# Permission Studio acceptance evidence ## 2026-09-03 — baseline and bounded-work decision - Core: `389278712f3f009141e36fcb8c9d9fb6cd93283b`; L1: `b460abce3d705905bf0edecc61596c6e6c58f886`. - Workload: 48 authorable Profiles, each read is one coherent five-family Snapshot. Initial load and reload fan out all reads at once. - Controlled two-Profile observation: 4.396 s and 5.537 s; current-user row lock waits observed. Aggregate post-security SQL time was 4.5894 s across 44 statements. No connection-pool wait. A field scan examined 282,645 rows, returning 6,001; its isolated read was 269.9 ms, not the complete latency. - The unbounded initial fan-out exceeds Runtime admission (16) and shares a 14-second L1 request timeout. Five historical object-grant Snapshots also fail deterministically even when read alone: this is a separate contract correctness failure, not evidence that increasing timeout fixes the page. - Highest-confidence change: L1 reads four visible Profiles on demand, with one shared two-request budget for reads/reloads/Save/Status. Each per-Profile baseline/draft survives page changes; missing state is unavailable, not zero. - Do not weaken Snapshot locks, add a cache/index, or increase timeouts without a separate coherence/cost proof. The existing ParentId index is present; the observed full scan alone does not justify duplicating it. ## 2026-09-03 — implementation evidence - Core/Contract/L1 source candidates are independent worktrees based on the commits above and Contract `b649e8d`. - L1 regression: 48 targets launch only two initial active requests. Overlapping read/command batches share the same ceiling; cancelled queued work is not issued. Failed columns do not erase good drafts; paging does not reread or omit edited Profiles from Save. 28 focused tests passed (including the single-row and bulk ModifyAll controls in the modal). - Full L1 source suite first exposed a missing package-build manifest entry for the scheduler helper (1 failure / 1,137 tests), not a runtime failure. Add the normal source-manifest/export entries, then rerun the ownership gate. - Real local TiDB `v8.5.0`, disposable per-test database: stored historical ModifyAll-without-Create/Delete Snapshot, unrelated field Save preserving those bits, then valid ModifyAll-without-Create Save all passed against the exact modified Contract and Core sources. No historical data was migrated. - These results prove request-count bounds and compatibility, not a measured production latency improvement. Frozen released dependencies and Test2 read-back remain required before claiming deployed acceptance. ## 2026-09-03 — owner regression and release boundary - Real TiDB Profile creation/defaults, delete rollback, deletion, inactive navigation, same-carrier restore and byte-equivalent grant read-back passed. External User references still reject deletion. A concurrent authoring Save reaching target resolution during deletion is rejected after delete commit. - Runtime Mutate/Status/replay now retain the single-operation conflict as INVALID_OPERATION. The existing PermissionSet rejection expectation was updated to the same rule and its real-TiDB isolated rerun passed. - Broad owner suites recorded 3,337 passing tests/subtests and no skips. Two other persistence failures remain baseline issues: the three RecordType generated-writer-ID assertions and the history-sequence pessimistic-lock retry-limit test both reproduced on untouched `389278712`. The history test passed in the isolated candidate rerun; the static assertions fail identically on both trees. No history/RecordType implementation is changed here, and the broad suite is not described as fully green. - `go vet` passed for Records, Permissions, Persistence, schema and schema catalog. L1 Permission Authoring handler tests passed with the exact semantic contract source. Full frontend package build and source ownership checks pass. - Contract PR #215 is the release prerequisite. Downstream PRs remain drafts until a stable root tag is published and consumer pins are updated. Tests used an external, disposable Go workspace; no repository replace or unpublished dependency pin is introduced. Test2 has not been changed. ## 2026-09-03 — published dependency verification - Contract #215 merged at `b9d873c3ef22c5a6ad818c45026e16fd29ab05ef` and is published as semantic root `v0.6.5`. A fresh module cache downloaded that exact tag/commit. Core and the L1 companion now pin the stable root, while retaining Wire `v0.3.2`; no cross-repository workspace or contract replacement is used for this verification. - The dependency update adds no implementation changes to the already tested Profile lifecycle, Snapshot compatibility or bounded Studio loading. - The relevant Records/Permissions batch passed 51 tests/subtests, no skips, including real TiDB Profile delete/restore/rollback/concurrency, historical object-grant read/save, restrictive PermissionSet references and durable conflict Status/replay. Both private-module pin gates passed, as did the production Runtime API, Runtime worker, server and setup builds. - Contract main's independent nested Wire module had referenced a vanished pseudo-version. A separate two-manifest fix pins the published root; `scripts/check.sh` passes with the fresh module cache. No Wire upgrade is needed by these consumers, and existing tags are not moved. - The earlier broad-suite baseline failures remain explicitly scoped above. This closes the local published-dependency gate, not deployed acceptance: Test2 rollout/read-back and real latency measurement are still outstanding. - Reconciled the newly merged `05e2980f4` main: keep its Connectors `v0.2.20` and Controlplane `v0.2.111`, alongside Contract `v0.6.5`. The only manual conflicts were adjacent dependency pins; the Profile catalog changes and the unrelated integration schema additions both remain intact. The repeated affected-owner batch passed 56 tests/subtests with zero skips; full schema and schema-catalog suites, both pin gates, and all five production builds (including integration-service) passed on the combined candidate.