perf(core): batch resolveUserAuthzGrants' independent reads — 8 sequential legs become 4 waves (#10825) (#11197)

cloud#1539 measured (R²=0.9994, causal latency injection) that an
authenticated request is ~23.4 sequential DB legs and that LEGS, not
query count, are the latency multiplier. resolveUserAuthzGrants
contributed 8 of them (legs 6-13), all live reads with no caching.

Wave 1 now issues the five reads that depend only on (userId,
tenantId) concurrently: sys_user (memoized; condition mirrors the
sequential implementation exactly — a fully-seeded API-key principal
still never touches the table), sys_member{user_id},
sys_user_position, sys_member{organization_id} (fellow-org), and
sys_user_permission_set. The dependent chain stays sequential because
it IS dependent: sys_position needs wave 1's position names,
sys_position_permission_set needs those rows' ids, sys_permission_set
needs the union of direct- and position-granted set ids. 8 legs -> 4
on the fullest path, 2 on the lightest. Per the prod model
(server_ms ~= 33 + L x 36.6) that removes ~150-220ms from every
authenticated request.

Equivalence is PROVEN, not asserted (the card's red line):
resolve-authz-context.batch-equivalence.test.ts is a differential
control — an 11-fixture matrix (multi-org, lapsed memberships,
deactivated positions/sets, validity windows, limit truncation at
200/1000, seeded API-key principals, ai_seat both ways) whose goldens
were captured from the SEQUENTIAL implementation at main 795ea05
(post-#10982, per the #10982 handoff on the card: the
lapsed-own-membership fixture's text now cites the 2026-08-22 ruling,
and its job here is pinning why the two sys_member reads are NOT
merged into one $or — that merge is a measured privilege escalation).
Three assertions per fixture: the grants envelope deep-equals
(including array order), the query multiset is identical (same
objects/filters/limits/isSystem — a widened $in or dropped tenancy
filter fails even when the envelope agrees), and the leg count matches
a per-fixture table while beating the sequential count. The two
sys_member reads and the memoized sys_user read remain exactly as they
were; nothing is cached, nothing survives the request.

Takeover of the stale Round-A delegation per the maintainer's
2026-08-23 prompt; os-elon's serial ruling stands (#10826 follows on
this file).

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/batch-authz-grants-10825.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/core': patch
+---
+
+`resolveUserAuthzGrants` issues its five independent reads (sys_user, both sys_member reads, sys_user_position, sys_user_permission_set) concurrently (#10825) — 8 sequential round trips become 4 waves on the fullest path (2 on the lightest), with byte-identical rows, filters, limits and tenancy scoping, pinned by a differential golden suite captured from the sequential implementation. No caching; nothing survives a request; authorization semantics unchanged by construction.