sys_permission_set: env-scope permission metadata saves don't project onto the queryable data record #2857

Problem

A sys_permission_set has two representations that are not kept in sync:

• Metadata — what client.layered('permission', name) / client.save read/write; the authoritative permission definition (ADR-0090). The structured permission editor writes this. Parsed camelCase fields: objects, fields, systemPermissions, rowLevelSecurity, tabPermissions, adminScope.
• Data record — the queryable sys_permission_set object (GET /api/v1/data/sys_permission_set), with snake_case JSON-string columns: system_permissions, object_permissions, row_level_security, admin_scope, tab_permissions.

An environment-scope metadata save (which is live — config, no publish) does not project onto the data record.

Repro (verified against app-showcase, 2026-07-13)

1. Open the env-scope permission editor for sales_rep and grant studio.access (System Capabilities), Save.
2. Reload the editor → the grant persists (metadata is updated). ✅
3. GET /api/v1/data/sys_permission_set → sales_rep.system_permissions is still "[]". ❌

Same for adminScope (e.g. toggling manageBindings on showcase_field_ops_delegate persisted in metadata but not in the data record). Seeded sets look consistent only because both stores were seeded together.

Why it matters

objectui ADR-0056 / #2403 (pure model: Studio designs, Setup assigns) makes Setup's sys_permission_set record page render each facet read-only from the data record (summary + "Design in Studio →" deep-link). Because env-scope metadata saves don't refresh the data record, a fresh Studio edit to any facet isn't reflected in Setup's summary until the projection catches up.

This is display-freshness only — enforcement and the ADR-0090 explain engine read the authoritative metadata, so access is correct. But it breaks the closed loop of the pure model (design in Studio → see it in Setup).

Ask

Make the sys_permission_set data-record projection track env-scope metadata saves (project all six facet columns), so the queryable record reflects the authoritative metadata. (Alternatively, objectui could read the metadata directly for the Setup summary, but the record projection is the framework-owned bridge.)

Refs

• objectui ADR-0056 (revised, pure model), epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) objectui#2398, PR feat(app-shell,plugin-detail): permission sets — Studio designs, Setup assigns (ADR-0056) objectui#2403
• Framework: plugin-security — sys-permission-set.object.ts (the JSON-string columns), the metadata permission type → sys_permission_set projection path.

Filed from objectui #2403 verification.