- **Pre-computed `myPermissions` now mirror the structural-write break-glass.** `AnnotationService.get_document_annotations` masked structural rows' `_can_update`/`_can_delete` to `False` for everyone — under-reporting for superusers, whose structural writes are allowed by the break-glass in `AnnotationManager.user_can` (a stale comment claimed superusers were "handled upstream", which stopped being true with scoped admin access 2026-05). `RelationshipService.get_document_relationships` had no structural mask at all — over-reporting doc+corpus write permissions on structural relationships for normal users. Both services now mask structural rows to `user.is_superuser`. Tests: `opencontractserver/tests/permissioning/test_structural_mypermissions_breakglass.py`.
- **Consolidated permissioning guide audited against the GraphQL + service layers** (`docs/permissioning/consolidated_permissioning_guide.md`): corrected the Discussion-Thread moderation rules (EDIT permission on corpus/document does NOT grant moderation; `CorpusModerator` with a non-empty permissions list does; `Corpus.user_can_moderate` divergence documented per #1450), the `DocumentActionsService` permission bullets (no superuser branch — the old `_check_document_permission` "User is superuser" list contradicted scoped admin access), anonymous conversation visibility (THREADs inherit public corpus/document context), the `get_users_permissions_for_obj` group-permission default (`True`, not `False`), Pitfall 1 (`allAnnotations` without `corpusId` returns structural-only, not empty), CorpusCategory management (superuser-gated GraphQL mutations exist alongside Django Admin), and the agent section (`ws/agent-chat/` URL, awaited `_check_user_permissions`, real test-file paths, issue #820 fault-tolerance split). Renamed every stale `*QueryOptimizer` reference to the current per-app services and dead `opencontractserver/<app>/query_optimizer.py` paths to `opencontractserver/<app>/services/…`. Documented previously-missing behavior: the issue #1682 `get_corpus_documents` vs `get_corpus_documents_visible_to_user` dual semantics, the `opencontracts.E001` system check (dual enforcement + scan-scope nuance), `BaseService.filter_visible_qs`, and reference-table rows for Note / UserFeedback / Embedding / CorpusAction / Notification.
- **Stale "superuser bypass" code comments removed** (scoped admin access 2026-05 left contradicting docstrings behind): `PermissionQuerySet.visible_to_user` + `BaseVisibilityManager` + `PermissionManager` (`opencontractserver/shared/`), `ChatMessageQuerySet.visible_to_user` (`opencontractserver/conversations/models.py`), `get_annotation_images_with_permission` (`opencontractserver/llms/tools/image_tools.py`), and `DocumentRelationshipService.user_has_permission` (`opencontractserver/documents/services/relationships.py`). Also fixed CLAUDE.md's pitfall #2 (`ConversationQueryOptimizer` → `ConversationService`).
