HYBRID CALENDAR 5.9.0 — BOARD ACCESS TEST

PASS — Board ID alone does not grant access.
PASS — Logged-in CRM identity is required.
PASS — Non-admin must have active can_view membership on the requested Board.
PASS — Inactive Board, inactive membership and non-member requests are rejected.
PASS — Every Board AJAX mutation repeats membership validation.
PASS — Card, note and file mutations are checked against the active Board ID.
PASS — Assignment dropdown contains active CRM staff mapped to active members of that Board only.
PASS — Assignment to an active staff user outside that Board is rejected server-side.
PASS — Personal calendar records remain board_id 0 and do not appear in a Board calendar.
PASS — Board calendar cards are filtered by board_id for owner and assignee views.
PASS — Board score header is filtered to the active Board context.
PASS — Client listing, client creation and client attachment are blocked in Board context until a verified Board-client resolver exists.
PASS — Reset and export endpoints are blocked in Board context.
PASS — No Workforce/HR, recruiting, commission, payroll or central user-creation table is read or written.
PASS — Task assignment creates a native CRM notification only for the resolved assignee.
PASS — Existing Calendar 5.8.0 layout and task controls are preserved.

ADMIN RULE
System administrators retain global visibility by design. This does not grant a Board member administrative authority.

DEPENDENCY
The Board calendar requires the existing hybrid_boards and hybrid_board_members tables. Workforce/HR remains a separate authority.
