@consiliency/agent-board-schema 1.55.0 → 1.57.0

package/tests/agent_board_room_roster.test.sql

@@ -2,19 +2,49 @@
 --
 -- Mutation controls (the assertion names are part of the evidence contract):
 --   * removing the owner/admin gate fails RC-32 (member denial);
---   * filtering active state before latest-row selection fails RC-38 (stale row);
---   * removing the id DESC tiebreak fails RC-39 (equal timestamp);
 --   * omitting role from v_board_memberships fails RC-12 (catalog ordinal);
---   * removing the roster board predicate fails RC-37 (cross-board isolation).
+--   * removing the roster board predicate fails RC-37 (cross-board isolation);
+--   * dropping the MBROWID 3a active-first key from the AUTHORIZATION site fails
+--     RC-45/RC-47/RC-49 (an active owner/admin with a newer removed/left/requested
+--     row is refused), message-board#542 -- and, since those callers then capture
+--     nothing, every board-C state check after them;
+--   * dropping it from the PROJECTION site fails RC-38/RC-39 and RC-46/RC-48/
+--     RC-50/RC-51 (that member is omitted) while RC-45/RC-47/RC-49 still pass;
+--   * splitting authorization into "has an active row" AND "has an owner/admin
+--     row in any state" fails RC-55/RC-56 (a member/observer with a newer
+--     non-active owner/admin row is admitted);
+--   * dropping the projection's active-state filter fails RC-25/RC-28/RC-51/RC-52
+--     (non-active agents listed); dropping the authorization's active-state check
+--     fails RC-53 (an owner with no active row admitted).
 --
--- HAND-COUNTED plan: RC-01..RC-44 = 44 assertions. The runner independently
+-- CURRENT STANDING IS ACTIVE-FIRST (message-board#542, migration 20261006000100).
+-- Each agent's current row is chosen `case when membership_state in
+-- ('joined','subscribed') then 0 else 1 end, created_at desc, id desc`, as every
+-- other acting membership reader does (MBROWID 3a). The partial active unique
+-- index allows at most ONE active row per (board, agent), so the result is "the
+-- agent's active row, if any". Two consequences for this file:
+--   * RC-38/RC-39 used to assert that a newer left/removed row HID an older
+--     joined row. That was the #542 defect written down as a requirement; they
+--     now assert the opposite, on board C.
+--   * the id DESC tiebreak is no longer observable through this function: with
+--     at most one active row it only orders non-active rows, which are never
+--     listed and never authorize. It is pinned structurally by assertion 99 of
+--     agent_board_rowid.test.sql (both list_board_members sites carry
+--     `created_at desc, id desc`); the key itself is a class property in
+--     agent_board_membership_current_row_class.test.sql.
+--
+-- EMISSION ORDER differs from label order: in the #542 section the captures
+-- RC-45/47/49 run first, then RC-46/48/50/51, RC-38, RC-39, RC-52, RC-57,
+-- RC-55, RC-56, RC-53, RC-54. Cite assertions by LABEL, not by TAP number.
+--
+-- HAND-COUNTED plan: RC-01..RC-57 = 57 assertions. The runner independently
 -- verifies the plan and emitted assertion counts, so a truncated file cannot pass.
 create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(44);
+select plan(57);
 
 -- ---------------------------------------------------------------------------
 -- Catalog contract: exact signature, projection, posture, privileges, and view.
@@ -158,6 +188,20 @@ create temp table _roomcontract_fixture (
   stale_agent uuid,
   tie_agent uuid,
   board_b_agent uuid,
+  board_c uuid,
+  c_owner_removed uuid,
+  c_admin_left uuid,
+  c_owner_requested uuid,
+  c_inactive_only uuid,
+  c_removed_owner uuid,
+  c_member_was_owner uuid,
+  c_observer_was_admin uuid,
+  c_member_was_owner_user uuid,
+  c_observer_was_admin_user uuid,
+  c_owner_removed_user uuid,
+  c_admin_left_user uuid,
+  c_owner_requested_user uuid,
+  c_removed_owner_user uuid,
   creator_user uuid,
   owner_user uuid,
   admin_user uuid,
@@ -177,6 +221,12 @@ declare
   v_observer_user uuid;
   v_nonmember_user uuid;
   v_suspended_user uuid;
+  v_c_owner_removed_user uuid;
+  v_c_admin_left_user uuid;
+  v_c_owner_requested_user uuid;
+  v_c_removed_owner_user uuid;
+  v_c_member_was_owner_user uuid;
+  v_c_observer_was_admin_user uuid;
 begin
   v_creator_user := public.ensure_github_user('rc-creator', 'rc-creator@example.test', 'rc-creator', 'RC Creator');
   v_owner_user := public.ensure_github_user('rc-owner', 'rc-owner@example.test', 'rc-owner', 'RC Owner');
@@ -185,6 +235,12 @@ begin
   v_observer_user := public.ensure_github_user('rc-observer', 'rc-observer@example.test', 'rc-observer', 'RC Observer');
   v_nonmember_user := public.ensure_github_user('rc-nonmember', 'rc-nonmember@example.test', 'rc-nonmember', 'RC Nonmember');
   v_suspended_user := public.ensure_github_user('rc-suspended', 'rc-suspended@example.test', 'rc-suspended', 'RC Suspended');
+  v_c_owner_removed_user := public.ensure_github_user('rc-c-owner-removed', 'rc-c-owner-removed@example.test', 'rc-c-owner-removed', 'RC C Owner Removed');
+  v_c_admin_left_user := public.ensure_github_user('rc-c-admin-left', 'rc-c-admin-left@example.test', 'rc-c-admin-left', 'RC C Admin Left');
+  v_c_owner_requested_user := public.ensure_github_user('rc-c-owner-requested', 'rc-c-owner-requested@example.test', 'rc-c-owner-requested', 'RC C Owner Requested');
+  v_c_removed_owner_user := public.ensure_github_user('rc-c-removed-owner', 'rc-c-removed-owner@example.test', 'rc-c-removed-owner', 'RC C Removed Owner');
+  v_c_member_was_owner_user := public.ensure_github_user('rc-c-member-was-owner', 'rc-c-member-was-owner@example.test', 'rc-c-member-was-owner', 'RC C Member Was Owner');
+  v_c_observer_was_admin_user := public.ensure_github_user('rc-c-observer-was-admin', 'rc-c-observer-was-admin@example.test', 'rc-c-observer-was-admin', 'RC C Observer Was Admin');
 
   insert into agent_board.agents(
     id, agent_type, handle, display_name, status, auth_user_id, owner_user_id
@@ -201,12 +257,20 @@ begin
     ('73000000-0000-4000-8000-00000000000a', 'agent', 'rc-suspended', 'RC Suspended', 'suspended', v_suspended_user, v_suspended_user),
     ('73000000-0000-4000-8000-00000000000b', 'agent', 'rc-stale', 'RC Stale', 'active', null, null),
     ('73000000-0000-4000-8000-00000000000c', 'agent', 'rc-tie', 'RC Tie', 'active', null, null),
-    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null);
+    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null),
+    ('73000000-0000-4000-8000-00000000000e', 'human', 'rc-c-owner-removed', 'RC C Owner Removed', 'active', v_c_owner_removed_user, v_c_owner_removed_user),
+    ('73000000-0000-4000-8000-00000000000f', 'human', 'rc-c-admin-left', 'RC C Admin Left', 'active', v_c_admin_left_user, v_c_admin_left_user),
+    ('73000000-0000-4000-8000-000000000010', 'human', 'rc-c-owner-requested', 'RC C Owner Requested', 'active', v_c_owner_requested_user, v_c_owner_requested_user),
+    ('73000000-0000-4000-8000-000000000011', 'agent', 'rc-c-inactive-only', 'RC C Inactive Only', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000012', 'human', 'rc-c-removed-owner', 'RC C Removed Owner', 'active', v_c_removed_owner_user, v_c_removed_owner_user),
+    ('73000000-0000-4000-8000-000000000013', 'human', 'rc-c-member-was-owner', 'RC C Member Was Owner', 'active', v_c_member_was_owner_user, v_c_member_was_owner_user),
+    ('73000000-0000-4000-8000-000000000014', 'human', 'rc-c-observer-was-admin', 'RC C Observer Was Admin', 'active', v_c_observer_was_admin_user, v_c_observer_was_admin_user);
 
   insert into agent_board.boards(id, slug, name, created_by_agent_id, status)
   values
     ('73010000-0000-4000-8000-000000000001', 'roomcontract-a', 'ROOMCONTRACT A', '73000000-0000-4000-8000-000000000001', 'active'),
-    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active');
+    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active'),
+    ('73010000-0000-4000-8000-000000000003', 'roomcontract-c', 'ROOMCONTRACT C', '73000000-0000-4000-8000-000000000001', 'active');
 
   -- Board A current active roster: owner, admin, four members, observer.
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
@@ -219,26 +283,59 @@ begin
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000007', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
     ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000008', 'joined', 'observer', '73000000-0000-4000-8000-000000000002');
 
-  -- The board creator has historical owner standing but a newer departed row.
+  -- The board creator once held owner standing and has NO active row now: a
+  -- removed owner row and a newer left row. Creator identity is not authority.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
     ('73020000-0000-4000-8000-000000000002', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00');
 
-  -- Stale-row control: selecting active rows before choosing latest resurrects this actor.
+  -- Board C (message-board#542): an active row coexisting with NEWER non-active
+  -- rows. The partial active unique index admits every pair below.
+  --
+  -- Stale-row control: an older joined row next to a newer left row is CURRENT.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
 
-  -- Total-order control: timestamps tie, so the larger removed-row id must win.
+  -- Equal-timestamp control: the removed row has the LARGER id, so a bare
+  -- `created_at desc, id desc` would pick it; active-first picks the joined row.
   insert into agent_board.board_memberships(
     id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
   ) values
-    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
-    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+
+  -- The three callers #542 names: an active owner with a newer REMOVED row, an
+  -- active admin with a newer LEFT row, an active owner with a newer REQUESTED row.
+  -- Then an agent whose ONLY rows are non-active, and an owner with no active row.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000020', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000021', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000e', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000022', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'subscribed', 'admin', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000023', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-00000000000f', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00', '2026-09-12 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000024', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000025', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000010', 'requested', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-13 00:00:00+00', '2026-09-13 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000026', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000027', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000011', 'removed', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000028', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'left', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000029', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000012', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00', '2026-09-11 00:00:00+00');
+
+  -- The NARROWING direction (round-1 review): an ACTIVE member/observer row
+  -- next to a NEWER non-active OWNER/ADMIN row. Standing comes from the active
+  -- row, so the historical owner/admin role confers nothing.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000030', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'joined', 'member', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000031', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000013', 'removed', 'owner', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000032', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'subscribed', 'observer', '73000000-0000-4000-8000-000000000001', null, '2026-09-10 00:00:00+00', '2026-09-10 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000033', '73010000-0000-4000-8000-000000000003', '73000000-0000-4000-8000-000000000014', 'left', 'admin', '73000000-0000-4000-8000-000000000001', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00', '2026-09-14 00:00:00+00');
 
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
   values
@@ -255,6 +352,16 @@ begin
     '73000000-0000-4000-8000-00000000000b',
     '73000000-0000-4000-8000-00000000000c',
     '73000000-0000-4000-8000-00000000000d',
+    '73010000-0000-4000-8000-000000000003',
+    '73000000-0000-4000-8000-00000000000e',
+    '73000000-0000-4000-8000-00000000000f',
+    '73000000-0000-4000-8000-000000000010',
+    '73000000-0000-4000-8000-000000000011',
+    '73000000-0000-4000-8000-000000000012',
+    '73000000-0000-4000-8000-000000000013',
+    '73000000-0000-4000-8000-000000000014',
+    v_c_member_was_owner_user, v_c_observer_was_admin_user,
+    v_c_owner_removed_user, v_c_admin_left_user, v_c_owner_requested_user, v_c_removed_owner_user,
     v_creator_user, v_owner_user, v_admin_user, v_member_user, v_observer_user,
     v_nonmember_user, v_suspended_user
   );
@@ -401,7 +508,7 @@ set local role authenticated;
 select throws_ok(
   (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
   '42501', 'only a board owner or admin may list board members',
-  'RC-36: board creator identity is not authority after its latest membership departed');
+  'RC-36: board creator identity is not authority when no membership row of its own is active');
 
 reset role;
 
@@ -416,18 +523,149 @@ select is(
     where agent_id = (select board_b_agent from _roomcontract_fixture)),
   0,
   'RC-37: board B membership is absent from board A roster (cross-board isolation)');
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- message-board#542: current standing is ACTIVE-FIRST (MBROWID 3a), on board C.
+-- Each allow is lives_ok over a CAPTURE (`create temp table … as select * from
+-- list_board_members(…)`), then SEPARATE state checks read the captured rows
+-- (AGENTS.md rule 3, #113). A bare `is((select … from list_board_members(…)))`
+-- would ABORT the file on a 42501 instead of failing one named assertion:
+-- measured while writing this section — with the authorization key mutated
+-- away, the first bare form killed the transaction and only 38 of 54 ran.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select c_owner_removed_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_removed on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-45: an active owner with a NEWER removed row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_admin_left_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_admin_left on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-47: an active admin with a NEWER left row may list the roster (#542)');
+reset role;
+select set_config('request.jwt.claim.sub', (select c_owner_requested_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$create temp table _rc542_owner_requested on commit drop as select * from agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  'RC-49: an active owner with a NEWER requested row may list the roster (#542)');
+reset role;
+
+-- A capture that never ran leaves no table; to_regclass keeps each state check
+-- a named `not ok` (have NULL) instead of a missing-relation abort.
+create temp table _rc542_rows (
+  caller text,
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  handle text,
+  display_name text,
+  agent_type text,
+  membership_state text,
+  role text,
+  created_by_agent_id uuid,
+  membership_created_at timestamptz,
+  membership_updated_at timestamptz
+) on commit drop;
+do $$
+begin
+  if to_regclass('pg_temp._rc542_owner_removed') is not null then
+    insert into _rc542_rows select 'owner_removed', r.* from _rc542_owner_removed r;
+  end if;
+  if to_regclass('pg_temp._rc542_admin_left') is not null then
+    insert into _rc542_rows select 'admin_left', r.* from _rc542_admin_left r;
+  end if;
+  if to_regclass('pg_temp._rc542_owner_requested') is not null then
+    insert into _rc542_rows select 'owner_requested', r.* from _rc542_owner_requested r;
+  end if;
+end
+$$;
+
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_owner_removed and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-46: that owner is listed once, by its ACTIVE owner row, not the newer removed row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'admin_left' and r.agent_id = f.c_admin_left and r.board_id = f.board_c),
+  'subscribed/admin',
+  'RC-48: that admin is listed once, by its ACTIVE admin row, not the newer left row');
+select is(
+  (select string_agg(r.membership_state || '/' || r.role, ',')
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_requested' and r.agent_id = f.c_owner_requested and r.board_id = f.board_c),
+  'joined/owner',
+  'RC-50: that owner is listed once, by its ACTIVE owner row, not the newer requested row');
+select is(
+  (select array_agg(r.handle order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c),
+  array['rc-c-admin-left', 'rc-c-member-was-owner', 'rc-c-observer-was-admin', 'rc-c-owner-removed', 'rc-c-owner-requested', 'rc-stale', 'rc-tie']::text[],
+  'RC-51: board C roster is exactly the seven agents holding an active row, whatever newer rows they have');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select stale_agent from _roomcontract_fixture)),
-  0,
-  'RC-38: latest left row excludes an older joined row (choose latest before filtering state)');
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.stale_agent and r.board_id = f.board_c
+      and r.membership_state = 'joined'),
+  1,
+  'RC-38: an older joined row outranks a newer LEFT row (active-first before recency)');
 select is(
   (select count(*)::int
-     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
-    where agent_id = (select tie_agent from _roomcontract_fixture)),
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.tie_agent and r.board_id = f.board_c
+      and r.membership_id = '73020000-0000-4000-8000-000000000010'::uuid),
+  1,
+  'RC-39: at an equal created_at the joined row outranks the larger-id removed row');
+select is(
+  (select count(*)::int
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.agent_id = f.c_inactive_only and r.board_id = f.board_c),
   0,
-  'RC-39: equal created_at rows use id DESC, so the larger removed row excludes the older joined row');
+  'RC-52: an agent whose only rows are left/removed is not listed');
+
+select is(
+  (select string_agg(r.handle || '=' || r.membership_state || '/' || r.role, ',' order by r.handle collate "C")
+     from _rc542_rows r, _roomcontract_fixture f
+    where r.caller = 'owner_removed' and r.board_id = f.board_c
+      and r.agent_id in (f.c_member_was_owner, f.c_observer_was_admin)),
+  'rc-c-member-was-owner=joined/member,rc-c-observer-was-admin=subscribed/observer',
+  'RC-57: a member/observer with a NEWER non-active owner/admin row is listed with its ACTIVE role');
+
+select set_config('request.jwt.claim.sub', (select c_member_was_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-55: an active MEMBER with a newer removed OWNER row is refused (the old role confers nothing)');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_observer_was_admin_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-56: an active OBSERVER with a newer left ADMIN row is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select c_removed_owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-53: an owner whose rows are all left/removed (no active row) is refused');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_c) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-54: board A''s owner holds no row on board C and is refused there (standing is board-scoped)');
 reset role;
 
 -- ---------------------------------------------------------------------------
@@ -456,7 +694,7 @@ select set_config('request.jwt.claim.sub', '', true);
 \else
 
 select * from skip(
-  28,
+  41,
   'ROOMCONTRACT runtime checks require list_board_members and v_board_memberships.role'
 );
 

package/tests/agent_board_rowid.test.sql

@@ -19,7 +19,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(98);
+select plan(100);
 
 create temp view _rowid_order_sites as
 with defs as (
@@ -29,7 +29,7 @@ with defs as (
     -- LITERALS STRIPPED, and re-derived rather than assumed. The first version of
     -- this line kept literals "because some ORDER BY operands are literals"; that
     -- was measured and is false for THIS view -- the derived checks over it match
-    -- `created_at desc` / `id desc`, which are code, and the whole file is 98/98
+    -- `created_at desc` / `id desc`, which are code, and the whole file was 98/98 when measured
     -- with literals stripped. Keeping them left a real, if narrow, hole: the site
     -- set is built by splitting `def` on `;`, so a literal containing a semicolon
     -- re-splits a statement and can drop it out of the set.
@@ -506,9 +506,10 @@ select is(
   true,
   'control: fixture and structural block really runs as service_role');
 
--- 2. Catalog-derived inventory: eight membership readers plus the two task/message idempotency
--- readers. request_join_board joined the set in MBCONSENT-B(iii), and list_board_members joined
--- it in ROOMCONTRACT; both read board_memberships with the created_at DESC + id DESC tiebreak.
+-- 2. Catalog-derived inventory: nine membership readers plus the two task/message idempotency
+-- readers. request_join_board joined the set in MBCONSENT-B(iii), list_board_members joined
+-- it in ROOMCONTRACT, and list_my_board_requests joined it in ONBOARD (v11); all read
+-- board_memberships with the created_at DESC + id DESC tiebreak.
 select is(
   (select array_agg(proname order by proname)
      from _rowid_function_order_counts),
@@ -519,12 +520,13 @@ select is(
     'join_board',
     'list_board_members',
     'list_board_pending_memberships',
+    'list_my_board_requests',
     'post_board_message',
     'request_join_board',
     'resolve_board_request',
     'update_board_membership'
   ]::text[],
-  'live catalog exposes eight membership readers plus two task/message idempotency readers');
+  'live catalog exposes nine membership readers plus two task/message idempotency readers');
 
 -- 3-10. COUNT-EQUALITY, never substring containment.
 select is(
@@ -1300,6 +1302,30 @@ select is(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- 99. list_board_members (ROOMCONTRACT, re-created active-first by #542) was in
+-- the assertion-2 inventory but had no count-equality row of its own, so a
+-- dropped `bm.id desc` at either site went unnoticed here; through the roster
+-- itself the tiebreak is unobservable (it only orders non-active rows). Pinned as
+-- the exact pair (created_at DESC sites, of them with id DESC) so a site that
+-- disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_board_members'),
+  array[2, 2],
+  'list_board_members: BOTH created_at DESC sites (authorization + projection) have the id DESC tiebreak');
+
+-- 100. list_my_board_requests (ONBOARD v11, 20261007000100): one statement, two created_at
+-- DESC sites -- the lateral that picks the caller's current membership row (active-first),
+-- and the result order -- and both carry the id DESC tiebreak. The exact pair, as for 99,
+-- so a site that disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_my_board_requests'),
+  array[2, 2],
+  'list_my_board_requests: BOTH created_at DESC sites (current row + result order) have the id DESC tiebreak');
+
 select finish();
 
 rollback;

package/tests/catalog/function_execute_privileges.json

@@ -1036,6 +1036,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "invite_board_for_display",
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": true,
+        "authenticated": false
+      }
+    },
     {
       "name": "invite_board_member",
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
@@ -1090,6 +1099,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "list_my_board_requests",
+      "signature": "list_my_board_requests()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": true
+      }
+    },
     {
       "name": "mark_read",
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",

package/tests/catalog/p_metadata_parameters.json

@@ -461,6 +461,10 @@
       "signature": "heartbeat(p_agent_id uuid, p_thread_id uuid, p_availability text, p_activity_summary text, p_expires_in interval, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -485,6 +489,10 @@
       "signature": "list_board_pending_memberships(p_board_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "list_my_board_requests()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",
       "declares_p_metadata": false