@consiliency/agent-board-schema 1.57.0 → 1.59.0

package/tests/agent_board_hosted_delegates.test.sql

@@ -0,0 +1,1278 @@
+-- HOSTED (v11) SL-2 pgTAP: hosted delegate instances, the exchange and tombstone RPCs,
+-- add_delegate_to_board, attribution, the D7/D12/D15/D16 rules, and the #583 acceptance tests
+-- (T1-T5) at the database. The CONTRACT is the HOSTED section of
+-- specs/agent-client-contract.md; each section below names the decision or test it pins.
+--
+-- METHOD.
+--   * Every probe is driven by a REAL operation: the exchange and tombstone RPCs as
+--     service_role, add_delegate_to_board and the membership RPCs as the owner's session, and
+--     the delegate's own calls AS agent_board_delegate. The owner is provisioned through the
+--     real enroll_federated_human, never a hand-seeded row, so a change to the owner-uid
+--     derivation fails the owner gate here (IF-0-HOSTED-12).
+--   * A delegate call SWITCHES ROLE (`set local role agent_board_delegate`), because grants and
+--     RLS are the property under test. Existing files probe with claims only, which leaves the
+--     role postgres; that would test nothing here.
+--   * Allow-side probes return 'ok' or `<sqlstate>:<message>` from a helper with its own
+--     exception block, then a SEPARATE assertion checks the resulting state (AGENTS.md rule 3).
+--     A refused probe is compared to its exact sqlstate and message, so a refusal for the wrong
+--     reason fails.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(143);
+
+-- The test role switches to agent_board_delegate. On PostgreSQL 16+ the role's creator holds
+-- ADMIN OPTION but not SET, so grant SET to the current role for this transaction only (rolled
+-- back with everything else). A superuser needs nothing.
+do $$
+begin
+  if not (select rolsuper from pg_roles where rolname = current_user) then
+    execute format('grant agent_board_delegate to %I with set true', current_user);
+  end if;
+end $$;
+
+create temp table _h(k text primary key, v text);
+create function pg_temp.v(p_k text) returns text language sql as $$ select v from _h where k = p_k $$;
+create function pg_temp.u(p_k text) returns uuid language sql as $$ select v::uuid from _h where k = p_k $$;
+create function pg_temp.put(p_k text, p_v text) returns void language sql as $$
+  insert into _h values (p_k, p_v) on conflict (k) do update set v = excluded.v $$;
+
+create function pg_temp.svc() returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims', '', true); end $$;
+create function pg_temp.authn(p_sub uuid) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', p_sub)::text, true);
+end $$;
+create function pg_temp.deleg(p_sub uuid, p_cred uuid) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims',
+    case when p_cred is null
+      then json_build_object('role', 'agent_board_delegate', 'sub', p_sub)::text
+      else json_build_object('role', 'agent_board_delegate', 'sub', p_sub, 'agent_credential_id', p_cred)::text
+    end, true);
+end $$;
+-- Run as the CURRENT role; 'ok' or '<sqlstate>:<message>'.
+create function pg_temp.try(p_sql text) returns text language plpgsql as $$
+begin
+  execute p_sql;
+  return 'ok';
+exception when others then
+  return sqlstate || ':' || sqlerrm;
+end $$;
+-- Run AS agent_board_delegate (claims set by the caller); 'ok' or '<sqlstate>:<message>'.
+create function pg_temp.as_d(p_sql text) returns text language plpgsql as $$
+declare v text;
+begin
+  set local role agent_board_delegate;
+  begin
+    execute p_sql;
+    v := 'ok';
+  exception when others then
+    v := sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  return v;
+end $$;
+-- Run AS agent_board_delegate and return the single scalar the query yields.
+create function pg_temp.as_d_val(p_sql text) returns text language plpgsql as $$
+declare v text;
+begin
+  set local role agent_board_delegate;
+  begin
+    execute p_sql into v;
+  exception when others then
+    v := 'ERR ' || sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  return v;
+end $$;
+
+-- A state read that runs as its OWN query, so it sees what an action earlier in the same
+-- statement wrote. A plain `(select ...)` in the statement that calls the action reads the
+-- statement's snapshot -- the state BEFORE the action -- and would pass vacuously.
+create function pg_temp.q(p_sql text) returns text language plpgsql as $$
+declare v text;
+begin
+  execute p_sql into v;
+  return coalesce(v, '(null)');
+end $$;
+create function pg_temp.claim(
+  p_iid text, p_gid text, p_gen bigint, p_owner_sub text, p_client text,
+  p_change jsonb default null, p_slot text default null, p_status text default 'active')
+returns jsonb language sql as $$
+  select jsonb_build_object(
+    'iss', 'https://portal.hosted.test',
+    'sub', p_owner_sub,
+    'slot_resource', p_slot,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', p_iid, 'grant_id', p_gid, 'generation', p_gen, 'owner_sub', p_owner_sub,
+      'client_id', p_client, 'status', p_status, 'client_change', p_change))
+$$;
+-- The exchange as service_role. On success records <key>.agent / .auth / .cred and returns 'ok'.
+create function pg_temp.exch(p_claims jsonb, p_key text) returns text language plpgsql as $$
+declare r record;
+begin
+  perform set_config('request.jwt.claims', '', true);
+  select * into r from agent_board.exchange_delegate_credential(p_claims);
+  perform pg_temp.put(p_key || '.agent', r.agent_id::text);
+  perform pg_temp.put(p_key || '.auth', r.auth_user_id::text);
+  perform pg_temp.put(p_key || '.cred', r.credential_id::text);
+  return 'ok';
+exception when others then
+  return sqlstate || ':' || sqlerrm;
+end $$;
+create function pg_temp.tomb(p_iid text, p_owner_sub text, p_reason text default 'owner_revoked') returns text
+language plpgsql as $$
+declare r record;
+begin
+  perform set_config('request.jwt.claims', '', true);
+  select * into r from agent_board.tombstone_delegate_instance(p_iid, 'https://portal.hosted.test', p_owner_sub, p_reason);
+  return 'first=' || r.first::text;
+exception when others then
+  return sqlstate || ':' || sqlerrm;
+end $$;
+create function pg_temp.state(b uuid, a uuid) returns text language sql as $$
+  select membership_state || '/' || role from agent_board.board_memberships
+   where board_id = b and agent_id = a
+   order by case when membership_state in ('joined','subscribed') then 0 else 1 end, created_at desc, id desc
+   limit 1 $$;
+create function pg_temp.last_event(b uuid, a uuid) returns text language sql as $$
+  select provenance || '/' || event_kind || '/' || coalesce(actor_agent_id::text, 'null') || '/' || result_state
+    from agent_board.board_membership_events where board_id = b and agent_id = a
+   order by seq desc limit 1 $$;
+
+-- ---------------------------------------------------------------------------
+-- Fixtures. The owners are federated humans provisioned through enroll_federated_human.
+-- ---------------------------------------------------------------------------
+insert into agent_board.identity_providers
+  (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+values ('https://portal.hosted.test', 'message-board', true, true, '{}', '{}', '{agent,human}');
+
+do $$
+declare r record; s text;
+begin
+  perform set_config('request.jwt.claims', '', true);
+  foreach s in array array['a', 'b', 'c'] loop
+    select * into r from agent_board.enroll_federated_human(
+      'https://portal.hosted.test', 'message-board', 'hosted-owner-' || s,
+      jsonb_build_object('sub', 'hosted-owner-' || s, 'email', 'owner-' || s || '@hosted.test', 'email_verified', true),
+      'Owner ' || upper(s));
+    perform pg_temp.put('O' || upper(s), r.agent_id::text);
+    perform pg_temp.put('O' || upper(s) || '.auth', r.auth_user_id::text);
+  end loop;
+end $$;
+
+-- Keyed agents: K (board owner/admin everywhere), K2 (member), Z1 (only on BZ).
+insert into auth.users(id, instance_id, aud, role, email)
+select ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'hosted-k' || n || '@t.test'
+  from generate_series(1, 3) n;
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('5e100000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, 'agent', 'agent',
+       'hosted-keyed-' || n, 'Hosted Keyed ' || n, 'active',
+       ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
+  from generate_series(1, 3) n;
+select pg_temp.put('K', '5e100000-0000-4000-8000-000000000001'),
+       pg_temp.put('K.auth', '5e000000-0000-4000-8000-000000000001'),
+       pg_temp.put('K2', '5e100000-0000-4000-8000-000000000002'),
+       pg_temp.put('K2.auth', '5e000000-0000-4000-8000-000000000002'),
+       pg_temp.put('Z1', '5e100000-0000-4000-8000-000000000003');
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('5e200000-0000-4000-8000-000000000001', 'hosted-bx', 'Hosted BX', pg_temp.u('K'), 'private', 'active'),
+       ('5e200000-0000-4000-8000-000000000002', 'hosted-by', 'Hosted BY', pg_temp.u('K'), 'private', 'active'),
+       ('5e200000-0000-4000-8000-000000000003', 'hosted-bz', 'Hosted BZ', pg_temp.u('K'), 'private', 'active'),
+       ('5e200000-0000-4000-8000-000000000004', 'hosted-bw', 'Hosted BW', pg_temp.u('OA'), 'private', 'active');
+select pg_temp.put('BX', '5e200000-0000-4000-8000-000000000001'),
+       pg_temp.put('BY', '5e200000-0000-4000-8000-000000000002'),
+       pg_temp.put('BZ', '5e200000-0000-4000-8000-000000000003'),
+       pg_temp.put('BW', '5e200000-0000-4000-8000-000000000004');
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values (pg_temp.u('BX'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
+       (pg_temp.u('BX'), pg_temp.u('K2'), 'member', 'joined', pg_temp.u('K')),
+       (pg_temp.u('BX'), pg_temp.u('OA'), 'member', 'joined', pg_temp.u('K')),
+       (pg_temp.u('BX'), pg_temp.u('OB'), 'member', 'joined', pg_temp.u('K')),
+       (pg_temp.u('BY'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
+       (pg_temp.u('BY'), pg_temp.u('OA'), 'member', 'joined', pg_temp.u('K')),
+       (pg_temp.u('BZ'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
+       (pg_temp.u('BZ'), pg_temp.u('Z1'), 'member', 'joined', pg_temp.u('K')),
+       (pg_temp.u('BW'), pg_temp.u('OA'), 'owner',  'joined', pg_temp.u('OA')),
+       (pg_temp.u('BW'), pg_temp.u('K'),  'member', 'joined', pg_temp.u('OA'));
+
+-- ===========================================================================
+-- 1. EXECUTE surface of the three new RPCs (D10's pin, plus IF-0-HOSTED-12)
+-- ===========================================================================
+-- 1
+select is(
+  (select string_agg(f || ':' || r || '=' || has_function_privilege(r, f, 'EXECUTE')::text, ' ' order by f, r)
+     from unnest(array['agent_board.exchange_delegate_credential(jsonb)',
+                       'agent_board.tombstone_delegate_instance(text,text,text,text)']) f
+    cross join unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r),
+  'agent_board.exchange_delegate_credential(jsonb):agent_board_delegate=false agent_board.exchange_delegate_credential(jsonb):anon=false agent_board.exchange_delegate_credential(jsonb):authenticated=false agent_board.exchange_delegate_credential(jsonb):service_role=true agent_board.tombstone_delegate_instance(text,text,text,text):agent_board_delegate=false agent_board.tombstone_delegate_instance(text,text,text,text):anon=false agent_board.tombstone_delegate_instance(text,text,text,text):authenticated=false agent_board.tombstone_delegate_instance(text,text,text,text):service_role=true',
+  'D10: the exchange and the tombstone are EXECUTE-able by service_role only, never authenticated, anon or agent_board_delegate');
+-- 2
+select is(
+  (select string_agg(r || '=' || has_function_privilege(r, 'agent_board.add_delegate_to_board(uuid,uuid)', 'EXECUTE')::text, ' ' order by r)
+     from unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r),
+  'agent_board_delegate=false anon=false authenticated=true service_role=false',
+  'IF-0-HOSTED-12: add_delegate_to_board is EXECUTE-able by authenticated only');
+-- 3 -- a non-service caller is refused inside the function too
+select pg_temp.authn(pg_temp.u('K.auth'));
+select is(
+  pg_temp.try($$ select agent_board.exchange_delegate_credential('{}'::jsonb) $$),
+  '42501:exchange_delegate_credential is service_role-only',
+  'the exchange refuses a non-service session in its own body');
+
+-- ===========================================================================
+-- 2. T1 -- three instances of ONE owner and ONE client are three principals
+-- ===========================================================================
+-- 4
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'I1')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_02', 'grant_aaaaaaaaaaaaaa_02_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'I2')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_03', 'grant_aaaaaaaaaaaaaa_03_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'I3'),
+  'ok ok ok',
+  'T1: three first exchanges of one owner and one client succeed');
+-- 5
+select is(
+  (select count(distinct v)::int from _h where k in ('I1.agent', 'I2.agent', 'I3.agent'))
+  + (select count(distinct v)::int from _h where k in ('I1.auth', 'I2.auth', 'I3.auth')),
+  6,
+  'T1: they are three distinct agents with three distinct auth users -- the (owner, client) pair alone is never the principal');
+-- 6
+select is(
+  (select string_agg(a.is_delegate::text || '/' || a.kind::text || '/' || a.agent_type || '/' || a.status
+                     || '/' || (a.owner_user_id = pg_temp.u('OA.auth'))::text
+                     || '/' || (a.handle = agent_board._delegate_instance_slug('https://portal.hosted.test', di.instance_id))::text
+                     || '/' || (a.auth_user_id = (select u.id from auth.users u where u.email = 'agent+' || a.handle || '@agent-board.local'))::text,
+                     ' ' order by di.instance_id)
+     from agent_board.delegate_instances di join agent_board.agents a on a.id = di.agent_id
+    where di.instance_id in ('inst_aaaaaaaaaaaaaaaa_01', 'inst_aaaaaaaaaaaaaaaa_02', 'inst_aaaaaaaaaaaaaaaa_03')),
+  'true/agent/agent/active/true/true/true true/agent/agent/active/true/true/true true/agent/agent/active/true/true/true',
+  'each delegate row: the delegate fact, kind=agent_type=agent, active, owned by the owner''s uid, handle = the instance slug, its own auth user');
+-- 7 -- IF-0-HOSTED-12 / owner identity: the recorded owner is EXACTLY the uid enroll_federated_human provisioned
+select is(
+  (select string_agg(distinct (di.owner_user_id = pg_temp.u('OA.auth'))::text, ',')
+     from agent_board.delegate_instances di
+    where di.instance_id like 'inst_aaaaaaaaaaaaaaaa_0%'),
+  'true',
+  'owner identity: delegate_instances.owner_user_id is the auth uid enroll_federated_human created for the owner (never the raw sub)');
+-- 8 -- the credential row
+select is(
+  (select string_agg(ac.grant_id || '/' || ac.generation || '/' || (ac.revoked_at is null)::text
+                     || '/' || (ac.expires_at <= now() + interval '900 seconds')::text, ' ' order by ac.grant_id)
+     from agent_board.agent_credentials ac where ac.id in (pg_temp.u('I1.cred'), pg_temp.u('I2.cred'))),
+  'grant_aaaaaaaaaaaaaa_01_1/1/true/true grant_aaaaaaaaaaaaaa_02_1/1/true/true',
+  'IF-0-HOSTED-7: each credential row records grant_id and generation, is live, and expires within 900 s');
+
+-- ===========================================================================
+-- 3. add_delegate_to_board (IF-0-HOSTED-12; D2, D15) -- the owner, through the real path
+-- ===========================================================================
+select pg_temp.authn(pg_temp.u('OA.auth'));
+-- 9
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I1.agent'), pg_temp.v('BX')))
+  || ' ' || pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I2.agent'), pg_temp.v('BX')))
+  || ' ' || pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I3.agent'), pg_temp.v('BY'))),
+  'ok ok ok',
+  'the owner (provisioned by enroll_federated_human) adds its delegates: the owner gate passes for the real owner uid');
+-- 10
+select is(
+  pg_temp.state(pg_temp.u('BX'), pg_temp.u('I1.agent')) || ' ' || pg_temp.state(pg_temp.u('BX'), pg_temp.u('I2.agent'))
+  || ' ' || pg_temp.state(pg_temp.u('BY'), pg_temp.u('I3.agent')),
+  'joined/member joined/member joined/member',
+  'each delegate is joined as member, never higher');
+-- 11
+select is(
+  pg_temp.last_event(pg_temp.u('BX'), pg_temp.u('I1.agent')),
+  'principal-authored/principal_placement/' || pg_temp.v('OA') || '/joined',
+  'D2: the placement is principal-authored, kind principal_placement, with the OWNER as actor');
+-- 12
+select is(
+  agent_board._membership_consent_present(pg_temp.u('BX'), pg_temp.u('I1.agent'))::text
+  || '/' || agent_board._membership_consent_kind(pg_temp.u('BX'), pg_temp.u('I1.agent')),
+  'true/principal',
+  'D2: _membership_consent_present counts the principal''s placement as consent, and _kind reports it as principal');
+-- 13 -- non-owner: OB is a member of BX with the same authority, but is not I3's owner
+select pg_temp.authn(pg_temp.u('OB.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I3.agent'), pg_temp.v('BX'))),
+  '42501:only the delegate''s owner may add it to a board',
+  'owner only: a board member who is not the instance''s owner is refused');
+-- 14 -- no invite authority: OA is not a member of BZ
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I3.agent'), pg_temp.v('BZ'))),
+  '42501:adding a delegate requires the owner''s own member-invite authority on this board',
+  'the owner''s own member-invite authority is required: refused on a board the owner is not on');
+-- 15 -- service_role has no resolved actor
+select pg_temp.svc();
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I3.agent'), pg_temp.v('BX'))),
+  '42501:current agent principal not resolved',
+  'a service_role session (no actor) cannot add a delegate');
+-- 16 -- only a delegate is added this way
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('K2'), pg_temp.v('BY'))),
+  '42501:add_delegate_to_board adds only a hosted delegate',
+  'add_delegate_to_board refuses a target without the delegate fact');
+
+-- ===========================================================================
+-- 4. The allow set, each entry AS agent_board_delegate (lives, then a state check)
+-- ===========================================================================
+create temp table _ex(signature text primary key);
+select pg_temp.deleg(pg_temp.u('I1.auth'), pg_temp.u('I1.cred'));
+-- 17 -- create_or_find_thread
+select pg_temp.put('T1', pg_temp.as_d_val($$ select thread_id::text from agent_board.create_or_find_thread(null, 'hosted delegate thread', 'hosted-key-1') $$));
+insert into _ex values ('create_or_find_thread(uuid, text, text, text, jsonb)');
+select is(
+  (select created_by_agent_id::text from agent_board.threads where id::text = pg_temp.v('T1')),
+  pg_temp.v('I1.agent'),
+  'allow set: create_or_find_thread as a delegate creates a thread owned by the delegate');
+-- 18 -- post_board_message by id
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_board_message(%L::uuid, null, %L::uuid, 'subj 1', 'delegate post one',
+                         'comment', 'medium', null, '{"delegate": {"delegate": false, "forged": true}}'::jsonb) $$,
+                      pg_temp.v('T1'), pg_temp.v('BX'))),
+  'ok',
+  'allow set: post_board_message(by id) lives as a delegate');
+insert into _ex values ('post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb)');
+-- 19
+select is(
+  (select count(*)::int from agent_board.messages m
+    where m.thread_id::text = pg_temp.v('T1') and m.author_agent_id = pg_temp.u('I1.agent') and m.body = 'delegate post one'
+      and exists (select 1 from agent_board.delivery_recipients dr where dr.source_message_id = m.id and dr.board_id = pg_temp.u('BX'))),
+  1,
+  'state: the post is authored by the delegate''s own agent id and delivered to the board');
+-- 20 -- post_board_message by slug
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_board_message(%L::uuid, null::uuid, 'hosted-bx'::text, 'addressing_v1'::text, 'subj 2'::text, 'delegate post two'::text, 'comment', 'medium', null::text, '{}'::jsonb) $$,
+                      pg_temp.v('T1'))),
+  'ok',
+  'allow set: post_board_message(by slug) lives as a delegate');
+insert into _ex values ('post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb)');
+-- 21
+select is(
+  (select count(*)::int from agent_board.messages where thread_id::text = pg_temp.v('T1') and author_agent_id = pg_temp.u('I1.agent') and body = 'delegate post two'),
+  1,
+  'state: the by-slug post exists, authored by the delegate');
+-- 22 -- post_message (reply)
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_message(%L::uuid, null, 'delegate reply') $$, pg_temp.v('T1'))),
+  'ok',
+  'allow set: post_message (reply in a thread) lives as a delegate');
+insert into _ex values ('post_message(uuid, uuid, text, text, uuid, jsonb)');
+-- 23
+select is(
+  (select count(*)::int from agent_board.messages where thread_id::text = pg_temp.v('T1') and author_agent_id = pg_temp.u('I1.agent') and body = 'delegate reply'),
+  1,
+  'state: the reply exists, authored by the delegate');
+-- 24 -- the ambient schema preflight
+select is(
+  pg_temp.as_d_val($$ select version::text from agent_board.get_schema_version() $$),
+  '8',
+  'allow set (ambient): get_schema_version answers a delegate with the schema version');
+insert into _ex values ('get_schema_version()');
+-- 25 -- every rpc / ambient_rpc in the list was exercised above (the list, not this file, is the set)
+select is(
+  (select coalesce(string_agg(signature, ' | ' order by signature), '(none)')
+     from agent_board.delegate_allowed_operations
+    where kind in ('rpc', 'ambient_rpc') and signature not in (select signature from _ex)),
+  '(none)',
+  'every rpc and ambient_rpc entry of delegate_allowed_operations is exercised as a delegate in this file');
+-- 26 -- the predicates, as the delegate
+select is(
+  pg_temp.as_d_val(format($$ select concat_ws(' ',
+      (agent_board.current_agent_id() = %L::uuid)::text,
+      (%L::uuid = any (agent_board._delegate_visible_board_ids()))::text, (%L::uuid = any (agent_board._delegate_visible_board_ids()))::text,
+      agent_board._delegate_visible_agent(%L::uuid)::text, agent_board._delegate_visible_agent(%L::uuid)::text) $$,
+    pg_temp.v('I1.agent'), pg_temp.v('BX'), pg_temp.v('BZ'), pg_temp.v('K2'), pg_temp.v('Z1'))),
+  'true true false true false',
+  'predicates: current_agent_id is the delegate; BX visible, BZ not; a co-member visible, a BZ-only agent not');
+-- 27 -- every read_view returns rows to the delegate (the list read from the table)
+select is(
+  (select string_agg(o.name || '=' || (pg_temp.as_d_val(format('select count(*) from agent_board.%I', o.name))::int > 0)::text, ' ' order by o.name)
+     from agent_board.delegate_allowed_operations o where o.kind = 'read_view'),
+  'v_agent_dashboard=true v_agent_inbox=true v_board_feed=true v_board_memberships=true v_thread_feed=true',
+  'every read_view of the allow set returns rows to a delegate on its own board');
+-- 28
+select is(
+  pg_temp.as_d_val(format($$ select count(*) from agent_board.v_agent_dashboard where agent_id = %L $$, pg_temp.v('I1.agent'))),
+  '1',
+  'v_agent_dashboard returns the delegate''s own row (resolveActingAgentId needs it)');
+
+-- ===========================================================================
+-- 5. Attribution (#583 requirement 4, §Attribution)
+-- ===========================================================================
+select pg_temp.deleg(pg_temp.u('I2.auth'), pg_temp.u('I2.cred'));
+select pg_temp.put('T2', pg_temp.as_d_val($$ select thread_id::text from agent_board.create_or_find_thread(null, 'second', 'hosted-key-2') $$));
+select pg_temp.as_d(format($$ select agent_board.post_board_message(%L::uuid, null, %L::uuid, 'subj', 'delegate two post') $$, pg_temp.v('T2'), pg_temp.v('BX')));
+-- 29
+select is(
+  (select string_agg(m.author_agent_id::text || '|' || (m.metadata -> 'delegate' ->> 'instance_id'), ' ' order by m.metadata -> 'delegate' ->> 'instance_id')
+     from agent_board.messages m where m.body in ('delegate post one', 'delegate two post')),
+  pg_temp.v('I1.agent') || '|inst_aaaaaaaaaaaaaaaa_01 ' || pg_temp.v('I2.agent') || '|inst_aaaaaaaaaaaaaaaa_02',
+  'T1: two siblings'' posts are attributed to two distinct authors, each carrying its own instance id');
+-- 30
+select is(
+  (select m.metadata -> 'delegate' from agent_board.messages m where m.body = 'delegate post one'),
+  jsonb_build_object('delegate', true, 'instance_id', 'inst_aaaaaaaaaaaaaaaa_01', 'owner_agent_id', pg_temp.v('OA'),
+                     'client_id', 'client-claude-ai', 'client_verified', false),
+  'the server writes the delegate mark (delegate:true, the owner link, the client, client_verified:false), overwriting the caller''s forged one');
+-- 31
+select is(
+  (select count(*)::int from agent_board.signature_evidence se
+     join agent_board.messages m on m.id = se.source_message_id
+    where m.author_agent_id in (pg_temp.u('I1.agent'), pg_temp.u('I2.agent'))),
+  0,
+  'signed:false -- a delegate''s posts carry no signature evidence');
+-- 32 -- a keyed agent cannot forge the mark
+select pg_temp.authn(pg_temp.u('K.auth'));
+select pg_temp.try(format($$ select agent_board.post_board_message(%L::uuid, null, %L::uuid, 'k', 'keyed forged', 'comment', 'medium', null,
+                          '{"delegate": {"delegate": true, "instance_id": "forged"}}'::jsonb) $$,
+                   (select thread_id from agent_board.create_or_find_thread(pg_temp.u('K'), 'keyed', 'hosted-key-k')), pg_temp.v('BX')));
+select is(
+  (select (metadata ? 'delegate')::text || '/' || author_agent_id::text from agent_board.messages where body = 'keyed forged'),
+  'false/' || pg_temp.v('K'),
+  'a keyed agent''s caller-supplied delegate key is removed: no keyed agent can forge the mark');
+
+-- ===========================================================================
+-- 6. T2 -- reconnect keeps the instance; generations supersede
+-- ===========================================================================
+-- 33
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai'), 'I1b'),
+  'ok',
+  'T2: a reconnect (a new grant at generation 2, same client) is exchanged');
+-- 34
+select is(pg_temp.v('I1b.agent') || '/' || pg_temp.v('I1b.auth'), pg_temp.v('I1.agent') || '/' || pg_temp.v('I1.auth'),
+  'T2: the reconnect keeps the instance''s agent id and auth user');
+-- 35
+select is(
+  (select string_agg((revoked_at is not null)::text, ' ' order by generation) from agent_board.agent_credentials
+    where id in (pg_temp.u('I1.cred'), pg_temp.u('I1b.cred'))),
+  'true false',
+  'T2: the higher generation revoked the generation-1 credential in the same transaction, and its own is live');
+-- 36 -- the old credential fails a direct board call; the new one works
+select pg_temp.deleg(pg_temp.u('I1.auth'), pg_temp.u('I1.cred'));
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_message(%L::uuid, null, 'with the superseded credential') $$, pg_temp.v('T1'))),
+  '42501:current agent principal not resolved',
+  'T2: the superseded generation-1 credential fails a direct board call');
+-- 37
+select pg_temp.deleg(pg_temp.u('I1.auth'), pg_temp.u('I1b.cred'));
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_message(%L::uuid, null, 'with the generation-2 credential') $$, pg_temp.v('T1'))),
+  'ok',
+  'T2: the generation-2 credential works');
+-- 38 -- refresh: same grant, same generation
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai'), 'I1c')
+  || '/' || (pg_temp.v('I1c.agent') = pg_temp.v('I1.agent'))::text
+  || '/' || pg_temp.q(format($q$select (revoked_at is null)::text from agent_board.agent_credentials where id = %L$q$, pg_temp.v('I1b.cred'))),
+  'ok/true/true',
+  'T2: a refresh (same grant and generation) keeps the instance and revokes nothing');
+-- 39
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'x'),
+  '42501:generation_superseded',
+  'a lower generation is refused');
+-- 40
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_X', 2, 'hosted-owner-a', 'client-claude-ai'), 'x'),
+  '42501:grant_conflict',
+  'an equal generation with a different grant is refused');
+-- 41
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-chatgpt'), 'x'),
+  '42501:client_mismatch',
+  'an equal generation from another client is refused');
+-- 42 -- a new instance never reuses a sibling's identity
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_04', 'grant_aaaaaaaaaaaaaa_04_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'I4')
+  || '/' || (pg_temp.v('I4.agent') not in (pg_temp.v('I1.agent'), pg_temp.v('I2.agent'), pg_temp.v('I3.agent')))::text,
+  'ok/true',
+  'T2: a "new assistant" is a new instance with a new agent, never a sibling''s');
+
+-- ===========================================================================
+-- 7. T4 -- substitution and client changes
+-- ===========================================================================
+-- 43
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_3', 3, 'hosted-owner-b', 'client-claude-ai'), 'x'),
+  '42501:owner_mismatch',
+  'T4: an exchange naming another owner for an existing instance is refused (the owner is immutable)');
+-- 44
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_03', 'grant_aaaaaaaaaaaaaa_03_2', 2, 'hosted-owner-a', 'client-chatgpt'), 'x'),
+  '42501:client_mismatch',
+  'a higher generation from another client WITHOUT the owner''s cross-client confirmation is refused');
+-- 45
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_03', 'grant_aaaaaaaaaaaaaa_03_2', 2, 'hosted-owner-a', 'client-chatgpt',
+               '{"from_client_id": "client-claude-ai", "confirmed_at": 1790000000, "confirmed_generation": 2}'::jsonb), 'I3b'),
+  'ok',
+  '...and accepted WITH it at the higher generation');
+-- 46
+select is(
+  (select di.client_id || '/' || di.client_change_generation || '/' || (di.agent_id = pg_temp.u('I3.agent'))::text
+     from agent_board.delegate_instances di where di.instance_id = 'inst_aaaaaaaaaaaaaaaa_03')
+  || '/' || (select (revoked_at is not null)::text from agent_board.agent_credentials where id = pg_temp.u('I3.cred')),
+  'client-chatgpt/2/true/true',
+  'the new client and confirmation are recorded, the instance keeps its id, and the old generation''s credential is revoked');
+-- 47 -- a sibling's agent id substituted in a direct board call
+select pg_temp.deleg(pg_temp.u('I1.auth'), pg_temp.u('I1b.cred'));
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 's', 'as my sibling') $$,
+                      pg_temp.v('T1'), pg_temp.v('I2.agent'), pg_temp.v('BX'))),
+  '42501:p_author_agent_id must match current_agent_id()',
+  'T4: a sibling instance''s agent id substituted in a direct board call is refused');
+-- 48 -- a delegate row with NO credential claim resolves to null
+select pg_temp.deleg(pg_temp.u('I1.auth'), null);
+select is(
+  agent_board.current_agent_id(),
+  null,
+  'IF-0-HOSTED-6: a delegate token without its credential claim resolves to NULL (never the null-claim branch)');
+-- 49 -- ...and a keyed agent is unchanged
+select pg_temp.authn(pg_temp.u('K.auth'));
+select is(agent_board.current_agent_id(), pg_temp.u('K'),
+  'T5: a keyed agent without a credential claim still resolves through the null-claim branch');
+-- 50 -- every delegate row is an instance's agent, and no keyed row carries the fact
+select is(
+  (select count(*)::int from agent_board.agents a
+    where a.is_delegate and not exists (select 1 from agent_board.delegate_instances di where di.agent_id = a.id)),
+  0,
+  'T5: every row with the delegate fact belongs to an instance (keyed rows were backfilled false)');
+-- 51
+select is(
+  pg_temp.try(format($$ update agent_board.agents set is_delegate = false where id = %L $$, pg_temp.v('I1.agent'))),
+  '23514:agents.is_delegate never changes on an existing row',
+  'the delegate fact never changes on an existing row');
+
+-- ===========================================================================
+-- 8. What stays refused (§What stays refused for a delegate; D15)
+-- ===========================================================================
+-- 52 -- role writer
+select pg_temp.authn(pg_temp.u('K.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.grant_board_role(%L, %L, 'admin') $$, pg_temp.v('BX'), pg_temp.v('I1.agent'))),
+  '42501:grant_board_role cannot place or raise a hosted delegate; add_delegate_to_board is its only way onto a board',
+  'role writers: grant_board_role refuses a delegate target, so nothing raises a delegate above member');
+-- 53
+select is(pg_temp.state(pg_temp.u('BX'), pg_temp.u('I1.agent')), 'joined/member', '...and the delegate is still a member');
+-- 54 -- placement by an invite offer
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid) $$, pg_temp.v('BX'), pg_temp.v('I4.agent'), pg_temp.v('K'))),
+  '42501:a hosted delegate joins a board only through add_delegate_to_board',
+  'placement: invite_board_member refuses a delegate target (an offer it could never answer)');
+-- 55 -- the owner itself, as BW's owner, cannot place it by an invite (the flag is add_delegate_to_board's)
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid) $$, pg_temp.v('BW'), pg_temp.v('I4.agent'), pg_temp.v('OA'))),
+  '42501:a hosted delegate joins a board only through add_delegate_to_board',
+  'D15: even its OWNER cannot place it through another entrypoint -- the sink needs the admission flag');
+-- 56 -- the admin's admission path
+select pg_temp.authn(pg_temp.u('K.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'joined') $$, pg_temp.v('BY'), pg_temp.v('I1.agent'))),
+  'P0002:board membership not found',
+  'placement: an admin cannot seat a delegate that has no membership row');
+-- 57 -- a pre-existing raised row cannot be re-affirmed (the sink's post-write member assertion)
+-- (through try, so a mutation that broke I4's exchange fails the assertion below, not the file)
+select pg_temp.try(format($$ insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+                            values (%L, %L, 'admin', 'joined', %L) $$, pg_temp.v('BY'), pg_temp.v('I4.agent'), pg_temp.v('K')));
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I4.agent'), pg_temp.v('BY'))),
+  '42501:a hosted delegate''s board role is member, never higher',
+  'D15: the sink asserts member after the write -- a raised delegate row (seeded directly) is refused, not re-affirmed');
+delete from agent_board.board_memberships where board_id = pg_temp.u('BY') and agent_id = pg_temp.u('I4.agent');
+-- 58 -- a delegate redeeming an invite: it holds no EXECUTE on redeem_invite_link
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  has_function_privilege('agent_board_delegate', 'agent_board.redeem_invite_link(text,jsonb)', 'EXECUTE'),
+  false,
+  'a delegate cannot redeem any invite: no EXECUTE on redeem_invite_link');
+
+-- ===========================================================================
+-- 9. Removal (D7) and R-LINK-7; T3 -- siblings unchanged
+-- ===========================================================================
+-- 59 -- the owner, a plain member of BX, withdraws I2's delegate
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'left') $$, pg_temp.v('BX'), pg_temp.v('I2.agent'))),
+  'ok',
+  'D7: the owner removes its delegate though it is not a board admin');
+-- 60
+select is(
+  pg_temp.state(pg_temp.u('BX'), pg_temp.u('I2.agent')) || ' ' || pg_temp.last_event(pg_temp.u('BX'), pg_temp.u('I2.agent')),
+  'left/member principal-authored/principal_withdraw/' || pg_temp.v('OA') || '/left',
+  'D7: recorded principal-authored, kind principal_withdraw, the owner as actor');
+-- 61
+select is(pg_temp.state(pg_temp.u('BX'), pg_temp.u('I1.agent')), 'joined/member',
+  'T3: one instance''s membership change leaves its sibling''s membership unchanged');
+-- 62 -- the owner-check mutation pin: service_role setting the flag still cannot place it
+select pg_temp.svc();
+select set_config('agent_board.delegate_admission', pg_temp.v('I2.agent'), true);
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'joined') $$, pg_temp.v('BX'), pg_temp.v('I2.agent'))),
+  '42501:a hosted delegate joins a board only through add_delegate_to_board',
+  'D15: a service_role session that sets the admission flag is still refused -- it is not the owner');
+select set_config('agent_board.delegate_admission', '', true);
+-- 63 -- a board admin removes a delegate
+select pg_temp.authn(pg_temp.u('K.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'removed') $$, pg_temp.v('BX'), pg_temp.v('I1.agent')))
+  || ' ' || pg_temp.last_event(pg_temp.u('BX'), pg_temp.u('I1.agent')),
+  'ok board-authored/eviction/' || pg_temp.v('K') || '/removed',
+  'a board admin removes a delegate through the existing path (board-authored eviction)');
+-- 64 -- R-LINK-7
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I1.agent'), pg_temp.v('BX'))),
+  '42501:a removed delegate stays removed; a board admin must lift the removal',
+  'R-LINK-7: the owner cannot re-add a delegate an admin removed');
+-- 65 -- D7 never launders an eviction
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'left') $$, pg_temp.v('BX'), pg_temp.v('I1.agent')))
+  || ' ' || pg_temp.state(pg_temp.u('BX'), pg_temp.u('I1.agent')),
+  '42501:a principal may withdraw its delegate only from an active or pending membership removed/member',
+  'D7: the owner cannot turn `removed` into `left` (the eviction is not laundered)');
+
+-- ===========================================================================
+-- 10. D12 -- a delegate leaves when its owner does
+-- ===========================================================================
+-- 66 -- the owner leaves BY on its own
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'left') $$, pg_temp.v('BY'), pg_temp.v('OA'))),
+  'ok',
+  'D12 setup: the owner leaves BY');
+-- 67
+select is(
+  pg_temp.state(pg_temp.u('BY'), pg_temp.u('I3.agent')) || ' ' || pg_temp.last_event(pg_temp.u('BY'), pg_temp.u('I3.agent')),
+  'left/member principal-authored/principal_withdraw/' || pg_temp.v('OA') || '/left',
+  'D12: its delegate on BY moved to left in the same transaction, recorded as the principal''s withdrawal');
+-- 68 -- the owner's return does not restore it
+select pg_temp.svc();
+select pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'joined') $$, pg_temp.v('BY'), pg_temp.v('OA')));
+select is(pg_temp.state(pg_temp.u('BY'), pg_temp.u('OA')) || ' ' || pg_temp.state(pg_temp.u('BY'), pg_temp.u('I3.agent')),
+  'joined/member left/member',
+  'D12: the owner''s return does not bring its delegate back');
+-- 69, 70 -- an admin removing the owner evicts its delegates too
+select pg_temp.exch(pg_temp.claim('inst_bbbbbbbbbbbbbbbb_06', 'grant_bbbbbbbbbbbbbb_06_1', 1, 'hosted-owner-b', 'client-codex'), 'I6');
+select pg_temp.authn(pg_temp.u('OB.auth'));
+select is(
+  pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I6.agent'), pg_temp.v('BX'))),
+  'ok',
+  'D12 setup: owner B adds its delegate to BX');
+select pg_temp.authn(pg_temp.u('K.auth'));
+select pg_temp.try(format($$ select agent_board.update_board_membership(%L, %L, 'removed') $$, pg_temp.v('BX'), pg_temp.v('OB')));
+select is(
+  pg_temp.state(pg_temp.u('BX'), pg_temp.u('I6.agent')) || ' ' || pg_temp.last_event(pg_temp.u('BX'), pg_temp.u('I6.agent')),
+  'left/member board-authored/eviction/' || pg_temp.v('K') || '/left',
+  'D12: when an admin removes the owner, its delegate moves to left, recorded as the admin''s eviction');
+
+-- ===========================================================================
+-- 11. Tombstones (IF-0-HOSTED-8); T3 -- revocation is per instance
+-- ===========================================================================
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I4.agent'), pg_temp.v('BX')));
+-- 71
+select is(pg_temp.tomb('inst_aaaaaaaaaaaaaaaa_04', 'hosted-owner-a'), 'first=true',
+  'a Portal revocation tombstones an instance');
+-- 72
+select is(
+  (select (di.tombstoned_at is not null)::text || '/' || di.tombstone_reason from agent_board.delegate_instances di where di.instance_id = 'inst_aaaaaaaaaaaaaaaa_04')
+  || ' ' || (select status from agent_board.agents where id = pg_temp.u('I4.agent'))
+  || ' ' || (select count(*) from agent_board.agent_credentials where agent_id = pg_temp.u('I4.agent') and revoked_at is null)::text,
+  'true/owner_revoked revoked 0',
+  'the tombstone, in one transaction: recorded, the agent revoked, every credential revoked');
+-- 73
+select is(
+  pg_temp.state(pg_temp.u('BX'), pg_temp.u('I4.agent')) || ' ' || pg_temp.last_event(pg_temp.u('BX'), pg_temp.u('I4.agent')),
+  'left/member operator-designated/operator_removal/null/left',
+  'the tombstone ends memberships through update_board_membership(..., ''left''): an operator_removal event');
+-- 74
+select pg_temp.deleg(pg_temp.u('I4.auth'), pg_temp.u('I4.cred'));
+select is(agent_board.current_agent_id(), null, 'T3: the tombstoned instance''s credential no longer resolves');
+-- 75 -- siblings unchanged
+select is(
+  (select string_agg(a.status || '/' || (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null)::text, ' ' order by di.instance_id)
+     from agent_board.delegate_instances di join agent_board.agents a on a.id = di.agent_id
+    where di.instance_id in ('inst_aaaaaaaaaaaaaaaa_01', 'inst_aaaaaaaaaaaaaaaa_03')),
+  'active/2 active/1',
+  'T3: one instance''s tombstone leaves its siblings'' agents and credentials unchanged');
+-- 76 -- idempotent
+select is(
+  pg_temp.tomb('inst_aaaaaaaaaaaaaaaa_04', 'hosted-owner-a', 'portal_admin')
+  || ' ' || pg_temp.q($q$select tombstone_reason from agent_board.delegate_instances where instance_id = 'inst_aaaaaaaaaaaaaaaa_04'$q$),
+  'first=false owner_revoked',
+  'a repeat tombstone is a no-op: first=false, nothing changes');
+-- 77 -- a revoked instance is never resurrected
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_04', 'grant_aaaaaaaaaaaaaa_04_9', 9, 'hosted-owner-a', 'client-claude-ai'), 'x'),
+  '42501:instance_revoked',
+  'T3: a tombstoned instance id is refused at any later exchange, whatever generation');
+-- 78, 79 -- a tombstone BEFORE the first exchange
+select is(pg_temp.tomb('inst_aaaaaaaaaaaaaaaa_05', 'hosted-owner-a'), 'first=true',
+  'a revocation before the first exchange creates the tombstoned row');
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_05', 'grant_aaaaaaaaaaaaaa_05_1', 1, 'hosted-owner-a', 'client-claude-ai'), 'x')
+  || ' ' || pg_temp.q($q$select count(*)::text from agent_board.agents where handle = agent_board._delegate_instance_slug('https://portal.hosted.test', 'inst_aaaaaaaaaaaaaaaa_05')$q$),
+  '42501:instance_revoked 0',
+  '...so the first exchange is refused and no agent is created');
+-- 80 -- a revocation naming another owner
+select is(
+  pg_temp.tomb('inst_aaaaaaaaaaaaaaaa_03', 'hosted-owner-b')
+  || ' ' || pg_temp.q($q$select (tombstoned_at is null)::text from agent_board.delegate_instances where instance_id = 'inst_aaaaaaaaaaaaaaaa_03'$q$),
+  '42501:owner_mismatch true',
+  'a revocation naming an existing instance of another owner is refused and changes nothing');
+-- 81 -- a token the Portal reports revoked
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai', null, null, 'revoked'), 'x')
+  || ' ' || pg_temp.q($q$select (tombstoned_at is null)::text from agent_board.delegate_instances where instance_id = 'inst_aaaaaaaaaaaaaaaa_01'$q$),
+  '42501:instance_revoked true',
+  'a token whose instance claim reports revoked is refused, and does not tombstone (only a Portal revocation does)');
+
+-- ===========================================================================
+-- 12. Revoking the owner revokes its delegates
+-- ===========================================================================
+select pg_temp.svc();
+select pg_temp.try(format($$ select agent_board.revoke_human_subtree(%L, %L, 'hosted test') $$, pg_temp.v('OB.auth'), pg_temp.v('K')));
+-- 82
+select is((select status from agent_board.agents where id = pg_temp.u('I6.agent')), 'revoked',
+  'revoke_human_subtree revokes the owner''s delegates (their owner_user_id is the owner)');
+-- 83
+select is(
+  pg_temp.exch(pg_temp.claim('inst_bbbbbbbbbbbbbbbb_06', 'grant_bbbbbbbbbbbbbb_06_2', 2, 'hosted-owner-b', 'client-codex'), 'x')
+  || ' ' || pg_temp.q($q$select (tombstoned_at is null)::text from agent_board.delegate_instances where instance_id = 'inst_bbbbbbbbbbbbbbbb_06'$q$),
+  '42501:owner_inactive true',
+  'N2: an exchange for an instance of a revoked owner is refused owner_inactive (the owner check precedes the instance''s own), and does not tombstone');
+
+-- ===========================================================================
+-- 13. D8 -- the resource
+-- ===========================================================================
+-- 84
+select is(
+  pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_07', 'grant_cccccccccccccc_07_1', 1, 'hosted-owner-c', 'client-c', null,
+               'https://mcp.hosted.test/mcp/s/slotAAAAAAAAAAAAAAAAAAAAAAA'), 'I7')
+  || ' ' || pg_temp.q($q$select slot_resource from agent_board.delegate_instances where instance_id = 'inst_cccccccccccccccc_07'$q$),
+  'ok https://mcp.hosted.test/mcp/s/slotAAAAAAAAAAAAAAAAAAAAAAA',
+  'D8: the first exchange records the slot');
+-- 85
+select is(
+  pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_07', 'grant_cccccccccccccc_07_1', 1, 'hosted-owner-c', 'client-c'), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_07', 'grant_cccccccccccccc_07_2', 2, 'hosted-owner-c', 'client-c', null,
+               'https://mcp.hosted.test/mcp/s/slotBBBBBBBBBBBBBBBBBBBBBBB'), 'x'),
+  '42501:resource_mismatch 42501:resource_mismatch',
+  'D8: a slotted instance refuses the base URL and any other slot, even at a higher generation');
+-- 86
+select is(
+  pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_08', 'grant_cccccccccccccc_08_1', 1, 'hosted-owner-c', 'client-c', null,
+               'https://mcp.hosted.test/mcp/s/slotAAAAAAAAAAAAAAAAAAAAAAA'), 'x')
+  || ' ' || pg_temp.q($q$select count(*)::text from agent_board.delegate_instances where instance_id = 'inst_cccccccccccccccc_08'$q$),
+  '42501:slot_in_use 0',
+  'D8: a slot belongs to one instance; another instance''s exchange for it is refused and keeps nothing');
+-- 87, 88 -- the one move: base URL -> slot, only at a higher generation
+select pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_09', 'grant_cccccccccccccc_09_1', 1, 'hosted-owner-c', 'client-c'), 'I9');
+select is(
+  pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_09', 'grant_cccccccccccccc_09_1', 1, 'hosted-owner-c', 'client-c', null,
+               'https://mcp.hosted.test/mcp/s/slotCCCCCCCCCCCCCCCCCCCCCCC'), 'x'),
+  '42501:resource_mismatch',
+  'D8: an instance recorded at the base URL cannot move to a slot on the same grant');
+select is(
+  pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_09', 'grant_cccccccccccccc_09_2', 2, 'hosted-owner-c', 'client-c', null,
+               'https://mcp.hosted.test/mcp/s/slotCCCCCCCCCCCCCCCCCCCCCCC'), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_cccccccccccccccc_09', 'grant_cccccccccccccc_09_3', 3, 'hosted-owner-c', 'client-c'), 'x'),
+  'ok 42501:resource_mismatch',
+  'D8: ...it moves once, at a higher generation, and never reverts to the base URL');
+
+-- ===========================================================================
+-- 14. D13 -- at most 20 live instances per owner
+-- ===========================================================================
+-- Owner C already has instances 07 and 09 live; add 18 more to reach 20.
+select pg_temp.put('cap', (select string_agg(pg_temp.exch(pg_temp.claim('inst_capcapcapcapcap_' || lpad(n::text, 2, '0'),
+                                    'grant_capcapcapcapca_' || lpad(n::text, 2, '0'), 1, 'hosted-owner-c', 'client-c'), 'cap' || n), ',')
+                             from generate_series(1, 18) n));
+-- 89
+select is(
+  (select count(*)::int from agent_board.delegate_instances di where di.owner_user_id = pg_temp.u('OC.auth') and di.tombstoned_at is null),
+  20,
+  'D13 setup: owner C has 20 live instances');
+-- 90
+select is(
+  pg_temp.exch(pg_temp.claim('inst_capcapcapcapcap_21', 'grant_capcapcapcapca_21', 1, 'hosted-owner-c', 'client-c'), 'x'),
+  '42501:instance_cap',
+  'D13: a first exchange that would give an owner a 21st live instance is refused');
+-- 91
+select pg_temp.tomb('inst_capcapcapcapcap_01', 'hosted-owner-c');
+select is(
+  pg_temp.exch(pg_temp.claim('inst_capcapcapcapcap_21', 'grant_capcapcapcapca_21', 1, 'hosted-owner-c', 'client-c'), 'x'),
+  'ok',
+  'D13: a tombstoned instance does not count toward the cap');
+
+-- ===========================================================================
+-- 15. D16 -- nothing is addressed to a delegate except through a board it is active on
+-- ===========================================================================
+select pg_temp.authn(pg_temp.u('K.auth'));
+select pg_temp.put('TK', (select thread_id::text from agent_board.create_or_find_thread(pg_temp.u('K'), 'keyed tasks', 'hosted-key-tasks')));
+select pg_temp.put('cnt0', (select (select count(*) from agent_board.tasks)::text || '/' || (select count(*) from agent_board.escalations)::text
+                                   || '/' || (select count(*) from agent_board.delegations)::text));
+-- 92
+select is(
+  pg_temp.try(format($$ select agent_board.create_task(%L, null, 'for a delegate', null, %L) $$, pg_temp.v('TK'), pg_temp.v('I3.agent'))),
+  '42501:a hosted delegate is addressed only through a board it is active on (task assignment)',
+  'D16: a task assigned to a delegate is refused');
+-- 93
+select is(
+  pg_temp.try(format($$ select agent_board.raise_escalation(%L, null, 'to a delegate', 'other', 'medium', null, %L) $$, pg_temp.v('TK'), pg_temp.v('I3.agent'))),
+  '42501:a hosted delegate is addressed only through a board it is active on (escalation assignment)',
+  'D16: an escalation assigned to a delegate is refused');
+-- 94
+select pg_temp.put('PT', (select task_id::text from agent_board.create_task(pg_temp.u('TK'), null, 'parent')));
+select is(
+  pg_temp.try(format($$ select agent_board.delegate_task(%L, null, 'child', null, %L) $$, pg_temp.v('PT'), pg_temp.v('I3.agent'))),
+  '42501:a hosted delegate is addressed only through a board it is active on (task assignment)',
+  'D16: task delegation to a delegate is refused');
+-- 95
+select is(
+  (select (select count(*) from agent_board.tasks)::text || '/' || (select count(*) from agent_board.escalations)::text
+          || '/' || (select count(*) from agent_board.delegations)::text),
+  (select split_part(pg_temp.v('cnt0'), '/', 1)::int + 1)::text || '/' || split_part(pg_temp.v('cnt0'), '/', 2) || '/' || split_part(pg_temp.v('cnt0'), '/', 3),
+  'D16: the refused assignments wrote no task, escalation or delegation (only the parent task exists)');
+-- 96, 97 -- a multicast naming a member and a delegate refuses the WHOLE call
+select pg_temp.put('cnt1', (select count(*) from agent_board.delivery_recipients)::text || '/' || (select count(*) from agent_board.inbox_items)::text);
+select is(
+  pg_temp.try(format($$ select agent_board.send_multicast_message(%L, null, %L::jsonb, 'addressing_v1', 's', 'to a member and a delegate', 'comment', 'medium', null, '{}'::jsonb) $$,
+                     pg_temp.v('TK'), jsonb_build_array(jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v('K2')),
+                                                        jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v('I3.agent')))::text)),
+  '42501:a hosted delegate is reached only through a board it is on',
+  'D16/NEW-4: a multicast naming a member AND a delegate refuses the whole call');
+select is(
+  (select count(*) from agent_board.delivery_recipients)::text || '/' || (select count(*) from agent_board.inbox_items)::text,
+  pg_temp.v('cnt1'),
+  'D16/NEW-4: ...and wrote no delivery and no inbox item, for anyone');
+-- 98 -- the raw-uuid overload has no resolver: the delivery writer refuses it instead
+select is(
+  pg_temp.try(format($$ select agent_board.send_multicast_message(%L, null, array[%L, %L]::uuid[], 's', 'raw ids') $$,
+                     pg_temp.v('TK'), pg_temp.v('K2'), pg_temp.v('I3.agent'))),
+  '42501:a hosted delegate is addressed only through a board it is active on (delivery)',
+  'D16: the raw-id multicast naming a delegate is refused by the delivery writer');
+-- 99 -- the dry run shows the denial
+select is(
+  (select r."deniedRecipients" -> 0 ->> 'reason'
+     from agent_board.expand_recipients_dry_run(null,
+            jsonb_build_array(jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v('I3.agent'))), null) r),
+  'recipient_is_hosted_delegate',
+  'D16/NEW-4: the dry run reports recipient_is_hosted_delegate for an explicitly named delegate');
+-- 100
+select is(
+  (select r."deniedRecipients" -> 0 ->> 'reason'
+     from agent_board.expand_recipients_dry_run(null,
+            jsonb_build_array(jsonb_build_object('kind', 'agent_handle', 'handle',
+              (select handle from agent_board.agents where id = pg_temp.u('I3.agent')))), null) r),
+  'recipient_is_hosted_delegate',
+  'D16/NEW-4: ...and for one named by handle');
+-- 101 -- an expansion never includes a delegate
+select is(
+  (select (exists (select 1 from jsonb_array_elements(r."resolvedRecipients") e
+                    where (e ->> 'agentId')::uuid in (select id from agent_board.agents where is_delegate)))::text
+          || '/' || (r."resolvedRecipients" @> jsonb_build_array(jsonb_build_object('agentId', pg_temp.v('K2'))))::text
+          || '/' || jsonb_array_length(r."deniedRecipients")
+     from agent_board.resolve_recipients(null, '[{"kind": "role_selector", "role": "agent"}]'::jsonb) r),
+  'false/true/0',
+  'D16/NEW-4: a role_selector expansion matching delegates delivers to the others and leaves the delegates out');
+-- 102, 103 -- the board-post fan-out still reaches an active delegate member
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select pg_temp.try(format($$ select agent_board.add_delegate_to_board(%L, %L) $$, pg_temp.v('I3.agent'), pg_temp.v('BW')));
+select pg_temp.authn(pg_temp.u('K.auth'));
+select pg_temp.put('TW', (select thread_id::text from agent_board.create_or_find_thread(pg_temp.u('K'), 'to BW', 'hosted-key-bw')));
+select is(
+  pg_temp.try(format($$ select agent_board.post_board_message(%L, null, %L, 's', 'fan-out to BW') $$, pg_temp.v('TW'), pg_temp.v('BW'))),
+  'ok',
+  'D16: a board post on a board the delegate is active on succeeds');
+select is(
+  (select count(*)::int from agent_board.inbox_items ii
+     join agent_board.messages m on m.id = ii.source_message_id
+    where ii.recipient_agent_id = pg_temp.u('I3.agent') and ii.board_id = pg_temp.u('BW') and m.body = 'fan-out to BW'),
+  1,
+  'D16: ...and its fan-out to members reaches the delegate (a board-scoped delivery)');
+
+-- ===========================================================================
+-- 16. The exchange's own shape checks
+-- ===========================================================================
+-- 104
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai') #- '{agent_board_delegate_instance,status}', 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai')
+                         || jsonb_build_object('agent_board_delegate_instance', pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai') -> 'agent_board_delegate_instance' || '{"extra": 1}'::jsonb), 'x')
+  || ' ' || pg_temp.exch(jsonb_set(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai'),
+                                   '{agent_board_delegate_instance,owner_sub}', '"someone-else"'), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_short', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai'), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_01', 'grant_aaaaaaaaaaaaaa_01_2', 2, 'hosted-owner-a', 'client-claude-ai', null,
+                                       'https://mcp.hosted.test/mcp/s/slotDDDDDDDDDDDDDDDDDDDDDDD?x=1'), 'x'),
+  '22023:claims_malformed 22023:claims_malformed 22023:claims_malformed 22023:claims_malformed 22023:claims_malformed',
+  'the RPC refuses a missing field, an extra field, owner_sub <> sub, a malformed instance id and a slot with a query');
+
+-- ===========================================================================
+-- 17. First exchange with client_change, and the T2 worked example
+-- ===========================================================================
+-- 105
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_10', 'grant_aaaaaaaaaaaaaa_10_1', 1, 'hosted-owner-a', 'client-A'), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_10', 'grant_aaaaaaaaaaaaaa_10_2', 2, 'hosted-owner-a', 'client-B',
+                  '{"from_client_id": "client-A", "confirmed_at": 1790000001, "confirmed_generation": 2}'::jsonb), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_10', 'grant_aaaaaaaaaaaaaa_10_3', 3, 'hosted-owner-a', 'client-B',
+                  '{"from_client_id": "client-A", "confirmed_at": 1790000001, "confirmed_generation": 2}'::jsonb), 'x'),
+  'ok ok ok',
+  'T2 worked example: a confirmed cross-client reconnect, then a same-client reconnect still carrying the confirmation');
+-- 106
+select is(
+  pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_11', 'grant_aaaaaaaaaaaaaa_11_1', 1, 'hosted-owner-a', 'client-B',
+                  '{"from_client_id": "client-A", "confirmed_at": 1790000001, "confirmed_generation": 1}'::jsonb), 'x')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_aaaaaaaaaaaaaaaa_10', 'grant_aaaaaaaaaaaaaa_10_4', 4, 'hosted-owner-a', 'client-C',
+                  '{"from_client_id": "client-B", "confirmed_at": 1790000002, "confirmed_generation": 2}'::jsonb), 'x'),
+  'ok 42501:client_mismatch',
+  'a first exchange accepts a client_change; a later client change whose confirmation predates the recorded binding is refused');
+
+-- ===========================================================================
+-- 18. The owner leaving through leave_board, and the cascade's exact reach
+-- ===========================================================================
+-- 107 -- I3's delegate is on BW (joined above); OA leaves BW through leave_board
+select pg_temp.authn(pg_temp.u('OA.auth'));
+select is( -- pgtap-allow-raise-checked: the RPC runs inside pg_temp.try, which returns a raise as text
+  pg_temp.try(format($$ select agent_board.leave_board(%L, %L) $$, pg_temp.v('BW'), pg_temp.v('OA')))
+  || ' ' || pg_temp.state(pg_temp.u('BW'), pg_temp.u('I3.agent')),
+  'ok left/member',
+  'D12: leave_board (another route to the same sink) also takes the owner''s delegates with it');
+-- 108 -- the cascade touches only the owner's delegates on THAT board
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join agent_board.agents a on a.id = bm.agent_id
+    where a.is_delegate and bm.membership_state in ('joined', 'subscribed')),
+  0,
+  'D12: no delegate is left active anywhere once each of its owners'' standing ended');
+-- 109 -- the D12 cascade leaves non-delegates alone
+select is(pg_temp.state(pg_temp.u('BW'), pg_temp.u('K')), 'joined/member',
+  'D12: the owner leaving does not touch a non-delegate co-member');
+
+-- ===========================================================================
+-- 19. The ledger CHECK and guard for principal-authored
+-- ===========================================================================
+-- 110
+select is(
+  pg_temp.try(format($$ insert into agent_board.board_membership_events(board_id, agent_id, event_kind, result_state, provenance, actor_agent_id)
+                        values (%L, %L, 'principal_placement', 'joined', 'principal-authored', %L) $$,
+                     pg_temp.v('BX'), pg_temp.v('I1.agent'), pg_temp.v('K'))),
+  '23514:substrate CHECK refuses principal-authored actor that is not the subject''s principal',
+  'the guard refuses a principal-authored event whose actor is not the subject''s principal');
+-- 111
+select is(
+  pg_temp.try(format($$ insert into agent_board.board_membership_events(board_id, agent_id, event_kind, result_state, provenance, actor_agent_id)
+                        values (%L, %L, 'principal_placement', 'joined', 'principal-authored', %L) $$,
+                     pg_temp.v('BX'), pg_temp.v('K2'), pg_temp.v('K'))),
+  '23514:substrate CHECK refuses principal-authored actor that is not the subject''s principal',
+  '...and one whose subject is not a delegate at all');
+-- 112 -- the CHECK arm itself, with the guard out of the way (the guard refuses first otherwise)
+alter table agent_board.board_membership_events disable trigger trg_board_membership_events_provenance_guard;
+select is(
+  pg_temp.try(format($$ insert into agent_board.board_membership_events(board_id, agent_id, event_kind, result_state, provenance, actor_agent_id)
+                        values (%L, %L, 'principal_placement', 'joined', 'principal-authored', %L) $$,
+                     pg_temp.v('BX'), pg_temp.v('I1.agent'), pg_temp.v('I1.agent'))),
+  '23514:new row for relation "board_membership_events" violates check constraint "board_membership_events_provenance_actor"',
+  'the CHECK arm refuses a principal-authored event whose actor is its subject');
+alter table agent_board.board_membership_events enable trigger trg_board_membership_events_provenance_guard;
+-- 113
+select is(
+  (select agent_board._membership_consent_kind(pg_temp.u('BX'), pg_temp.u('I2.agent'))),
+  null,
+  'a principal WITHDRAWAL is a removal: the withdrawn delegate has no consent kind');
+
+-- ===========================================================================
+-- 20. Visibility after removal, for the delegate itself (the full matrix is in
+--     agent_board_delegate_role_class.test.sql)
+-- ===========================================================================
+-- 114 -- I1 was removed from BX: its own posts there are now invisible to it
+select pg_temp.deleg(pg_temp.u('I1.auth'), pg_temp.u('I1b.cred'));
+select is(
+  pg_temp.as_d_val(format($$ select count(*) from agent_board.messages where author_agent_id = %L $$, pg_temp.v('I1.agent'))),
+  '0',
+  'D14: after its removal from BX the delegate no longer reads even the posts it authored there');
+-- 115
+select is(
+  pg_temp.as_d_val(format($$ select count(*) from agent_board.v_board_feed where board_id = %L $$, pg_temp.v('BX'))),
+  '0',
+  'D14: ...nor the board feed');
+-- 116 -- and it cannot post there any more
+select is(
+  pg_temp.as_d(format($$ select agent_board.post_board_message(%L::uuid, null, %L::uuid, 's', 'after removal') $$, pg_temp.v('T1'), pg_temp.v('BX'))),
+  '42501:board not accessible to current agent',
+  'a removed delegate cannot post to the board');
+
+-- ===========================================================================
+-- 21. The compatibility report covers the role
+-- ===========================================================================
+-- 117
+select is(
+  (agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'),
+  'true',
+  'signed_* stays operator-only for authenticated, anon AND agent_board_delegate');
+-- 118
+select ok(
+  agent_board_test.stripped_body('agent_board.get_bundle_compatibility()'::regprocedure, true) ~ '''agent_board_delegate''',
+  'get_bundle_compatibility''s signed_write_enforced names the delegate role');
+
+-- ===========================================================================
+-- 22. The admission flag never outlives add_delegate_to_board
+-- ===========================================================================
+-- 119
+select is(coalesce(current_setting('agent_board.delegate_admission', true), ''), '',
+  'D15: add_delegate_to_board clears the admission flag before returning');
+-- 120 -- the role is never a member of authenticated (it would inherit every authenticated grant)
+select is(pg_has_role('agent_board_delegate', 'authenticated', 'MEMBER'), false,
+  'agent_board_delegate is not a member of authenticated');
+
+-- 121 -- delegate_instances: SELECT for service_role only (the operator check), no writes for anyone
+select is(
+  (select string_agg(r || ':' || p || '=' || has_table_privilege(r, 'agent_board.delegate_instances', p)::text, ' ' order by r, p)
+     from unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r
+    cross join unnest(array['SELECT', 'INSERT', 'UPDATE', 'DELETE']) p),
+  'agent_board_delegate:DELETE=false agent_board_delegate:INSERT=false agent_board_delegate:SELECT=false agent_board_delegate:UPDATE=false anon:DELETE=false anon:INSERT=false anon:SELECT=false anon:UPDATE=false authenticated:DELETE=false authenticated:INSERT=false authenticated:SELECT=false authenticated:UPDATE=false service_role:DELETE=false service_role:INSERT=false service_role:SELECT=true service_role:UPDATE=false',
+  'delegate_instances is written only by its two RPCs; service_role may only read it');
+
+-- ===========================================================================
+-- 23. N2 -- a revoked or suspended owner has no hosted path (fix lane, PR #590)
+-- ===========================================================================
+-- The exchange refuses owner_inactive when (iss, sub) is in fleet_human_revocations or the
+-- owner's human row (agents.auth_user_id = the owner uid) is not active, as
+-- enroll_federated_human does. Each refusal is checked to have written nothing.
+create function pg_temp.n2_rows(p_iid text) returns text language sql as $$
+  select (select count(*) from agent_board.delegate_instances where instance_id = p_iid)::text
+    || ' ' || (select count(*) from agent_board.agents
+                where handle = agent_board._delegate_instance_slug('https://portal.hosted.test', p_iid))::text
+    || ' ' || (select count(*) from auth.users
+                where email = 'agent+' || agent_board._delegate_instance_slug('https://portal.hosted.test', p_iid) || '@agent-board.local')::text
+$$;
+-- 122 -- owner B was revoked by revoke_human_subtree (section 12): a NEW instance is refused too
+select is(
+  pg_temp.exch(pg_temp.claim('inst_bbbbbbbbbbbbbbbb_n2', 'grant_bbbbbbbbbbbbbb_n2_1', 1, 'hosted-owner-b', 'client-codex'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_bbbbbbbbbbbbbbbb_n2'),
+  '42501:owner_inactive 0 0 0',
+  'N2: a fleet-revoked human cannot bring up a new delegate instance: refused, and no instance, agent or auth user is written');
+
+-- Owner D: a federated human, enrolled through the real RPC.
+do $$
+declare r record;
+begin
+  perform set_config('request.jwt.claims', '', true);
+  select * into r from agent_board.enroll_federated_human(
+    'https://portal.hosted.test', 'message-board', 'hosted-owner-d',
+    jsonb_build_object('sub', 'hosted-owner-d'), 'Owner D');
+  perform pg_temp.put('OD', r.agent_id::text);
+end $$;
+-- 123 -- control: a live owner exchanges
+select is(
+  pg_temp.exch(pg_temp.claim('inst_dddddddddddddddd_01', 'grant_dddddddddddddd_01_1', 1, 'hosted-owner-d', 'client-d'), 'D1')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_dddddddddddddddd_02', 'grant_dddddddddddddd_02_1', 1, 'hosted-owner-d', 'client-d'), 'D2'),
+  'ok ok',
+  'N2 control: an active, unrevoked owner''s first exchanges succeed');
+-- 124 -- the delegate itself suspended, the owner live: still agent_inactive
+select pg_temp.svc();
+select pg_temp.try(format($$ select agent_board.revoke_agent(%L, 'hosted n2 test') $$, pg_temp.v('D2.agent')));
+select is(
+  pg_temp.exch(pg_temp.claim('inst_dddddddddddddddd_02', 'grant_dddddddddddddd_02_1', 1, 'hosted-owner-d', 'client-d'), 'x')
+  || ' ' || pg_temp.q($q$select (tombstoned_at is null)::text from agent_board.delegate_instances where instance_id = 'inst_dddddddddddddddd_02'$q$),
+  '42501:agent_inactive true',
+  'an exchange for a suspended delegate of a live owner is refused agent_inactive, and does not tombstone');
+-- 125 -- the OWNER suspended (revoke_agent): its existing delegate stops exchanging
+select pg_temp.svc();
+select pg_temp.try(format($$ select agent_board.revoke_agent(%L, 'hosted n2 test') $$, pg_temp.v('OD')));
+select is(
+  pg_temp.q(format($q$select status from agent_board.agents where id = %L$q$, pg_temp.v('OD')))
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_dddddddddddddddd_01', 'grant_dddddddddddddd_01_1', 1, 'hosted-owner-d', 'client-d'), 'x')
+  || ' ' || pg_temp.q($q$select (tombstoned_at is null)::text from agent_board.delegate_instances where instance_id = 'inst_dddddddddddddddd_01'$q$)
+  || ' ' || pg_temp.q(format($q$select count(*)::text from agent_board.agent_credentials where agent_id = %L and revoked_at is null$q$, pg_temp.v('D1.agent'))),
+  'suspended 42501:owner_inactive true 1',
+  'N2: a suspended owner''s existing delegate is refused owner_inactive: no new credential, no tombstone');
+-- 126
+select is(
+  pg_temp.exch(pg_temp.claim('inst_dddddddddddddddd_03', 'grant_dddddddddddddd_03_1', 1, 'hosted-owner-d', 'client-d'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_dddddddddddddddd_03'),
+  '42501:owner_inactive 0 0 0',
+  'N2: a suspended owner cannot bring up a new delegate instance, and nothing is written');
+
+-- Owner E: never enrolled as a human on this board (no human row), then durably revoked. The
+-- marker is SEEDED here, by hand, so that E's delegate row stays active and 128 isolates the
+-- marker arm alone (revoke_human_subtree would also revoke the delegate). The row is the shape
+-- revoke_human_subtree writes, keyed by the verified (iss, sub). The real revocation of a
+-- delegate-only owner, which now writes the marker from the instance's recorded (iss, sub)
+-- (#591 item 4, AB15), is section 24.
+-- 127 -- control: an owner with no human row is allowed, as before
+select is(
+  pg_temp.exch(pg_temp.claim('inst_eeeeeeeeeeeeeeee_01', 'grant_eeeeeeeeeeeeee_01_1', 1, 'hosted-owner-e', 'client-e'), 'E1'),
+  'ok',
+  'N2 control: an owner the board has never enrolled as a human is not refused for the absent row');
+insert into agent_board.fleet_human_revocations(issuer, subject, owner_user_id, revoked_by_agent_id, revocation_reason)
+values ('https://portal.hosted.test', 'hosted-owner-e',
+        (select owner_user_id from agent_board.delegate_instances where instance_id = 'inst_eeeeeeeeeeeeeeee_01'),
+        pg_temp.u('K'), 'hosted n2 test');
+-- 128
+select is(
+  pg_temp.exch(pg_temp.claim('inst_eeeeeeeeeeeeeeee_01', 'grant_eeeeeeeeeeeeee_01_1', 1, 'hosted-owner-e', 'client-e'), 'x')
+  || ' ' || pg_temp.q(format($q$select status || '/' || (select count(*) from agent_board.agent_credentials where agent_id = %L and revoked_at is null)::text from agent_board.agents where id = %L$q$, pg_temp.v('E1.agent'), pg_temp.v('E1.agent'))),
+  '42501:owner_inactive active/1',
+  'N2: the revocation marker alone refuses the exchange of an existing instance (the delegate row itself is still active)');
+-- 129
+select is(
+  pg_temp.exch(pg_temp.claim('inst_eeeeeeeeeeeeeeee_02', 'grant_eeeeeeeeeeeeee_02_1', 1, 'hosted-owner-e', 'client-e'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_eeeeeeeeeeeeeeee_02'),
+  '42501:owner_inactive 0 0 0',
+  'N2: the revocation marker alone refuses a new instance, and nothing is written');
+
+-- ===========================================================================
+-- 24. #591 item 4 -- the owner's (iss, sub) on each instance, and the marker it gives
+--     revoke_human_subtree (AB15); #591 item 9 -- owner_inactive before instance_revoked
+-- ===========================================================================
+-- An owner whose only principals are hosted delegates has no enrollment audit row, so before
+-- 1.59.0 revoke_human_subtree wrote it no marker, and a fresh first exchange passed. Both RPCs now
+-- record the verified pair, and the revocation derives a marker from it.
+-- plpgsql, not sql: each read runs as its own query, so it sees what an action earlier in the
+-- same statement wrote (the reason pg_temp.q exists).
+create function pg_temp.pair(p_iid text) returns text language plpgsql as $$
+begin
+  return coalesce((select coalesce(owner_issuer, '(null)') || ' ' || coalesce(owner_subject, '(null)')
+                     from agent_board.delegate_instances where instance_id = p_iid), '(no row)');
+end $$;
+create function pg_temp.owner_of(p_iid text) returns uuid language plpgsql as $$
+begin
+  return (select owner_user_id from agent_board.delegate_instances where instance_id = p_iid);
+end $$;
+create function pg_temp.markers(p_sub text) returns text language plpgsql as $$
+begin
+  return (select count(*)::text || coalesce(' ' || string_agg(r.owner_user_id::text, ','), '')
+            from agent_board.fleet_human_revocations r
+           where r.issuer = 'https://portal.hosted.test' and r.subject = p_sub);
+end $$;
+-- 130 -- the exchange records the pair (D1 was exchanged in 123)
+select is(pg_temp.pair('inst_dddddddddddddddd_01'), 'https://portal.hosted.test hosted-owner-d',
+  'AB15: the exchange records the owner''s verified (iss, sub) on the instance');
+-- 131 -- a revocation before the first exchange records it too (owner H has nothing else)
+select is(
+  pg_temp.tomb('inst_hhhhhhhhhhhhhhhh_01', 'hosted-owner-h') || ' ' || pg_temp.pair('inst_hhhhhhhhhhhhhhhh_01'),
+  'first=true https://portal.hosted.test hosted-owner-h',
+  'AB15: a pre-exchange tombstone records the owner''s verified (iss, sub) on the row it creates');
+-- 132 -- once recorded, the pair never changes
+select is(
+  pg_temp.try($q$update agent_board.delegate_instances set owner_subject = 'someone-else' where instance_id = 'inst_dddddddddddddddd_01'$q$)
+  || ' ' || pg_temp.pair('inst_dddddddddddddddd_01'),
+  '23514:delegate_instances owner identity never changes once recorded https://portal.hosted.test hosted-owner-d',
+  'AB15: the recorded owner pair is immutable');
+
+-- Owner G: never enrolled, live; the control owner, and the legacy-row fills.
+select pg_temp.svc();
+-- 133 -- a LEGACY row (pre-1.59.0 shape: no pair) is filled by its first exchange
+select is(
+  pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_01', 'grant_gggggggggggggg_01_1', 1, 'hosted-owner-g', 'client-g'), 'G1')
+  || ' ' || pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id) values ('inst_gggggggggggggggg_l1', %L), ('inst_gggggggggggggggg_l2', %L)$q$,
+                              pg_temp.owner_of('inst_gggggggggggggggg_01'), pg_temp.owner_of('inst_gggggggggggggggg_01')))
+  || ' ' || pg_temp.pair('inst_gggggggggggggggg_l1')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_l1', 'grant_gggggggggggggg_l1_1', 1, 'hosted-owner-g', 'client-g'), 'GL1')
+  || ' ' || pg_temp.pair('inst_gggggggggggggggg_l1'),
+  'ok ok (null) (null) ok https://portal.hosted.test hosted-owner-g',
+  'AB15: a legacy instance with no recorded pair is filled by its next exchange');
+-- 134 -- ...and by a tombstone
+select is(
+  pg_temp.tomb('inst_gggggggggggggggg_l2', 'hosted-owner-g') || ' ' || pg_temp.pair('inst_gggggggggggggggg_l2'),
+  'first=true https://portal.hosted.test hosted-owner-g',
+  'AB15: a legacy instance with no recorded pair is filled by its tombstone');
+
+-- Owner F: never enrolled as a human; its ONLY principal is a hosted delegate.
+-- 135 -- revoke_human_subtree for real, as service_role
+select is(
+  pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_01', 'grant_ffffffffffffff_01_1', 1, 'hosted-owner-f', 'client-f'), 'F1')
+  || ' ' || pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                               pg_temp.owner_of('inst_ffffffffffffffff_01'), pg_temp.v('K')))
+  || ' ' || pg_temp.q(format($q$select status from agent_board.agents where id = %L$q$, pg_temp.v('F1.agent'))),
+  'ok ok revoked',
+  '#591 item 4: an owner with only a hosted delegate is revoked, and its delegate with it');
+-- 136 -- the marker exists, keyed by the verified pair, naming the owner
+select is(pg_temp.markers('hosted-owner-f'), '1 ' || pg_temp.owner_of('inst_ffffffffffffffff_01')::text,
+  '#591 item 4: revoking a delegate-only owner writes the durable (iss, sub) marker from the instance''s recorded pair');
+-- 137 -- so a fresh first exchange is refused, and writes nothing
+select is(
+  pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_02', 'grant_ffffffffffffff_02_1', 1, 'hosted-owner-f', 'client-f'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_ffffffffffffffff_02'),
+  '42501:owner_inactive 0 0 0',
+  '#591 item 4: after the revocation a new first exchange for that owner is refused owner_inactive, and nothing is written');
+-- 138 -- control: another live owner, never enrolled, still brings up a new instance
+select is(
+  pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_02', 'grant_gggggggggggggg_02_1', 1, 'hosted-owner-g', 'client-g'), 'G2')
+  || ' ' || pg_temp.markers('hosted-owner-g'),
+  'ok 0',
+  '#591 item 4 control: a different, unrevoked owner''s first exchange succeeds and has no marker');
+-- 139 -- #591 item 9: a revoked owner AND a tombstoned instance -> owner_inactive, not instance_revoked
+select is(
+  pg_temp.tomb('inst_ffffffffffffffff_01', 'hosted-owner-f')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_01', 'grant_ffffffffffffff_01_2', 2, 'hosted-owner-f', 'client-f'), 'x'),
+  'first=true 42501:owner_inactive',
+  'AB14 precedence: the owner check runs before the instance''s own refusals -- a tombstoned instance of a revoked owner is refused owner_inactive, not instance_revoked');
+-- 140 -- owner H, whose only row is a pre-exchange tombstone (131): its revocation marks it too
+select is(
+  pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                     pg_temp.owner_of('inst_hhhhhhhhhhhhhhhh_01'), pg_temp.v('K')))
+  || ' ' || pg_temp.markers('hosted-owner-h')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_hhhhhhhhhhhhhhhh_02', 'grant_hhhhhhhhhhhhhh_02_1', 1, 'hosted-owner-h', 'client-h'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_hhhhhhhhhhhhhhhh_02'),
+  'ok 1 ' || pg_temp.owner_of('inst_hhhhhhhhhhhhhhhh_01')::text || ' 42501:owner_inactive 0 0 0',
+  '#591 item 4: an owner whose only row is a pre-exchange tombstone is marked by its revocation, and a new instance is refused');
+-- 141 -- the class: every function that WRITES delegate_instances (any INSERT, UPDATE, MERGE or
+-- DELETE, from the catalog, through the shared matcher family) is one of the two RPCs that record
+-- the pair, and every row this file created carries one except the two hand-inserted legacy rows,
+-- which their exchange and tombstone filled (133, 134). A new writer fails this and names itself.
+-- Every non-system schema, not only agent_board: a writer in public or extensions bypasses the pair
+-- just as well (mutation-checked with one in public). agent_board_test is excluded because it holds
+-- this suite's matcher functions, which carry relation names as data and write nothing.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema', 'agent_board_test')
+      and n.nspname !~ '^pg_'
+      and p.prokind in ('f', 'p')
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.write_re('delegate_instances'))
+  || ' ' || (select count(*) from agent_board.delegate_instances where owner_issuer is null)::text,
+  'exchange_delegate_credential,tombstone_delegate_instance 0',
+  'AB15: exactly the exchange and the tombstone write delegate_instances (catalog-derived), and no row is left without the owner pair');
+
+-- 142 -- the pair is both-or-neither and never empty (delegate_instances_owner_identity_shape)
+select is(
+  pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, owner_issuer) values ('inst_gggggggggggggggg_s1', %L, 'https://portal.hosted.test')$q$, pg_temp.owner_of('inst_gggggggggggggggg_01')))
+  || ' ' || pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, owner_issuer, owner_subject) values ('inst_gggggggggggggggg_s2', %L, 'https://portal.hosted.test', '')$q$, pg_temp.owner_of('inst_gggggggggggggggg_01'))),
+  '23514:new row for relation "delegate_instances" violates check constraint "delegate_instances_owner_identity_shape" 23514:new row for relation "delegate_instances" violates check constraint "delegate_instances_owner_identity_shape"',
+  'AB15: an owner pair is recorded whole or not at all, and never empty');
+
+-- 143 -- a LEGACY TOMBSTONED row (pre-1.59.0: tombstoned, no pair) is filled by a repeated
+-- revocation. Nothing else ever writes such a row again: the exchange refuses it
+-- (instance_revoked) before its UPDATE, and a tombstone used to return early. Owner J has only this
+-- row (never enrolled, never exchanged), so the pair is the only evidence revoke_human_subtree can
+-- mark it from. Then a new first exchange of J is refused owner_inactive and writes nothing.
+select pg_temp.put('J.owner', agent_board._ensure_agent_auth_user(
+  agent_board._federated_identity_slug('https://portal.hosted.test', 'hosted-owner-j'))::text);
+select is(
+  pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, tombstoned_at, tombstone_reason) values ('inst_jjjjjjjjjjjjjjjj_l1', %L, now(), 'owner_revoked')$q$, pg_temp.v('J.owner')))
+  || ' ' || pg_temp.pair('inst_jjjjjjjjjjjjjjjj_l1')
+  || ' ' || pg_temp.tomb('inst_jjjjjjjjjjjjjjjj_l1', 'hosted-owner-j')
+  || ' ' || pg_temp.pair('inst_jjjjjjjjjjjjjjjj_l1')
+  || ' ' || pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                               pg_temp.v('J.owner'), pg_temp.v('K')))
+  || ' ' || pg_temp.markers('hosted-owner-j')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_jjjjjjjjjjjjjjjj_02', 'grant_jjjjjjjjjjjjjj_02_1', 1, 'hosted-owner-j', 'client-j'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_jjjjjjjjjjjjjjjj_02'),
+  'ok (null) (null) first=false https://portal.hosted.test hosted-owner-j ok 1 ' || pg_temp.v('J.owner')
+  || ' 42501:owner_inactive 0 0 0',
+  'AB15: a legacy tombstoned row is filled by a repeated revocation, so revoking its delegate-only owner marks it and a new instance is refused');
+
+select * from finish();
+rollback;