@consiliency/agent-board-schema 1.54.0 → 1.56.0

package/tests/agent_board_room_roster.test.sql

@@ -2,19 +2,49 @@
 --
 -- Mutation controls (the assertion names are part of the evidence contract):
 --   * removing the owner/admin gate fails RC-32 (member denial);
---   * filtering active state before latest-row selection fails RC-38 (stale row);
---   * removing the id DESC tiebreak fails RC-39 (equal timestamp);
 --   * omitting role from v_board_memberships fails RC-12 (catalog ordinal);
---   * removing the roster board predicate fails RC-37 (cross-board isolation).
+--   * removing the roster board predicate fails RC-37 (cross-board isolation);
+--   * dropping the MBROWID 3a active-first key from the AUTHORIZATION site fails
+--     RC-45/RC-47/RC-49 (an active owner/admin with a newer removed/left/requested
+--     row is refused), message-board#542 -- and, since those callers then capture
+--     nothing, every board-C state check after them;
+--   * dropping it from the PROJECTION site fails RC-38/RC-39 and RC-46/RC-48/
+--     RC-50/RC-51 (that member is omitted) while RC-45/RC-47/RC-49 still pass;
+--   * splitting authorization into "has an active row" AND "has an owner/admin
+--     row in any state" fails RC-55/RC-56 (a member/observer with a newer
+--     non-active owner/admin row is admitted);
+--   * dropping the projection's active-state filter fails RC-25/RC-28/RC-51/RC-52
+--     (non-active agents listed); dropping the authorization's active-state check
+--     fails RC-53 (an owner with no active row admitted).
 --
--- HAND-COUNTED plan: RC-01..RC-44 = 44 assertions. The runner independently
+-- CURRENT STANDING IS ACTIVE-FIRST (message-board#542, migration 20261006000100).
+-- Each agent's current row is chosen `case when membership_state in
+-- ('joined','subscribed') then 0 else 1 end, created_at desc, id desc`, as every
+-- other acting membership reader does (MBROWID 3a). The partial active unique
+-- index allows at most ONE active row per (board, agent), so the result is "the
+-- agent's active row, if any". Two consequences for this file:
+--   * RC-38/RC-39 used to assert that a newer left/removed row HID an older
+--     joined row. That was the #542 defect written down as a requirement; they
+--     now assert the opposite, on board C.
+--   * the id DESC tiebreak is no longer observable through this function: with
+--     at most one active row it only orders non-active rows, which are never
+--     listed and never authorize. It is pinned structurally by assertion 99 of
+--     agent_board_rowid.test.sql (both list_board_members sites carry
+--     `created_at desc, id desc`); the key itself is a class property in
+--     agent_board_membership_current_row_class.test.sql.
+--
+-- EMISSION ORDER differs from label order: in the #542 section the captures
+-- RC-45/47/49 run first, then RC-46/48/50/51, RC-38, RC-39, RC-52, RC-57,
+-- RC-55, RC-56, RC-53, RC-54. Cite assertions by LABEL, not by TAP number.
+--
+-- HAND-COUNTED plan: RC-01..RC-57 = 57 assertions. The runner independently
 -- verifies the plan and emitted assertion counts, so a truncated file cannot pass.
 create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(44);
+select plan(57);
 
 -- ---------------------------------------------------------------------------
 -- Catalog contract: exact signature, projection, posture, privileges, and view.
@@ -158,6 +188,20 @@ create temp table _roomcontract_fixture (
   stale_agent uuid,
   tie_agent uuid,
   board_b_agent uuid,
+  board_c uuid,
+  c_owner_removed uuid,
+  c_admin_left uuid,
+  c_owner_requested uuid,
+  c_inactive_only uuid,
+  c_removed_owner uuid,
+  c_member_was_owner uuid,
+  c_observer_was_admin uuid,
+  c_member_was_owner_user uuid,
+  c_observer_was_admin_user uuid,
+  c_owner_removed_user uuid,
+  c_admin_left_user uuid,
+  c_owner_requested_user uuid,
+  c_removed_owner_user uuid,
   creator_user uuid,
   owner_user uuid,
   admin_user uuid,
@@ -177,6 +221,12 @@ declare
   v_observer_user uuid;
   v_nonmember_user uuid;
   v_suspended_user uuid;
+  v_c_owner_removed_user uuid;
+  v_c_admin_left_user uuid;
+  v_c_owner_requested_user uuid;
+  v_c_removed_owner_user uuid;
+  v_c_member_was_owner_user uuid;
+  v_c_observer_was_admin_user uuid;
 begin
   v_creator_user := public.ensure_github_user('rc-creator', 'rc-creator@example.test', 'rc-creator', 'RC Creator');
   v_owner_user := public.ensure_github_user('rc-owner', 'rc-owner@example.test', 'rc-owner', 'RC Owner');
@@ -185,6 +235,12 @@ begin
   v_observer_user := public.ensure_github_user('rc-observer', 'rc-observer@example.test', 'rc-observer', 'RC Observer');
   v_nonmember_user := public.ensure_github_user('rc-nonmember', 'rc-nonmember@example.test', 'rc-nonmember', 'RC Nonmember');
   v_suspended_user := public.ensure_github_user('rc-suspended', 'rc-suspended@example.test', 'rc-suspended', 'RC Suspended');
+  v_c_owner_removed_user := public.ensure_github_user('rc-c-owner-removed', 'rc-c-owner-removed@example.test', 'rc-c-owner-removed', 'RC C Owner Removed');
+  v_c_admin_left_user := public.ensure_github_user('rc-c-admin-left', 'rc-c-admin-left@example.test', 'rc-c-admin-left', 'RC C Admin Left');
+  v_c_owner_requested_user := public.ensure_github_user('rc-c-owner-requested', 'rc-c-owner-requested@example.test', 'rc-c-owner-requested', 'RC C Owner Requested');
+  v_c_removed_owner_user := public.ensure_github_user('rc-c-removed-owner', 'rc-c-removed-owner@example.test', 'rc-c-removed-owner', 'RC C Removed Owner');
+  v_c_member_was_owner_user := public.ensure_github_user('rc-c-member-was-owner', 'rc-c-member-was-owner@example.test', 'rc-c-member-was-owner', 'RC C Member Was Owner');
+  v_c_observer_was_admin_user := public.ensure_github_user('rc-c-observer-was-admin', 'rc-c-observer-was-admin@example.test', 'rc-c-observer-was-admin', 'RC C Observer Was Admin');
 
   insert into agent_board.agents(
     id, agent_type, handle, display_name, status, auth_user_id, owner_user_id
@@ -201,12 +257,20 @@ begin
     ('73000000-0000-4000-8000-00000000000a', 'agent', 'rc-suspended', 'RC Suspended', 'suspended', v_suspended_user, v_suspended_user),
     ('73000000-0000-4000-8000-00000000000b', 'agent', 'rc-stale', 'RC Stale', 'active', null, null),
     ('73000000-0000-4000-8000-00000000000c', 'agent', 'rc-tie', 'RC Tie', 'active', null, null),
-    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null);
+    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null),
+    ('73000000-0000-4000-8000-00000000000e', 'human', 'rc-c-owner-removed', 'RC C Owner Removed', 'active', v_c_owner_removed_user, v_c_owner_removed_user),
+    ('73000000-0000-4000-8000-00000000000f', 'human', 'rc-c-admin-left', 'RC C Admin Left', 'active', v_c_admin_left_user, v_c_admin_left_user),
+    ('73000000-0000-4000-8000-000000000010', 'human', 'rc-c-owner-requested', 'RC C Owner Requested', 'active', v_c_owner_requested_user, v_c_owner_requested_user),
+    ('73000000-0000-4000-8000-000000000011', 'agent', 'rc-c-inactive-only', 'RC C Inactive Only', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000012', 'human', 'rc-c-removed-owner', 'RC C Removed Owner', 'active', v_c_removed_owner_user, v_c_removed_owner_user),
+    ('73000000-0000-4000-8000-000000000013', 'human', 'rc-c-member-was-owner', 'RC C Member Was Owner', 'active', v_c_member_was_owner_user, v_c_member_was_owner_user),
+    ('73000000-0000-4000-8000-000000000014', 'human', 'rc-c-observer-was-admin', 'RC C Observer Was Admin', 'active', v_c_observer_was_admin_user, v_c_observer_was_admin_user);
 
   insert into agent_board.boards(id, slug, name, created_by_agent_id, status)
   values
     ('73010000-0000-4000-8000-000000000001', 'roomcontract-a', 'ROOMCONTRACT A', '73000000-0000-4000-8000-000000000001', 'active'),
-    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active');
+    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active'),
+    ('73010000-0000-4000-8000-000000000003', 'roomcontract-c', 'ROOMCONTRACT C', '73000000-0000-4000-8000-000000000001', 'active');
 
   -- Board A current active roster: owner, admin, four members, observer.
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
@@ -219,26 +283,59 @@ begin
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000007', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000008', 'joined', 'observer', '73000000-0000-4000-8000-000000000002');
 
-  -- The board creator has historical owner standing but a newer departed row.
+  -- The board creator once held owner standing and has NO active row now: a
+  -- removed owner row and a newer left row. Creator identity is not authority.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
     ('73020000-0000-4000-8000-000000000002', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00');
 
-  -- Stale-row control: selecting active rows before choosing latest resurrects this actor.
+  -- Board C (message-board#542): an active row coexisting with NEWER non-active
+  -- rows. The partial active unique index admits every pair below.
+  --
+  -- Stale-row control: an older joined row next to a newer left row is CURRENT.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
 
-  -- Total-order control: timestamps tie, so the larger removed-row id must win.
+  -- Equal-timestamp control: the removed row has the LARGER id, so a bare
+  -- `created_at desc, id desc` would pick it; active-first picks the joined row.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+
+  -- The three callers #542 names: an active owner with a newer REMOVED row, an
+  -- active admin with a newer LEFT row, an active owner with a newer REQUESTED row.
+  -- Then an agent whose ONLY rows are non-active, and an owner with no active row.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000020', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000021', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000022', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'subscribed', 'admin', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000023', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000024', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000025', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'requested', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-13 00:00:00+00', '2026-09-13 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000026', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000027', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'removed', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000028', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'left', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000029', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00');
+
+  -- The NARROWING direction (round-1 review): an ACTIVE member/observer row
+  -- next to a NEWER non-active OWNER/ADMIN row. Standing comes from the active
+  -- row, so the historical owner/admin role confers nothing.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000030', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'joined', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000031', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000032', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'subscribed', 'observer', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000033', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00');
 
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
   values
@@ -255,6 +352,16 @@ begin
     '73000000-0000-4000-8000-00000000000b',
     '73000000-0000-4000-8000-00000000000c',
     '73000000-0000-4000-8000-00000000000d',
+    '73010000-0000-4000-8000-000000000003',
+    '73000000-0000-4000-8000-00000000000e',
+    '73000000-0000-4000-8000-00000000000f',
+    '73000000-0000-4000-8000-000000000010',
+    '73000000-0000-4000-8000-000000000011',
+    '73000000-0000-4000-8000-000000000012',
+    '73000000-0000-4000-8000-000000000013',
+    '73000000-0000-4000-8000-000000000014',
+    v_c_member_was_owner_user, v_c_observer_was_admin_user,
+    v_c_owner_removed_user, v_c_admin_left_user, v_c_owner_requested_user, v_c_removed_owner_user,
     v_creator_user, v_owner_user, v_admin_user, v_member_user, v_observer_user,
     v_nonmember_user, v_suspended_user
   );
@@ -401,7 +508,7 @@ set local role authenticated;
 select throws_ok(
   (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
   '42501', 'only a board owner or admin may list board members',
-  'RC-36: board creator identity is not authority after its latest membership departed');
+  'RC-36: board creator identity is not authority when no membership row of its own is active');
 
 reset role;
 
@@ -416,18 +523,149 @@ select is(
     where agent_id = (select board_b_agent from _roomcontract_fixture)),
   0,
   'RC-37: board B membership is absent from board A roster (cross-board isolation)');
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- message-board#542: current standing is ACTIVE-FIRST (MBROWID 3a), on board C.
+-- Each allow is lives_ok over a CAPTURE (`create temp table … as select * from
+-- list_board_members(…)`), then SEPARATE state checks read the captured rows
+-- (AGENTS.md rule 3, #113). A bare `is((select … from list_board_members(…)))`
+-- would ABORT the file on a 42501 instead of failing one named assertion:
+-- measured while writing this section — with the authorization key mutated
+-- away, the first bare form killed the transaction and only 38 of 54 ran.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select c_owner_removed_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_removed on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-45: an active owner with a NEWER removed row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_admin_left_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_admin_left on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-47: an active admin with a NEWER left row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_owner_requested_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_requested on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-49: an active owner with a NEWER requested row may list the roster (#542)');
+reset role;
+
+-- A capture that never ran leaves no table; to_regclass keeps each state check
+-- a named `not ok` (have NULL) instead of a missing-relation abort.
+create temp table _rc542_rows (
+  caller text,
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  handle text,
+  display_name text,
+  agent_type text,
+  membership_state text,
+  role text,
+  created_by_agent_id uuid,
+  membership_created_at timestamptz,
+  membership_updated_at timestamptz
+) on commit drop;
+do $$
+begin
+  if to_regclass('pg_temp._rc542_owner_removed') is not null then
+    insert into _rc542_rows select 'owner_removed', r.* from _rc542_owner_removed r;
+  end if;
+  if to_regclass('pg_temp._rc542_admin_left') is not null then
+    insert into _rc542_rows select 'admin_left', r.* from _rc542_admin_left r;
+  end if;
+  if to_regclass('pg_temp._rc542_owner_requested') is not null then
+    insert into _rc542_rows select 'owner_requested', r.* from _rc542_owner_requested r;
+  end if;
+end
+$$;
+
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_owner_removed and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-46: that owner is listed once, by its ACTIVE owner row, not the newer removed row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'admin_left' and r.agent_id = f.c_admin_left and r.board_id = f.board_c),
+  'subscribed/admin',
+  'RC-48: that admin is listed once, by its ACTIVE admin row, not the newer left row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_requested' and r.agent_id = f.c_owner_requested and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-50: that owner is listed once, by its ACTIVE owner row, not the newer requested row');
+select is(
+  (select array_agg(r.handle order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c),
+  array['rc-c-admin-left', 'rc-c-member-was-owner', 'rc-c-observer-was-admin', 'rc-c-owner-removed', 'rc-c-owner-requested', 'rc-stale', 'rc-tie']::text[],
+  'RC-51: board C roster is exactly the seven agents holding an active row, whatever newer rows they have');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select stale_agent from _roomcontract_fixture)),
-  0,
-  'RC-38: latest left row excludes an older joined row (choose latest before filtering state)');
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.stale_agent and r.board_id = f.board_c
+      and r.membership_state = 'joined'),
+  1,
+  'RC-38: an older joined row outranks a newer LEFT row (active-first before recency)');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select tie_agent from _roomcontract_fixture)),
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.tie_agent and r.board_id = f.board_c
+      and r.membership_id = '73020000-0000-4000-8000-000000000010'::uuid),
+  1,
+  'RC-39: at an equal created_at the joined row outranks the larger-id removed row');
+select is(
+  (select count(*)::int
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_inactive_only and r.board_id = f.board_c),
   0,
-  'RC-39: equal created_at rows use id DESC, so the larger removed row excludes the older joined row');
+  'RC-52: an agent whose only rows are left/removed is not listed');
+
+select is(
+  (select string_agg(r.handle || '=' || r.membership_state || '/' || r.role, ',' order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c
+      and r.agent_id in (f.c_member_was_owner, f.c_observer_was_admin)),
+  'rc-c-member-was-owner=joined/member,rc-c-observer-was-admin=subscribed/observer',
+  'RC-57: a member/observer with a NEWER non-active owner/admin row is listed with its ACTIVE role');
+
+select set_config('request.jwt.claim.sub', (select c_member_was_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-55: an active MEMBER with a newer removed OWNER row is refused (the old role confers nothing)');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_observer_was_admin_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-56: an active OBSERVER with a newer left ADMIN row is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_removed_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-53: an owner whose rows are all left/removed (no active row) is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-54: board A''s owner holds no row on board C and is refused there (standing is board-scoped)');
 reset role;
 
 -- ---------------------------------------------------------------------------
@@ -456,7 +694,7 @@ select set_config('request.jwt.claim.sub', '', true);
 \else
 
 select * from skip(
-  28,
+  41,
   'ROOMCONTRACT runtime checks require list_board_members and v_board_memberships.role'
 );
 

package/tests/agent_board_roomlink.test.sql

@@ -343,7 +343,7 @@ begin
     from _lf f, agent_board.enroll_federated_identity(
       f.prov_iss, 'message-board', f.prov_sub,
       jsonb_build_object('iss',f.prov_iss,'aud','message-board','sub', f.prov_sub), f.prov_slug,
-      f.pub1, 'raw_ed25519_base64url', f.fp1, true, null, 'agent', '{}', '{}', f.code_enroll) e;
+      f.pub1, 'raw_ed25519_base64url', f.fp1, true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{}', '{}', f.code_enroll) e;
   insert into _er values ('X', v_aid, v_red);
 
   -- Bad code: enrollment still succeeds, invite_redeemed=false, no membership.
@@ -351,7 +351,7 @@ begin
     from _lf f, agent_board.enroll_federated_identity(
       f.prov_iss, 'message-board', f.prov_sub || '-2',
       jsonb_build_object('iss',f.prov_iss,'aud','message-board','sub', f.prov_sub || '-2'), f.prov_slug || '-2',
-      f.pub2, 'raw_ed25519_base64url', f.fp2, true, null, 'agent', '{}', '{}', 'bogus-code-nonexistent') e;
+      f.pub2, 'raw_ed25519_base64url', f.fp2, true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{}', '{}', 'bogus-code-nonexistent') e;
   insert into _er values ('Y', v_aid, v_red);
 end
 $$;

package/tests/agent_board_rowid.test.sql

@@ -19,7 +19,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(98);
+select plan(99);
 
 create temp view _rowid_order_sites as
 with defs as (
@@ -29,7 +29,7 @@ with defs as (
     -- LITERALS STRIPPED, and re-derived rather than assumed. The first version of
     -- this line kept literals "because some ORDER BY operands are literals"; that
     -- was measured and is false for THIS view -- the derived checks over it match
-    -- `created_at desc` / `id desc`, which are code, and the whole file is 98/98
+    -- `created_at desc` / `id desc`, which are code, and the whole file was 98/98 when measured
     -- with literals stripped. Keeping them left a real, if narrow, hole: the site
     -- set is built by splitting `def` on `;`, so a literal containing a semicolon
     -- re-splits a statement and can drop it out of the set.
@@ -1300,6 +1300,19 @@ select is(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- 99. list_board_members (ROOMCONTRACT, re-created active-first by #542) was in
+-- the assertion-2 inventory but had no count-equality row of its own, so a
+-- dropped `bm.id desc` at either site went unnoticed here; through the roster
+-- itself the tiebreak is unobservable (it only orders non-active rows). Pinned as
+-- the exact pair (created_at DESC sites, of them with id DESC) so a site that
+-- disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_board_members'),
+  array[2, 2],
+  'list_board_members: BOTH created_at DESC sites (authorization + projection) have the id DESC tiebreak');
+
 select finish();
 
 rollback;

package/tests/agent_board_write_enforcement_class.test.sql

@@ -424,10 +424,13 @@ select distinct p.oid,
 
 -- WEC-1. The universe canary. Without it, a write-target set that had gone empty would empty the
 -- writer population too. Base tables only — see limit 4 on why the 26 views are not pinned.
+-- 59 -> 60 with #521's agent_board.enroll_token_uses. Its only writer, _enroll_token_bind, is
+-- EXECUTE-able by no API role and is reached only from the service_role-only
+-- enroll_federated_identity, so it adds no member to the `authenticated` writer population.
 select is(
   (select count(*)::text from _wec_target where relkind = 'r'),
-  '59',
-  '#325 canary: agent_board has 59 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
+  '60',
+  '#325 canary: agent_board has 60 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
 
 -- WEC-2. The relations the class writes, as an EXACT SET. A new one names itself.
 select is(

package/tests/catalog/function_execute_privileges.json

@@ -366,7 +366,16 @@
       "signature": "_enroll_federated_identity_once(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
       "executable_by": {
         "anon": false,
-        "service_role": true,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
+    {
+      "name": "_enroll_token_bind",
+      "signature": "_enroll_token_bind(p_token_sha256 text, p_token_expires_at timestamp with time zone, p_fingerprint text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
         "authenticated": false
       }
     },
@@ -957,7 +966,7 @@
     },
     {
       "name": "enroll_federated_identity",
-      "signature": "enroll_federated_identity(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
+      "signature": "enroll_federated_identity(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_token_sha256 text, p_token_expires_at timestamp with time zone, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
       "executable_by": {
         "anon": false,
         "service_role": true,
@@ -1119,7 +1128,7 @@
     },
     {
       "name": "onboard_federated_fleet_agent",
-      "signature": "onboard_federated_fleet_agent(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text, p_board_id uuid, p_machine_id uuid, p_harness_kind text, p_harness_label text, p_repo_slug text, p_repo_fingerprint text, p_repo_scope_role text, p_agent_role text, p_expected_agent_handle text)",
+      "signature": "onboard_federated_fleet_agent(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_token_sha256 text, p_token_expires_at timestamp with time zone, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text, p_board_id uuid, p_machine_id uuid, p_harness_kind text, p_harness_label text, p_repo_slug text, p_repo_fingerprint text, p_repo_scope_role text, p_agent_role text, p_expected_agent_handle text)",
       "executable_by": {
         "anon": false,
         "service_role": true,

package/tests/catalog/p_metadata_parameters.json

@@ -165,6 +165,10 @@
       "signature": "_enroll_federated_identity_once(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_enroll_token_bind(p_token_sha256 text, p_token_expires_at timestamp with time zone, p_fingerprint text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_ensure_agent_auth_user(p_slug text)",
       "declares_p_metadata": false
@@ -426,7 +430,7 @@
       "declares_p_metadata": false
     },
     {
-      "signature": "enroll_federated_identity(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
+      "signature": "enroll_federated_identity(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_token_sha256 text, p_token_expires_at timestamp with time zone, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text)",
       "declares_p_metadata": false
     },
     {
@@ -498,7 +502,7 @@
       "declares_p_metadata": false
     },
     {
-      "signature": "onboard_federated_fleet_agent(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text, p_board_id uuid, p_machine_id uuid, p_harness_kind text, p_harness_label text, p_repo_slug text, p_repo_fingerprint text, p_repo_scope_role text, p_agent_role text, p_expected_agent_handle text)",
+      "signature": "onboard_federated_fleet_agent(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_token_sha256 text, p_token_expires_at timestamp with time zone, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text, p_board_id uuid, p_machine_id uuid, p_harness_kind text, p_harness_label text, p_repo_slug text, p_repo_fingerprint text, p_repo_scope_role text, p_agent_role text, p_expected_agent_handle text)",
       "declares_p_metadata": false
     },
     {

package/tests/isolation/expected/atomic_fedsession_fleet_lock_order.out

@@ -26,7 +26,7 @@ step fleet_onboard:
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
       'raw_ed25519_base64url',
       'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
-      true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
       (select code from agent_board.board_invite_tokens where created_by_agent_id='162a0000-0000-0000-0000-000000000001'),
       (select id from agent_board.boards where slug='atomic-cross-board'),
       '162a0000-0000-0000-0000-000000000003',

package/tests/isolation/expected/atomic_fleet_authority_races.out

@@ -11,7 +11,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -71,7 +71,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -129,7 +129,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -202,7 +202,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -256,7 +256,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -312,7 +312,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -355,7 +355,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
@@ -436,7 +436,7 @@ step retry_onboard:
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='atomic-authority-board'),
     '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',