@@ -0,0 +1,24 @@
+---
+'@objectstack/core': patch
+---
+
+fix(core)!: an ordinary member of an organization with more than 1,000 members sees every fellow member in `sys_user` again, and an organization too large for the database's bound-parameter limit is refused loudly instead of served a short list
+
+Clause-②: no (narrowing)
+Metadata-protocol: none
+
+The claim declared `no` for an interim that reads the membership to completion; the seat's ruling (6577690137 on #29281) reads the refusal past the bound-parameter limit as a narrowing.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export, type or metadata changes: the authorization resolver reads a list it already read, to completion. No author has anything to rewrite; the one new refusal is the database's own, for an organization whose membership exceeds what one statement can bind. -->
+
+**BREAKING** for organizations past the database's bound-parameter limit only: their members' `sys_user` reads, which used to answer a silently short list, now fail.
+
+`sys_user`'s organization-members row scope (`id in current_user.org_user_ids`, the object's default row scope and `member_default`'s `sys_user_org_members`) reads the fellow-org peer list the request's authorization resolver builds. That list was built from one `sys_member` read bounded at 1,000 rows, so in an organization with more members everyone past the 1,000th `sys_member.id` was missing from it with no signal: a people picker or lookup searching for them found nothing, and reading them by id answered `404`. Which members vanished was arbitrary, because member ids are random.
+
+- **Every member, nobody else.** When that first read comes back at its bound, the resolver now reads the active organization's membership to completion, in pages of 10,000 ordered by id, and the list holds every member plus the caller. Members of other organizations stay out.
+- **Smaller organizations are unchanged.** An organization under 1,000 members issues exactly the one read it always did; nothing else is read and nothing is logged. An organization of exactly 1,000 gets the same list after one more read, and nothing is logged.
+- **Said once.** The first time an organization's membership outgrows the first read, the server logs one `warn` naming the organization and its member count. Every request in that organization now reads its whole membership, and each `sys_user` read in it binds one parameter per member.
+- **Who sees the narrowing.** An organization whose membership passes the backend's bound-parameter limit: on SQLite, 32,000 members were served and 40,000 refused (`too many SQL variables`, `500`); Postgres's wire protocol caps a statement at 65,535 parameters. Its members' `sys_user` reads now fail where they used to answer a list missing everyone past the 1,000th member. The `warn` line names the organization and its count so an operator can connect the two.
+- **Loud, never short.** A membership page that fails to read, or a driver that does not honour the id cursor, fails the request with the existing `503` authorization-store error instead of answering a shorter list.
+
+**The remedy.** None is needed below the limit. Past it there is no workaround in this release: the relational membership predicate (#29360) removes the per-member parameters altogether.
@@ -359,6 +359,10 @@ export const FIXTURES: Fixture[] = [
     // limit, 1005 peers against the 1000 limit. Truncation is OBSERVABLE here
     // (the double slices like a driver), so a batch that changed either limit —
     // or merged the two reads under one of them — moves these arrays.
+    // [#29281] …except the peers': a fellow-org read that comes back AT its
+    // bound is now a first page, and the membership is read to completion, so
+    // `org_user_ids` holds all 1,006 members; the 1000 bound is still pinned
+    // by the recorded `queries`, and the 200 one by `accessible_org_ids`.
     name: 'read-limits-truncate',
     userId: 'u_lim',
     opts: { tenantId: 'org_0000', seedEmail: 'lim@x.com', nowMs: T0 },
 
@@ -1767,7 +1767,13 @@
         "peer_0995",
         "peer_0996",
         "peer_0997",
-        "peer_0998"
+        "peer_0998",
+        "peer_0999",
+        "peer_1000",
+        "peer_1001",
+        "peer_1002",
+        "peer_1003",
+        "peer_1004"
       ],
       "accessible_org_ids": [
         "org_0000",
@@ -1999,6 +2005,14 @@
         "limit": 1000,
         "isSystem": true
       },
+      {
+        "object": "sys_member",
+        "where": {
+          "organization_id": "org_0000"
+        },
+        "limit": 10000,
+        "isSystem": true
+      },
       {
         "object": "sys_user_permission_set",
         "where": {
 
@@ -87,6 +87,18 @@
  * it joins the activation-ledger read's wave, so the fixture still resolves in
  * two legs. That read is in the golden because the code genuinely issues it —
  * the organization-less row this fixture used to hold asked none.
+ *
+ * ⚠️ A fifth recorded move ([#29281], the visible set it corrects is the
+ * defect the card reports): the fellow-org `sys_member` read that comes back
+ * AT its 1,000-row bound is a first page, no longer the membership, and the
+ * resolver reads the active organization's membership to completion. One
+ * fixture's golden moved, `read-limits-truncate`, whose 1,006 rows for
+ * `org_0000` came back at the bound: `grants.org_user_ids` gains the six
+ * members the bound cut (`peer_0999` … `peer_1004`), `queries` gains the
+ * completion read (`sys_member {organization_id}`, limit 10,000), and the
+ * fixture resolves in three legs, the completion read being its own. The
+ * first read itself, its bound and every other recorded read are unchanged,
+ * and so is every other fixture: none comes back at the bound.
  */
 
 import { readFileSync } from 'node:fs';
@@ -143,7 +155,9 @@ const BATCHED_LEGS: Record<string, number> = {
   'ai-seat-and-email-from-sys-user': 2,
   'ai-seat-denied': 2,
   'seeded-permissions-and-email': 2,
-  'read-limits-truncate': 2,
+  // [#29281] Three: the fellow-org read came back at its bound, so the
+  // membership is read to completion after wave 1, in a leg of its own.
+  'read-limits-truncate': 3,
   'no-active-org': 2,
 };
 
@@ -283,6 +297,9 @@ describe('[#10825] batched resolveUserAuthzGrants — equivalence with the seque
           // Wave 2: the activation ledger and the Default Organization read,
           // which are issued together after wave 1 (#10757 leg 4).
           .filter((c) => c.object !== 'sys_metadata_activation' && c.object !== 'sys_organization')
+          // [#29281] …and the membership completion read (limit 10,000), which
+          // exists only because wave 1's fellow-org read came back at its bound.
+          .filter((c) => !(c.object === 'sys_member' && c.limit === 10000))
           .map((c) => c.object)
           .sort(),
       );
 
@@ -0,0 +1,191 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#29281] `org_user_ids` — the fellow-org peer list `sys_user`'s org-members
+ * row scope reads (`id in current_user.org_user_ids`) — holds EVERY member of
+ * the active organization, whatever its size, and nobody else.
+ *
+ * It is read from `sys_member` in the resolver's first leg, bounded at 1,000
+ * rows. That bound used to be the list: a read that came back AT it was taken
+ * as the whole membership, so the members past the 1,000th `sys_member.id`
+ * were silently missing from every ordinary member's `sys_user` reads. Now a
+ * first read at its bound is the signal to read the membership to completion
+ * (ordered by id, a page at a time) and to say so once; a first read under it
+ * is the whole membership, exactly as before, and nothing else is read.
+ *
+ * The double below honours the reads' `where` (equality, `$gt`), `orderBy` and
+ * `limit`, and answers an UNORDERED read in insertion order, which here is not
+ * id order — so a completion that resumed after the first page's last id,
+ * trusting that page to be the id-lowest 1,000, would miss members and fail.
+ * The real-driver twin is plugin-security's
+ * `sys-user-org-members-past-first-read.test.ts`.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { resolveUserAuthzGrants } from './resolve-authz-context.js';
+import { isAuthzStoreUnavailableError } from './authz-store-unavailable.js';
+import { bindCatalogFromTables } from './__tests__/security-catalog.testkit.js';
+
+const ORG = 'org_large';
+const ELSEWHERE = 'org_elsewhere';
+const ME = 'u000000';
+const FIRST_READ_BOUND = 1000;
+/** The completion read's page (`ORG_MEMBERS_PAGE_ROWS` in `resolve-authz-context.ts`). */
+const PAGE_ROWS = 10000;
+
+interface Read { object: string; where: Record<string, unknown>; limit?: number; orderBy?: unknown }
+
+function makeQl(tables: Record<string, any[]>, opts: { ignoreCursor?: boolean; failAfter?: number } = {}) {
+  const reads: Read[] = [];
+  const holds = (row: any, where: Record<string, unknown>) =>
+    Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      if (v && typeof v === 'object' && '$gt' in (v as any)) {
+        return opts.ignoreCursor ? true : String(row[k]) > String((v as any).$gt);
+      }
+      if (v && typeof v === 'object' && '$in' in (v as any)) return (v as any).$in.includes(row[k]);
+      if (v === null) return (row[k] ?? null) === null;
+      return row[k] === v;
+    });
+  return Object.assign(bindCatalogFromTables({
+    async find(object: string, q: any) {
+      reads.push({ object, where: JSON.parse(JSON.stringify(q?.where ?? {})), limit: q?.limit, orderBy: q?.orderBy });
+      if (opts.failAfter !== undefined && object === 'sys_member' && reads.filter((r) => r.object === 'sys_member').length > opts.failAfter) {
+        throw new Error('connection reset');
+      }
+      let rows = (tables[object] ?? []).filter((r) => holds(r, q?.where ?? {}));
+      const order = Array.isArray(q?.orderBy) ? q.orderBy[0] : undefined;
+      if (order) {
+        rows = [...rows].sort((a, b) => (a[order.field] < b[order.field] ? -1 : a[order.field] > b[order.field] ? 1 : 0));
+        if (order.order === 'desc') rows.reverse();
+      }
+      return typeof q?.limit === 'number' ? rows.slice(0, q.limit) : rows;
+    },
+  }, tables), { reads });
+}
+
+/**
+ * `n` members of `ORG` (the caller first) plus two members of `ELSEWHERE`.
+ * Each `sys_member.id` comes from a permutation that does not follow the user
+ * ids, and the table holds the rows in user order, so the first 1,000 rows an
+ * unordered read returns are NOT the 1,000 lowest ids.
+ */
+function tablesOf(n: number) {
+  const pad = (i: number) => String(i).padStart(6, '0');
+  const sys_member = Array.from({ length: n }, (_, i) => ({
+    id: `m${pad((i * 7919) % 1000003)}`,
+    user_id: `u${pad(i)}`,
+    organization_id: ORG,
+    role: 'member',
+  }));
+  sys_member.push(
+    { id: 'm000001x', user_id: 'u_elsewhere_1', organization_id: ELSEWHERE, role: 'member' },
+    { id: 'mzzzzzz', user_id: 'u_elsewhere_2', organization_id: ELSEWHERE, role: 'member' },
+  );
+  return {
+    sys_user: [{ id: ME, email: 'me@example.test' }],
+    sys_member,
+    sys_user_position: [],
+    sys_user_permission_set: [],
+  };
+}
+
+const orgReads = (reads: Read[]) => reads.filter((r) => r.object === 'sys_member' && r.where.organization_id === ORG);
+const membersOf = (tables: ReturnType<typeof tablesOf>) =>
+  tables.sys_member.filter((m) => m.organization_id === ORG).map((m) => m.user_id).sort();
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('[#29281] org_user_ids holds the whole active organization', () => {
+  it('⭐ 1,005 members: every member and the caller, and nobody from another organization', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(FIRST_READ_BOUND + 5);
+    const grants = await resolveUserAuthzGrants(makeQl(tables), ME, { tenantId: ORG });
+
+    expect([...grants.org_user_ids].sort()).toEqual(membersOf(tables));
+    expect(grants.org_user_ids).toHaveLength(FIRST_READ_BOUND + 5);
+    expect(grants.org_user_ids).not.toContain('u_elsewhere_1');
+    expect(grants.org_user_ids).not.toContain('u_elsewhere_2');
+  });
+
+  it('a first read AT its bound reads the rest in id order, a page at a time, inside the organization', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(PAGE_ROWS * 2 + 7);
+    const ql = makeQl(tables);
+    const grants = await resolveUserAuthzGrants(ql, ME, { tenantId: ORG });
+
+    expect([...grants.org_user_ids].sort()).toEqual(membersOf(tables));
+    const [first, ...rest] = orgReads(ql.reads);
+    // The first leg's read is unchanged: same filter, same bound, no ordering asked.
+    expect(first).toEqual({ object: 'sys_member', where: { organization_id: ORG }, limit: FIRST_READ_BOUND, orderBy: undefined });
+    // The completion starts over from the first id, then resumes after each page's last id.
+    const ids = tables.sys_member.filter((m) => m.organization_id === ORG).map((m) => m.id).sort();
+    expect(rest).toEqual([
+      { object: 'sys_member', where: { organization_id: ORG }, limit: PAGE_ROWS, orderBy: [{ field: 'id', order: 'asc' }] },
+      { object: 'sys_member', where: { organization_id: ORG, id: { $gt: ids[PAGE_ROWS - 1] } }, limit: PAGE_ROWS, orderBy: [{ field: 'id', order: 'asc' }] },
+      { object: 'sys_member', where: { organization_id: ORG, id: { $gt: ids[PAGE_ROWS * 2 - 1] } }, limit: PAGE_ROWS, orderBy: [{ field: 'id', order: 'asc' }] },
+    ]);
+  });
+
+  it('999 members: the one first read is the whole membership, nothing else is read and nothing is said', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(FIRST_READ_BOUND - 1);
+    const ql = makeQl(tables);
+    const grants = await resolveUserAuthzGrants(ql, ME, { tenantId: ORG });
+
+    expect([...grants.org_user_ids].sort()).toEqual(membersOf(tables));
+    expect(orgReads(ql.reads)).toHaveLength(1);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it('exactly 1,000 members: the same members, one completion read that comes back short, and nothing said', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(FIRST_READ_BOUND);
+    const ql = makeQl(tables);
+    const grants = await resolveUserAuthzGrants(ql, ME, { tenantId: ORG });
+
+    expect([...grants.org_user_ids].sort()).toEqual(membersOf(tables));
+    // The first read cannot tell 1,000 from more, so one page is read — and it is the whole membership.
+    expect(orgReads(ql.reads)).toHaveLength(2);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it('a first read at its bound is said once per organization and engine, naming the organization and the count', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(FIRST_READ_BOUND + 5);
+    const ql = makeQl(tables);
+    await resolveUserAuthzGrants(ql, ME, { tenantId: ORG });
+    await resolveUserAuthzGrants(ql, ME, { tenantId: ORG });
+
+    const lines = warn.mock.calls.map((c) => String(c[0])).filter((l) => l.includes(ORG));
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toContain(`${FIRST_READ_BOUND + 5}`);
+    expect(lines[0]).toContain('org_user_ids');
+  });
+
+  it('a page that fails to read fails the resolution loudly — never a shorter list', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(FIRST_READ_BOUND + 5);
+    // The caller's own read and the first organization read succeed; the next one throws.
+    const err = await resolveUserAuthzGrants(makeQl(tables, { failAfter: 2 }), ME, { tenantId: ORG }).catch((e) => e);
+    expect(isAuthzStoreUnavailableError(err)).toBe(true);
+    expect((err as { object?: string }).object).toBe('sys_member');
+  });
+
+  it('a full page whose rows carry no id fails loudly — there is no cursor to resume after', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(PAGE_ROWS + 5);
+    for (const m of tables.sys_member) delete (m as { id?: string }).id;
+    const err = await resolveUserAuthzGrants(makeQl(tables), ME, { tenantId: ORG }).catch((e) => e);
+    expect(isAuthzStoreUnavailableError(err)).toBe(true);
+    expect((err as { object?: string }).object).toBe('sys_member');
+  });
+
+  it('a page that does not advance past its cursor fails loudly — never loops, never truncates', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const tables = tablesOf(PAGE_ROWS + 5);
+    const err = await resolveUserAuthzGrants(makeQl(tables, { ignoreCursor: true }), ME, { tenantId: ORG }).catch((e) => e);
+    expect(isAuthzStoreUnavailableError(err)).toBe(true);
+    expect((err as { object?: string }).object).toBe('sys_member');
+  });
+});