# Layout role authority read

## 2026-09-05 — current ancestry with an admitted epoch

- Run: `layout-role-plan-20260905`; candidate: PR #4786, parent
  `712fef15884cacd3b5613b4c71491fcf6925f5ad`, with the epoch-guarded role reader.
- Environment: local TiDB 8, one database, primary-key Role identities and a
  parent index. Workload: 10,003 roles, a three-role selected chain, and 10,000
  unrelated roots. This was a plan check, not a throughput or latency benchmark.
- Before: the production Layout adapter used the PermissionService's 60-second
  cache and ignored the admitted epoch. A second replica's reparent could keep
  selecting the old Layout. The warmed-cache regression reproduced this.
- Change: one recursive SQL statement joins the authoritative org epoch and
  follows current parent IDs. There is no process cache on this read path.
- Profile: `EXPLAIN ANALYZE` returned 3 CTE rows. The seed used primary-key
  point gets; the recursive part used an index join and read 2 parent rows.
  CTE storage was 5.25 KB, with no disk spill. The single cold sample took
  47.6 ms; it is not evidence of a production latency guarantee.
- Verification: a real two-pool TiDB test retains the old PermissionService
  cache and proves that the production Layout engine selects the new parent's
  Layout, including a role update without an epoch bump. Old/future epochs,
  wrong org, missing/deleted roles, deleted parents, cycles, and cancellation
  fail closed. A dangling-parent fixture was rejected by the canonical FK and
  removed; no database invariant was disabled to manufacture that state.
- Learned: a security epoch alone is not a role-cache invalidation token because
  current role writers need not advance it. The safe narrow read is current
  ancestry guarded by the admitted epoch, not a cache refreshed only on epoch
  change. The indexed chain read avoids scanning the full role forest.
- Next hypothesis: none requiring an optimization now. Measure representative
  production page latency before considering a cache and its writer contract.