fix(core)!: org_user_ids holds every member of an organization with more than 1,000 members - #29356

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 11 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

16 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 57cde8cb3da5970f2c3f6512569cacdb9b2b06a8.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5672e540605ff4f3060b23beee29629165c1377a && git checkout 5672e540605ff4f3060b23beee29629165c1377a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 57cde8cb3da5970f2c3f6512569cacdb9b2b06a8 c1b4f69fc606705e82b5ac1db705b6bf058dcc28 && git checkout -B drift-repro 57cde8cb3da5970f2c3f6512569cacdb9b2b06a8 && git merge --no-ff c1b4f69fc606705e82b5ac1db705b6bf058dcc28

node scripts/docs-audit/affected-docs.mjs --json 57cde8cb3da5970f2c3f6512569cacdb9b2b06a8

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 57cde8cb3da5970f2c3f6512569cacdb9b2b06a8 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

Contract-review-claim: session_01ADHkmQJdgarUjPLNgFBY67 · head c1b4f69 · 2026-11-02T13:51Z

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c1b4f69fc606705e82b5ac1db705b6bf058dcc28
Local-runs: none
Scope: packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/tests/resolve-authz-context.batch-equivalence.testkit.ts, packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json, packages/core/src/security/resolve-authz-context.batch-equivalence.test.ts, packages/core/src/security/resolve-authz-context.org-members-past-first-read.test.ts, packages/plugins/plugin-security/src/sys-user-org-members-past-first-read.test.ts, .changeset/29281-org-members-complete.md + packages/spec/src/security/rls.zod.ts, packages/spec/src/kernel/execution-context.zod.ts, packages/platform-objects/src/identity/sys-user.object.ts, packages/plugins/plugin-security/src/objects/default-permission-sets.ts, packages/plugins/plugin-security/src/rls-compiler.ts, packages/formula/src/cel-to-filter.ts, packages/drivers/driver-sql/src/sql-driver.ts, packages/drivers/driver-sql/src/sql-driver-predicate-emitters.ts, packages/drivers/driver-memory/src/memory-driver.ts, packages/drivers/driver-mongodb/src/mongodb-filter.ts, packages/drivers/driver-mongodb/src/mongodb-driver.ts, packages/objectql/src/engine.ts, packages/core/src/security/assemble-execution-context.ts, packages/core/src/security/resolve-user-grants-cache.ts, packages/plugins/plugin-security/src/explain-engine.ts, packages/plugins/plugin-audit/src/mention-recipient-gate.ts, docs/adr/0139-engine-internal-semi-join-leaf-readable-parent-ids.md, docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md

Inputs read: card #29281 body and all seven comments (triage 6575447789 and 6575719368, claim 6576308060, os-dev-report 6577634380, claim amendment 6577655349, seat ruling 6577690137), PR #29356 body and file list, git diff origin/main...pr29356, and the 67 check-runs on this head. Cited code read on origin/main via git show; the PR head via git show pr29356:PATH.

① Derived judgments

Accept-set and surface changes the diff implies, each judged against the tree:

1. The visible set under 1,000 members: byte-identical. Leg 1 still issues tryFind(ql, 'sys_member', { organization_id: tenantId }, 1000) with the same { isSystem: true } context and no order; §5 takes the completion branch only when orgMembersLeg.length >= 1000. Under the bound the code path, the read multiset and the resulting org_user_ids are what main produced. Pinned by the core 999 test (one read, no warn), the real-driver under-bound test (knex query counter, exactly one where organization_id = ? read), and the unchanged batch-equivalence goldens for every fixture but read-limits-truncate. RIGHT.
2. Exactly 1,000: same set, one extra short read, nothing logged. The first read cannot distinguish 1,000 from more, so one 10,000-row page is read and comes back short; members.length > 1000 is false so no warn. Pinned by the exactly-1,000 test. RIGHT (the extra read is a cost, not a set change).
3. Over 1,000: the set becomes every member plus the caller. This is the correction the card orders; relative to the spec's declaration ("IDs of all users in the active organization", execution-context.zod.ts L371-378) it is the declared set, not a new one. Golden read-limits-truncate gains exactly peer_0999 … peer_1004 and one sys_member {organization_id} limit 10000 query. RIGHT.
4. No path adds a non-member. Every completion page's where is { organization_id } or { organization_id, id: { $gt: after } }; the cursor is ANDed onto the organization equality, never substituted. The read runs under the same { isSystem: true } context as the first read, so applyTenantScope behaves identically for both. ids.add(userId) is pre-existing. The .filter(typeof v === 'string' && v.length > 0) on user_id is unchanged. Pinned by the outsider tests in both files and ablated (dev report: dropping the organization filter reds 3 core + 3 real-driver tests). RIGHT.
5. Single-org and group posture agree. tenantId is the active organization in both; accessible_org_ids is derived from the user-keyed sys_member read ({ user_id }, limit 200), which this PR does not touch, and the driver wall is not reached by a system read. The group wall's membership source is untouched. RIGHT.
6. A failing page is loud, never a shorter list. tryFind's catch throws AuthzStoreUnavailableError (503) for any thrown read not positively classified isMissingTableError; the completion read inherits it. A repeated id (driver ignored the cursor) or an id-less row on a FULL page also throws the same error. A short page is terminal by design. Pinned by three tests (failing page, id-less full page, non-advancing cursor). RIGHT. The 503 is the correct code: it is the resolver's existing "store did not answer" class, and the request was not served a fabricated set.
7. full is page.length >= 10000. I looked for anything that could clamp a find limit below 10,000 and make full never true (silent truncation): no clamp in packages/objectql/src/engine.ts (fillQueryAstDefaults passes limit through), driver-sql applies builder.limit(query.limit) as given, driver-memory slices, driver-mongodb applies the limit. countPositionHolders already reads this object at the same 10,000. RIGHT.
8. The narrowing (the one real accept-set change): above the backend's bind-parameter limit every sys_user read by an ordinary member now fails at the driver (500) where main answered a silently short 200. The lowering is unchanged: rls-compiler.ts#userContextOf copies org_user_ids to the CEL context, cel-to-filter.ts#lowerMembership emits { id: { $in: value } } with no size bound (the DEFAULT_LIMITS memo bounds the CEL source text, not a resolved array), and sql-driver-predicate-emitters.ts emits list('in') with one bind per member. The repo's only bind-limit awareness is the delete path's REFERENCE_PROBE_BATCH = 500 (engine.ts L19443, L21016), which cannot apply to a filter inside one statement. So the refusal is real, it is the driver's, and the ruling's reading (6577690137 item 1) that this is a narrowing is correct. Declared correctly, see ②.
9. Public surface: tryFind gains an optional orderBy. tryFind is module-private (not exported); no published export, type or schema moves. Metadata-protocol: none is RIGHT.
10. Readers of org_user_ids that copy the array (assemble-execution-context.ts L381, engine.ts SEED_USER_GRANTS L22710-22721, explain-engine.ts L776/L904, mention-recipient-gate.ts L261, service-automation run seeding) receive a longer array for organizations past 1,000; none bounds or re-reads it, none serialises it to the wire (current-user-endpoints.ts names it only in a comment). No accept-set change at those sites beyond item 3. RIGHT.

② Semver level

• Changeset .changeset/29281-org-members-complete.md: '@objectstack/core': patch, a BREAKING banner, the Clause-② key declared once as a narrowing, Metadata-protocol: none, and exactly one ADR-0087 marker not-required (no-migration-prescription) with its reason. patch is the level AGENTS.md assigns a non-protocol breaking change ("ships patch and keeps its BREAKING banner and ADR-0087 disposition"); no-migration-prescription is in the gate's category list (check-adr-0087-registration.mjs L557) and the reason given (no key, export or type moves; the one refusal is the database's own) matches the diff. Title carries ! (fix(core)!:).
• PR body: the Clause-② and Metadata-protocol: none declarations are line-initial, each once; the body also records why the claim's no was re-declared, citing the seat ruling. The claim amendment 6577655349 (not the widen-one-narrow-another value) is honoured in both carriers.
• Gates on this head: Check Changeset success, Lint & Repo Gates success (carries check-adr-0087-registration, check-changeset-no-major, check-empty-changeset), PR-body guards success, Governed Surface Queue Guard success. No governed path in the file list.
• Clause-②: no (narrowing). The key is org_user_ids' consumer surface: sys_user reads in an organization past the backend bind ceiling now refuse where they answered short. Nothing widens.

③ Boundary flags

Dev open_questions (6577634380), each answered by the seat ruling 6577690137 and implemented on this head:

• Q1 bind ceiling: ruled B (declare a narrowing). Head carries !, the narrowing declaration in both carriers, and the body's Verification section records the full dogfood battery; Dogfood Regression Gate is success on this head. ANSWERED.
• Q2 log level: ruled A (warn, once per organization per engine). Implemented as console.warn behind membersOutgrewFirstReadSaid; consistent with AGENTS.md's degradation rule (nothing is lost; the line reports cost). ANSWERED.
• Q3 page size: ruled A (10,000 rows, id + user_id). Implemented as ORG_MEMBERS_PAGE_ROWS = 10000, ORG_MEMBER_PAGE_COLUMNS = ['id', 'user_id']. ANSWERED.
• Q4 redesign: ruled that the seat files the ADR card (ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360 per the PR body and brief) with D-a..D-g and the ADR → spec → per-driver order; the PR body names ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360 as the retirement path and makes no ADR edit. ANSWERED (escalated to its own card, as ruled).

Dev deviations: (1) real-driver test in plugin-security outside the claimed surface: ACCEPTED by the ruling. (2) PR body attribution block above Fixes #29281 (line 4): PR-body guards success; harmless. (3) assignee/trailer handling per the fleet relay rules: no action. (4) warn not error: ruled. (5) not measured on Postgres or MongoDB: ACCEPTED as noted; the completion read uses only equality, $gt, orderBy and limit, each of which mongodb-filter.ts ($gt L1325), mongodb-driver.ts (orderBy L805) and memory-driver.ts (orderBy L747, $gt L1897) implement, and a driver that drops the cursor is caught by the repeat guard. (6) no ADR file, no spec change: ruled.

Dev out_of_scope_findings: sharing expandRole and approvals role-tier sys_member reads at 10,000 with catch → []: the PR body says the seat filed #29362. rlsMembership keys share the bind ceiling: recorded for the ADR card (D-f). Stale "org_user_ids cap" prose in ADR-0057 (L85, L162) and admin-set-user-manager.ts L71: confirmed stale on main after this PR; governed path, routed to the ADR card. All carried, none dropped.

Forced batch-equivalence edits (golden, test header, BATCHED_LEGS['read-limits-truncate']: 3, wave-1 filter excluding the limit-10,000 sys_member read, testkit comment): ACCEPTED; each is the mechanical shadow of item ①.3 and nothing else moved in the golden.

④ Design judgment

Against the published spec on main. rls.zod.ts (L33-34, L108, L481-505) and execution-context.zod.ts (L371-378, L405-418) declare that subquery-shaped needs are pre-resolved arrays and that org_user_ids is "IDs of all users in the active organization", lowered as IN (current_user.org_user_ids). On main that capability was declared and not delivered past 1,000 members. This PR delivers it at the consumer's producer (the resolver) up to the physical limit of the declared mechanism, and makes the mechanism's own refusal (one bind per member) visible instead of masking it with a short list. It takes no declared capability away at the consumer: nothing in rls-compiler.ts, cel-to-filter.ts or the drivers is changed, and the shipped scopes (sys-user.object.ts defaultRowScope, default-permission-sets.ts sys_user_org_members) keep their spelling. The relational form is correctly left to an ADR: ADR-0139 D1 forbids a second leaf or correlated form ("⛔ No second leaf, no EXISTS, no correlated form"), and ReadableIds projects the parent's id under the caller's read scope, so it cannot express user_id FROM sys_member WHERE organization_id = tenant. The dev's "no relational form a scope can use" holds against the tree. The narrowing is therefore the spec's own refusal made real, not a consumer-side narrowing of a declared capability. The design holds.

Trying to break it:

• Per-request cost: for an organization at or past 1,000 members, every uncached resolution adds one sequential leg of ceil(n/10,000) reads after Leg 1 (plus the Leg 1 read), and every sys_user read binds n parameters. The grants cache (resolve-user-grants-cache.ts, OS_AUTHZ_GRANTS_CACHE_TTL_MS, default off) amortises it where enabled, and openRequestGrantsMemo dedupes within one request. Measured by the dev on in-process SQLite (20,000 members: 3 reads, 44.5 ms). Accepted by the ruling as the interim; the ADR card retires it. Not a fix for this PR.
• Warn-once state: WeakMap(engine → Set(organizationId)). Bounded by the number of distinct organizations with 1,001+ sys_member rows the engine serves; the key is a tenant id backed by real rows, not an author-controlled string, so the 500-entry clear-on-overflow the sibling memos (cel-to-filter.ts#warnedOverLimit, rls-compiler.ts#warnedDenials) carry is not owed here. Freed with the engine. No leak.
• Concurrency: the said-set check and add are synchronous with no await between, so two concurrent first requests cannot both log. Concurrent first requests all pay the completion read (no cross-request in-flight dedupe); cost only. Keyset paging is snapshot-per-statement: a member added or removed between pages is seen or not as any list read would, and no non-member can enter.
• Bind-ceiling 500's message: the PR adds none; the error is the database's (too many SQL variables on SQLite, the protocol's parameter cap on Postgres), surfaced as an unclassified 500. The warn line is what ties it to the organization and its count, and it is said once per process. The seat ruled option C (a resolver-side cap with a located refusal) out; accepted.
• isMissingTableError false-positive on a completion page returns [] and would shrink the list to the caller alone: this is the pre-existing, maintainer-signed risk in tryFind's catch and applies equally to the first read on main; no new exposure class.

Findings, graded:

• should-fix 1: readOrganizationMembersToCompletion trusts the driver's orderBy. A driver that honours $gt and limit but drops orderBy returns unordered pages; the repeat guard catches that whenever any page row sorts above the page's last row (practically always), but when the last row happens to be the page maximum the rows below it that were not returned are skipped silently. A monotonic check per page (id strictly greater than the previous row's) closes it at no cost and makes the "driver did not honour the order" failure as loud as the cursor one. Shipped drivers apply orderBy, so not a must-fix.
• should-fix 2: the completion read replaces the first read's rows rather than unioning them. If the completion's pages return fewer members than the first read did (a connection seeing an older snapshot, or a misclassified read failure), the list is shorter than what was already in hand. Unioning orgMembersLeg into ids cannot add a non-member (that read was organization-filtered) and guarantees the result is never shorter than main's. Not a must-fix: both reads are honest snapshots and the misclassification risk is pre-existing and recorded.
• should-fix 3 (for the ADR card, not this PR): the raw driver 500 past the bind ceiling carries no remedy text; the ADR's relational leaf removes the ceiling, and until then the once-per-process warn is the only operator pointer. Recorded against ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360.

No must-fix. The tree, not the body, was judged: every claim in the body I checked (first read unchanged, cursor ANDed, 503 on failed/non-advancing page, warn once, exactly-1,000 silent, no spec change, no export change) is what the diff does.

Implemented-by: claude/project-thread-imac18
Reviewed-by: session_01ADHkmQJdgarUjPLNgFBY67

VERDICT: PASS

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

席位核对 · ACCEPT · PR #29356 · 2026-11-02T14:04Z

Head-sha: c1b4f69fc606705e82b5ac1db705b6bf058dcc28

维护者速读(席位终稿)

• 改了什么:组织成员超过 1,000 人时，org_user_ids 现在装下全部成员加调用者本人。首次读取不变(1,000 行);只在它读满时，按 id 游标分页补读(每页 10,000 行，只取 id、user_id),每个组织每个引擎只记一次 warn。补读失败、游标不前进或整页缺 id 都是 503,不会悄悄给出更短的名单。
• 为什么改:core/security: org_user_ids is built from a sys_member read capped at 1000 rows, so in an organization with more than 1000 members the rest of the members' sys_user rows are invisible to every non-admin user #29281。规范声明 org_user_ids 是「当前组织全部用户的 ID」,但以前只读前 1,000 条成员记录，大组织里其余成员的 sys_user 行对所有非管理员不可见，而且没有任何提示。席位裁定见 6577690137。
• 风险与回滚:中。这是收窄：成员数超过数据库绑定参数上限时(SQLite 约 32,766),普通成员读 sys_user 会得到驱动报错(500),以前是悄悄少给的 200。1,000 人以下逐字节不变。根治(改为引擎内部 semi-join,去掉上限)归 ADR 卡 ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360。回滚即 revert。
• 先看:packages/core/src/security/resolve-authz-context.ts(补读函数和 §5 分支)。
• 两分钟验证:pnpm --filter @objectstack/core exec vitest run src/security/resolve-authz-context.org-members-past-first-read.test.ts,预期全绿。
• 需要你做的:无。席位按常设授权落地，合并即关 core/security: org_user_ids is built from a sys_member read capped at 1000 rows, so in an organization with more than 1000 members the rest of the members' sys_user rows are invisible to every non-admin user #29281。
• 席位意见:可落。本 head 67 个 check-run 全部完成(56 成功、11 跳过、0 失败),即入队。

核对六项

1. 形态:draft → main;标题带 !(fix(core)!:);Fixes #29281,与认领 6576308060 及其修正 6577655349 一致;7 个文件 +619/-5,都在申报面内，或经裁定接受(plugin-security 的真驱动测试)。
2. 前提实测:契约复审(CONTRACT_REVIEW_TIER,收窄面)在本 head 上 PASS,记录 6579099249,无必修项。复审逐条对照树而非正文：游标只与组织等值条件 AND,不会引入非成员;find 的 limit 在引擎和三个驱动里都没有被压低;收窄来自驱动的绑定参数，判定正确。
3. 门禁与 dogfood:Dogfood Regression Gate、Check Changeset、Lint & Repo Gates(含 ADR-0087 注册、no-major、empty-changeset)、PR-body guards、Governed Surface Queue Guard 在本 head 都是绿。dev 报告(6577634380)含消融：去掉组织过滤，core 3 条、真驱动 3 条转红。
4. 接受的偏差:batch-equivalence 的 golden 与测试头被迫改动，只是 read-limits-truncate 多出 6 个成员和一次 10,000 行读取，其余 golden 未动，接受。未在 Postgres、MongoDB 上实测，接受：补读只用等值、$gt、orderBy、limit,三个驱动都实现了。
5. 范围外去向:复审的 should-fix 1(不信任驱动的 orderBy,加单调检查)和 should-fix 2(补读结果与首次读取取并集)已立 core/security: the org-members completion read trusts the driver's orderBy and replaces the first read's rows, so a driver that drops the order, or a completion that sees fewer rows, can shorten org_user_ids silently #29398,p3 建议，不挡本 PR。should-fix 3(绑定上限的 500 无补救文字)记在 ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360。共享 expandRole 与审批的成员读取归 plugins: sharing expandRole and approvals role-tier recipients read sys_member at a 10,000-row bound and turn a failed read into an empty list, so a large or unreadable membership silently shrinks the set #29362;ADR-0057 里过时的「上限」说法归 ADR card: membership-scoped RLS (id in current_user.org_user_ids) lowers to an engine-internal semi-join leaf instead of a pre-resolved id array, removing the per-request completion read and the bind-parameter ceiling #29360。
6. 落地条款:Clause-②: no (narrowing),PR 正文与 changeset 都有;收窄面契约复审与全量 dogfood 已做。semver:@objectstack/core patch,带 BREAKING 说明，ADR-0087 标记 not-required (no-migration-prescription)。Metadata-protocol: none。check-governed-merges --pr 29356:NOT governed(入队前复核)。落地授权，维护者原话:「按照 pm-dispatch 规则复核过的都授权」(2026-10-25T11:35Z)。