@@ -102,7 +102,7 @@ This creates `gitlab-permissions/users.csv` and `gitlab-permissions/project-perm
 
 The export includes active, unlocked human members with Reporter access or higher. It excludes Guests, Planners, bots, and memberships expiring today or earlier in UTC. It does not infer access from public/internal visibility, administrator or Auditor privileges, or custom permissions below Reporter. GitLab policies such as SSO or external authorization are not represented by these CSVs. Review the grants against your organization's access requirements before uploading them.
 
-Requests run serially, paced at 60 per minute by default. Set `--requests-per-minute` to change this export-job ceiling; it does not configure live Search traffic. Each run uses one project request, one request per membership page, and one profile request per candidate reader. API errors, hidden emails, identity conflicts, and oversized exports stop the job without publishing either file.
+Requests run serially, paced at 60 per minute by default. Set `--requests-per-minute` to change this export-job ceiling; it does not configure live Search traffic. Each run uses one project request, one request per membership page, and one profile request per candidate reader. API errors, hidden emails, identity conflicts, inconsistent pagination totals (when GitLab provides them), and oversized exports stop the job without publishing either file. Run exports after bulk membership updates finish; paginated API reads are not a point-in-time snapshot.
 
 ## Access checks
 
 
@@ -100,11 +100,19 @@ def export(client, project):
     users, emails, seen_members = {}, {}, set()
     today = datetime.now(timezone.utc).date()
     page = 1
+    expected_total = None
     while page <= 1000:
         members, headers = client.get(f"projects/{project_id}/members/all",
                                       {"per_page": 100, "page": page})
         if not isinstance(members, list) or len(members) > 100:
             raise ExportError("GitLab returned an invalid membership page.")
+        total = headers.get("X-Total")
+        if total is not None:
+            if not re.fullmatch(r"[0-9]{1,6}", total) or int(total) > MAX_ROWS:
+                raise ExportError("GitLab membership total is invalid or exceeds the 100,000-row limit.")
+            if expected_total is not None and int(total) != expected_total:
+                raise ExportError("GitLab membership total changed during pagination. Rerun the export.")
+            expected_total = int(total)
         for member in members:
             if not isinstance(member, dict):
                 raise ExportError("GitLab returned an invalid membership.")
@@ -154,6 +162,8 @@ def export(client, project):
         page = int(next_page)
     else:
         raise ExportError("GitLab membership pagination exceeds 1,000 pages.")
+    if expected_total is not None and len(seen_members) != expected_total:
+        raise ExportError("Exported membership count does not match GitLab's total. Rerun the export.")
     if not users:
         raise ExportError("No eligible readers. Pause search in Sim; empty CSVs cannot revoke all grants.")
     return project_path, users
 
@@ -51,6 +51,10 @@ def do_GET(self):
                                  "issues_access_level": "enabled", "wiki_access_level": "enabled"})
         elif endpoint == "projects/91/members/all":
             page = parse_qs(parsed.query).get("page", ["1"])[0]
+            total = "11" if scenario in ("truncated-membership", "changing-total") else "10"
+            if scenario == "changing-total" and page == "2":
+                total = "10"
+            headers = {} if scenario == "missing-pagination" else {"X-Total": total}
             if scenario == "page-failure" and page == "2":
                 self.reply(500, {"message": TOKEN})
             elif scenario == "pagination-loop":
@@ -60,13 +64,13 @@ def do_GET(self):
             elif scenario == "empty":
                 self.reply(200, [member(3, access_level=10)])
             elif page == "1":
-                self.reply(200, [member(2), member(1)], {"X-Next-Page": "2"})
+                self.reply(200, [member(2), member(1)], {**headers, "X-Next-Page": "2"})
             else:
                 self.reply(200, [member(3, access_level=10), member(4, state="blocked"),
                                  member(5), member(6, expires_at="2000-01-01"),
                                  member(7), member(8, access_level=15), member(9),
                                  member(10, expires_at=datetime.now(timezone.utc).date().isoformat())],
-                           {"X-Next-Page": ""})
+                           {**headers, "X-Next-Page": ""})
         elif endpoint.startswith("users/"):
             user_id = int(endpoint.split("/")[1])
             email = {1: "ALICE@example.com", 2: "bob@example.com", 7: "carol@example.com"}.get(
@@ -117,6 +121,7 @@ def run():
                 for scenario, expected_error in [
                     ("success", None), ("numeric-project", None), ("missing-pagination", None),
                     ("issues-only", None), ("paced", None),
+                    ("truncated-membership", "total"), ("changing-total", "changed"),
                     ("hidden-email", "email"), ("duplicate-email", "email"),
                     ("wrong-identity", "identity"), ("denied", "403"),
                     ("page-failure", "500"), ("pagination-loop", "pagination"),