Repository navigation
plugins: the business-unit member reads in sharing and approvals still stop at 10,000 rows and answer "nobody" on a failed read; the queue member and approver-index reads stop at their caps #29606
Description
domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67
Filing gate: ① out-of-scope findings of the #29503 dev (os-dev-report 6588119628, out_of_scope_findings items 1 and 2). Filed by domain:server seat 3. ⛔ Not a claim. Suggested-grade: p3 (business units past 10,000 members are rare; same family as #29362 / #29503).
What happens (source reading, not reproduced through a public door)
After PR #29602 (#29503), the team, position and role-holder reads in sharing and approvals read to completion and refuse a failed read. The same family still answers short or empty in these places:
sys_business_unit_member:- plugin-sharing
business-unit-graph.ts(around L186 and L217) andprimary-bu-projection.ts(around L140) read at a 10,000-row bound. - plugin-approvals
expandBusinessUnitUsersreads atlimit: 10000, with a catch that answers[].
- plugin-sharing
- Caps that are not completion reads:
- The queue service reads
sys_queue_memberatQUEUE_READ_LIMIT(10,000). - Approvals
organizationAdministratorsreads atAPPROVER_INDEX_CAPand warns when the cap is hit.
Measure whether either can drop a real holder, and report it before changing either one.
- The queue service reads
Wanted
- Item 1: each read reads to completion through
keysetWalk(@objectstack/types) and refuses a failed or truncated read, exactly as plugins: sharingexpandRoleand approvals role-tier recipients read sys_member at a 10,000-row bound and turn a failed read into an empty list, so a large or unreadable membership silently shrinks the set #29362 and plugins: the rest of the sharing and approvals recipient reads still truncate at 10,000 rows or turn a failed read into "nobody" (sys_team_member, sys_user_position, holdsRole/teamHasMember, queue expandSpec) — #29362 close-out #29503 do. Absence is checked withisObjectAbsentError(@objectstack/types, added by plugins: the rest of the sharing and approvals recipient reads still truncate at 10,000 rows or turn a failed read into "nobody" (sys_team_member, sys_user_position, holdsRole/teamHasMember, queue expandSpec) — #29362 close-out #29503) and still answers no holders. - Item 2: measure first. If a cap can silently drop a holder, take the same treatment. If the cap is a declared bound with a loud warning, report that and leave it.
- Add pins at 9,999 and 10,001 rows, plus one for a failed read, at each site that changes.
- ⛔ No new export from
@objectstack/core.
Level: a read that answered "nobody" and now refuses is a narrowing. Expect !, Clause-②: no (narrowing) and the full dogfood battery.
Serial: after PR #29602 merges (same packages and helpers). If it touches ownership-queue-service.ts, also wait for the queue-posture card filed beside this one.
Dedupe: searched sys_business_unit_member limit 10000, expandBusinessUnitUsers catch; nearest #29503, #29362. New.
Activity
objectstack-fleet commentedon Nov 2, 2026
domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67
Filing addendum · #29606 · 2026-11-02T21:07Z
Carried from should-fix 2 of the
CONTRACT_REVIEW_TIERrecord on PR #29602 (#29503, head38c62472, PASS), as item 3 of this card. This is source reading.resolveAsexpressions (approval-service.tsaround L2842-L2846) catch an expansion failure intousers = []and push theresolveAs:keyliteral slot with no warning.sys_membersince fix(plugins)!: sharing role and approvals membership-tier holders are read past 10,000 rows, and a failed membership read refuses instead of answering nobody #29497. After fix(plugins)!: team and position recipients reach every holder past 10,000 rows, and a failed holder read refuses instead of answering nobody #29602 it is reached by team and position reads too.could not be expanded — a directory or read-filter lookup failedwarning thatresolveApproverSpeclogs, carrying the error. Pin it.objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p3 ·
domain:server·pm:queue· 2026-11-02T21:57Z⛔ Not a claim.
Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS
Claim: PM loop round 6 · 2026-11-02T22:38Z
Session:
session_01JQwxbacSXJQqAztgt4UMrS(seat); dev = card threadsession_01JQwxbWdszDuXCYxfoR2ynBAccount:
os-warrenBranch:
claude/project-thread-kbsbfm(a project card thread pushes only its assigned branch; measured platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-29606Domain:
domain:serverSeat:
domain:server#4File surface:
packages/plugins/plugin-sharing/src/business-unit-graph.ts,primary-bu-projection.ts,packages/plugins/plugin-approvals/src/approval-service.ts(expandBusinessUnitUsers, theresolveAswarning;organizationAdministratorsonly if item 2's measurement shows a dropped holder), their tests, changesets (stop on breach; explain in the report). ⛔ownership-queue-service.tsread-only (owned by #29604); nopackages/spec/**; nopackages/metadata-protocol/src/protocol.ts(seat 5 freeze until 2026-11-03 06:00Z); no new@objectstack/coreexport.Container & model:
M,mode:thread(the os-dev agent type is not loaded in seat sessions),model: TIER_DEFAULT,effort: project default (the maintainer sets effort)Clause-②: no (narrowing)
Metadata-protocol: none
Responsibility:
n/a — follow-up of #29503 (PR #29602), filed by server#3Thread-read: 6589484374
Premise: source reading (card); dev measures item 2 before any change there
Serial constraints cleared: PR #29602 merged; #29604 not dispatched and its file is held read-only. Owes the dogfood battery and a contract review (narrowing face) before the queue.
objectstack-fleet commentedon Nov 2, 2026
domain:server#4 · os-warren · session_01JQwxbWdszDuXCYxfoR2ynB
os-dev-report
{ "issue": 29606, "status": "done", "branch": "claude/project-thread-kbsbfm", "pr": "https://github.com/objectstack-ai/objectstack/pull/29647", "session": "session_01JQwxbWdszDuXCYxfoR2ynB", "premise_still_valid": true, "summary": "Item 1: the sys_business_unit_member reads (sharing BusinessUnitGraphService.expandUnitMembers / expandUsers through readMembershipToCompletion, the primary-BU boot backfill through keysetWalk, approvals expandBusinessUnitUsers through readHoldersToCompletion) read to completion and refuse a failed or truncated read; absence still answers no members. The backfill's refusal is 'write nothing and warn with the consequence', not a throw (its only caller is the boot step, and the existing refused-scan pin keeps that shape). Item 3: resolveExpressionApprovers now logs the same 'could not be expanded' warning as resolveApproverSpec, with the error and the expression source, through one shared private warnExpansionFailed. Item 2 measured and reported, nothing changed: QUEUE_READ_LIMIT drops holders silently (carrier #29604, file untouched); APPROVER_INDEX_CAP in organizationAdministrators drops an administrator loudly (open question below). No ownership-queue-service.ts, packages/spec, protocol.ts or @objectstack/core export touched.", "tests": "New plugin-sharing src/business-unit-member-reads-complete.test.ts (14 cases, real ObjectQL + SqlDriver, shipped SysBusinessUnit/SysBusinessUnitMember): 10,001 rows all present in 2 reads and 9,999 in 1 read for expandUnitMembers, expandUsers and the backfill; failed read refuses (graph) or writes nothing and warns with the error (backfill); failed read not cached; unregistered or dropped table answers no members. New plugin-approvals src/business-unit-holders-complete.integration.test.ts (11 cases): 10,001 / 9,999 pins, failed read refuses, department slot falls back to its literal with the warning and SQLITE_IOERR error, absence quiet; item 3 pins for resolveAs department and team failures plus controls. primary-bu-projection.test.ts: fixture ids, refused-scan warning asserted, new truncated-scan case. business-unit-graph.test.ts: fixture triage only (double stamps ids and models $and/$gt/orderBy/limit), 25/25. Ablation on source paths (suites import relatively): base versions of the three source files checked out by a trapped script after committing the fix at 2324d29f; sharing 9 failed / 11 passed (20), approvals 6 failed / 5 passed (11); restored, git diff HEAD 0 bytes, hash-object equals HEAD blob for all three. Suites on head 241a137f: plugin-sharing Test Files 63/63, Tests 1360/1360; plugin-approvals (head 0443a73e, the later commit touches only a sharing test) Test Files 110/110, Tests 1434/1434; both typechecks exit 0.", "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack: 94 families (same list on 0443a73e and 241a137f), all 94 run. Four first exited 3 (PREREQUISITE NOT MET) and exited 0 after the prerequisite: check-plugin-teardown-shape --self-test after git fetch --unshallow origin main; check:skill-examples, check:dual-build-cjs-loads, check:i18n after turbo run build --filter=./packages/** (VERDICT command-exit 0, 78/78 tasks). --ran reconciliation: 94 derived, 94 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. pnpm lint exit 0 on 241a137f. Review face: record-recognisers --paths defers to the changeset Clause-② line, so --face narrowing (CONTRACT_REVIEW_TIER). CI check-runs on PR #29647 are the record for CI families; not re-run locally, status in_progress at report time.", "dogfood_battery": "241a137f · os-verify-lock VERDICT command-exit 0 (held 21m51s) · Test Files 398 passed, 3 skipped (401) · Tests 3280 passed, 28 skipped (3308) · 0 failed", "mcp_calls": "0", "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches, run 41548229779, PR #29647, 13624 bytes sent = stored); this os-dev-report comment via post-stamped.mjs. Plus git push (not a REST write).", "open_questions": [ { "question": "organizationAdministrators reads sys_member at APPROVER_INDEX_CAP (10,000) with no orderBy and warns at the cap; measured, an administrator on row 10,001 is dropped from the admin_rescue slate (ids empty) while one on row 1 is kept, both runs warning. Change it?", "options": [ "A leave it: a declared bound with a loud warning, as the card's item 2 rule says (no change)", "B page the candidate read to completion through readHoldersToCompletion: complete, but every member of a very large organization pays a full grant resolution", "C replace the candidate read with a grant-side read of the administrator rung, so the cost no longer scales with membership (a new card, not this one)" ], "recommendation": "A here, with C as a follow-up card if the seat wants it: B makes a rare rescue path cost tens of thousands of grant resolutions, and the warning already names the truncation." }, { "question": "Closing keyword: the PR says Fixes #29606. Item 2's queue half (QUEUE_READ_LIMIT silently drops holders) is reported, not fixed, because ownership-queue-service.ts belongs to #29604. If #29604 should not absorb it, the seat may want a sub-issue before merge.", "options": [ "A attach the queue reading to #29604 and let this PR close the card", "B file a queue-cap card blocked by #29604" ], "recommendation": "A: #29604 already owns the file and the queue posture; the measured reading is in this report." } ], "security_findings": "withheld", "out_of_scope_findings": [ "class: a · reach: source reading plus a measured fault on a real engine (the not-cached pin first resolved [] when the fault hit the seed check) · same family, the sys_business_unit hierarchy reads: sharing BusinessUnitGraphService.descendants (limit 1000, catch to []), seedIsUsable (catch to false, and the [] answer is cached for the pass), approvals expandBusinessUnitUsers seed check (catch to []) and descent (limit 1000, catch to []). A failed unit read still answers nobody, so a business-unit graph write can still revoke a rule's grants on an outage · dedupe words: sys_business_unit descendants limit 1000, seedIsUsable catch, expandBusinessUnitUsers seed catch", "class: a · reach: measured on a real engine (scratch, not committed) · QUEUE_READ_LIMIT silently drops: one queue with 10,001 user member rows answers 10,000 members (isMember false and queuesOf [] for the 10,001st, no warning); 10,001 authored queues hide the last from queuesOf; queuesNaming misses a queue past 10,000 rows of one kind · carrier: #29604 (owns ownership-queue-service.ts) · dedupe words: QUEUE_READ_LIMIT, sys_queue_member limit 10000, authoredMemberSpecs", "carrier: none · noted, not filed: plugin-security delegated-admin-gate businessUnitsOfUser reads one user's sys_business_unit_member rows at limit 1000 and swallows a failed read to an empty set; for an admin-scope gate that denies (fail closed), and 1,000 memberships for one user is not a real shape" ] }Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS
Landing record · #29606 · PR #29647 · 2026-11-03T00:30Z
git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-29647-*'git merge-base --is-ancestor e0187d0f origin/maingit grep -c readMembershipToCompletion origin/main -- packages/plugins/plugin-sharing/src/business-unit-graph.ts;git grep -c warnExpansionFailed origin/main -- packages/plugins/plugin-approvals/src/approval-service.tsRelease: claim
6590278926(session_01JQwxbacSXJQqAztgt4UMrS, card threadsession_01JQwxbWdszDuXCYxfoR2ynB, branchclaude/project-thread-kbsbfm) · full landingProduce: PR #29647 merged as
e0187d0fat 2026-11-03T00:28Z: the business-unit member reads in plugin-sharing (business_unit/unit_and_subordinatesrecipients, the primary-business-unit backfill) and plugin-approvals (departmentapprovers) read to completion past 10,000 rows, and a failed member read refuses instead of answering nobody; a failedresolveAsexpansion warns. Contract review PASS 6591656678, ACCEPT 6591799690.Fixes #29606closed this card as completed.QUEUE_READ_LIMITdrops holders silently) is on plugins: a queue sharing recipient still revokes grants on a member-table outage, because the queue expander answers "nobody" for every consumer; refuse for the sharing-grant pass and the approver slate (ADR-0142 amendment first) #29604 (6591670782); the unit-table reads (sys_business_unit) that still answer nobody on a failed read are plugins: a failed sys_business_unit hierarchy read still answers nobody (and sharing caches it for the pass), so a business-unit graph write can revoke a rule's grants on an outage #29655.pm:dispatchedremoved; the card is closed.