metadata-protocol: the seed loader's organization-member probe pages every same-named person deployment-wide, by offset, and skips values that look like internal ids #33280

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Filing gate: follow-up of #33207 / PR #33222, from contract review records 6879099931 (nits 5 and 6) and 6878779800 (nit 6) on that PR. A hosted deployment that deals sample data to every new organization pays this on every replay, and a rare concurrent delete can make the probe answer wrong. ⛔ Not a claim; triage sets the lane and grade.

What happens today

After #33222, an organization's seed load resolves a person reference (sys_user by email or name) only to a member of that organization. probeOrganizationMember in packages/metadata-protocol/src/seed-loader.ts reads the same-named sys_user candidates 50 at a time, ordered by id with a growing offset, asks sys_member per page, and answers "not a member" only after the last page.

1. Cost grows with the deployment, not the organization. In the hosted case each organization's sample people share the seeded names, so the candidate set is one row per organization deployment-wide, while the organization being replayed usually holds a handful of members. Every replay reads two queries per 50 organizations per reference value, and the full candidate list for every name with no member in the load's organization. The candidate read filters sys_user by a column with no declared index.
2. Offset paging is not stable under a concurrent delete. If a same-named sys_user below the current offset is deleted between two pages, the next page shifts by one and a candidate is skipped. If the skipped one is the load organization's member, the probe answers the false "not a member" fix(metadata-protocol)!: an organization's seed load resolves people through its membership, reports a refused reference probe, and writes as that organization #33222 exists to prevent. The window is one probe wide.
3. An authored value that looks like an internal id skips the probe. A value looksLikeInternalId recognises is taken as an id and never judged by the membership rule. This predates fix(metadata-protocol)!: an organization's seed load resolves people through its membership, reports a refused reference probe, and writes as that organization #33222.

What this card would build

• Drive the probe from the load organization's member set: read sys_member for the organization, then one sys_user read constrained to those user ids and the reference value. That bounds the cost by the organization. If paging stays anywhere, use keyset paging (id > the last id seen) instead of offset.
• Decide whether a value that looks like an internal id should still be checked for membership on an organization-scoped load, and pin either answer.
• Keep fix(metadata-protocol)!: an organization's seed load resolves people through its membership, reports a refused reference probe, and writes as that organization #33222's pins green: 60 same-named people with the member last, the workspace_id-walled object, the pass-2 back-fill that cannot see its row.

Seam

Seam: metadata-protocol:seed-loader.ts (probeOrganizationMember) → sys_member / sys_user reads.

Dedupe words: seed member probe, probeOrganizationMember, keyset paging seed, same-named sys_user, looksLikeInternalId.