2026-07-17 — XP-135 auth hot-path perf

What shipped

• packages/auth/src/rbac.ts — resolvePermissions folded the lone users.superuser await into the existing Promise.all, so the three userId-keyed queries (user, perm rows, role rows) now fire as ONE parallel wave instead of 2 sequential waves. Hit on every authenticated request via withWhoami.
• packages/service/src/roles/get-role.ts — two sequential selects (roles then role_permissions) collapsed to a single RQB findFirst with the role_permissions nested relation.

Key decisions

• Behavior-preserving refactor, no new tests: identical output guarded by the existing rbac + roles integration suites (red-green TDD is for new behavior, not roundtrip reductions).
• !user guard relocated to after the parallel wave; perm/role queries now also fire for a non-existent user, returning empty sets — accepted ceiling, the point is parallelism, error path unchanged.

Gotchas / lessons

• The ticket text loosely called the RQB relation permissions; the real relation name is role_permissions (packages/db/src/relations.ts:43). Integration suite against real Postgres is the only gate that catches a wrong relation name — it passed.

Reference changes

None. No canonical doc (plans/ARCHITECTURE.md, plans/scope/*.md, .claude/rules/*.md) changed.