test: guard inactive directory membership

.superpowers/sdd/admin-user-management/task-1-report.md

@@ -117,3 +117,45 @@ Passed with no whitespace errors.
 - Shared-team membership now uses every requester `Player` row, including inactive ones, exactly as required by the directory plan.
 - The user query joins only `status` and `role`, projects safe raw columns, applies shared-team visibility/search in SQL, counts `DISTINCT user.id`, orders by `user.id`, and applies offset/limit before mapping.
 - Assignment rows are fetched only for the selected page of user IDs and are scoped with the same shared-team subquery for non-admins. No directory query selects or hydrates `User` authentication columns.
+
+## Fix Round 2
+
+### Files changed
+
+- `myteamwallet_backend/src/users/users.service.spec.ts` — strengthens the inactive-requester regression with a QueryBuilder boundary that rejects `requesterPlayer.active` in the shared-team predicate.
+
+### RED evidence
+
+Test file: `myteamwallet_backend/src/users/users.service.spec.ts`
+
+After installing the boundary guard, the shared-team query was deliberately mutated to add `requesterPlayer.active = :active`.
+
+```powershell
+npm test -- users/users.service.spec.ts --runInBand
+```
+
+Result: failed as expected, 1/9 tests failed. `treats an inactive requester assignment as a shared team membership` failed with `shared-team membership must not filter inactive requester assignments`. The mutation was then removed; the production query remains user-ID-only.
+
+### GREEN verification
+
+```powershell
+npm test -- users/users.service.spec.ts --runInBand
+```
+
+Passed: 1 suite, 9 tests.
+
+```powershell
+.\node_modules\.bin\eslint.cmd src\users\users.service.spec.ts --max-warnings=0
+```
+
+Passed with no warnings or errors.
+
+```powershell
+git diff --check
+```
+
+Passed with no whitespace errors.
+
+### Implementation notes
+
+- The test double checks the actual shared-team predicate supplied by the service, rather than returning fixed rows alone. It rejects only for the inactive-requester regression if a predicate references `requesterPlayer.active`, so the test now fails for the realistic authorization regression while preserving the existing output-contract assertions.