Unclear behaviour for /members when a user has left the room and specifies a pagination token

**Link to problem area**: https://spec.matrix.org/v1.5/client-server-api/#get_matrixclientv3roomsroomidmembers

**Issue**

The documentation for the `at` parameter states:

> The point in time (pagination token) to return members for in the room. This token can be obtained from a prev_batch token returned for each room by the sync API. Defaults to the current state of the room, as determined by the server.

Further down, it states:

> If you are joined to the room then this will be the current members of the room. If you have left the room then this will be the members of the room when you left.

While this is incorrect for being currently joined (it is either the current members *or* those at the specified timestamp), the behaviour for when you have *left* the room is unspecified. Does it:

- Send you the members at the time you left, regardless of the `at` parameter?
- Send you the members at the time of the `at` parameter, regardless of whether you were in the room at that time? (hopefully not, this would be a security issue)
- Send you the members at the time of the `at` parameter, unless that parameter is from after you've left somehow, in which case it is bounded by the last event before you left?
- Reject the request with some unspecified error code?
- Something else?

Start with the linked Matrix Client-Server API section for GET /rooms/{roomId}/members and its `at` parameter. Determine the intended behavior for users who have left a room, then update the specification to state how pagination tokens are handled in that case and what behavior is expected for tokens outside the user's permitted history.

Written by the indexing model from the issue text.