@consiliency/agent-board-schema 1.55.0 → 1.56.0

package/fixtures/already-applied.json

@@ -612,6 +612,10 @@
   {
    "id": "20261005000100_agent_board_enroll_token_single_use",
    "sha256": "317d7b41432b36a2e38cc64940838e173e425014e3e256a96d832202b250e82d"
+  },
+  {
+   "id": "20261006000100_agent_board_room_roster_active_first",
+   "sha256": "637480feeca07dbb2fe7a4624dc6d063d0c1f23e6ea3c3ee9a946ad43de4e34e"
   }
  ]
 }

package/migrations/20261006000100_agent_board_room_roster_active_first.sql

@@ -0,0 +1,118 @@
+-- ROOMCONTRACT-ACTIVEFIRST (message-board#542): the owner/admin roster chooses current
+-- standing ACTIVE-FIRST, as every other acting membership reader does (MBROWID 3a).
+--
+-- THE DEFECT. 20261003000100 chose the caller's standing (authorization) and each
+-- member's inclusion (projection) from the LATEST board_memberships row alone:
+-- `order by created_at desc, id desc`. The active-membership unique index is PARTIAL
+-- (idx_agent_board_board_memberships_active_unique, WHERE membership_state in
+-- ('joined','subscribed')), so one active row can coexist with newer non-active rows
+-- (removed / left / requested / invited). MBROWID 3a (20260803000100) ruled that every
+-- reader acting on "current standing" prefers the active row when one exists; join_board,
+-- update_board_membership, _upsert_board_membership_state and
+-- list_board_pending_memberships all do. The roster did not, so an active owner or admin
+-- with a newer non-active row was refused with 42501 and omitted from every roster —
+-- while the rest of MB (and Portal's self view, which reduces active-first as MBROWID
+-- requires) treated them as active.
+--
+-- THE FIX. Both selection sites take the MBROWID 3a key, then the existing total order:
+--   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+--            created_at desc, id desc
+-- Everything else is unchanged: signature, projection, STABLE, SECURITY DEFINER,
+-- search_path, the 42501 message, the result order, and the grants.
+--
+-- The class this belongs to is pinned from the catalog, not from this list:
+-- tests/agent_board_membership_current_row_class.test.sql derives every statement that
+-- picks ONE board_memberships row by recency and requires the active-first key, or a
+-- named exemption whose filter it asserts exactly. This migration fixes the only two
+-- sites that class found without the key; the exemptions are recorded there.
+--
+-- CREATE OR REPLACE keeps the ACL and the COMMENT, but both are restated below anyway:
+-- the COMMENT's text described latest-row semantics and must change, and the grants are
+-- restated so this file alone says what the function's posture is.
+
+create or replace function agent_board.list_board_members(p_board_id uuid)
+returns table(
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  handle text,
+  display_name text,
+  agent_type text,
+  membership_state text,
+  role text,
+  created_by_agent_id uuid,
+  membership_created_at timestamptz,
+  membership_updated_at timestamptz
+)
+language plpgsql
+stable
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- Authorization precedes disclosure. Creator identity is deliberately absent:
+  -- only the caller's current membership row can establish authority, and the
+  -- current row is the ACTIVE one when one exists (MBROWID 3a), else the latest.
+  if v_actor is null
+     or not exists (
+       select 1
+         from (
+           select bm.membership_state, bm.role
+             from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = v_actor
+            order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+                     bm.created_at desc, bm.id desc
+            limit 1
+         ) actor_standing
+        where actor_standing.membership_state in ('joined', 'subscribed')
+          and actor_standing.role in ('owner', 'admin')
+     ) then
+    raise exception 'only a board owner or admin may list board members'
+      using errcode = '42501';
+  end if;
+
+  -- Choose exactly one current row per agent (active-first, MBROWID 3a), then
+  -- keep only agents whose current row is active.
+  return query
+  select
+    latest.id,
+    latest.board_id,
+    latest.agent_id,
+    a.handle,
+    a.display_name,
+    a.agent_type,
+    latest.membership_state,
+    latest.role,
+    latest.created_by_agent_id,
+    latest.created_at,
+    latest.updated_at
+  from (
+    select distinct on (bm.agent_id) bm.*
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+     order by bm.agent_id,
+              case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+              bm.created_at desc, bm.id desc
+  ) latest
+  join agent_board.agents a on a.id = latest.agent_id
+  where latest.membership_state in ('joined', 'subscribed')
+  order by
+    case latest.role
+      when 'owner' then 0
+      when 'admin' then 1
+      when 'member' then 2
+      when 'observer' then 3
+    end,
+    lower(a.handle),
+    latest.agent_id;
+end;
+$$;
+
+comment on function agent_board.list_board_members(uuid) is
+  'Owner/admin-gated active board roster. Fails 42501 for a null actor (including service_role through this user-facing path), creator without current standing, or any caller whose current board membership is not active owner/admin. The current row is chosen active-first (MBROWID 3a): case when membership_state in (joined, subscribed) then 0 else 1 end, created_at desc, id desc — so an active row outranks a newer removed/left/requested/invited row. Returns each agent''s current row only when joined/subscribed, ordered owner/admin/member/observer then lower(handle), agent_id. Board-scoped and metadata-free.';
+
+revoke all on function agent_board.list_board_members(uuid) from public, anon;
+grant execute on function agent_board.list_board_members(uuid) to authenticated, service_role;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.55.0",
+  "version": "1.56.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.55.0",
+  "packageVersion": "1.56.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 153,
-  "aggregateSha256": "90e7cdfd7208e11b31f1699482c22b96f2ad0d797eb9490c85098491881e95dc",
+  "migrationCount": 154,
+  "aggregateSha256": "d0b74be9b41032a78ad45227706a48283f931b40cd6350c63c619a0e153c0cee",
   "migrations": [
     {
       "order": 0,
@@ -1425,6 +1425,15 @@
       "sourceRef": "message-board",
       "bytes": 55964,
       "sha256": "317d7b41432b36a2e38cc64940838e173e425014e3e256a96d832202b250e82d"
+    },
+    {
+      "order": 153,
+      "id": "20261006000100_agent_board_room_roster_active_first",
+      "filename": "20261006000100_agent_board_room_roster_active_first.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 5470,
+      "sha256": "637480feeca07dbb2fe7a4624dc6d063d0c1f23e6ea3c3ee9a946ad43de4e34e"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 153)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 154)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(153);
+    expect(manifest.migrationCount).toBe(154);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -340,6 +340,9 @@ describe('manifest integrity', () => {
       '20261004000100_agent_board_callback_consumer_intent.sql',
       // ENROLLTOKENSINGLEUSE (#521): a verified Portal token binds to at most one key.
       '20261005000100_agent_board_enroll_token_single_use.sql',
+      // ROOMCONTRACT-ACTIVEFIRST (#542): list_board_members chooses current standing
+      // active-first (MBROWID 3a) at both its authorization and projection sites.
+      '20261006000100_agent_board_room_roster_active_first.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_membership_current_row_class.test.sql

@@ -0,0 +1,460 @@
+-- MBROWID 3a as a CLASS (message-board#542): every statement that picks ONE
+-- board_memberships row must prefer the active row first.
+--
+-- WHY THIS FILE EXISTS. MBROWID (20260803000100) ruled that a reader acting on
+-- "current standing" orders
+--     case when membership_state in ('joined','subscribed') then 0 else 1 end,
+--     created_at desc, id desc
+-- and enumerated the readers of its day in a comment. ROOMCONTRACT
+-- (20261003000100) then shipped list_board_members with bare
+-- `created_at desc, id desc` at BOTH its selection sites, and nothing noticed:
+-- the rule lived in a comment, and agent_board_rowid.test.sql pins the id DESC
+-- tiebreak, not the active-first key. This file makes the key a class property,
+-- so the next reader that forgets it fails here and NAMES itself.
+--
+-- THE CLASS, derived from the catalog (every agent_board function body, read
+-- through agent_board_test.stripped_body so a comment cannot supply or hide a
+-- site). A SITE is a query that picks ONE row from a SOURCE:
+--   * SOURCE `direct`: agent_board.board_memberships or the unfiltered view
+--     agent_board.v_board_memberships, at the query's own parenthesis level;
+--   * SOURCE `outer` (form shown as `limit(outer)` etc.): a parenthesised group
+--     -- a derived table or a CTE body -- that reads either one directly or one
+--     group down, with the choosing ORDER BY outside the group;
+-- and the ONE-ROW forms, each followed at the same level:
+--   * `limit`   : ORDER BY <list> LIMIT|FETCH;
+--   * `distinct`: DISTINCT ON (...) ... ORDER BY <list>;
+--   * `into`    : a plpgsql SELECT ... INTO with an ORDER BY and no LIMIT, which
+--                 silently keeps the first row.
+-- The ORDER BY operands are NOT inspected: a recency order spelled through an
+-- output alias or a column ordinal is in the class the same as `created_at desc`,
+-- and so is a non-recency order (see _grant_within_ceiling below).
+-- A site is:
+--   * `active-first` when the MBROWID 3a key is the FIRST ordering item (for
+--     DISTINCT ON, the first after exactly the DISTINCT ON expressions) AND a
+--     COMPLETE ascending item: `case when membership_state in ('joined',
+--     'subscribed') then 0 else 1 end`, then only [ASC] [NULLS FIRST|LAST], then
+--     `,` or the end of the list (see the key pattern for why);
+--   * `filtered:<set>` when the key is absent but the query's own WHERE pins
+--     membership_state to an explicit literal set AT ITS OWN LEVEL (a
+--     `membership_state in (...)` inside a nested subquery, on any table, is
+--     consumed with that subquery and never read as this query's filter). The
+--     row is then chosen among rows of that set only, and the set is asserted
+--     EXACTLY per exemption below;
+--   * `latest-row` otherwise -- the defect.
+--
+-- WHAT IS ASSERTED.
+--   CRC-1  the exact site population (function / form / verdict). A new site --
+--          compliant or not -- changes it and appears in the diff by name, so
+--          reverse membership holds, and a site that silently leaves the class
+--          (a matcher that stops matching) fails too.
+--   CRC-2  no site is `latest-row`; the failure lists every offender by name.
+--   CRC-3  each exemption, positively: the exact function and the exact state set
+--          its WHERE pins. Widening one (resolve_board_request's pending read
+--          admitting 'joined', say) fails here even though the site stays
+--          "filtered".
+--   CRC-4  the active-first members, exactly.
+--   CRC-5..  behaviour rows: the SAME pattern objects over fixture text, with the
+--          REJECT rows (key after another ordering item, a key naming the wrong
+--          states, a key only in a comment, a `)` inside a literal) that every
+--          defective matcher passes.
+--
+-- WHAT THIS CANNOT SEE, stated so the green is not over-read:
+--   * views as SITES. v_board_directory's current_membership lateral is
+--     active-first and is pinned BEHAVIOURALLY by agent_board_rowid.test.sql; a
+--     deparsed viewdef spells the key `CASE WHEN (... = ANY (ARRAY[...]))`, which
+--     this matcher does not read. (A function reading v_board_memberships IS a
+--     site, above.)
+--   * any other view or set-returning function that exposes membership rows,
+--     read by a function: only the two relation names above are sources.
+--   * an `outer` source nested more than two groups deep, and nesting deeper than
+--     three parenthesis levels inside one ORDER BY or WHERE.
+--   * dynamic SQL (EXECUTE of an assembled string), and a choice made by
+--     max()/min() or a window function instead of ORDER BY.
+--   * a filter widened by an OR elsewhere in the same WHERE level: the filter
+--     check reads the first `membership_state in (...)` conjunct at that level,
+--     not the boolean structure around it. An `outer` site's filter is read from
+--     the span AFTER the group, so a filter inside the derived table does not
+--     exempt it (fails closed).
+--   * the key's SEMANTICS beyond its spelling. The matcher accepts one exact
+--     spelling (arms 0/1, the literal pair in that order, ascending) and rejects
+--     every other; an equivalent spelling (`in ('subscribed','joined')`,
+--     `then 0 else 2`, a helper function returning the rank) is reported
+--     `latest-row` and fails closed rather than being judged.
+--   * a key spelled inside a DOLLAR-quoted string constant within the ORDER BY
+--     list. Literals are kept (see _crc_bodies), so such a constant's text would
+--     satisfy the key match. A single-quoted constant cannot: its doubled quotes
+--     (`(''joined''`) break the `\(\s*'joined'` match. Ordering by a string
+--     constant is not a shape any reader has a reason to write; it is named here
+--     because the fixture rows cover the comment arm and not this one.
+-- The shapes the second review round named (a derived table or CTE with the
+-- ORDER BY ... LIMIT outside it, a read through v_board_memberships, an ORDER BY
+-- alias or ordinal, a filter inside a nested subquery) are detected, and pinned
+-- by CRC-15..CRC-19.
+--
+-- HAND-COUNTED plan: CRC-1..CRC-4 + 20 behaviour rows = 24.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(24);
+
+-- The composed patterns, built ONCE from the shared matcher family and read by
+-- both the catalog scan and the behaviour rows, so the rows exercise the same
+-- objects the scan compiles.
+--   lit   : a plain string literal, consumed whole ('' escapes), so a `)` or `;`
+--           inside one cannot end a span;
+--   bal   : a parenthesised group, literal-aware, three levels deep;
+--   item  : one token of the SAME parenthesis level (a group is ONE token);
+--   qn    : a reference to agent_board.board_memberships OR to the unfiltered
+--           view agent_board.v_board_memberships (bare admitted: every
+--           agent_board function that could read either bare pins agent_board
+--           on its search_path, and over-admitting only ADDS sites, which fails
+--           closed);
+--   grp   : a parenthesised group (derived table, CTE body) that references qn
+--           directly or one group down -- the `outer` source, whose ORDER BY
+--           sits OUTSIDE the group that reads memberships.
+create temp view _crc_frag as
+with base as (
+  select
+    $l$'(?:[^']|'')*'$l$ as lit,
+    '\m' || agent_board_test.ci_re('order by') || '\M' as orderby,
+    '\m(?:' || agent_board_test.ci_re('limit') || '|' || agent_board_test.ci_re('fetch') || ')\M' as limitkw,
+    '(?:' || agent_board_test.qname_frag('board_memberships', true)
+      || '|' || agent_board_test.qname_frag('v_board_memberships', true) || ')' as qn
+),
+bal as (
+  select b.*,
+         '\((?:[^()'']|' || b.lit || '|\((?:[^()'']|' || b.lit
+           || '|\((?:[^()'']|' || b.lit || ')*\))*\))*\)' as bal
+    from base b
+),
+it as (
+  select b.*, '(?:[^;()'']|' || b.lit || '|' || b.bal || ')' as item,
+         '(?:[^()'']|' || b.lit || '|' || b.bal || ')' as gitem
+    from bal b
+),
+g1 as (
+  select i.*, '\(' || i.gitem || '*?' || i.qn || i.gitem || '*\)' as grp1
+    from it i
+)
+select
+  g.*,
+  '(?:' || g.grp1 || '|\(' || g.gitem || '*?' || g.grp1 || g.gitem || '*\))' as grp,
+  -- the MBROWID 3a key, literals included: its operands ARE the claim.
+  -- It must be a COMPLETE ASCENDING ORDER BY item, so the pattern pins three
+  -- things, not just the CASE text:
+  --   * the arms: exactly `then 0 else 1` -- `then 1 else 0` is the reversal
+  --     and does not match (`\s+0\s+` also refuses `0.5`, `00`, `0::int`);
+  --   * the CONTINUATION after END: only an optional ASC, then an optional
+  --     NULLS FIRST|LAST, then `,` or the END of the ORDER BY list. DESC (the
+  --     reversal), arithmetic (`* 0` erases the preference), a cast, COLLATE,
+  --     or anything else leaves the item unmatched, and the site falls through
+  --     to `latest-row` (fails closed). NULLS FIRST/LAST are admitted because
+  --     they are inert here: this CASE has an ELSE and literal arms, so it is
+  --     never NULL and a NULLS clause cannot reorder it;
+  --   * the START is checked by the classifier, not here: nothing but the
+  --     DISTINCT ON expressions may precede the key in the list.
+  agent_board_test.ci_re('case') || '\s+' || agent_board_test.ci_re('when') || '\s+'
+    || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in')
+    || $k$\s*\(\s*'joined'\s*,\s*'subscribed'\s*\)\s*$k$
+    || agent_board_test.ci_re('then') || '\s+0\s+' || agent_board_test.ci_re('else') || '\s+1\s+'
+    || agent_board_test.ci_re('end') || agent_board_test.trail_guard()
+    || '(?:\s+' || agent_board_test.ci_re('asc') || agent_board_test.trail_guard() || ')?'
+    || '(?:\s+' || agent_board_test.ci_re('nulls') || '\s+(?:' || agent_board_test.ci_re('first')
+    || '|' || agent_board_test.ci_re('last') || ')' || agent_board_test.trail_guard() || ')?'
+    || '\s*(?:,|$)' as key,
+  -- a `membership_state in ('<a>', '<b>', ...)` conjunct AT THE WHERE-SPAN'S OWN
+  -- LEVEL: every group before it is consumed whole, so a filter inside a nested
+  -- subquery (on any table) is never read as this query's filter.
+  '^(?:(?!' || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in') || '\s*\()'
+    || g.item || ')*' || agent_board_test.col_ref_frag('membership_state') || '\s+' || agent_board_test.ci_re('in')
+    || '\s*\(((?:\s*' || g.lit || '\s*,?)+)\)' as filter
+from g1 g;
+
+-- Six extraction patterns: three single-row FORMS x two SOURCES. The sources run
+-- as SEPARATE patterns because a 'g' scan never returns overlapping matches: a
+-- derived table with its own LIMIT inside and another outside would otherwise
+-- lose one of the two sites.
+--   form `limit`   : <source> <where-span> ORDER BY <list> LIMIT|FETCH
+--   form `distinct`: DISTINCT ON (<exprs>) ... <source> <where-span> ORDER BY <list> <end of level>
+--   form `into`    : SELECT ... INTO <var> ... <source> <where-span> ORDER BY <list>, no LIMIT
+--                    (`into` directly followed by the relation is an INSERT target)
+-- Every pattern captures (1) the where-span, (2) the ORDER BY list; `distinct`
+-- captures (3) the DISTINCT ON group.
+create temp table _crc_re on commit drop as
+with src(source, s, guard) as (
+  -- An OUTER match's where-span may not itself name the relation at its own
+  -- level: `exists (select … from memberships …) then … from memberships … order
+  -- by … limit 1` is the DIRECT site after the group, not a second, outer one.
+  select 'direct', f.qn, '' from _crc_frag f
+  union all
+  select 'outer', f.grp, '(?!' || f.qn || ')' from _crc_frag f
+)
+select
+  x.source,
+  agent_board_test.re(
+    x.s || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=' || f.limitkw || ')'
+  ) as limit_re,
+  agent_board_test.re(
+    '\m' || agent_board_test.ci_re('distinct on') || '\s*(' || f.bal || ')'
+    || '(?:(?!' || f.orderby || ')' || f.item || ')*?' || x.s
+    || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=\s*(?:\)|;|$))'
+  ) as distinct_re,
+  agent_board_test.re(
+    '\m' || agent_board_test.ci_re('into') || '\M(?!\s*' || f.qn || ')'
+    || '(?:(?!' || f.orderby || ')' || f.item || ')*?' || x.s
+    || '((?:(?!' || f.orderby || ')' || x.guard || f.item || ')*)' || f.orderby
+    || '((?:(?!' || f.limitkw || ')' || f.item || ')*)(?=\s*(?:\)|;|$|\m'
+    || agent_board_test.ci_re('for') || '\M|\m' || agent_board_test.ci_re('loop') || '\M))'
+  ) as into_re,
+  agent_board_test.re(f.key) as key_re,
+  agent_board_test.re(f.filter) as filter_re,
+  agent_board_test.re(f.lit) as lit_re
+from src x cross join _crc_frag f;
+
+-- Bodies: every live agent_board function, plus the behaviour-row fixtures, in
+-- ONE relation so both go through the same extraction.
+-- stripped_body(..., true) KEEPS LITERALS on purpose: the key's operands
+-- 'joined'/'subscribed' and the exemption filter sets ARE the claim, and a
+-- literal-stripped body would make every key and every filter read identically.
+-- Comments are still removed, so prose cannot supply a key.
+create temp table _crc_fixture (label text primary key, src text not null) on commit drop;
+insert into _crc_fixture(label, src) values
+  ('latest',        $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by bm.created_at desc, bm.id desc limit 1$f$),
+  ('keyed',         $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end, bm.created_at desc, bm.id desc limit 1$f$),
+  ('key-after',     $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by bm.created_at desc, case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end limit 1$f$),
+  ('key-wrong-set', $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'removed') then 0 else 1 end, bm.created_at desc limit 1$f$),
+  ('key-in-comment',$f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by /* case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end, */ bm.created_at desc limit 1$f$),
+  ('paren-literal', $f$select bm.id into v from agent_board.board_memberships bm where bm.note <> ')' and bm.board_id = p order by bm.created_at desc limit 1$f$),
+  ('distinct',      $f$return query select * from (select distinct on (bm.agent_id) bm.* from agent_board.board_memberships bm where bm.board_id = p order by bm.agent_id, bm.created_at desc) x order by x.agent_id$f$),
+  ('into-nolimit',  $f$select bm.role into v from agent_board.board_memberships bm where bm.board_id = p order by bm.updated_at desc$f$),
+  ('end-desc',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end desc, bm.created_at desc limit 1$f$),
+  ('end-times-zero',$f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end * 0, bm.created_at desc limit 1$f$),
+  ('then1-else0',   $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 1 else 0 end, bm.created_at desc limit 1$f$),
+  ('end-cast',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end::text, bm.created_at desc limit 1$f$),
+  ('end-asc',       $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end ASC nulls last, bm.created_at desc limit 1$f$),
+  ('filtered',      $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p and bm.membership_state in ('joined','subscribed') order by bm.created_at desc limit 1$f$),
+  ('outer-derived', $f$select x.id into v from (select bm.id, bm.created_at from agent_board.board_memberships bm where bm.board_id = p) x order by x.created_at desc limit 1$f$),
+  ('outer-cte',     $f$return query with h as (select bm.* from agent_board.board_memberships bm where bm.board_id = p) select h.id from h order by h.created_at desc limit 1$f$),
+  ('view',          $f$select m.board_membership_id into v from agent_board.v_board_memberships m where m.board_id = p order by m.created_at desc limit 1$f$),
+  ('ordinal',       $f$select bm.id, bm.created_at into v, t from agent_board.board_memberships bm where bm.board_id = p order by 2 desc limit 1$f$),
+  ('nested-filter', $f$select bm.id into v from agent_board.board_memberships bm where bm.board_id = p and exists (select 1 from agent_board.agents o where o.id = bm.agent_id and o.membership_state in ('joined','subscribed')) order by bm.created_at desc limit 1$f$),
+  ('not-a-site',    $f$perform 1 from agent_board.board_memberships bm where bm.board_id = p order by bm.id for update; for r in select bm.id from agent_board.board_memberships bm where bm.membership_state in ('joined', 'subscribed') order by bm.created_at loop null; end loop$f$);
+
+create temp view _crc_bodies as
+select 'catalog'::text as kind,
+       p.proname::text as proname,
+       agent_board_test.stripped_body(p.oid, true) as body
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+ where n.nspname = 'agent_board'
+   and p.prokind = 'f'
+union all
+select 'fixture', x.label, agent_board_test.strip_sql(x.src, true)
+  from _crc_fixture x;
+
+create temp view _crc_sites as
+with raw as (
+  select b.kind, b.proname, 'limit'::text as form, r.source, m[1] as where_span, m[2] as order_list, null::text as don
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.limit_re, 'g') as m
+  union all
+  select b.kind, b.proname, 'distinct', r.source, m[2], m[3], m[1]
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.distinct_re, 'g') as m
+  union all
+  select b.kind, b.proname, 'into', r.source, m[1], m[2], null
+    from _crc_bodies b cross join _crc_re as r cross join lateral regexp_matches(b.body, r.into_re, 'g') as m
+),
+cls as (
+  select raw.*,
+         nullif(regexp_instr(raw.order_list, k.key_re), 0) as key_at,
+         (select array_to_string(array_agg(l[1] order by ord), ',')
+            from regexp_matches(substring(raw.where_span from k.filter_re), k.lit_re, 'g')
+                 with ordinality as fl(l, ord)) as filter_set
+    from raw join _crc_re as k on k.source = 'direct'
+)
+-- ACTIVE-FIRST means the key is the FIRST ordering item: nothing may precede it
+-- except, for DISTINCT ON, exactly the DISTINCT ON expressions (which partition
+-- and do not choose). The ordering operands are NOT inspected, so a recency order
+-- spelled through an output alias or a column ordinal is judged the same way as
+-- `created_at desc` -- and so is a non-recency order (a rank): any single-row
+-- choice over memberships is in the class.
+select kind, proname,
+       form || case when source = 'outer' then '(outer)' else '' end as form,
+       case
+         when key_at is not null
+              and (translate(substr(order_list, 1, key_at - 1), E' \t\r\n', '') = ''
+                   or (form = 'distinct'
+                       and translate(substr(order_list, 1, key_at - 1), E' \t\r\n', '')
+                           = translate(substr(don, 2, length(don) - 2), E' \t\r\n', '') || ','))
+           then 'active-first'
+         when filter_set is not null then 'filtered:' || filter_set
+         else 'latest-row'
+       end as verdict
+  from cls;
+
+-- ---------------------------------------------------------------------------
+-- CRC-1: the exact population, derived from the catalog.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '/' || form || '/' || verdict order by proname, form, verdict)
+     from _crc_sites where kind = 'catalog'),
+  array[
+    '_active_board_membership_id/limit/filtered:''joined'',''subscribed''',
+    '_grant_within_ceiling/limit/filtered:''joined'',''subscribed''',
+    '_upsert_board_membership_state/limit/active-first',
+    'join_board/limit/active-first',
+    'list_board_members/distinct/active-first',
+    'list_board_members/limit/active-first',
+    'list_board_pending_memberships/distinct/active-first',
+    'request_join_board/limit/filtered:''joined'',''subscribed''',
+    'resolve_board_request/limit/filtered:''joined'',''subscribed''',
+    'resolve_board_request/limit/filtered:''requested'',''invited''',
+    'update_board_membership/limit/active-first',
+    'update_board_membership/limit/active-first'
+  ]::text[],
+  'CRC-1: every catalog statement choosing ONE board_memberships row is exactly this set');
+
+-- ---------------------------------------------------------------------------
+-- CRC-2: no site chooses the bare latest row.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(array_agg(proname || '/' || form order by proname, form), '{}'::text[])
+     from _crc_sites where kind = 'catalog' and verdict = 'latest-row'),
+  '{}'::text[],
+  'CRC-2: no function chooses one board membership row without the MBROWID 3a key or an exact filter');
+
+-- ---------------------------------------------------------------------------
+-- CRC-3: each exemption's claim, positively -- the function and the EXACT set
+-- its WHERE pins. Why each is legitimately not active-first:
+--   _active_board_membership_id -- returns the ACTIVE row's id; the WHERE already
+--     restricts to joined/subscribed, and the partial unique index allows at most
+--     one such row, so there is nothing for the key to prefer (MBROWID 3c).
+--   request_join_board          -- the same: its idempotent return reads the
+--     caller's existing ACTIVE row only.
+--   resolve_board_request (active) -- the approval path's "already active" probe.
+--   _grant_within_ceiling       -- orders by ROLE RANK, not recency: it takes the
+--     grantor's highest active role, among active rows only. With one active row
+--     per (board, agent) the order is moot; it is in the class because the class
+--     no longer requires a recency operand (an alias or ordinal would hide one).
+--   resolve_board_request (pending) -- MBROWID 3c: the approval gate must see the
+--     newest requested/invited marker, NOT prefer a coexisting active row; the
+--     active case is handled by the probe above.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '=' || substr(verdict, length('filtered:') + 1) order by proname, verdict)
+     from _crc_sites where kind = 'catalog' and verdict like 'filtered:%'),
+  array[
+    '_active_board_membership_id=''joined'',''subscribed''',
+    '_grant_within_ceiling=''joined'',''subscribed''',
+    'request_join_board=''joined'',''subscribed''',
+    'resolve_board_request=''joined'',''subscribed''',
+    'resolve_board_request=''requested'',''invited'''
+  ]::text[],
+  'CRC-3: the five filtered exemptions pin exactly these membership_state sets');
+
+-- ---------------------------------------------------------------------------
+-- CRC-4: the active-first members, exactly.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(proname || '/' || form order by proname, form)
+     from _crc_sites where kind = 'catalog' and verdict = 'active-first'),
+  array[
+    '_upsert_board_membership_state/limit',
+    'join_board/limit',
+    'list_board_members/distinct',
+    'list_board_members/limit',
+    'list_board_pending_memberships/distinct',
+    'update_board_membership/limit',
+    'update_board_membership/limit'
+  ]::text[],
+  'CRC-4: these seven sites carry the MBROWID 3a active-first key');
+
+-- ---------------------------------------------------------------------------
+-- CRC-5..14: behaviour rows over fixture text, through the same objects.
+-- ---------------------------------------------------------------------------
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'latest'),
+  array['limit/latest-row']::text[],
+  'CRC-5 REJECT: bare created_at desc, id desc + LIMIT is latest-row');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'keyed'),
+  array['limit/active-first']::text[],
+  'CRC-6 ACCEPT: the MBROWID 3a key before the recency operands is active-first');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-after'),
+  array['limit/latest-row']::text[],
+  'CRC-7 REJECT: the key AFTER a recency operand does not make the choice active-first');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-wrong-set'),
+  array['limit/latest-row']::text[],
+  'CRC-8 REJECT: a key preferring (joined, removed) is not the active-first key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'key-in-comment'),
+  array['limit/latest-row']::text[],
+  'CRC-9 REJECT: a key written only in a comment is stripped and does not count');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'paren-literal'),
+  array['limit/latest-row']::text[],
+  'CRC-10 REJECT: a `)` inside a string literal in the WHERE does not hide the site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'distinct'),
+  array['distinct/latest-row']::text[],
+  'CRC-11 REJECT: a DISTINCT ON per-agent choice by bare recency is latest-row (and the outer order is not a site)');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'into-nolimit'),
+  array['into/latest-row']::text[],
+  'CRC-12 REJECT: SELECT ... INTO ordered by updated_at desc with no LIMIT keeps the first row, and is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'filtered'),
+  array['limit/filtered:''joined'',''subscribed''']::text[],
+  'CRC-13 ACCEPT-AS-EXEMPTION: a WHERE pinning membership_state reports its exact set');
+select is(
+  (select count(*)::int from _crc_sites where kind = 'fixture' and proname = 'not-a-site'),
+  0,
+  'CRC-14: a lock-ordering PERFORM and an unbounded ascending iteration choose no row and are not sites');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'outer-derived'),
+  array['limit(outer)/latest-row']::text[],
+  'CRC-15 REJECT: a derived table read by an OUTER order by recency + LIMIT is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'outer-cte'),
+  array['limit(outer)/latest-row']::text[],
+  'CRC-16 REJECT: a CTE over memberships chosen by the outer ORDER BY ... LIMIT is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'view'),
+  array['limit/latest-row']::text[],
+  'CRC-17 REJECT: a latest-row read through the unfiltered view v_board_memberships is a site');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'ordinal'),
+  array['limit/latest-row']::text[],
+  'CRC-18 REJECT: ORDER BY a column ordinal (or an alias) is a site; the operand is not inspected');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'nested-filter'),
+  array['limit/latest-row']::text[],
+  'CRC-19 REJECT: a membership_state filter inside a nested subquery is not this query''s filter');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-desc'),
+  array['limit/latest-row']::text[],
+  'CRC-20 REJECT: `... END DESC` is inactive-first -- the exact reversal -- not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-times-zero'),
+  array['limit/latest-row']::text[],
+  'CRC-21 REJECT: `... END * 0` erases the preference and is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'then1-else0'),
+  array['limit/latest-row']::text[],
+  'CRC-22 REJECT: `THEN 1 ELSE 0` is the reversal and is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-cast'),
+  array['limit/latest-row']::text[],
+  'CRC-23 REJECT: `... END::text` (a cast continuation) is not the key');
+select is(
+  (select array_agg(form || '/' || verdict) from _crc_sites where kind = 'fixture' and proname = 'end-asc'),
+  array['limit/active-first']::text[],
+  'CRC-24 ACCEPT: `... END ASC NULLS LAST` is the key (ASC is the default; NULLS is inert on a non-null CASE)');
+
+select * from finish();
+rollback;

package/tests/agent_board_room_roster.test.sql

@@ -2,19 +2,49 @@
 --
 -- Mutation controls (the assertion names are part of the evidence contract):
 --   * removing the owner/admin gate fails RC-32 (member denial);
---   * filtering active state before latest-row selection fails RC-38 (stale row);
---   * removing the id DESC tiebreak fails RC-39 (equal timestamp);
 --   * omitting role from v_board_memberships fails RC-12 (catalog ordinal);
---   * removing the roster board predicate fails RC-37 (cross-board isolation).
+--   * removing the roster board predicate fails RC-37 (cross-board isolation);
+--   * dropping the MBROWID 3a active-first key from the AUTHORIZATION site fails
+--     RC-45/RC-47/RC-49 (an active owner/admin with a newer removed/left/requested
+--     row is refused), message-board#542 -- and, since those callers then capture
+--     nothing, every board-C state check after them;
+--   * dropping it from the PROJECTION site fails RC-38/RC-39 and RC-46/RC-48/
+--     RC-50/RC-51 (that member is omitted) while RC-45/RC-47/RC-49 still pass;
+--   * splitting authorization into "has an active row" AND "has an owner/admin
+--     row in any state" fails RC-55/RC-56 (a member/observer with a newer
+--     non-active owner/admin row is admitted);
+--   * dropping the projection's active-state filter fails RC-25/RC-28/RC-51/RC-52
+--     (non-active agents listed); dropping the authorization's active-state check
+--     fails RC-53 (an owner with no active row admitted).
 --
--- HAND-COUNTED plan: RC-01..RC-44 = 44 assertions. The runner independently
+-- CURRENT STANDING IS ACTIVE-FIRST (message-board#542, migration 20261006000100).
+-- Each agent's current row is chosen `case when membership_state in
+-- ('joined','subscribed') then 0 else 1 end, created_at desc, id desc`, as every
+-- other acting membership reader does (MBROWID 3a). The partial active unique
+-- index allows at most ONE active row per (board, agent), so the result is "the
+-- agent's active row, if any". Two consequences for this file:
+--   * RC-38/RC-39 used to assert that a newer left/removed row HID an older
+--     joined row. That was the #542 defect written down as a requirement; they
+--     now assert the opposite, on board C.
+--   * the id DESC tiebreak is no longer observable through this function: with
+--     at most one active row it only orders non-active rows, which are never
+--     listed and never authorize. It is pinned structurally by assertion 99 of
+--     agent_board_rowid.test.sql (both list_board_members sites carry
+--     `created_at desc, id desc`); the key itself is a class property in
+--     agent_board_membership_current_row_class.test.sql.
+--
+-- EMISSION ORDER differs from label order: in the #542 section the captures
+-- RC-45/47/49 run first, then RC-46/48/50/51, RC-38, RC-39, RC-52, RC-57,
+-- RC-55, RC-56, RC-53, RC-54. Cite assertions by LABEL, not by TAP number.
+--
+-- HAND-COUNTED plan: RC-01..RC-57 = 57 assertions. The runner independently
 -- verifies the plan and emitted assertion counts, so a truncated file cannot pass.
 create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(44);
+select plan(57);
 
 -- ---------------------------------------------------------------------------
 -- Catalog contract: exact signature, projection, posture, privileges, and view.
@@ -158,6 +188,20 @@ create temp table _roomcontract_fixture (
   stale_agent uuid,
   tie_agent uuid,
   board_b_agent uuid,
+  board_c uuid,
+  c_owner_removed uuid,
+  c_admin_left uuid,
+  c_owner_requested uuid,
+  c_inactive_only uuid,
+  c_removed_owner uuid,
+  c_member_was_owner uuid,
+  c_observer_was_admin uuid,
+  c_member_was_owner_user uuid,
+  c_observer_was_admin_user uuid,
+  c_owner_removed_user uuid,
+  c_admin_left_user uuid,
+  c_owner_requested_user uuid,
+  c_removed_owner_user uuid,
   creator_user uuid,
   owner_user uuid,
   admin_user uuid,
@@ -177,6 +221,12 @@ declare
   v_observer_user uuid;
   v_nonmember_user uuid;
   v_suspended_user uuid;
+  v_c_owner_removed_user uuid;
+  v_c_admin_left_user uuid;
+  v_c_owner_requested_user uuid;
+  v_c_removed_owner_user uuid;
+  v_c_member_was_owner_user uuid;
+  v_c_observer_was_admin_user uuid;
 begin
   v_creator_user := public.ensure_github_user('rc-creator', 'rc-creator@example.test', 'rc-creator', 'RC Creator');
   v_owner_user := public.ensure_github_user('rc-owner', 'rc-owner@example.test', 'rc-owner', 'RC Owner');
@@ -185,6 +235,12 @@ begin
   v_observer_user := public.ensure_github_user('rc-observer', 'rc-observer@example.test', 'rc-observer', 'RC Observer');
   v_nonmember_user := public.ensure_github_user('rc-nonmember', 'rc-nonmember@example.test', 'rc-nonmember', 'RC Nonmember');
   v_suspended_user := public.ensure_github_user('rc-suspended', 'rc-suspended@example.test', 'rc-suspended', 'RC Suspended');
+  v_c_owner_removed_user := public.ensure_github_user('rc-c-owner-removed', 'rc-c-owner-removed@example.test', 'rc-c-owner-removed', 'RC C Owner Removed');
+  v_c_admin_left_user := public.ensure_github_user('rc-c-admin-left', 'rc-c-admin-left@example.test', 'rc-c-admin-left', 'RC C Admin Left');
+  v_c_owner_requested_user := public.ensure_github_user('rc-c-owner-requested', 'rc-c-owner-requested@example.test', 'rc-c-owner-requested', 'RC C Owner Requested');
+  v_c_removed_owner_user := public.ensure_github_user('rc-c-removed-owner', 'rc-c-removed-owner@example.test', 'rc-c-removed-owner', 'RC C Removed Owner');
+  v_c_member_was_owner_user := public.ensure_github_user('rc-c-member-was-owner', 'rc-c-member-was-owner@example.test', 'rc-c-member-was-owner', 'RC C Member Was Owner');
+  v_c_observer_was_admin_user := public.ensure_github_user('rc-c-observer-was-admin', 'rc-c-observer-was-admin@example.test', 'rc-c-observer-was-admin', 'RC C Observer Was Admin');
 
   insert into agent_board.agents(
     id, agent_type, handle, display_name, status, auth_user_id, owner_user_id
@@ -201,12 +257,20 @@ begin
     ('73000000-0000-4000-8000-00000000000a', 'agent', 'rc-suspended', 'RC Suspended', 'suspended', v_suspended_user, v_suspended_user),
     ('73000000-0000-4000-8000-00000000000b', 'agent', 'rc-stale', 'RC Stale', 'active', null, null),
     ('73000000-0000-4000-8000-00000000000c', 'agent', 'rc-tie', 'RC Tie', 'active', null, null),
-    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null);
+    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null),
+    ('73000000-0000-4000-8000-00000000000e', 'human', 'rc-c-owner-removed', 'RC C Owner Removed', 'active', v_c_owner_removed_user, v_c_owner_removed_user),
+    ('73000000-0000-4000-8000-00000000000f', 'human', 'rc-c-admin-left', 'RC C Admin Left', 'active', v_c_admin_left_user, v_c_admin_left_user),
+    ('73000000-0000-4000-8000-000000000010', 'human', 'rc-c-owner-requested', 'RC C Owner Requested', 'active', v_c_owner_requested_user, v_c_owner_requested_user),
+    ('73000000-0000-4000-8000-000000000011', 'agent', 'rc-c-inactive-only', 'RC C Inactive Only', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000012', 'human', 'rc-c-removed-owner', 'RC C Removed Owner', 'active', v_c_removed_owner_user, v_c_removed_owner_user),
+    ('73000000-0000-4000-8000-000000000013', 'human', 'rc-c-member-was-owner', 'RC C Member Was Owner', 'active', v_c_member_was_owner_user, v_c_member_was_owner_user),
+    ('73000000-0000-4000-8000-000000000014', 'human', 'rc-c-observer-was-admin', 'RC C Observer Was Admin', 'active', v_c_observer_was_admin_user, v_c_observer_was_admin_user);
 
   insert into agent_board.boards(id, slug, name, created_by_agent_id, status)
   values
     ('73010000-0000-4000-8000-000000000001', 'roomcontract-a', 'ROOMCONTRACT A', '73000000-0000-4000-8000-000000000001', 'active'),
-    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active');
+    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active'),
+    ('73010000-0000-4000-8000-000000000003', 'roomcontract-c', 'ROOMCONTRACT C', '73000000-0000-4000-8000-000000000001', 'active');
 
   -- Board A current active roster: owner, admin, four members, observer.
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
@@ -219,26 +283,59 @@ begin
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000007', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000008', 'joined', 'observer', '73000000-0000-4000-8000-000000000002');
 
-  -- The board creator has historical owner standing but a newer departed row.
+  -- The board creator once held owner standing and has NO active row now: a
+  -- removed owner row and a newer left row. Creator identity is not authority.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
     ('73020000-0000-4000-8000-000000000002', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00');
 
-  -- Stale-row control: selecting active rows before choosing latest resurrects this actor.
+  -- Board C (message-board#542): an active row coexisting with NEWER non-active
+  -- rows. The partial active unique index admits every pair below.
+  --
+  -- Stale-row control: an older joined row next to a newer left row is CURRENT.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
 
-  -- Total-order control: timestamps tie, so the larger removed-row id must win.
+  -- Equal-timestamp control: the removed row has the LARGER id, so a bare
+  -- `created_at desc, id desc` would pick it; active-first picks the joined row.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+
+  -- The three callers #542 names: an active owner with a newer REMOVED row, an
+  -- active admin with a newer LEFT row, an active owner with a newer REQUESTED row.
+  -- Then an agent whose ONLY rows are non-active, and an owner with no active row.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000020', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000021', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000022', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'subscribed', 'admin', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000023', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000024', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000025', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'requested', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-13 00:00:00+00', '2026-09-13 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000026', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000027', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'removed', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000028', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'left', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000029', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00');
+
+  -- The NARROWING direction (round-1 review): an ACTIVE member/observer row
+  -- next to a NEWER non-active OWNER/ADMIN row. Standing comes from the active
+  -- row, so the historical owner/admin role confers nothing.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000030', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'joined', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000031', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000032', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'subscribed', 'observer', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000033', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00');
 
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
   values
@@ -255,6 +352,16 @@ begin
     '73000000-0000-4000-8000-00000000000b',
     '73000000-0000-4000-8000-00000000000c',
     '73000000-0000-4000-8000-00000000000d',
+    '73010000-0000-4000-8000-000000000003',
+    '73000000-0000-4000-8000-00000000000e',
+    '73000000-0000-4000-8000-00000000000f',
+    '73000000-0000-4000-8000-000000000010',
+    '73000000-0000-4000-8000-000000000011',
+    '73000000-0000-4000-8000-000000000012',
+    '73000000-0000-4000-8000-000000000013',
+    '73000000-0000-4000-8000-000000000014',
+    v_c_member_was_owner_user, v_c_observer_was_admin_user,
+    v_c_owner_removed_user, v_c_admin_left_user, v_c_owner_requested_user, v_c_removed_owner_user,
     v_creator_user, v_owner_user, v_admin_user, v_member_user, v_observer_user,
     v_nonmember_user, v_suspended_user
   );
@@ -401,7 +508,7 @@ set local role authenticated;
 select throws_ok(
   (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
   '42501', 'only a board owner or admin may list board members',
-  'RC-36: board creator identity is not authority after its latest membership departed');
+  'RC-36: board creator identity is not authority when no membership row of its own is active');
 
 reset role;
 
@@ -416,18 +523,149 @@ select is(
     where agent_id = (select board_b_agent from _roomcontract_fixture)),
   0,
   'RC-37: board B membership is absent from board A roster (cross-board isolation)');
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- message-board#542: current standing is ACTIVE-FIRST (MBROWID 3a), on board C.
+-- Each allow is lives_ok over a CAPTURE (`create temp table … as select * from
+-- list_board_members(…)`), then SEPARATE state checks read the captured rows
+-- (AGENTS.md rule 3, #113). A bare `is((select … from list_board_members(…)))`
+-- would ABORT the file on a 42501 instead of failing one named assertion:
+-- measured while writing this section — with the authorization key mutated
+-- away, the first bare form killed the transaction and only 38 of 54 ran.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select c_owner_removed_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_removed on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-45: an active owner with a NEWER removed row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_admin_left_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_admin_left on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-47: an active admin with a NEWER left row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_owner_requested_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_requested on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-49: an active owner with a NEWER requested row may list the roster (#542)');
+reset role;
+
+-- A capture that never ran leaves no table; to_regclass keeps each state check
+-- a named `not ok` (have NULL) instead of a missing-relation abort.
+create temp table _rc542_rows (
+  caller text,
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  handle text,
+  display_name text,
+  agent_type text,
+  membership_state text,
+  role text,
+  created_by_agent_id uuid,
+  membership_created_at timestamptz,
+  membership_updated_at timestamptz
+) on commit drop;
+do $$
+begin
+  if to_regclass('pg_temp._rc542_owner_removed') is not null then
+    insert into _rc542_rows select 'owner_removed', r.* from _rc542_owner_removed r;
+  end if;
+  if to_regclass('pg_temp._rc542_admin_left') is not null then
+    insert into _rc542_rows select 'admin_left', r.* from _rc542_admin_left r;
+  end if;
+  if to_regclass('pg_temp._rc542_owner_requested') is not null then
+    insert into _rc542_rows select 'owner_requested', r.* from _rc542_owner_requested r;
+  end if;
+end
+$$;
+
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_owner_removed and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-46: that owner is listed once, by its ACTIVE owner row, not the newer removed row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'admin_left' and r.agent_id = f.c_admin_left and r.board_id = f.board_c),
+  'subscribed/admin',
+  'RC-48: that admin is listed once, by its ACTIVE admin row, not the newer left row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_requested' and r.agent_id = f.c_owner_requested and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-50: that owner is listed once, by its ACTIVE owner row, not the newer requested row');
+select is(
+  (select array_agg(r.handle order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c),
+  array['rc-c-admin-left', 'rc-c-member-was-owner', 'rc-c-observer-was-admin', 'rc-c-owner-removed', 'rc-c-owner-requested', 'rc-stale', 'rc-tie']::text[],
+  'RC-51: board C roster is exactly the seven agents holding an active row, whatever newer rows they have');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select stale_agent from _roomcontract_fixture)),
-  0,
-  'RC-38: latest left row excludes an older joined row (choose latest before filtering state)');
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.stale_agent and r.board_id = f.board_c
+      and r.membership_state = 'joined'),
+  1,
+  'RC-38: an older joined row outranks a newer LEFT row (active-first before recency)');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select tie_agent from _roomcontract_fixture)),
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.tie_agent and r.board_id = f.board_c
+      and r.membership_id = '73020000-0000-4000-8000-000000000010'::uuid),
+  1,
+  'RC-39: at an equal created_at the joined row outranks the larger-id removed row');
+select is(
+  (select count(*)::int
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_inactive_only and r.board_id = f.board_c),
   0,
-  'RC-39: equal created_at rows use id DESC, so the larger removed row excludes the older joined row');
+  'RC-52: an agent whose only rows are left/removed is not listed');
+
+select is(
+  (select string_agg(r.handle || '=' || r.membership_state || '/' || r.role, ',' order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c
+      and r.agent_id in (f.c_member_was_owner, f.c_observer_was_admin)),
+  'rc-c-member-was-owner=joined/member,rc-c-observer-was-admin=subscribed/observer',
+  'RC-57: a member/observer with a NEWER non-active owner/admin row is listed with its ACTIVE role');
+
+select set_config('request.jwt.claim.sub', (select c_member_was_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-55: an active MEMBER with a newer removed OWNER row is refused (the old role confers nothing)');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_observer_was_admin_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-56: an active OBSERVER with a newer left ADMIN row is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_removed_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-53: an owner whose rows are all left/removed (no active row) is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-54: board A''s owner holds no row on board C and is refused there (standing is board-scoped)');
 reset role;
 
 -- ---------------------------------------------------------------------------
@@ -456,7 +694,7 @@ select set_config('request.jwt.claim.sub', '', true);
 \else
 
 select * from skip(
-  28,
+  41,
   'ROOMCONTRACT runtime checks require list_board_members and v_board_memberships.role'
 );
 

package/tests/agent_board_rowid.test.sql

@@ -19,7 +19,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(98);
+select plan(99);
 
 create temp view _rowid_order_sites as
 with defs as (
@@ -29,7 +29,7 @@ with defs as (
     -- LITERALS STRIPPED, and re-derived rather than assumed. The first version of
     -- this line kept literals "because some ORDER BY operands are literals"; that
     -- was measured and is false for THIS view -- the derived checks over it match
-    -- `created_at desc` / `id desc`, which are code, and the whole file is 98/98
+    -- `created_at desc` / `id desc`, which are code, and the whole file was 98/98 when measured
     -- with literals stripped. Keeping them left a real, if narrow, hole: the site
     -- set is built by splitting `def` on `;`, so a literal containing a semicolon
     -- re-splits a statement and can drop it out of the set.
@@ -1300,6 +1300,19 @@ select is(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- 99. list_board_members (ROOMCONTRACT, re-created active-first by #542) was in
+-- the assertion-2 inventory but had no count-equality row of its own, so a
+-- dropped `bm.id desc` at either site went unnoticed here; through the roster
+-- itself the tiebreak is unobservable (it only orders non-active rows). Pinned as
+-- the exact pair (created_at DESC sites, of them with id DESC) so a site that
+-- disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_board_members'),
+  array[2, 2],
+  'list_board_members: BOTH created_at DESC sites (authorization + projection) have the id DESC tiebreak');
+
 select finish();
 
 rollback;