# Roles walkthrough in progress — 19 September 2026

Actual local Studio0.6.2 owner Ada, own org ck-local-mu83iwh3. Fresh normal UI login, expanded sidebar, Configuration chevron then Role & Permission.

Part1 passed: created LeadEditor, description Enquiry team: read, create and update records; Leads screen only. CheckedRead/Create/Update and oneAppmintLeads menu; no page component actions orBusinessMade menu. Save/reload/reopen retained3of6,0of4,Appmint1of145/BusinessMade0of73. Rolekey6aae7bec13a229612ebc2dd2. Captures01–03.

Part2 started: User,Group→Groups→CreateGroup drawer opened; no groupfields orSave yet. Studio restart for sibling support-chat isolation interrupted the drawer. Resume by inspecting UI/state; do not recreate LeadEditor. No colleague invitation, grant, removal or permission test yet.

Root runner/tmp/learner-root-resumed.mjs session26428, page=rolesPage, bmPageoriginal3600; CDP9346. Owner fixture/tmp/learner-local-20260919.json, neverprint. Corebooks subsequently enabledownerMFA throughUI; private TOTP recovery/tmp/learner-owner-mfa-20260919.json0600 mayberequiredforsignin. No codes areevidence.

Part2continued: Salesgroup saved/reload LeadEditor empty; WebsiteEditors savedPublisherempty. Actualdescriptionbug: groupcard saysNo descriptionprovided whileEditSales containsCopperKettle enquiryteam; screenshot05/08. Source2linefixmodern-user-groups.tsx readsdata.description withlegacyfallback inclsearch, savedanddiffcheckpassed; awaitingcoordinatedStudio restart/recheck. OwnerAda addedSales throughgroupeditor, reloadMembers1, removedSales, reloadMembers0/LeadEditorpreserved screenshots09–11. No partial-saveerror.

MayaIto ownlocalinvitation createdonce~07:22 to maya.ito@copperkettle.test, Salesonly, welcomeemailchecked. Pendingafterreload screenshot13; immediate listsold0pending untilreload (newobservedcachegap). SentDateN/A (newobservedmappinggap). CopyLink UI worked /invite/complete, secretlinkonly/tmp/learner-ito-invite-private.txt0600. No SMTPrecipientcaptureyet, catcher27244alive; investigateactualnotificationdeliverywithoutresend. Notaccepted yet. RootcurrentStudioInvites; waitagentStudio/APIrestorereadiness beforewrites.

Application source follow-up saved: user-management-store invitation send/resend/cancel now call loadInvitations(true), with six actual-method regressions passing; modern-invitations Sent Date now uses canonical createdate with legacy fallbacks. Both await browser recheck after a later Studio restart. Group description fix is live and captured14.

Maya Ito acceptance succeeded, but backend log confirmed swallowed group assignment error. Actual restricted /app/leads navigation refused17. Core owns robust stored-invitation grant repair; no source overlap. Assisted recovery through owner UI: refresh users, add Maya Ito to Sales, then remove her unintended User membership (not other employees); captures18–19. Fresh private context signin is queued to check actual LeadEditor access. Original bad invitation/account evidence is preserved; do not call that initial acceptance a pass. Private password /tmp/learner-ito-20260919.json and invitation link /tmp/learner-ito-invite-private.txt must stay outside docs.

Local invitation email delivery subsequently confirmed: SMTP privatefile1789820700802-zvu564.json, sent by worker07:25. No resend was needed; queued dispatch explains earlier empty catcher checks. Do not expose the raw mail/token.

Continued after credits resumed: normal API healthy PID66098 (session58578), invitation-grant backend fix built and40 focused tests passed. Fresh Nora invite/acceptance proof still required. Owner viewed Maya Ito profile: Sales group but direct Roles User, confirming old login materialized that inherited grant. Edit Profile exposes no access controls; core agent investigating supported recovery UI. No Maya direct-role mutation performed. Owner profile closed and Invites selected,0pending/3all. Maya restricted-session edit form was opened but no fields changed or saved. Website agent now coordinates Studio restart to load invitation refresh/date fixes; don't rely on stale browser tabs until ready. Root driver session26428 remains alive, page=ownerRolesPage.

## Recovered continuation — 19 September, 20:06 UTC onward

Old driver26428, browser9346 and API3300 processes were gone, verified before restoration. Chrome restored in session39044, root runner /tmp/learner-root-recovered-v2.mjs session71420. Studio66565 and BusinessMade24808 survived. Core restored normal API in session8745 (health200), and SMTP catcher restored session40751. Replacement agents core_recovery, stock_recovery, website_recovery own their respective repairs.

Nora invitation sent BEFORE interruption is preserved; NOT resent. Capture23 proves immediate pending row with populated Sent Date after frontend repairs. Actual saved copied invitation link remained valid. Fresh form showed the organisation and personal message. Nora Ellis completed first/last/password/confirmation once (capture24, password masked), account automatically opened Studio, LeadEditor only (capture25). Ended the44-stop tour, expanded sidebar, CRM→Leads succeeded (capture26). Authenticated session has groups[Sales], roles[LeadEditor], noUser; sanitized nora-authenticated-grants.json saved. Raw stored roles still need readback; inherited session roles are not proof of direct stored roles. Private credentials /tmp/learner-nora-20260919.json; session /tmp/learner-nora-session.json0600. Nora has made NO lead writes yet.

Core now implements direct-role removal repair (old endpoint enriched then whole-record saved, no existing owner UI); stock identity repair is awaiting combined build. Root toldcore Nora acceptance succeeded and build may start; do not submit new business writes during downtime. Next: allowed lead create/edit/readback, Delete refusal, directURL refusal/request approval/re-auth, owner Maya legacy directUser removal after newUI, devices/cards/passwordpolicy reads.

Nora websiteapprovalandrevocation actualpassed: directRolePermissionURLrefused38; websiteeditorrefused39; ownrequest40–41; ownerApprovals42; WebsiteEditorsselection43/approve44; freshNoraSales+WebsiteEditors rolesLeadEditor+Publisher45, editorallowed46; ownergroupRemove47/48; freshNoraSales+LeadEditor only editorrefused49. WebsiteEditorszeroagain; SalesNora+Maya. No editorcontent saved. RootrequestedcorecombinedbuildCRUDdeny+roleAdd+inspection+UI/profile/Approvals asready. Rootcurrentpage=noraRevoked.p onwebsiteeditorrefusal; ownerPageUserGroups. Nosaveinflight.

CombinedsecuritybuildactualNora test created PermissionsVerified6aaef2896408c738121ec060201, TitleUpdateverifiedPUT200/immediateUIcorrect50. DELETE403Forbiddenbutoldservicecaughtfailure/storeoptimisticallyremovedlead; fullreload52restoredrecord. Core nowfixesactualservice/storepropagation+detailintegrationtests8pass; awaitStudiofrontendloadthenretestEXISTINGprobe, no newcreate needed. Nora remainsSalesLeadEditor aftertemporaryWebsitegrant revoked. NewMayaFreshlogin afternetworkinterruptionpassed53/54: SalesLeadEditor only, noUser, Leadsopens. SourceCountroles reportupdated. Rootclosedoldcontext(initialNora),noraApproved.c,noraRevoked.c toreducebrowsermemory. CurrentNora noraFinal.p, Maya mayaLoginPage, owner ownerPage; pagecurrentlyMaya. Rootdriver71420. APIexternalprocessnow99929 (prior98501replaced), Studio98017pendingcorerestart. Corestagingisolatedfuturebuild3311 toavoidotherClaudecheckoutdistcollisions.


## Final local checks — latest state

The repaired Delete now returns403 with Forbidden visible and the practice lead retained (55); owner later deleted that exact probe200 (61), reload62 confirms both original enquiries remain. Maya fresh login53–54 inherits only LeadEditor from Sales. Devices57, Cards58 and Password Policy59 were inspected without mutation. Corrected Approvals route and Decided history survive reload60. Role overview shows both inherited holders63, full reload64 confirms Maya and Nora. Group readback65 confirms Sales2/WebsiteEditors0; its Quick Stats incorrectly counts hidden root groups (16 vs12). Small display fix saved; browser retest pending. Account-departure wording is being checked against actual available admin controls. Course remains pending.

Private rootdriver71420 remains alive; ownerPage now Groups; current API3311r2 PID4231/session76531 and Studio4261, subject to coordinated agent updates. Both disposable permission leads were cleaned up: do NOT recreate or delete them again.