Gate: an ObjectQL find double in a test must apply the caller's limit, or refuse it loudly

.github/workflows/lint.yml

@@ -2554,6 +2554,28 @@ jobs:
  - name: WHERE-matcher conformance gate
  run: pnpm check:where-matcher
 
+ # ObjectQL double `limit` gate (#11525, from #10978). The third member of
+ # the family above, and the one the other two leave uncovered: a
+ # `find(object, opts)` double that matches `where` correctly and then hands
+ # back EVERY matched row. It cannot tell a read bounded at 200 from the same
+ # read bounded at 1000, or from an unbounded one, so any limit change on
+ # that read is green by construction and the production symptom is a
+ # silently truncated result set rather than an error -- #10978's worked
+ # example truncates an RLS input. PR #11521 converted nine doubles on the
+ # authorization path and measured the population; #11525 is the observation
+ # one level up: nothing held those nine right. This lifts each discovered
+ # double out of its file and asks it a bounded question, encoding all three
+ # shape rules the nine settled -- presence not truthiness, bound after the
+ # filter, bound before any row-touching stage. Behavioural rather than
+ # syntactic on purpose: the bound is applied through inline slices, per-file
+ # helpers and shared helpers alike, and no pattern-match over source spans
+ # them. Pre-existing doubles are in a shrink-only measured baseline. Runs
+ # its own --self-test first: the detector can be broken while every double
+ # is fine, and a scan that quietly stops matching would report OK while
+ # reading nothing (#4868's family).
+ - name: ObjectQL double limit gate
+ run: pnpm check:objectql-double-limit
+
  # Paired kernel-hook pin gate (#5282, from #5170 / #5257 / #5274). The two
  # kernels — ObjectKernel (production) and LiteKernel (vitest / serverless /
  # edge) — run the same plugin code and the same hook vocabulary, but do NOT

package.json

@@ -125,6 +125,7 @@
  "check:driver-memory-census": "node scripts/check-driver-memory-census.mjs --self-test && node scripts/check-driver-memory-census.mjs",
  "check:engine-double-contract": "node scripts/check-engine-double-contract.mjs --self-test && node scripts/check-engine-double-contract.mjs",
  "check:where-matcher": "node scripts/check-where-matcher-conformance.mjs --self-test && node scripts/check-where-matcher-conformance.mjs",
+ "check:objectql-double-limit": "node scripts/check-objectql-double-limit.mjs --self-test && node scripts/check-objectql-double-limit.mjs",
  "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
  "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
  "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",

packages/plugins/plugin-auth/src/audience-posture.test.ts

@@ -83,7 +83,9 @@ const createMemoryEngine = () => {
  async find(name: string, q: any = {}) {
  let out = rows(name).filter((r) => matches(r, q.where));
  if (q.offset) out = out.slice(q.offset);
- if (q.limit) out = out.slice(0, q.limit);
+ // Presence, not truthiness: `limit: 0` is a request for NOTHING, and `0`
+ // is falsy — `if (q.limit)` answers it with every matched row.
+ if (typeof q.limit === 'number') out = out.slice(0, q.limit);
  return out.map((r) => project(r, q.fields));
  },
  async count(name: string, q: any = {}) {