@@ -0,0 +1,18 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/core': patch
+---
+
+fix(platform-objects): an organization membership, a two-factor enrollment and the two SCIM join rows are named by the people and groups they point at, not raw ids
+
+Clause-②: no
+Metadata-protocol: none
+
+- **The record titles.** Four identity join objects built their title (`display_title`) by splicing stored lookup ids, so a record page's heading, a list's Title column and every reference to the row read ids. Each now reads names one hop through its lookups (ADR-0079 addendum, 2026-10-18), as `sys_business_unit_member` and `sys_team_member` do. A person is their `name`, or their `email` where the name is blank:
+  - `sys_member`: `Ada Lovelace (admin)`, or `Ada Lovelace` with no role;
+  - `sys_two_factor`: `Two-factor for Ada Lovelace`;
+  - `sys_scim_projection_grant`: `billing_admin → Ada Lovelace`;
+  - `sys_scim_group_member`: the provisioned user's `user_name` and the group's `display_name`, each its object's own title: `ada.lovelace@idp.example in Operations`.
+
+  Every hop is read as the reader: a person, provisioned user or group the reader may not read, or one that no longer exists, leaves the title empty rather than showing an id. No column is stored, so a rename shows on the next read.
+- **The authorization prelude reads no title.** `@objectstack/core`'s grant resolver reads `sys_member` three times (the caller's memberships, the active organization's first page of members, and the position-holder count). Each read now names the columns it decides on, as the `sys_user_permission_set` grant read already did, so the membership's title, which now reads a `sys_user` row, is never computed there. An authenticated request still pays the same reads and round trips as before.
@@ -30,7 +30,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { ADMIN_FULL_ACCESS } from '@objectstack/spec';
 import { resetPlatformAdminEmailMemo } from './platform-admin.js';
-import { resolveUserAuthzGrants } from './resolve-authz-context.js';
+import { countPositionHolders, resolveUserAuthzGrants } from './resolve-authz-context.js';
 import { FIXTURES, T0, makeRecordingQl } from './__tests__/resolve-authz-context.batch-equivalence.testkit.js';
 import { bindStaticSecurityCatalog } from './__tests__/security-catalog.testkit.js';
 
@@ -173,13 +173,14 @@ async function resolveBoth(
 }
 
 describe('the prelude\'s grant read names the columns the resolver decides on', () => {
-  it('the grant read names exactly permission_set, organization_id, valid_from and valid_until — no other read names any', async () => {
+  it('the grant read names exactly permission_set, organization_id, valid_from and valid_until — no other read but the memberships names any', async () => {
     const { projections } = await resolveBoth('u1', tablesFor(GRANT_FIXTURES.at(-1)!.grants), { tenantId: ORG_A, nowMs: T0 }, definitions);
     const grantReads = projections.filter((p) => p.object === 'sys_user_permission_set');
     expect(grantReads).toHaveLength(1);
     expect([...(grantReads[0]!.fields as string[])].sort()).toEqual(['organization_id', 'permission_set', 'valid_from', 'valid_until']);
-    // No other read in the prelude changes.
-    expect(projections.filter((p) => p.object !== 'sys_user_permission_set' && p.fields !== undefined)).toEqual([]);
+    // No other read in the prelude changes; the membership reads name theirs
+    // (pinned below).
+    expect(projections.filter((p) => !['sys_user_permission_set', 'sys_member'].includes(p.object) && p.fields !== undefined)).toEqual([]);
   });
 
   describe.each(GRANT_FIXTURES)('$name', ({ grants, tenantId }) => {
@@ -209,3 +210,86 @@ describe('the prelude\'s grant read names the columns the resolver decides on',
     });
   });
 });
+
+/**
+ * [#30454] The prelude's `sys_member` reads name the columns the resolver
+ * decides on, for the same reason as the grant read: the membership's record
+ * title reads the person one hop through `user_id`, which a read naming no
+ * columns pays for with a `sys_user` read and a round trip in every request.
+ * The user's own memberships carry the organization, the role and the ADR-0091
+ * validity window; the active organization's first page carries the one value
+ * §5 keeps, as its completion pages do. Pinned the same way: the envelope over
+ * projected rows equals the envelope over full rows, per membership state the
+ * resolver discriminates, and so does the position-holder count.
+ */
+describe('[#30454] the prelude\'s membership reads name the columns the resolver decides on', () => {
+  /** A membership row as stored: every column the object declares, and the title a full read computes. */
+  const memberRow = (id: string, cols: Record<string, unknown>) => ({
+    id,
+    user_id: 'u1',
+    organization_id: ORG_A,
+    role: 'member',
+    created_at: past,
+    ...cols,
+    display_title: `Ursula (${String(cols.role ?? 'member')})`,
+  });
+
+  const tablesWith = (members: Array<Record<string, unknown>>): Record<string, unknown[]> => ({
+    ...tablesFor([]),
+    sys_member: [
+      ...members,
+      // A fellow member of the active organization (§5's `org_user_ids`).
+      { id: 'm_peer', user_id: 'u2', organization_id: ORG_A, role: 'admin', created_at: past, display_title: 'Vera (admin)' },
+    ],
+  });
+
+  const MEMBER_FIXTURES: Array<{ name: string; members: Array<Record<string, unknown>>; tenantId?: string }> = [
+    { name: 'an owner of the active organization', tenantId: ORG_A, members: [memberRow('m_owner', { role: 'owner' })] },
+    { name: 'an admin of another organization', tenantId: ORG_A, members: [memberRow('m_b', { role: 'admin', organization_id: ORG_B })] },
+    { name: 'an external member', tenantId: ORG_A, members: [memberRow('m_ext', { role: 'external' })] },
+    { name: 'two roles in one membership', tenantId: ORG_A, members: [memberRow('m_two', { role: 'admin,member' })] },
+    { name: 'a lapsed membership (valid_until past)', tenantId: ORG_A, members: [memberRow('m_lapsed', { role: 'owner', valid_until: past })] },
+    { name: 'a membership not yet valid (valid_from future)', tenantId: ORG_A, members: [memberRow('m_pending', { role: 'owner', valid_from: future })] },
+    { name: 'memberships in two organizations, none active', members: [memberRow('m_a', { role: 'admin' }), memberRow('m_b', { role: 'member', organization_id: ORG_B })] },
+  ];
+
+  it('the user\'s membership read names organization_id, role, valid_from and valid_until; the organization\'s names id and user_id', async () => {
+    const { projections } = await resolveBoth('u1', tablesWith([memberRow('m_owner', { role: 'owner' })]), { tenantId: ORG_A, nowMs: T0 }, definitions);
+    const memberReads = projections.filter((p) => p.object === 'sys_member').map((p) => [...(p.fields as string[])].sort());
+    expect(memberReads).toHaveLength(2);
+    expect(memberReads).toEqual(expect.arrayContaining([
+      ['organization_id', 'role', 'valid_from', 'valid_until'],
+      ['id', 'user_id'],
+    ]));
+  });
+
+  describe.each(MEMBER_FIXTURES)('$name', ({ members, tenantId }) => {
+    it('resolves the identical envelope from the projected rows as from the full rows', async () => {
+      const opts = { ...(tenantId ? { tenantId } : {}), nowMs: T0 };
+      const { full, projected } = await resolveBoth('u1', tablesWith(members), opts, definitions);
+      expect(projected).toEqual(full);
+    });
+  });
+
+  it('the fixtures discriminate: they resolve distinct envelopes', async () => {
+    const seen = new Set<string>();
+    for (const { members, tenantId } of MEMBER_FIXTURES) {
+      const { projected } = await resolveBoth('u1', tablesWith(members), { ...(tenantId ? { tenantId } : {}), nowMs: T0 }, definitions);
+      seen.add(JSON.stringify(projected));
+    }
+    expect(seen.size).toBeGreaterThanOrEqual(5);
+  });
+
+  it('the position-holder count reads user_id beside those columns, and counts the same from projected rows', async () => {
+    const tables = tablesWith([memberRow('m_owner', { role: 'owner' }), memberRow('m_lapsed', { user_id: 'u3', role: 'owner', valid_until: past })]);
+    const positions = ['org_owner', 'org_admin', 'everyone'];
+    const full = engineOver(tables, false);
+    const projected = engineOver(tables, true);
+    const fullCounts = await countPositionHolders(full.ql, ORG_A, positions, { nowMs: T0 });
+    const projectedCounts = await countPositionHolders(projected.ql, ORG_A, positions, { nowMs: T0 });
+    expect([...projectedCounts]).toEqual([...fullCounts]);
+    expect(projectedCounts.get('org_owner')).toBe(1);
+    const memberRead = projected.projections.find((p) => p.object === 'sys_member');
+    expect([...(memberRead!.fields as string[])].sort()).toEqual(['organization_id', 'role', 'user_id', 'valid_from', 'valid_until']);
+  });
+});
@@ -954,6 +954,29 @@ function grantAppliesInTenant(organizationId: string | null, tenantId: string |
  */
 const GRANT_ROW_COLUMNS = ['permission_set', 'organization_id', 'valid_from', 'valid_until'] as const;
 
+/**
+ * [#30454] The columns of a principal's own `sys_member` row this resolver
+ * decides on, and the only ones its membership reads ask for: the
+ * organization (`accessible_org_ids`, §3b), the role ({@link heldPositionNames})
+ * and the ADR-0091 validity window (`isGrantActive`,
+ * `nextGrantValidityBoundary`). The reads run in every request's prelude, and a
+ * read naming no columns computes every formula field the object declares —
+ * the membership's record title reads the person one hop through `user_id`, a
+ * `sys_user` read and a round trip — for values nothing here reads. The two
+ * bounds are named although `sys_member` declares neither today: a read names
+ * an undeclared column to no effect, and so the moment the object declares
+ * them they are read, as §3's comment promises. A helper below that learns to
+ * read another column of a membership row adds it here.
+ */
+const MEMBER_ROW_COLUMNS = ['organization_id', 'role', 'valid_from', 'valid_until'] as const;
+
+/**
+ * [#30454] {@link MEMBER_ROW_COLUMNS} plus the member (`user_id`), for
+ * {@link countPositionHolders}, which reads the organization's memberships
+ * and groups them by person.
+ */
+const MEMBER_HOLDER_ROW_COLUMNS = ['user_id', ...MEMBER_ROW_COLUMNS] as const;
+
 /**
  * [#29281] The bound of the first leg's `sys_member` read for the active
  * organization — the read the fellow-org peer list (`org_user_ids`, §5) is
@@ -969,7 +992,9 @@ const GRANT_ROW_COLUMNS = ['permission_set', 'organization_id', 'valid_from', 'v
  * ordinary member's `sys_user` reads — a people picker's search, a read by id,
  * a lookup label — lost them (the ids are random, so which members vanished was
  * arbitrary and moved as members joined). Unchanged as a bound, so an
- * organization under it issues byte-identically the one read it always did.
+ * organization under it issues the one read it always did; that read asks for
+ * the completion pages' columns ({@link ORG_MEMBER_PAGE_COLUMNS}), the one
+ * value §5 keeps, so it computes no formula field (#30454).
  */
 const ORG_MEMBERS_FIRST_READ_ROWS = 1000;
 
@@ -1526,7 +1551,7 @@ export async function countPositionHolders(
   const limit = opts.limit ?? 10000;
   const nowMs = opts.nowMs ?? Date.now();
   const [members, userPositionRows] = await Promise.all([
-    tryFind(ql, 'sys_member', { organization_id: tenantId }, limit),
+    tryFind(ql, 'sys_member', { organization_id: tenantId }, limit, undefined, MEMBER_HOLDER_ROW_COLUMNS),
     tryFind(ql, 'sys_user_position', { organization_id: tenantId }, limit),
   ]);
   if (members.length >= limit || userPositionRows.length >= limit) return counts;
@@ -1858,9 +1883,9 @@ export async function resolveUserAuthzGrants(
     !grants.email || !grants.permissions.includes('ai_seat') || platformAdminConfig.emails.length > 0;
   const [, members, userPositionRows, orgMembersLeg, upsRowsAll] = await Promise.all([
     needsUserRow ? getUserRow() : Promise.resolve(undefined),
-    tryFind(ql, 'sys_member', { user_id: userId }, 200),
+    tryFind(ql, 'sys_member', { user_id: userId }, 200, undefined, MEMBER_ROW_COLUMNS),
     tryFind(ql, 'sys_user_position', { user_id: userId }, 200),
-    tenantId ? tryFind(ql, 'sys_member', { organization_id: tenantId }, ORG_MEMBERS_FIRST_READ_ROWS) : Promise.resolve([] as any[]),
+    tenantId ? tryFind(ql, 'sys_member', { organization_id: tenantId }, ORG_MEMBERS_FIRST_READ_ROWS, undefined, ORG_MEMBER_PAGE_COLUMNS) : Promise.resolve([] as any[]),
     tryFind(ql, 'sys_user_permission_set', { user_id: userId }, 100, undefined, GRANT_ROW_COLUMNS),
   ]);