[VibeSWE]

Summary

Follow-up from the #77 review (pre-existing, Medium): user PATCH changed the live user before persisting.

• PATCH /user/{userid} (in rbac.rs, shared by the Query and standalone servers) called UpdateUser::update(). That writes the change, such as the email via Users.put_email, into the live map before get_metadata/put_metadata run.
• If storage failed, the request returned an error, but this node kept the new value in memory while durable state didn't have it.

Fix:

• The change is prepared on a cloned user, the metadata is persisted, and only then is the clone published to the live map, all under UPDATE_LOCK.
• Validation order, HTTP responses and active sessions are unchanged.
• UpdateUser::update() had no other production callers. The ingestor sync handlers are separate.

Tests

The preparation step is factored out so it can be tested without storage:

• the pre-storage step must leave the live user unchanged (committed red first);
• preparation for native and OAuth users;
• existing validation behaviour.

Verification

• cargo fmt --check ✅, cargo clippy -- -D warnings ✅
• cargo test --lib: 1024 passed, 0 failed, 2 ignored

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[VibeSWE]

Adversarial review of PR #81 (at 1b85d00a, fixes in 8fa492a0)

One Sol 6.1 and one Opus 5.5 reviewer. Neither found anything blocking or newly introduced.

Both confirmed:

• Every error path (validation, missing user, API-key user, storage read or write) returns before the live map is touched.
• The HTTP contract and validation order are identical to main.
• Every handler that mutates a live User holds UPDATE_LOCK from read to publish, so nothing changes the user between the clone and the publish.
• No other handler publishes before persisting.

Severity	Finding	Outcome
Medium (pre-existing)	PATCH wrote the whole live user into parseable.json. For a logged-in OAuth user that includes bearer tokens, and it caused an extra metadata write on the next OIDC reconcile	Fixed: the stored entry now gets only the patched email (UpdateUser::apply)
Low	mut_users().insert after an .await could recreate a user removed concurrently (latent: the only unlocked remover has no callers)	Fixed: new Users::replace_user updates the live user in place and never recreates one; test added
Low	Nothing tests that the change is published after a successful persist	Partly covered: replace_user is tested directly. The handler's storage paths can't be reached from tests
Low (pre-existing)	A Query-node PATCH is never synced to ingestors	Follow-up: profile changes don't affect authorization
Nit	Users::put_email is now unused	Removed

Local at 8fa492a0: fmt and clippy -- -D warnings clean; cargo test --lib 1026 passed, 0 failed.