PermissionRegistry caches a failed runtime source as empty until invalidated #517

Tier 3: resilience

Problem

framework/core/simple_module_core/permissions.py:146-152:

except Exception:
    logger.exception("Permission source %r failed; contributing nothing", name)
    keys, labels = [], {}
out = (sorted(set(keys)), labels)
self._source_cache[name] = out

The failure result is cached. One transient error on the first read hides that worker's runtime-defined permissions (in the role editor and labels) until someone calls invalidate_source(name), which may never happen.

Fix

On the exception path, return the empty result without caching it, or cache it with a short retry-after. Add a test where a source fails once and then succeeds, and the second read returns its keys.