -- the #79 role clamp fires on ADMISSION to an active
+       -- state, and a suppressed offer admits nobody.
+       --
+       -- Stated precisely, because a first draft of this comment overclaimed and a mutation
+       -- refuted it: keying the clamp off v_next_state instead does NOT reset an ordinary owner,
+       -- because the clamp's second conjunct already requires the PRIOR state to be non-active
+       -- (or currently-removed standing to hold), and on a suppressed offer the prior state is
+       -- active by construction. The two spellings differ only in the `v_currently_removed`
+       -- corner, where the selected row is active while a removed duplicate exists. So the
+       -- asymmetry is worth keeping and worth explaining, but it is not the gaping hole the
+       -- draft claimed. The assertions below pin the ordinary case, which is what they cover.
+       set membership_state = v_next_state,
+           created_by_agent_id = coalesce(p_created_by_agent_id, bm.created_by_agent_id),
+           -- PRESERVE the first departure time. Restamping it would let the departing agent (or a
+           -- re-kicking owner) push its own row past the retention cutoff (20260513000001:121).
+           left_at = case
+                       when p_membership_state in ('left', 'removed') then
+                         case
+                           -- SAME terminal state re-asserted: preserve the FIRST departure time so a
+                           -- repeat call cannot push the retention cutoff forward.
+                           when v_membership.membership_state = p_membership_state
+                             then coalesce(v_membership.left_at, now())
+                           -- GENUINE transition (notably left -> removed, an owner barring
+                           -- invite-link re-entry for an already-departed agent) stamps NOW. R-LINK-7
+                           -- deliberately does not block voluntary 'left' (20260724000100:321-322),
+                           -- so this is the real kick moment; inheriting the earlier departure would
+                           -- both lose the audit answer and make the marker row retention-eligible
+                           -- prematurely.
+                           else now()
+                         end
+                       else null
+                     end,
+           -- ROLERESET (#79): clamp role to the table default on non-active -> active re-entry.
+           -- Hardcoded 'member' (column default at 20260717000100:13-15); do not read
+           -- information_schema at runtime. Active -> active preserves bm.role (including owner).
+           -- Unconditional — no service_role exemption.
+           -- MBROWID: origin is non-active when the selected row is non-active OR when
+           -- currently-removed standing holds (R-LINK-7 set form). With active-preferring
+           -- selection those agree; the set form is load-bearing against equal-created_at
+           -- removed+left duplicates where a single-row read would flip with id order.
+           role = case
+                    when p_membership_state in ('joined', 'subscribed')
+                     and (
+                       v_membership.membership_state not in ('joined', 'subscribed')
+                       or v_currently_removed
+                     )
+                    then 'member'
+                    else bm.role
+                  end,
+           metadata = coalesce(bm.metadata, '{}'::jsonb) || v_metadata,
+           updated_at = now()
+     where bm.id = v_membership.id
+     returning * into v_membership;
+  end if;
+
+  -- Emission is delegated so the sink and the four raw writers cannot drift apart.
+  -- The frozen mapping distinguishes a self-TOGGLE between two active states from a fresh
+  -- self-JOIN. Only the sink knows the prior state, so it names the kind; the emitter derives
+  -- everything security-critical regardless.
+  -- A caller-supplied kind wins; otherwise the sink's own derivation stands. Only the
+  -- DESCRIPTIVE field is delegated -- provenance is always derived from the session.
+  --
+  -- #317 -- NOTHING IS EMITTED WHEN NOTHING HAPPENED, and both of the obvious alternatives are
+  -- WORSE. Before the guard above, the argument and the resulting row could not differ, so the
+  -- question did not arise. The guard makes them differ on exactly one path, and that path then
+  -- has three options, two of which are defects:
+  --
+  --   * emit `p_membership_state` (what the first draft of this migration did): appends
+  --     `result_state = 'invited'` beside a row that says `joined`. `board_membership_events` is
+  --     append-only, so the false row can never be corrected -- and it is the table the #317
+  --     investigation itself read to establish what happened. The fix would have falsified its
+  --     own diagnostic. Caught by three review seats.
+  --
+  --   * emit `v_membership.membership_state` (what the SECOND draft did, "fixing" the above):
+  --     MINTS CONSENT OUT OF AN OFFER, which is strictly worse than a cosmetically wrong row.
+  --     `_membership_consent_present` -- the FROZEN MBCONSENT interface (IF-0-MBCONSENT-1) that
+  --     `update_board_membership` consults before admitting anyone -- treats
+  --     `operator-designated` + `result_state in ('joined','subscribed')` as an actual PLACEMENT,
+  --     i.e. as consent. An operator re-inviting a member whose ledger is silent would therefore
+  --     turn a mere OFFER into an admission grant. Measured, not reasoned:
+  --
+  --         consent BEFORE operator re-invite = false
+  --         consent AFTER  operator re-invite = true
+  --
+  --     That is the precise narrowing MBCONSENT shipped 20260806000100 to make -- "a bare operator
+  --     `invited` OFFER must be NEUTRAL" -- reopened from the other side. Delegating a kind cannot
+  --     avoid it either: the predicate keys on (provenance, result_state) ONLY, and provenance is
+  --     derived from the session and is not delegatable.
+  --
+  --   * emit nothing, which is what this does. `board_membership_events` records membership-state
+  --     events; a suppressed offer changed no state, so there is no event. A silent ledger reads
+  --     as `false` from the consent predicate, so this cannot mint anything, and it writes no row
+  --     that a later reader must distrust.
+  --
+  -- WHAT THIS GIVES UP, stated rather than left to be discovered: an invite that lands on an
+  -- already-active member is no longer visible in this ledger at all. That is a real loss of
+  -- audit for a real action. It is accepted because the only two ways to record it here are a
+  -- false statement about the row or a forged consent grant, and because the CALLER still sees
+  -- the outcome -- invite_board_member and update_board_membership both return the row, which
+  -- now reads `joined` rather than `invited`. If that action needs auditing, it needs a surface
+  -- that is not the consent ledger.
+  --
+  -- Emission is otherwise unchanged and still delegated, so the sink and the raw writers cannot
+  -- drift apart.
+  -- HOSTED (D15): a hosted delegate is a member, never higher, whatever route wrote the row.
+  if v_is_delegate and v_membership.role is distinct from 'member' then
+    raise exception 'a hosted delegate''s board role is member, never higher'
+      using errcode = '42501';
+  end if;
+
+  if not v_offer_noop then
+    perform agent_board._emit_membership_event(
+      p_board_id, p_agent_id, p_membership_state,
+      coalesce(p_event_kind, case
+        when v_prior_state in ('joined', 'subscribed')
+         and p_membership_state in ('joined', 'subscribed')
+         -- The states must actually DIFFER. join_board and update_board_membership both permit
+         -- joined->joined and subscribed->subscribed, and a write that changes nothing is not a
+         -- toggle of anything -- recording it as one permanently mislabels an append-only event.
+         and v_prior_state <> p_membership_state
+         and not agent_board._is_service_role()
+         and agent_board.current_agent_id() = p_agent_id
+        then 'consent_self_toggle'
+        else null
+      end));
+  end if;
+
+  -- HOSTED (D12): A DELEGATE LEAVES A BOARD WHEN ITS OWNER DOES. When this write leaves the
+  -- target without an active membership (at most one active row exists per board and agent,
+  -- idx_agent_board_board_memberships_active_unique), every hosted delegate of the target
+  -- that is active on this board moves to `left` in the same transaction, through this sink,
+  -- so each gets its own ledger event derived from the session (principal_withdraw when the
+  -- owner leaves, eviction when an admin removes the owner, operator_removal under
+  -- service_role). A delegate already removed is left as it is; the owner's return does not
+  -- restore its delegates. Lock order: the owner's row (held above) before the delegates'.
+  if not v_is_delegate and v_membership.membership_state not in ('joined', 'subscribed') then
+    for v_delegate_id in
+      select bm.agent_id
+        from agent_board.board_memberships bm
+        join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+        join agent_board.agents owner_agent on owner_agent.auth_user_id = di.owner_user_id
+       where owner_agent.id = p_agent_id
+         and bm.board_id = p_board_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by bm.agent_id
+    loop
+      perform agent_board._upsert_board_membership_state(p_board_id, v_delegate_id, 'left');
+    end loop;
+  end if;
+
+  return v_membership;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.update_board_membership(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_board agent_board.boards%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+  v_is_service boolean := agent_board._is_service_role();
+  v_existing_state text;
+  v_target_role text;
+  v_actor_role text;
+  -- HOSTED (D7): the caller is the target hosted delegate's principal asking for `left`.
+  v_principal_withdraw boolean;
+begin
+  if v_actor is null and not v_is_service then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  v_principal_withdraw := not v_is_service
+    and v_actor <> p_agent_id
+    and p_membership_state = 'left'
+    and v_actor = agent_board._delegate_principal_agent_id(p_agent_id);
+
+  if not v_is_service and v_actor <> p_agent_id and not v_principal_withdraw then
+    select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+    if v_board.id is null then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    select bm.role
+      into v_actor_role
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = v_actor
+       and bm.membership_state in ('joined', 'subscribed')
+     limit 1;
+    if v_actor_role is null or v_actor_role not in ('owner', 'admin') then
+      raise exception 'board membership change requires owner or admin role'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- HOSTED: LOCKED, so every transition rule below is decided on the state the sink will
+  -- overwrite. Unlocked, an admin's uncommitted `removed` committed after this read, and the D7
+  -- withdrawal (and an ordinary self-leave, the same branch shape) then wrote `left` over it in
+  -- the sink, erasing the eviction R-LINK-7 reads (hosted_delegate_withdraw_evict_race). The
+  -- sink's own first lock is this same row in the same order, so the lock set is unchanged;
+  -- it is only taken earlier, before reads that lock nothing.
+  select bm.membership_state, bm.role
+    into v_existing_state, v_target_role
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1
+   for update;
+  if v_existing_state is null then
+    raise exception 'board membership not found' using errcode = 'P0002';
+  end if;
+
+  if v_principal_withdraw then
+    -- HOSTED (D7): the owner withdraws its own delegate whatever its board role, but ONLY from
+    -- the states a self-leave may leave. Never from `removed`: turning an eviction into `left`
+    -- would erase the standing R-LINK-7 reads and let the owner re-add the evicted delegate.
+    if v_existing_state not in ('joined', 'subscribed', 'invited', 'requested') then
+      raise exception 'a principal may withdraw its delegate only from an active or pending membership'
+        using errcode = '42501';
+    end if;
+  elsif not v_is_service then
+    if v_actor = p_agent_id then
+      if not (
+        (p_membership_state = 'left'
+         and v_existing_state in ('joined', 'subscribed', 'invited', 'requested'))
+        or (p_membership_state in ('joined', 'subscribed')
+            and v_existing_state in ('joined', 'subscribed'))
+        or (p_membership_state = v_existing_state
+            and p_membership_state in ('left', 'removed'))
+      ) then
+        raise exception 'self membership change not permitted; use the join/approval path'
+          using errcode = '42501';
+      end if;
+    else
+      if agent_board._role_rank(v_actor_role)
+         <= agent_board._role_rank(
+              case
+                when p_membership_state in ('joined', 'subscribed')
+                 and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+                then 'member'
+                else coalesce(v_target_role, '')
+              end) then
+        raise exception 'board membership change requires a higher board role than the target'
+          using errcode = '42501';
+      end if;
+
+      if p_membership_state in ('joined', 'subscribed')
+         and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+         and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+        raise exception 'admitting % requires an act by that agent', p_agent_id
+          using errcode = '42501';
+      end if;
+
+      -- INVITEPOLICY (#90): seating an inbound-disclosure membership ('invited'/'requested')
+      -- for a target that has blocked THIS actor is refused, mirroring invite_board_member.
+      -- Without this, an owner/admin re-seats the exact row the block refuses. Active-admission
+      -- states are already consent-gated above; service_role/self never reach this branch.
+      if p_membership_state in ('invited', 'requested')
+         and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+        raise exception 'target has blocked invitations from this inviter on this board'
+          using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  if not v_is_service
+     and p_membership_state = v_existing_state
+     and p_membership_state in ('left', 'removed') then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  select * into v_membership
+    from agent_board._upsert_board_membership_state(
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      null,
+      p_metadata
+    );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.grant_board_role(p_board_id uuid, p_agent_id uuid, p_grantee_role text, p_grantor_agent_id uuid DEFAULT NULL::uuid)
+ RETURNS TABLE(board_id uuid, agent_id uuid, role text, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_grantor uuid;
+  v_updated agent_board.board_memberships%rowtype;
+begin
+  if p_grantee_role not in ('owner', 'admin', 'member', 'observer') then
+    raise exception 'invalid grantee role' using errcode = '22023';
+  end if;
+
+  -- #276, FORCED BY AN EXISTING CLASS ASSERTION, not chosen. Adding the ledger gate makes this
+  -- function row-lock `agents` (transitively, through _assert_actor_not_fleet_revoked) as well
+  -- as board_memberships, which puts it in the class agent_board_signer_lifecycle.test.sql
+  -- section 9 pins from the call-graph closure: every function locking BOTH relations must take
+  -- the board advisory lock that serialises them against onboard_federated_fleet_agent. That
+  -- assertion FAILED and named this function when the gate was added without this line.
+  --
+  -- The tempting reply is that this function's order is agents -> board_memberships, the SAME
+  -- direction as onboarding, so it cannot close the F4 cycle. That is true today and is exactly
+  -- the ordering argument #269 refused: mutual exclusion survives a lock being added downstream,
+  -- a re-derived ordering does not. So the lock is taken rather than the assertion relaxed.
+  --
+  -- It also closes a gap 20260901000110 left open and explicitly declined to determine: this
+  -- function reads the ceiling for authorization (via _grant_within_ceiling below) and was one
+  -- of the three readers that did NOT take the lock serialising the ceiling row's ABSENCE, so a
+  -- concurrent first-ceiling insert could be missed and the read pass as default-owner. It is
+  -- now serialised, and agent_board_atomic_fleet_onboarding.test.sql's ceiling-reader registry
+  -- records it as such.
+  --
+  -- FIRST, before any row lock, so both routes are advisory -> agents -> board_memberships.
+  -- Re-taking it inside signed_grant_board_role (which already holds it) is a no-op: advisory
+  -- transaction locks are re-entrant within a session.
+  -- HOSTED (role-writer class): a hosted delegate is a member, never higher.
+  perform agent_board._refuse_delegate_membership_target(p_agent_id, 'grant_board_role');
+
+  perform agent_board._lock_board_authority_ceiling(p_board_id);
+
+  -- Grantor is the RESOLVED actor. service_role -> supplied arg; authenticated ->
+  -- current_agent_id() and raises 42501 if null (suspended/unmapped) or if the
+  -- supplied arg <> current_agent_id(). This closes the single-principal escalation.
+  v_grantor := agent_board._resolved_actor_agent_id(p_grantor_agent_id, 'p_grantor_agent_id');
+
+  -- #276. Fleet revocation removes board authority, not only send. Sited HERE — inside the
+  -- chokepoint, not in the signed wrapper — because signed_grant_board_role is the only other
+  -- referrer of this function in the whole database, so the signed route inherits this check
+  -- by construction and the unsigned `authenticated` route (the wider door) is closed by the
+  -- same line. Before the membership pre-check so the lock order is agents -> board_memberships,
+  -- matching onboard_federated_fleet_agent; below the write it would be the inversion #269
+  -- reproduced as `deadlock detected`, and this route has no advisory lock to be rescued by.
+  perform agent_board._assert_actor_not_fleet_revoked(v_grantor, 'grant_board_role');
+
+  if not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = p_board_id and bm.agent_id = p_agent_id
+       and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    raise exception 'grantee has no membership on this board' using errcode = 'P0002';
+  end if;
+
+  -- Ceiling consumption: grantee-bounded against min(grantor role, board ceiling).
+  if not agent_board._grant_within_ceiling(v_grantor, p_board_id, p_grantee_role) then
+    raise exception 'grant exceeds grantor role or board authority ceiling' using errcode = '42501';
+  end if;
+
+  update agent_board.board_memberships bm
+     set role = p_grantee_role,
+         updated_at = now()
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('joined', 'subscribed')
+   returning * into v_updated;
+
+  -- CR finding: the state predicate above closes the unauthorized WRITE, but on its own it
+  -- CREATES a false-success path. If an eviction commits between the pre-check and this
+  -- UPDATE (the TOCTOU window the mirrored predicate exists for), the UPDATE matches zero
+  -- rows, v_updated stays NULL, and the RETURN QUERY below would emit ONE ALL-NULL ROW with
+  -- no error -- a caller that checks "did I get a row back?" reads that as a completed grant.
+  -- Fail closed with the same P0002 the pre-check raises, so the serial and racing cases are
+  -- indistinguishable to the caller.
+  if not found then
+    raise exception 'grantee has no membership on this board' using errcode = 'P0002';
+  end if;
+
+  return query
+  select v_updated.board_id, v_updated.agent_id, v_updated.role, v_updated.updated_at;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.create_board(p_created_by_agent_id uuid, p_slug text, p_name text, p_description text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb, p_visibility text DEFAULT 'private'::text)
+ RETURNS TABLE(board_id uuid, slug text, name text, status text, visibility text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+#variable_conflict use_column
+declare
+  v_seed_state text;
+  v_actor uuid;
+  v_existing agent_board.boards%rowtype;
+  v_board agent_board.boards%rowtype;
+begin
+  if nullif(trim(p_slug), '') is null or nullif(trim(p_name), '') is null then
+    raise exception 'board slug and name are required' using errcode = '22023';
+  end if;
+  if coalesce(p_visibility, 'private') not in ('private', 'invite_only', 'open', 'directory_hidden') then
+    raise exception 'invalid board visibility' using errcode = '22023';
+  end if;
+
+  -- Effective actor: service_role -> supplied arg (create-on-behalf-of);
+  -- authenticated -> current_agent_id() and rejects arg <> current (42501).
+  v_actor := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  -- HOSTED (placement class): create_board seeds its creator's own owner seat directly. A
+  -- hosted delegate is never seated except by add_delegate_to_board.
+  perform agent_board._refuse_delegate_membership_target(v_actor, 'create_board');
+
+  if not exists (select 1 from agent_board.agents where id = v_actor) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  select * into v_existing
+    from agent_board.boards b
+   where b.slug = trim(p_slug);
+
+  if found then
+    -- Slug-collision path is OWNER-ONLY, keyed on CURRENT authority: the actor must
+    -- hold an ACTIVE owner-role membership on the existing board — NOT merely be its
+    -- original `created_by_agent_id`. A demoted or departed original creator no longer
+    -- owns the board and must NOT be able to re-open/rename/flip-visibility it.
+    if not exists (
+      select 1 from agent_board.board_memberships m
+       where m.board_id = v_existing.id
+         and m.agent_id = v_actor
+         and m.role = 'owner'
+         and m.membership_state in ('joined', 'subscribed')
+    ) then
+      raise exception 'board slug already in use' using errcode = '42501';
+    end if;
+
+    update agent_board.boards as b
+       set name = trim(p_name),
+           description = nullif(trim(p_description), ''),
+           status = 'active',
+           visibility = coalesce(p_visibility, 'private'),
+           metadata = coalesce(b.metadata, '{}'::jsonb) || coalesce(p_metadata, '{}'::jsonb),
+           updated_at = now()
+     where b.id = v_existing.id
+    returning * into v_board;
+    -- No owner re-seed: the owner was seeded at this board's original creation, and
+    -- re-promoting on every create_board would resurrect a deliberately demoted owner.
+  else
+    insert into agent_board.boards as b(slug, name, description, created_by_agent_id, visibility, metadata)
+    values (
+      trim(p_slug),
+      trim(p_name),
+      nullif(trim(p_description), ''),
+      v_actor,
+      coalesce(p_visibility, 'private'),
+      coalesce(p_metadata, '{}'::jsonb)
+    )
+    returning * into v_board;
+
+    -- Seed the creator's owner membership, bound to the board's ACTUAL
+    -- created_by_agent_id (never the raw param). Idempotent against the active
+    -- partial-unique index so at most one active owner row exists.
+    insert into agent_board.board_memberships as bm(board_id, agent_id, membership_state, role, created_by_agent_id)
+    values (v_board.id, v_board.created_by_agent_id, 'joined', 'owner', v_board.created_by_agent_id)
+    on conflict (board_id, agent_id) where (membership_state in ('joined', 'subscribed'))
+      do update set role = 'owner', updated_at = now()
+    returning bm.membership_state into v_seed_state;
+    -- The creator seeds their OWN owner seat, so the session is the subject and this emits
+    -- target-authored. Under service_role it emits operator-designated instead -- correct
+    -- either way, because the helper reads the session rather than being told.
+    --
+    -- v_seed_state, NOT a literal 'joined'. The ON CONFLICT above lifts only the ROLE, so a
+    -- board whose creator already holds a `subscribed` row stays subscribed while a literal
+    -- would record `joined` -- a ledger contradicting the table. Same defect the redemption
+    -- path had; fixing one instance without sweeping the class is how it survived here.
+    perform agent_board._emit_membership_event(v_board.id, v_board.created_by_agent_id, v_seed_state, 'owner_seed');
+  end if;
+
+  -- #280. Revoked means revoked: a fleet-revoked agent creates nothing. #276 gated the three
+  -- authority chokepoints and both invite halves and left this function open on a stated
+  -- argument (a fresh board confers nothing on anyone else); the owner overturned that in favour
+  -- of the simpler rule, and this line is the whole of the change.
+  --
+  -- SITED HERE, at the convergence of both branches and AFTER every write, for the lock order.
+  -- Fresh branch: boards(insert) -> board_memberships(insert, FK KEY SHARE on agents) ->
+  -- agents(SHARE). Collision branch: boards(FOR UPDATE) -> agents(SHARE). Both are
+  -- boards-before-agents, the canonical order. HOISTED above the slug read it would become
+  -- agents(SHARE) -> boards(FOR UPDATE) on the collision branch, which is #269 F4's exact ABBA
+  -- against onboard_federated_fleet_agent's boards -> agents. One transaction, so this raise
+  -- rolls back the board, the owner seat and the owner_seed event alike -- position costs
+  -- nothing in correctness and everything in deadlock safety.
+  --
+  -- On the fresh branch the FK on the seat insert has ALREADY taken KEY SHARE on this row, so
+  -- the FOR SHARE is a free upgrade and is NOT what serializes that path (see the header). On
+  -- the collision branch it is the only agents lock there is, and it is the serialization point.
+  perform agent_board._assert_actor_not_fleet_revoked(v_actor, 'create_board');
+
+  return query
+  select v_board.id, v_board.slug, v_board.name, v_board.status, v_board.visibility, v_board.created_at, v_board.updated_at;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.bootstrap_board_owner_memberships()
+ RETURNS TABLE(board_id uuid, owner_agent_id uuid, membership_id uuid)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+#variable_conflict use_column
+declare
+  v_seed_state text;
+  v_row record;
+  v_membership_id uuid;
+begin
+  -- service_role-only: current_agent_id() is null for service_role, non-null for any
+  -- authenticated principal (guarded here in addition to the EXECUTE revoke below).
+  if not agent_board._is_service_role() then
+    raise exception 'bootstrap_board_owner_memberships is service_role-only' using errcode = '42501';
+  end if;
+
+  -- R-LINK-7 guard shape (structural proof requires no-active AND no-removed
+  -- contiguously): re-seed only when the creator has no active membership AND is
+  -- not currently removed. NEVER suppress on 'left' alone — that is the
+  -- sole-owner-lockout recovery trigger (agent_board_rolereset.test.sql assertion
+  -- 23). requested/invited-only creators still re-seed; a removed+left pair is
+  -- suppressed.
+  for v_row in
+    select b.id as board_id, b.created_by_agent_id as owner_agent_id
+      from agent_board.boards b
+     where not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = b.id
+          and bm.agent_id = b.created_by_agent_id
+          and bm.membership_state in ('joined', 'subscribed')
+     )
+       and not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = b.id
+          and bm.agent_id = b.created_by_agent_id
+          and bm.membership_state = 'removed'
+     )
+  loop
+    -- HOSTED (placement class): bootstrap seats a board creator directly; never a delegate.
+    perform agent_board._refuse_delegate_membership_target(v_row.owner_agent_id, 'bootstrap_board_owner_memberships');
+    insert into agent_board.board_memberships as bm(board_id, agent_id, membership_state, role, created_by_agent_id)
+    values (v_row.board_id, v_row.owner_agent_id, 'joined', 'owner', v_row.owner_agent_id)
+    on conflict (board_id, agent_id) where (membership_state in ('joined', 'subscribed'))
+      do update set role = 'owner', updated_at = now()
+    returning bm.id, bm.membership_state into v_membership_id, v_seed_state;
+
+    -- Operator repair path: always operator-designated, never the owner's own act.
+    -- v_seed_state, NOT a literal: the ON CONFLICT lifts only the ROLE, so a concurrently
+    -- created `subscribed` membership stays subscribed while a literal would record `joined`.
+    perform agent_board._emit_membership_event(v_row.board_id, v_row.owner_agent_id, v_seed_state, 'operator_repair');
+
+    board_id := v_row.board_id;
+    owner_agent_id := v_row.owner_agent_id;
+    membership_id := v_membership_id;
+    return next;
+  end loop;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._fedsession_autojoin_default_board(p_provider agent_board.identity_providers, p_agent_id uuid)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+begin
+  if p_provider.default_board_id is null then
+    return;
+  end if;
+  -- HOSTED (placement class): the auto-join seats a federated human directly; never a delegate.
+  perform agent_board._refuse_delegate_membership_target(p_agent_id, 'fedsession auto-join');
+  -- The NOT EXISTS below is FIRST-TIME-ONLY (any existing membership row, incl. 'left'/
+  -- 'removed', suppresses the auto-join so a human who deliberately left is not re-joined).
+  -- Under concurrency it is NOT sufficient on its own: two concurrent re-provisions of the
+  -- same already-provisioned human can both pass NOT EXISTS, and the second insert then trips
+  -- the partial unique index idx_agent_board_board_memberships_active_unique. Catch that
+  -- unique_violation to a no-op (mirrors enroll_federated_human's step-8 agent-insert race
+  -- handling) so auto-join is NEVER fatal to the session mint and never duplicates.
+  begin
+    insert into agent_board.board_memberships(
+      board_id, agent_id, role, membership_state, created_by_agent_id, metadata)
+    select p_provider.default_board_id, p_agent_id, 'member', 'joined', p_agent_id,
+           jsonb_build_object('source', 'fedsession-autojoin', 'providerId', p_provider.id)
+    where exists (
+        select 1 from agent_board.boards b
+         where b.id = p_provider.default_board_id
+           and b.status = 'active')
+      and not exists (
+        select 1 from agent_board.board_memberships m
+         where m.board_id = p_provider.default_board_id
+           and m.agent_id = p_agent_id);
+
+    -- FOUND is true only if the conditional insert actually placed a row. The NOT EXISTS can
+    -- suppress it entirely, and the race branch below is a no-op -- neither must emit an event
+    -- for a placement that did not happen.
+    if found then
+      -- A LITERAL is correct here, and only here. The other writers use ON CONFLICT DO UPDATE,
+      -- which can preserve a DIFFERENT existing state -- so a literal there records an outcome
+      -- the row does not have. This insert has NO conflict-update path: it either inserts
+      -- exactly this state or inserts nothing, and `found` gates the emit. Do not copy the
+      -- literal to a writer that upserts.
+      perform agent_board._emit_membership_event(p_provider.default_board_id, p_agent_id, 'joined', 'operator_designation');
+    end if;
+  exception when unique_violation then
+    null;  -- concurrent auto-join won the race; its membership stands. Non-fatal.
+  end;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._redeem_unbounded_invite_for_agent(p_code text, p_agent_id uuid)
+ RETURNS TABLE(board_id uuid, agent_id uuid, role text, membership_state text, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+-- OUT params board_id/agent_id/role/membership_state/updated_at share names with the
+-- membership columns referenced in the on-conflict target + update set below; prefer
+-- the column in any collision (mirrors ROOMOWN create_board).
+#variable_conflict use_column
+declare
+  v_inv agent_board.board_invite_tokens%rowtype;
+  v_led agent_board.board_invite_redemptions%rowtype;
+  v_m agent_board.board_memberships%rowtype;
+begin
+  -- HOSTED (placement class): a hosted delegate redeems no invite; this helper seats directly.
+  perform agent_board._refuse_delegate_membership_target(p_agent_id, 'invite redemption');
+  -- Lock the token row FIRST (concurrency invariant: the exhaustion check and the
+  -- same-txn uses_count increment happen under this lock, and concurrent redeemers
+  -- of the same token serialize here).
+  select * into v_inv
+    from agent_board.board_invite_tokens t
+   where t.code = p_code
+   for update;
+  if not found then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- M1 idempotency ordering: an existing (invite, agent) ledger row means this is a
+  -- replay -> return the existing membership and SKIP every exhaustion/ceiling check
+  -- (a maxed link re-redeemed by the same agent is a no-op, NOT 42501).
+  select * into v_led
+    from agent_board.board_invite_redemptions r
+   where r.invite_id = v_inv.id
+     and r.agent_id = p_agent_id;
+  if found then
+    select * into v_m
+      from agent_board.board_memberships bm
+     where bm.id = v_led.membership_id;
+    return query
+    select v_m.board_id, v_m.agent_id, v_m.role, v_m.membership_state, v_m.updated_at;
+    return;
+  end if;
+
+  -- Genuinely new redemption: uniform 42501 for revoked / expired / exhausted
+  -- (no P0002-vs-42501 existence oracle).
+  if v_inv.revoked_at is not null then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+  if v_inv.expires_at <= now() then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+  if v_inv.max_uses is not null and v_inv.uses_count >= v_inv.max_uses then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- R-LINK-2 suspension containment: the creator must still be an ACTIVE agent
+  -- (revoke_agent suspends but does not drop memberships, so an outstanding link
+  -- from a compromised-then-suspended owner must stop minting).
+  if not exists (
+    select 1 from agent_board.agents a
+     where a.id = v_inv.created_by_agent_id and a.status = 'active'
+  ) then
+    -- Uniform message (see other 42501s) so a code-bearer cannot distinguish
+    -- "creator suspended" from a dead/expired/exhausted link (no lifecycle oracle).
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- #276 fleet containment, the sibling of R-LINK-2 one column over. Fleet revocation
+  -- deliberately leaves agents.status = 'active', so the check above passes for a
+  -- ledger-revoked creator and an outstanding admin link kept conferring admin -- the same
+  -- principal the send path already refuses. Keyed on the CREATOR because the creator is who
+  -- confers here; the redeemer is receiving, and its own standing is handled by
+  -- current_agent_id() and by the R-LINK-7 clause below.
+  --
+  -- UNLOCKED (_actor_fleet_revoked, not the share-locking assert) and with the SAME uniform
+  -- message as every other arm. Both choices are load-bearing, not stylistic: see the header.
+  if agent_board._actor_fleet_revoked(v_inv.created_by_agent_id) then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- Re-bind: the creator's CURRENT authority must still cover the preset role
+  -- (stale admin-link auto-degrades if the creator was demoted).
+  if not agent_board._grant_within_ceiling(v_inv.created_by_agent_id, v_inv.board_id, v_inv.preset_role) then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- R-LINK-7 kicked-agent re-entry: refuse when the agent's CURRENT standing on the
+  -- board is 'removed' — i.e. a 'removed' row exists AND there is no active
+  -- (joined/subscribed) membership. The active partial-unique index does NOT cover
+  -- 'removed' rows, so a fresh 'joined' insert would otherwise bypass revocation +
+  -- join-approval. Scoping to "removed and not currently active" avoids a false
+  -- negative for an agent who was removed and then legitimately re-added (an active
+  -- row present ⇒ the rank-max upsert handles them correctly). Voluntary 'left' is
+  -- intentionally NOT blocked (self-departure).
+  if exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = v_inv.board_id
+       and bm.agent_id = p_agent_id
+       and bm.membership_state = 'removed'
+  ) and not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = v_inv.board_id
+       and bm.agent_id = p_agent_id
+       and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    raise exception 'invite is not usable' using errcode = '42501';
+  end if;
+
+  -- Record the ledger row (idempotent under concurrent same-agent redemption).
+  insert into agent_board.board_invite_redemptions as r(invite_id, agent_id)
+  values (v_inv.id, p_agent_id)
+  on conflict (invite_id, agent_id) do nothing;
+
+  -- B1 atomic rank-max membership upsert: never downgrade a higher existing role,
+  -- race-safe across concurrent tokens. On conflict targets the active partial-unique
+  -- index; the CASE lifts ONLY when the preset outranks the current role.
+  insert into agent_board.board_memberships (
+    board_id, agent_id, membership_state, role, created_by_agent_id
+  )
+  values (
+    v_inv.board_id, p_agent_id, v_inv.preset_membership_state, v_inv.preset_role,
+    v_inv.created_by_agent_id
+  )
+  on conflict (board_id, agent_id) where (membership_state in ('joined', 'subscribed'))
+    do update set
+      role = case
+        when agent_board._role_rank(excluded.role) > agent_board._role_rank(agent_board.board_memberships.role)
+          then excluded.role
+        else agent_board.board_memberships.role
+      end,
+      updated_at = now()
+  returning * into v_m;
+
+  -- The redeemer places THEMSELVES -- the public wrapper passes current_agent_id() and takes no
+  -- target parameter -- so this emits target-authored: redeeming a link IS the consenting act.
+  --
+  -- v_m.membership_state, NOT v_inv.preset_membership_state. The ON CONFLICT above lifts only
+  -- the ROLE and leaves an existing membership_state untouched, so an already-`subscribed`
+  -- member redeeming a `joined` link stays subscribed. Emitting the token's preset would
+  -- record a resulting state the row does not have -- a ledger that contradicts the table it
+  -- describes. Recording the redemption as a fresh consent act is right; recording the wrong
+  -- outcome is not.
+  perform agent_board._emit_membership_event(
+    v_inv.board_id, p_agent_id, v_m.membership_state, 'consent_link_redeem');
+
+  -- Consume one use and bind the ledger row to the resulting membership.
+  update agent_board.board_invite_tokens t
+     set uses_count = t.uses_count + 1
+   where t.id = v_inv.id;
+
+  update agent_board.board_invite_redemptions r
+     set membership_id = v_m.id
+   where r.invite_id = v_inv.id
+     and r.agent_id = p_agent_id;
+
+  return query
+  select v_m.board_id, v_m.agent_id, v_m.role, v_m.membership_state, v_m.updated_at;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.create_task(p_thread_id uuid, p_created_by_agent_id uuid, p_title text, p_details text DEFAULT NULL::text, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_parent_task_id uuid DEFAULT NULL::uuid, p_priority text DEFAULT 'medium'::text, p_orchestration_mode text DEFAULT 'distributed'::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(task_id uuid, parent_task_id uuid, root_task_id uuid, created_event_id uuid, created_event_sequence bigint, status text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_task_id uuid;
+  v_root_task_id uuid;
+  v_event_id uuid;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  if nullif(trim(p_title), '') is null then
+    raise exception 'task title is required' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-2 (#123): a board-linked thread requires a non-observer board role to author.
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+  if p_assigned_agent_id is not null and not exists (select 1 from agent_board.agents where id = p_assigned_agent_id) then
+    raise exception 'assigned agent not found' using errcode = 'P0002';
+  end if;
+  -- HOSTED (D16): a hosted delegate can act on no task, so it is never an assignee.
+  perform agent_board._refuse_delegate_addressee(p_assigned_agent_id, null, 'task assignment');
+
+  if p_parent_task_id is not null then
+    select coalesce(tasks.root_task_id, tasks.id)
+      into v_root_task_id
+      from agent_board.tasks
+     where id = p_parent_task_id and tasks.thread_id = p_thread_id;
+    if v_root_task_id is null then
+      raise exception 'parent task not found in thread' using errcode = '22023';
+    end if;
+    if not agent_board._current_agent_can_access_task(p_parent_task_id) then
+      raise exception 'parent task not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  v_task_id := gen_random_uuid();
+  if p_parent_task_id is null then
+    v_root_task_id := v_task_id;
+  end if;
+
+  insert into agent_board.tasks(id, thread_id, created_by_agent_id, assigned_agent_id, parent_task_id, root_task_id, title, details, priority, orchestration_mode, metadata)
+  values (v_task_id, p_thread_id, v_actor_agent_id, p_assigned_agent_id, p_parent_task_id, v_root_task_id, trim(p_title), p_details, coalesce(p_priority, 'medium'), coalesce(p_orchestration_mode, 'distributed'), coalesce(p_metadata, '{}'::jsonb));
+
+  -- #288: create_task is the ONE writer that inserts into task_events directly rather than
+  -- through the funnel, which is why a fix instrumenting only append_task_event's callers
+  -- would miss it. Its own declared posture is signed-metadata (it declares p_metadata and the
+  -- client signs it). No parameter is threaded here deliberately -- see the plan's section 5:
+  -- where a signed wrapper is involved (signed_create_tasking_delivery keys its evidence to
+  -- THIS event, two levels up), a real signature_evidence row exists and v_task_tree already
+  -- surfaces it, which is the stronger signal. A threaded parameter would change no answer.
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
+  values (v_task_id, p_thread_id, v_actor_agent_id, 1, 'created', jsonb_build_object('title', trim(p_title)), 'unattested:signed-metadata-rpc')
+  returning id into v_event_id;
+
+  return query
+  select t.id, t.parent_task_id, t.root_task_id, v_event_id, 1::bigint, t.status, t.created_at, t.updated_at
+    from agent_board.tasks t
+   where t.id = v_task_id;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._append_task_event(p_origin_posture text, p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb DEFAULT '{}'::jsonb, p_status text DEFAULT NULL::text, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_completed_at timestamp with time zone DEFAULT NULL::timestamp with time zone)
+ RETURNS TABLE(task_id uuid, thread_id uuid, event_id uuid, event_sequence bigint, task_status text, assigned_agent_id uuid, updated_at timestamp with time zone, completed_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_thread_id uuid;
+  v_locked_thread_id uuid;
+  v_sequence bigint;
+  v_event_id uuid;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_actor_agent_id, 'p_actor_agent_id');
+
+  select tasks.thread_id into v_thread_id from agent_board.tasks where id = p_task_id;
+  if v_thread_id is null then
+    raise exception 'task not found' using errcode = 'P0002';
+  end if;
+
+  perform 1 from agent_board.threads th where th.id = v_thread_id for key share;
+
+  select tasks.thread_id into v_locked_thread_id from agent_board.tasks where id = p_task_id for update;
+  if v_locked_thread_id is null then
+    raise exception 'task not found' using errcode = 'P0002';
+  end if;
+  if v_locked_thread_id is distinct from v_thread_id then
+    raise exception 'task thread changed while acquiring locks' using errcode = '40001';
+  end if;
+
+  if not agent_board._current_agent_can_access_task(p_task_id) then
+    raise exception 'task not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_can_mutate_task(p_task_id) then
+    raise exception 'task mutation requires a non-observer board role, or task assignment/creation'
+      using errcode = '42501';
+  end if;
+
+  -- HOSTED (D16): a hosted delegate can act on no task, so it is never an assignee.
+  perform agent_board._refuse_delegate_addressee(p_assigned_agent_id, null, 'task assignment');
+
+  select coalesce(max(te.event_sequence), 0) + 1 into v_sequence from agent_board.task_events te where te.task_id = p_task_id;
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
+  values (p_task_id, v_thread_id, v_actor_agent_id, v_sequence, p_event_type, coalesce(p_payload, '{}'::jsonb), p_origin_posture)
+  returning id into v_event_id;
+
+  update agent_board.tasks
+     set status = coalesce(p_status, tasks.status),
+         assigned_agent_id = coalesce(p_assigned_agent_id, tasks.assigned_agent_id),
+         completed_at = coalesce(p_completed_at, tasks.completed_at),
+         updated_at = now()
+   where id = p_task_id;
+
+  return query
+  select t.id, t.thread_id, v_event_id, v_sequence, t.status, t.assigned_agent_id, t.updated_at, t.completed_at
+    from agent_board.tasks t
+   where t.id = p_task_id;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.delegate_task(p_parent_task_id uuid, p_actor_agent_id uuid, p_title text, p_details text DEFAULT NULL::text, p_delegated_to_agent_id uuid DEFAULT NULL::uuid, p_priority text DEFAULT 'medium'::text, p_note text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(delegation_id uuid, child_task_id uuid, parent_task_id uuid, root_task_id uuid, delegation_status text, child_event_sequence bigint, parent_event_sequence bigint, created_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_parent agent_board.tasks%rowtype;
+  v_child record;
+  v_delegation_id uuid;
+  v_parent_event record;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_actor_agent_id, 'p_actor_agent_id');
+
+  select * into v_parent from agent_board.tasks where id = p_parent_task_id;
+  if v_parent.id is null then
+    raise exception 'parent task not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_task(p_parent_task_id) then
+    raise exception 'parent task not accessible to current agent' using errcode = '42501';
+  end if;
+
+  select * into v_child
+    from agent_board.create_task(v_parent.thread_id, v_actor_agent_id, p_title, p_details, p_delegated_to_agent_id, p_parent_task_id, p_priority, 'hierarchical', p_metadata);
+
+  -- HOSTED (D16): a hosted delegate can act on no task, so nothing is delegated to it.
+  perform agent_board._refuse_delegate_addressee(p_delegated_to_agent_id, null, 'task delegation');
+  insert into agent_board.delegations(parent_task_id, child_task_id, delegated_by_agent_id, delegated_to_agent_id, note, metadata)
+  values (p_parent_task_id, v_child.task_id, v_actor_agent_id, p_delegated_to_agent_id, p_note, coalesce(p_metadata, '{}'::jsonb))
+  returning id into v_delegation_id;
+
+  select * into v_parent_event
+    from agent_board._append_task_event('unattested:signed-metadata-rpc', p_parent_task_id, v_actor_agent_id, 'delegated', jsonb_build_object('delegation_id', v_delegation_id, 'child_task_id', v_child.task_id));
+
+  return query
+  select v_delegation_id, v_child.task_id, p_parent_task_id, v_child.root_task_id, 'requested'::text, v_child.created_event_sequence, v_parent_event.event_sequence, now();
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.raise_escalation(p_thread_id uuid, p_raised_by_agent_id uuid, p_summary text, p_escalation_type text DEFAULT 'other'::text, p_severity text DEFAULT 'medium'::text, p_task_id uuid DEFAULT NULL::uuid, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_details jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(escalation_id uuid, status text, task_event_sequence bigint, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_escalation_id uuid;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_raised_by_agent_id, 'p_raised_by_agent_id');
+
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-2 (#123): a board-linked thread requires a non-observer board role.
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  -- HOSTED (D16): a hosted delegate can act on no escalation, so it is never an assignee.
+  perform agent_board._refuse_delegate_addressee(p_assigned_agent_id, null, 'escalation assignment');
+
+  insert into agent_board.escalations(thread_id, task_id, raised_by_agent_id, assigned_agent_id, summary, escalation_type, severity, details)
+  values (p_thread_id, p_task_id, v_actor_agent_id, p_assigned_agent_id, p_summary, coalesce(p_escalation_type, 'other'), coalesce(p_severity, 'medium'), coalesce(p_details, '{}'::jsonb))
+  returning id into v_escalation_id;
+
+  -- v_event_sequence stays NULL for a thread-level escalation (no task) — fixes the same latent
+  -- "record not assigned yet" bug on the no-task path.
+  if p_task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:unsigned-deliberate-rpc', p_task_id, v_actor_agent_id, 'escalated', jsonb_build_object('escalation_id', v_escalation_id));
+  end if;
+
+  return query
+  select e.id, e.status, v_event_sequence, e.created_at, e.updated_at
+    from agent_board.escalations e
+   where e.id = v_escalation_id;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._upsert_delivery_recipient(p_delivery_mode text, p_recipient_agent_id uuid, p_source_kind text, p_source_message_id uuid DEFAULT NULL::uuid, p_source_task_id uuid DEFAULT NULL::uuid, p_source_delegation_id uuid DEFAULT NULL::uuid, p_board_id uuid DEFAULT NULL::uuid, p_board_membership_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS agent_board.delivery_recipients
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_row agent_board.delivery_recipients%rowtype;
+begin
+  -- HOSTED (D16): a delivery reaches a hosted delegate only through a board it is active on
+  -- (the board-post fan-out to members). It can read nothing without a board.
+  perform agent_board._refuse_delegate_addressee(p_recipient_agent_id, p_board_id, 'delivery');
+  -- OBSGATE (#78): stamp the thread's owning board on first board delivery so
+  -- post_message's posting gate can resolve it. Resolve the thread from WHICHEVER source the
+  -- delivery carries — message (post_board_message), task (create_tasking_delivery), or
+  -- delegation — so EVERY board-fanning path links the thread, not just the message-sourced one.
+  -- First-board-wins (never overwrites); board-less deliveries (p_board_id null) never stamp.
+  if p_board_id is not null then
+    update agent_board.threads t
+       set board_id = p_board_id
+     where t.board_id is null
+       and t.id = coalesce(
+         (select m.thread_id from agent_board.messages m where m.id = p_source_message_id),
+         (select tk.thread_id from agent_board.tasks tk where tk.id = p_source_task_id),
+         (select tk.thread_id
+            from agent_board.delegations d
+            join agent_board.tasks tk on tk.id = d.child_task_id
+           where d.id = p_source_delegation_id)
+       );
+  end if;
+
+  insert into agent_board.delivery_recipients(
+    delivery_mode,
+    recipient_agent_id,
+    source_kind,
+    source_message_id,
+    source_task_id,
+    source_delegation_id,
+    board_id,
+    board_membership_id,
+    metadata
+  )
+  values (
+    p_delivery_mode,
+    p_recipient_agent_id,
+    p_source_kind,
+    p_source_message_id,
+    p_source_task_id,
+    p_source_delegation_id,
+    p_board_id,
+    p_board_membership_id,
+    coalesce(p_metadata, '{}'::jsonb)
+  )
+  on conflict (recipient_agent_id, canonical_source_key) do update
+    set metadata = coalesce(agent_board.delivery_recipients.metadata, '{}'::jsonb) || coalesce(excluded.metadata, '{}'::jsonb)
+  returning * into v_row;
+
+  return v_row;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._upsert_inbox_item(p_delivery_recipient_id uuid, p_recipient_agent_id uuid, p_board_id uuid, p_delivery_mode text, p_source_kind text, p_source_message_id uuid DEFAULT NULL::uuid, p_source_task_id uuid DEFAULT NULL::uuid, p_source_delegation_id uuid DEFAULT NULL::uuid, p_subject text DEFAULT NULL::text, p_preview text DEFAULT NULL::text, p_priority text DEFAULT 'medium'::text, p_visible_in_inbox boolean DEFAULT true, p_visible_in_board_feed boolean DEFAULT false, p_fetch_descriptor jsonb DEFAULT '{}'::jsonb, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS agent_board.inbox_items
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_row agent_board.inbox_items%rowtype;
+begin
+  -- HOSTED (D16): as for deliveries, only through a board the delegate is active on.
+  perform agent_board._refuse_delegate_addressee(p_recipient_agent_id, p_board_id, 'inbox item');
+  insert into agent_board.inbox_items(
+    delivery_recipient_id,
+    recipient_agent_id,
+    board_id,
+    delivery_mode,
+    source_kind,
+    source_message_id,
+    source_task_id,
+    source_delegation_id,
+    subject,
+    preview,
+    priority,
+    visible_in_inbox,
+    visible_in_board_feed,
+    fetch_descriptor,
+    metadata
+  )
+  values (
+    p_delivery_recipient_id,
+    p_recipient_agent_id,
+    p_board_id,
+    p_delivery_mode,
+    p_source_kind,
+    p_source_message_id,
+    p_source_task_id,
+    p_source_delegation_id,
+    p_subject,
+    p_preview,
+    p_priority,
+    p_visible_in_inbox,
+    p_visible_in_board_feed,
+    coalesce(p_fetch_descriptor, '{}'::jsonb),
+    coalesce(p_metadata, '{}'::jsonb)
+  )
+  on conflict (delivery_recipient_id) do update
+    set board_id = excluded.board_id,
+        subject = excluded.subject,
+        preview = excluded.preview,
+        priority = excluded.priority,
+        visible_in_inbox = excluded.visible_in_inbox,
+        visible_in_board_feed = excluded.visible_in_board_feed,
+        fetch_descriptor = excluded.fetch_descriptor,
+        metadata = coalesce(agent_board.inbox_items.metadata, '{}'::jsonb) || coalesce(excluded.metadata, '{}'::jsonb),
+        updated_at = now()
+  returning * into v_row;
+
+  return v_row;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._resolve_addressing_recipient_rows(p_actor_agent_id uuid, p_recipient_descriptors jsonb)
+ RETURNS TABLE(ordinal integer, recipient_agent_id uuid, handle text, display_name text, descriptor jsonb, warning text, denied_reason text)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_descriptor jsonb;
+  v_kind text;
+  v_index integer := 0;
+  v_match_count integer;
+  v_group_alias text;
+  v_role text;
+begin
+  for v_descriptor in
+    select value
+      from jsonb_array_elements(agent_board._addressing_descriptors_array(p_recipient_descriptors))
+  loop
+    v_index := v_index + 1;
+    v_kind := v_descriptor ->> 'kind';
+
+    if v_kind = 'explicit_set' then
+      return query
+      select v_index * 100000 + nested.ordinal,
+             nested.recipient_agent_id,
+             nested.handle,
+             nested.display_name,
+             nested.descriptor,
+             nested.warning,
+             nested.denied_reason
+        from agent_board._resolve_addressing_recipient_rows(
+          p_actor_agent_id,
+          coalesce(v_descriptor -> 'recipients', '[]'::jsonb)
+        ) nested;
+    elsif v_kind = 'agent_id' then
+      select count(*) into v_match_count
+        from agent_board.agents a
+       where a.id = (v_descriptor ->> 'agentId')::uuid
+         and a.status = 'active';
+
+      if v_match_count = 1 then
+        -- HOSTED (D16, NEW-4): naming a hosted delegate explicitly is DENIED, so the dry run
+        -- shows it and the send refuses the whole call (_addressing_agent_ids_or_raise).
+        return query
+        select v_index,
+               case when a.is_delegate then null::uuid else a.id end,
+               case when a.is_delegate then null::text else a.handle end,
+               case when a.is_delegate then null::text else a.display_name end,
+               v_descriptor, null::text,
+               case when a.is_delegate then 'recipient_is_hosted_delegate'::text else null::text end
+          from agent_board.agents a
+         where a.id = (v_descriptor ->> 'agentId')::uuid
+           and a.status = 'active';
+      else
+        return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'unknown agent_id'::text;
+      end if;
+    elsif v_kind in ('agent_handle', 'human_handle') then
+      select count(*) into v_match_count
+        from agent_board.agents a
+       where a.handle = v_descriptor ->> 'handle'
+         and a.status = 'active'
+         and (
+           (v_kind = 'agent_handle' and a.agent_type <> 'human')
+           or (v_kind = 'human_handle' and a.agent_type = 'human')
+         );
+
+      if v_match_count = 1 then
+        -- HOSTED (D16, NEW-4): as for agent_id.
+        return query
+        select v_index,
+               case when a.is_delegate then null::uuid else a.id end,
+               case when a.is_delegate then null::text else a.handle end,
+               case when a.is_delegate then null::text else a.display_name end,
+               v_descriptor, null::text,
+               case when a.is_delegate then 'recipient_is_hosted_delegate'::text else null::text end
+          from agent_board.agents a
+         where a.handle = v_descriptor ->> 'handle'
+           and a.status = 'active'
+           and (
+             (v_kind = 'agent_handle' and a.agent_type <> 'human')
+             or (v_kind = 'human_handle' and a.agent_type = 'human')
+           );
+      elsif v_match_count = 0 then
+        return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'unknown handle'::text;
+      else
+        return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'ambiguous handle'::text;
+      end if;
+    elsif v_kind = 'group_alias' then
+      v_group_alias := nullif(trim(v_descriptor ->> 'groupAlias'), '');
+      return query
+      select v_index,
+             a.id,
+             a.handle,
+             a.display_name,
+             v_descriptor,
+             null::text,
+             null::text
+        from agent_board.agents a
+       where a.status = 'active'
+         -- HOSTED (D16, NEW-4): an expansion names a set, not an agent; it never includes a
+         -- hosted delegate, so one delegate cannot break every send to the set.
+         and not a.is_delegate
+         and (
+           a.metadata ->> 'groupAlias' = v_group_alias
+           or a.metadata ->> 'group_alias' = v_group_alias
+           or coalesce(a.metadata -> 'groupAliases', '[]'::jsonb) ? v_group_alias
+           or coalesce(a.metadata -> 'group_aliases', '[]'::jsonb) ? v_group_alias
+         )
+       order by a.handle, a.id;
+
+      if not found then
+        return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'unknown group_alias'::text;
+      end if;
+    elsif v_kind = 'role_selector' then
+      v_role := nullif(trim(v_descriptor ->> 'role'), '');
+      return query
+      select v_index,
+             a.id,
+             a.handle,
+             a.display_name,
+             v_descriptor,
+             null::text,
+             null::text
+        from agent_board.agents a
+       where a.status = 'active'
+         -- HOSTED (D16, NEW-4): as for group_alias.
+         and not a.is_delegate
+         and (
+           a.agent_type = v_role
+           or a.kind::text = v_role
+           or a.metadata ->> 'role' = v_role
+           or coalesce(a.metadata -> 'roles', '[]'::jsonb) ? v_role
+           or coalesce(a.metadata -> 'scopes', '[]'::jsonb) ? v_role
+         )
+       order by a.handle, a.id;
+
+      if not found then
+        return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'unknown role_selector'::text;
+      end if;
+    else
+      return query select v_index, null::uuid, null::text, null::text, v_descriptor, null::text, 'unsupported descriptor kind'::text;
+    end if;
+  end loop;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board._addressing_agent_ids_or_raise(p_actor_agent_id uuid, p_recipient_descriptors jsonb)
+ RETURNS uuid[]
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_result record;
+  v_ids uuid[];
+begin
+  select * into v_result
+    from agent_board.resolve_recipients(p_actor_agent_id, p_recipient_descriptors);
+
+  -- HOSTED (D16, NEW-4): naming a hosted delegate refuses the whole send as an authorization
+  -- failure, before any delivery is written.
+  if exists (
+    select 1
+      from jsonb_array_elements(v_result."deniedRecipients") d
+     where d ->> 'reason' = 'recipient_is_hosted_delegate'
+  ) then
+    raise exception 'a hosted delegate is reached only through a board it is on' using errcode = '42501', detail = v_result."deniedRecipients"::text;
+  end if;
+
+  if jsonb_array_length(v_result."deniedRecipients") > 0 then
+    raise exception 'recipient descriptor resolution failed' using errcode = '22023', detail = v_result."deniedRecipients"::text;
+  end if;
+
+  select array_agg((value ->> 'agentId')::uuid)
+    into v_ids
+    from jsonb_array_elements(v_result."resolvedRecipients") as value;
+
+  if v_ids is null or cardinality(v_ids) = 0 then
+    raise exception 'recipient descriptors resolved no recipients' using errcode = '22023';
+  end if;
+
+  return v_ids;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.post_message(p_thread_id uuid, p_author_agent_id uuid, p_body text, p_message_type text DEFAULT 'comment'::text, p_task_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(message_id uuid, thread_id uuid, task_id uuid, message_sequence bigint, created_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_sequence bigint;
+  v_actor_agent_id uuid;
+  v_metadata jsonb;
+  v_instance agent_board.delegate_instances%rowtype;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_body), '') is null then
+    raise exception 'message body is required' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE (#78): a board-linked thread under 'inherit' requires a non-observer board role.
+  -- post_message is the sole authenticated writer to messages, so this gate cannot be bypassed
+  -- by any send path. Board-less threads and service_role fall through (access check above).
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+  if p_task_id is not null and not exists (select 1 from agent_board.tasks where id = p_task_id and tasks.thread_id = p_thread_id) then
+    raise exception 'task not found in thread' using errcode = '22023';
+  end if;
+
+  -- HOSTED attribution: the `delegate` key is written by the server, never by a caller. A
+  -- hosted delegate's post carries it (overwriting anything supplied); every other author's
+  -- caller-supplied `delegate` key is removed, so no keyed agent can forge the mark.
+  -- client_verified is always false: under dynamic client registration anyone can name a client.
+  v_metadata := coalesce(p_metadata, '{}'::jsonb);
+  if jsonb_typeof(v_metadata) = 'object' then
+    v_metadata := v_metadata - 'delegate';
+  end if;
+  select di.* into v_instance
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where a.id = v_actor_agent_id
+     and a.is_delegate;
+  if found then
+    if jsonb_typeof(v_metadata) <> 'object' then
+      raise exception 'a hosted delegate''s message metadata must be a JSON object' using errcode = '22023';
+    end if;
+    v_metadata := v_metadata || jsonb_build_object('delegate', jsonb_build_object(
+      'delegate', true,
+      'instance_id', v_instance.instance_id,
+      'owner_agent_id', agent_board._delegate_principal_agent_id(v_actor_agent_id),
+      'client_id', v_instance.client_id,
+      'client_verified', false));
+  end if;
+
+  v_sequence := agent_board._next_thread_message_sequence(p_thread_id);
+
+  return query
+  insert into agent_board.messages(thread_id, author_agent_id, task_id, message_sequence, message_type, body, metadata)
+  values (p_thread_id, v_actor_agent_id, p_task_id, v_sequence, coalesce(p_message_type, 'comment'), p_body, v_metadata)
+  returning id, messages.thread_id, messages.task_id, messages.message_sequence, messages.created_at;
+end;
+$function$;
+
+CREATE OR REPLACE FUNCTION agent_board.get_bundle_compatibility()
+ RETURNS jsonb
+ LANGUAGE sql
+ STABLE SECURITY DEFINER
+ SET search_path TO 'agent_board', 'pg_temp'
+AS $function$
+  select jsonb_build_object(
+    'schema_version', (select version from agent_board.schema_version limit 1),
+    'installed_bundle_version', (select package_version from agent_board.bundle_installation limit 1),
+    'installed_bundle_digest', (select bundle_digest from agent_board.bundle_installation limit 1),
+    'installed_schema_version', (select schema_version from agent_board.bundle_installation limit 1),
+    'source_commit', (select source_commit from agent_board.bundle_installation limit 1),
+    -- #326: which PROPOSITION the boolean below is answering, said out loud, so a
+    -- reader does not have to consult a version boundary to decode it. A constant
+    -- rather than a derivation: it names the model this bundle's predicate encodes,
+    -- which is a fact about the migration you are reading, not about the database.
+    'signed_write_model', 'operator-only-gateway',
+    -- #310: enforcement means the SIGNED path stays operator-only, not that the unsigned path is
+    -- unreachable. See 20260918000100's header for what this does and does not establish.
+    'signed_write_enforced', (
+      -- The anchor. A schema with no signed gateway grants none of them, which would make the
+      -- second clause vacuously true; requiring the gateway to exist is what stops "enforced"
+      -- from meaning "nothing to enforce".
+      exists (
+        select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.proname = 'signed_send_direct_message'
+      )
+      and not exists (
+        -- Catalog-derived over pg_proc ROWS: covers all seven gateways and every overload of
+        -- each, and asks the privilege RESOLVER rather than reading a direct-grant view.
+        select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+         cross join (values ('authenticated'), ('anon'), ('agent_board_delegate')) as r(rolname)
+         where n.nspname = 'agent_board'
+           and p.proname like 'signed\_%'
+           and pg_catalog.has_function_privilege(r.rolname, p.oid, 'EXECUTE')
+      )
+    ),
+    -- Ready only once the materializer has recorded an install AND the schema
+    -- version handshake resolves.
+    'ready', (
+      (select version from agent_board.schema_version limit 1) is not null
+      and exists (select 1 from agent_board.bundle_installation)
+    ),
+    'checked_at', now()
+  );
+$function$;
+
+-- =============================================================================
+-- 12. The delegate read policies (D14, §The read closure)
+-- =============================================================================
+-- One SELECT policy per read_table, TO agent_board_delegate only. No authenticated predicate
+-- is reused. The caller's board set and identity are read through UNCORRELATED subqueries, so
+-- each is computed once per query rather than once per row (see section 6). No policy FOR INSERT, UPDATE, DELETE or ALL is created for the role.
+-- Each expression is stated ONCE, here; agent_board_delegate_role_class pins its deparse.
+create policy agent_board_delegate_select_boards
+  on agent_board.boards for select to agent_board_delegate
+  using (id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[])));
+
+create policy agent_board_delegate_select_board_memberships
+  on agent_board.board_memberships for select to agent_board_delegate
+  using (agent_id = (select agent_board.current_agent_id()) and membership_state in ('joined', 'subscribed'));
+
+create policy agent_board_delegate_select_agents
+  on agent_board.agents for select to agent_board_delegate
+  using (agent_board._delegate_visible_agent(id));
+
+create policy agent_board_delegate_select_messages
+  on agent_board.messages for select to agent_board_delegate
+  using (exists (select 1 from agent_board.delivery_recipients dr
+                  where dr.source_message_id = messages.id
+                    and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))));
+
+create policy agent_board_delegate_select_delivery_recipients
+  on agent_board.delivery_recipients for select to agent_board_delegate
+  using (board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[])));
+
+-- The own-or-feed conjunct is the authenticated policy's (20260713000000:80): per-recipient
+-- rows carry a board_id with visible_in_board_feed = false, and without it a delegate would
+-- read every co-member's triage rows. Recipiency here only NARROWS.
+create policy agent_board_delegate_select_inbox_items
+  on agent_board.inbox_items for select to agent_board_delegate
+  using (board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))
+         and (recipient_agent_id = (select agent_board.current_agent_id()) or visible_in_board_feed));
+
+create policy agent_board_delegate_select_tasks
+  on agent_board.tasks for select to agent_board_delegate
+  using (exists (select 1 from agent_board.delivery_recipients dr
+                  where dr.source_task_id = tasks.id
+                    and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))));
+
+create policy agent_board_delegate_select_task_events
+  on agent_board.task_events for select to agent_board_delegate
+  using (exists (select 1 from agent_board.delivery_recipients dr
+                  where dr.source_task_id = task_events.task_id
+                    and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))));
+
+create policy agent_board_delegate_select_claims
+  on agent_board.claims for select to agent_board_delegate
+  using (task_id is not null and exists (select 1 from agent_board.delivery_recipients dr
+                  where dr.source_task_id = claims.task_id
+                    and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))));
+
+create policy agent_board_delegate_select_escalations
+  on agent_board.escalations for select to agent_board_delegate
+  using (task_id is not null and exists (select 1 from agent_board.delivery_recipients dr
+                  where dr.source_task_id = escalations.task_id
+                    and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))));
+
+-- At least one source is non-null, and EVERY non-null source is visible. source_artifact_id is
+-- a source too, and artifacts are outside the read closure, so evidence over an artifact is
+-- invisible. The task-event and delivery subqueries are filtered by their own delegate
+-- policies. The authenticated policy's own-agent_id branch is not kept.
+create policy agent_board_delegate_select_signature_evidence
+  on agent_board.signature_evidence for select to agent_board_delegate
+  using ((source_message_id is not null or source_task_event_id is not null or source_delivery_recipient_id is not null)
+         and source_artifact_id is null
+         and (source_message_id is null
+              or exists (select 1 from agent_board.delivery_recipients dr
+                          where dr.source_message_id = signature_evidence.source_message_id
+                            and dr.board_id = any (coalesce((select agent_board._delegate_visible_board_ids()), '{}'::uuid[]))))
+         and (source_task_event_id is null
+              or exists (select 1 from agent_board.task_events te where te.id = source_task_event_id))
+         and (source_delivery_recipient_id is null
+              or exists (select 1 from agent_board.delivery_recipients dr where dr.id = source_delivery_recipient_id)));
+
+create policy agent_board_delegate_select_presence
+  on agent_board.presence for select to agent_board_delegate
+  using (false);
+
+create policy agent_board_delegate_select_agent_signing_keys
+  on agent_board.agent_signing_keys for select to agent_board_delegate
+  using (false);
+
+-- =============================================================================
+-- 13. Grants, FROM the allow set (§What it holds, exactly)
+-- =============================================================================
+-- EXECUTE on each rpc / ambient_rpc / predicate row, SELECT on each read_view / read_table
+-- row, and on agents only the eight columns authenticated holds (never auth_user_id or
+-- owner_user_id). Nothing else: no INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER,
+-- and no sequence privilege. A signature that names no function fails the apply, loudly.
+do $grants$
+declare
+  r record;
+begin
+  for r in
+    select kind, name, signature from agent_board.delegate_allowed_operations order by kind, signature
+  loop
+    if r.kind in ('rpc', 'ambient_rpc', 'predicate') then
+      execute format('grant execute on function agent_board.%s to agent_board_delegate', r.signature);
+    elsif r.name = 'agents' then
+      grant select (kind, display_name, agent_type, created_at, updated_at, id, handle, status)
+        on agent_board.agents to agent_board_delegate;
+    else
+      execute format('grant select on agent_board.%I to agent_board_delegate', r.name);
+    end if;
+  end loop;
+end
+$grants$;
+
+-- =============================================================================
+-- 14. Indexes for the per-row predicates (NEW-5, §Class assertions: the query plan)
+-- =============================================================================
+-- The predicates are STABLE SECURITY DEFINER functions the planner cannot inline into the
+-- feeds; each is an index probe per row. The plan evidence is in plans/evidence/hosted/.
+create index if not exists idx_agent_board_delivery_recipients_source_message_board
+  on agent_board.delivery_recipients (source_message_id, board_id)
+  where source_message_id is not null;
+
+create index if not exists idx_agent_board_delivery_recipients_source_task_board
+  on agent_board.delivery_recipients (source_task_id, board_id)
+  where source_task_id is not null;
+
+-- _delegate_visible_agent's past-author branch.
+create index if not exists idx_agent_board_messages_author
+  on agent_board.messages (author_agent_id);
+
+-- =============================================================================
+-- 15. The ceiling lock's machine-read COMMENT gains its new reader
+-- =============================================================================
+-- add_delegate_to_board reads the ceiling for authorization (_grant_within_ceiling) and takes
+-- the lock. agent_board_atomic_fleet_onboarding.test.sql compares these lists with pg_proc.
+-- Restated in full: COMMENT ON replaces, it does not append.
+comment on function agent_board._lock_board_authority_ceiling(uuid) is
+  'Board-keyed transaction advisory lock serializing the ABSENCE of a board_authority_ceilings row. Held to commit. WRITERS[serialized: set_board_authority_ceiling][UNSERIALIZED: (none)] -- the RPCs that write board_authority_ceilings. set_board_authority_ceiling takes this lock before its owner gate and its upsert, and therefore before the boards row that upsert reaches through board_authority_ceilings'' FK on INSERT. A direct table write by service_role bypasses every function-level lock (deliberate, 20260717000400). READERS[serialized: add_delegate_to_board, grant_board_role, onboard_federated_fleet_agent][UNSERIALIZED: _redeem_unbounded_invite_for_agent, create_invite_link] -- the RPCs that read the ceiling for authorization through _grant_within_ceiling. onboard_federated_fleet_agent takes this lock BEFORE its boards row lock, because the writer reaches boards through that FK and the two orders must agree (inverted, they deadlocked). grant_board_role takes no boards row lock, so it makes no ordering claim. add_delegate_to_board (HOSTED) takes no boards row lock either, and takes this lock FIRST, before any row lock, as grant_board_role does; tombstone_delegate_instance, the other holder of the delegate_instances row it locks next, never takes this lock. The UNSERIALIZED readers evaluate the ceiling WITHOUT serializing against its absence: a concurrent set_board_authority_ceiling can commit a first ceiling row after such a reader observed none, and it passes as default-owner. That race is real, known and accepted (#277); it is deliberately NOT closed by adding acquisitions, since each new edge in this lock graph has already produced a reproduced ABBA deadlock once (#269 F4). Both lists are machine-compared against pg_proc by agent_board_atomic_fleet_onboarding.test.sql, which fails when this COMMENT and the catalog disagree -- do not edit a list by hand without the catalog. Internal: it takes a lock with NO authorization check on an arbitrary board id, so it must never be grantable to authenticated.';