From 8123c81d9c19bdac52b3bc766751a60cd04e440a Mon Sep 17 00:00:00 2001
From: "Prashant Rane (ALLYIS INC)" <v-prasrane@microsoft.com>
Date: Tue, 3 Nov 2026 13:58:42 -0600
Subject: [PATCH 1/2] chore(release): prepare 0.55.67 tenant10 migration
 exception

Record explicit operator authorization T10-0.55.67-PERF-EXCEPTION-2026-11-03. Performance remains unqualified; all other gates stay mandatory and customer production is excluded. Import existing version metadata without dependency or runtime changes; keep qualification research draft.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 CHANGELOG.md                                  | 20 ++++++
 DEPLOYMENT.md                                 |  2 +-
 README.md                                     |  2 +-
 Session_starter.md                            | 19 +++++
 api/package-lock.json                         |  4 +-
 api/package.json                              |  2 +-
 docs/AUTHENTICATION_GUIDE.md                  |  2 +-
 docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md      |  4 +-
 docs/COMPLETE_API_REFERENCE.md                |  4 +-
 docs/CONTEXT_INSTRUCTIONS.md                  | 19 ++++-
 docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md           |  2 +-
 docs/DOCKER_GUIDE_AND_TEST_REPORT.md          |  4 +-
 docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md       |  4 +-
 docs/ENDPOINT_CREATION_WIKI.md                |  4 +-
 docs/ENDPOINT_LIFECYCLE_AND_USAGE.md          |  4 +-
 docs/ENDPOINT_PROFILE_ARCHITECTURE.md         |  2 +-
 .../GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md |  2 +-
 docs/INDEX.md                                 |  4 +-
 docs/LOGGING_AND_OBSERVABILITY.md             |  2 +-
 docs/MULTI_ENDPOINT_GUIDE.md                  |  4 +-
 ...ERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md |  2 +-
 docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md       |  2 +-
 docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md    |  4 +-
 docs/RELEASE_NOTES.md                         | 21 +++++-
 docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md        |  2 +-
 docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md  |  2 +-
 docs/SCHEMA_CUSTOMIZATION_GUIDE.md            |  2 +-
 docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md    |  4 +-
 ...ENANT_10_MIGRATION_EXECUTION_2026_10_30.md | 72 ++++++++++++++++++-
 docs/UI_GUIDE.md                              |  4 +-
 web/package-lock.json                         |  4 +-
 web/package.json                              |  2 +-
 32 files changed, 188 insertions(+), 43 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b65eb673..58fcc1d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.67 tenant 10 migration release under a scoped exception
+
+- Record explicit operator authorization
+  `T10-0.55.67-PERF-EXCEPTION-2026-11-03` for this dev-and-canary migration
+  only. Performance remains unqualified; every other gate is mandatory.
+  Customer production must not change. Failed qualification evidence and
+  normal qualification rules remain unchanged.
+- Import the existing 0.55.67 API/web manifests and lockfiles without
+  regeneration or dependency changes. Complete API/web trees match integrated
+  candidate5823a225; runtime source and schema are unchanged from reviewed
+  mastera80fafb2. Keep diagnostic research in draft PR251 rather than starting
+  campaigns through its ready-for-review event.
+- Root/web dependency restores, unchanged-lock checks, API Prisma generation
+  and complete lock provenance pass. Protected and hosted test counts,
+  reviewed merge, final artifact identity and actual dev/canary validation
+  are pending; no unchanged parent count is presented as a fresh run.
+- Self-improvement applied: record the bounded exception separately from
+  passing evidence and require final source/digest binding. Architecture
+  disposition accepted: no general gate bypass or runtime abstraction.
+
 ### Tenant rollover tooling consolidation
 
 - Record PR267's normal reviewed merge at84099293570a and authoritative
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 21a5aa11..ef7b9aed 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 
diff --git a/README.md b/README.md
index a5c0ab11..c6e694e7 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
diff --git a/Session_starter.md b/Session_starter.md
index 33cdfb56..c010b8a8 100644
--- a/Session_starter.md
+++ b/Session_starter.md
@@ -1,5 +1,24 @@
 ## SCIMServer - Condensed Session Memory
 
+**2026-11-03 authorized migration release:** the operator explicitly authorized
+`T10-0.55.67-PERF-EXCEPTION-2026-11-03` for this 0.55.67 tenant 10 dev/canary
+migration only. Performance remains unqualified; all other security,
+data-integrity, functional, browser and migration gates stay mandatory.
+Customer production must not change. The exact authorization and boundaries
+are recorded in `docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md`.
+Release-only branch `ops/tenant10-release-exception-20261103` starts at reviewed
+mastera80fafb2 and imports the four existing 0.55.67 manifest/lock blobs.
+Its complete API/web trees match integrated candidate5823a225; no dependency
+graph, runtime source, schema, workflow or qualification rule changes.
+Keep PR251 research draft: ready_for_review explicitly starts its campaigns.
+Root/web restores, unchanged-lock checks, API Prisma generation and full
+lock provenance pass. Protected publication, reviewed merge and immutable
+artifact binding are pending. No target app, verified source-writer freeze,
+final carry or cutover is claimed. Historical no-waiver statements below are
+superseded, not failed benchmark receipts. Self-improvement applied: explicit
+scope/artifact binding and separate release/research units. Design disposition
+accepted: no general gate bypass or runtime abstraction is justified.
+
 **Last verified:** 2026-11-03
 
 ### Current handoff: tooling merged; release and deployment remain held
diff --git a/api/package-lock.json b/api/package-lock.json
index 921bb0d7..383a2204 100644
--- a/api/package-lock.json
+++ b/api/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.66",
+  "version": "0.55.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "scimserver-api",
-      "version": "0.55.66",
+      "version": "0.55.67",
       "license": "MIT",
       "dependencies": {
         "@nestjs/common": "^11.1.27",
diff --git a/api/package.json b/api/package.json
index f3a20680..14ae0197 100644
--- a/api/package.json
+++ b/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.66",
+  "version": "0.55.67",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",
diff --git a/docs/AUTHENTICATION_GUIDE.md b/docs/AUTHENTICATION_GUIDE.md
index a9f9822e..7ecb22dc 100644
--- a/docs/AUTHENTICATION_GUIDE.md
+++ b/docs/AUTHENTICATION_GUIDE.md
@@ -1,6 +1,6 @@
 # Authentication Guide
 
-> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 >
 > **The captured protocol examples below were measured against a running server.** Request and response bodies are verbatim wire captures. Status codes and `reason_code` values are what the server actually returned. The reason-code table in [Section 8](#8-troubleshooting) is generated from [auth-reason-catalog.ts](../api/src/oauth/auth-reason-catalog.ts), so it cannot drift from the implementation.
 >
diff --git a/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md b/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
index 98fc846b..37347139 100644
--- a/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
+++ b/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
@@ -1,8 +1,8 @@
 # Azure Deployment & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [deploy.ps1](../deploy.ps1), [scripts/deploy-azure.ps1](../scripts/deploy-azure.ps1), [infra/](../infra/)
 
 ---
diff --git a/docs/COMPLETE_API_REFERENCE.md b/docs/COMPLETE_API_REFERENCE.md
index d2c8cb56..27e049eb 100644
--- a/docs/COMPLETE_API_REFERENCE.md
+++ b/docs/COMPLETE_API_REFERENCE.md
@@ -1,8 +1,8 @@
 # Complete API Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-16
+> **Version:** 0.55.67 - **Updated:** 2026-10-16
 > **Current release:** [Release notes, upgrade steps and validation limits](RELEASE_NOTES.md). Earlier isolated P1-P9 receipts remain historical; the correctness consolidation is included in the deployed release.
 > **Base URL:** `http://localhost:{PORT}/scim` (configurable via `API_PREFIX` env var)
 > **121 route handlers** across 33 controllers (includes 2 dashboard analytics routes and the web SPA catch-all). Counted from the `@Get`/`@Post`/`@Put`/`@Patch`/`@Delete`/`@Sse` decorators in `api/src/**/*.controller.ts` with comments stripped; the count is enforced by `node scripts/audit-doc-content.mjs`.
diff --git a/docs/CONTEXT_INSTRUCTIONS.md b/docs/CONTEXT_INSTRUCTIONS.md
index 38e18109..5ae0af27 100644
--- a/docs/CONTEXT_INSTRUCTIONS.md
+++ b/docs/CONTEXT_INSTRUCTIONS.md
@@ -1,7 +1,7 @@
 # SCIMServer - Context Instructions for AI Assistants
 
 > **Purpose**: This file provides complete project context for AI coding assistants (GitHub Copilot, etc.) to enable productive sessions without re-discovery of architecture, patterns, and decisions.
-> **Version**: 0.55.66
+> **Version**: 0.55.67
 > **Last Updated**: November 3, 2026
 > **Last verified:** 2026-10-29
 
@@ -9,6 +9,23 @@
 
 ## Active Delivery Process
 
+**Current operator-authorized release path:** performance-admission exception
+`T10-0.55.67-PERF-EXCEPTION-2026-11-03` applies only to this 0.55.67 tenant 10
+dev/canary migration. Performance remains unqualified. Every other security,
+data-integrity, functional, browser and migration gate remains mandatory;
+customer production must not change. The existing migration execution document
+records the exact authorization, scope and required merged-commit/image-digest
+binding. Historical no-waiver holds below are superseded, not failed receipts.
+Use release-only branch `ops/tenant10-release-exception-20261103`; keep
+qualification research PR251 draft. Complete API/web trees match integrated
+candidate5823a225 after importing four unchanged version-bearing blobs.
+No runtime, schema, dependency graph, workflow or normal qualification logic
+changes. Root/web dependency restore, unchanged-lock verification, API Prisma
+generation and public-registry/sha512 provenance pass. Normal protected review,
+final immutable artifact, actual target acceptance, source freeze/final carry
+and cutover remain pending. Self-improvement applied: bounded authorization
+and honest pending evidence. Design disposition accepted: no general bypass.
+
 **Authoritative current state:** PR267 is merged at84099293570af5ab06f7d8e2f93e7e6ae2c0236f.
 Reviewed883fb6c6 passes29 protected gates, and exact-tip5757623103 reports
 no open issues (COMMENTED, not formal APPROVED). Postmerge41696483989,
diff --git a/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md b/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
index 67005f90..7b69502b 100644
--- a/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
+++ b/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
@@ -9,7 +9,7 @@ or fetching them. See [minimal-schema validation](GOOGLE_MINIMAL_GROUP_MEMBERSHI
 [reference persistence and compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > **P7a behavior, included since 0.55.36:** [Profile validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > adds declaration/type/cardinality checks, required extension enforcement,
diff --git a/docs/DOCKER_GUIDE_AND_TEST_REPORT.md b/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
index ca73645e..62d4edeb 100644
--- a/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
+++ b/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
@@ -1,8 +1,8 @@
 # Docker Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [Dockerfile](../Dockerfile), [docker-compose.yml](../docker-compose.yml)
 
 ---
diff --git a/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md b/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
index 42630ef9..55a953ec 100644
--- a/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
+++ b/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
@@ -1,8 +1,8 @@
 # Endpoint Configuration Flags Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** September 29, 2026
+> **Version:** 0.55.67 - **Updated:** September 29, 2026
 > **Source of truth:** [endpoint-profile.types.ts](../api/src/modules/scim/endpoint-profile/endpoint-profile.types.ts) (`ProfileSettings`)
 > 39 registered settings in the unreleased lifetime port: 20 boolean + 16 numeric (11 runtime-egress overrides + 3 active-credential caps + 2 token lifetimes) + 3 other typed values. `PersistRequestSecrets` is inert and `CredentialSecretVisibility` supports only `always`. See the [behavioral evidence and explicit coverage gaps](SCIM_SETTINGS_BEHAVIOR_EVIDENCE.md) and [Entra compatibility guide](SCIM_ENTRA_COMPATIBILITY.md). Registry membership is not evidence of enforcement.
 > 6 value types: `boolean`, `logLevel`, `primaryEnforcement`, `credentialVisibility`, `structured`, and `number` (the last added for the runtime JWKS-fetch egress knobs).
diff --git a/docs/ENDPOINT_CREATION_WIKI.md b/docs/ENDPOINT_CREATION_WIKI.md
index 71f55690..9d6acab9 100644
--- a/docs/ENDPOINT_CREATION_WIKI.md
+++ b/docs/ENDPOINT_CREATION_WIKI.md
@@ -1,8 +1,8 @@
 # Create Your Own SCIM Endpoint - Self-Service Wiki
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-16
+> **Version:** 0.55.67 - **Updated:** 2026-10-16
 > Beginner-friendly, copy-paste guide for standing up a SCIM endpoint in minutes.
 > **Source of truth:** [endpoint.controller.ts](../api/src/modules/endpoint/controllers/endpoint.controller.ts) - [built-in-presets.ts](../api/src/modules/scim/endpoint-profile/built-in-presets.ts)
 
diff --git a/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md b/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
index 57e47c8d..de0e2093 100644
--- a/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
+++ b/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
@@ -1,8 +1,8 @@
 # Endpoint Lifecycle & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > Quick-start recipes for common SCIMServer operations
 
 ---
diff --git a/docs/ENDPOINT_PROFILE_ARCHITECTURE.md b/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
index 32813e61..af68d4ca 100644
--- a/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
+++ b/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
@@ -1,6 +1,6 @@
 # Endpoint Profile Architecture
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
 > **Updated:** 2026-10-17
 > **Source of truth:** [endpoint-profile/](../api/src/modules/scim/endpoint-profile/) and [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
diff --git a/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md b/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
index 6a7cd57a..583efe8f 100644
--- a/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
+++ b/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
@@ -1,6 +1,6 @@
 # Global navigation and workflow context
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 See [current release notes](RELEASE_NOTES.md) for deployment and acceptance
 boundaries. Endpoints now uses available window height, Dashboard uses compact
diff --git a/docs/INDEX.md b/docs/INDEX.md
index 17673e82..897ebcf4 100644
--- a/docs/INDEX.md
+++ b/docs/INDEX.md
@@ -1,8 +1,8 @@
 # SCIMServer Documentation Index
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-21
+> **Version:** 0.55.67 - **Updated:** 2026-10-21
 > 6 presets - **39 endpoint settings controls** in the unreleased lifetime port (20 boolean flags + 3 other typed settings + 16 numerics) - profile-driven User, Group, and custom ResourceType forms
 
 **Unreleased preparation:** [endpoint token lifetime integration and original
diff --git a/docs/LOGGING_AND_OBSERVABILITY.md b/docs/LOGGING_AND_OBSERVABILITY.md
index a495246e..c7c66ff9 100644
--- a/docs/LOGGING_AND_OBSERVABILITY.md
+++ b/docs/LOGGING_AND_OBSERVABILITY.md
@@ -1,6 +1,6 @@
 # Logging & Observability Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 **Current UI presentation:** absolute timestamps in Logs, Activity, Operations
 and live/detail drawers include full UTC date/time and milliseconds. Copy
diff --git a/docs/MULTI_ENDPOINT_GUIDE.md b/docs/MULTI_ENDPOINT_GUIDE.md
index d8c5699d..06022798 100644
--- a/docs/MULTI_ENDPOINT_GUIDE.md
+++ b/docs/MULTI_ENDPOINT_GUIDE.md
@@ -1,8 +1,8 @@
 # Multi-Endpoint Architecture Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
 
 ---
diff --git a/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md b/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
index 3509376e..b99016f4 100644
--- a/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
+++ b/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
@@ -1,6 +1,6 @@
 # Observability, Traceability, Correlation IDs, Logging, Error Handling and Diagnostics
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 **Current operator presentation:** all absolute UI timestamps carry complete
 UTC date/time, milliseconds and timezone; invalid expiry values are explicit,
diff --git a/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md b/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
index 07487400..63ed6039 100644
--- a/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
+++ b/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
@@ -11,7 +11,7 @@ rejected later operation saves no earlier mutation. See
 [reference persistence and rollback compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [current release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > Comprehensive, source-verified reference for every PATCH option, mode, setting, path form, verb, and persistence outcome across Users, Groups, custom extensions, and custom resource types - grounded in RFC 7644 / RFC 7643 and the SCIMServer implementation.
 
diff --git a/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md b/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
index b1e86e56..e967d275 100644
--- a/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
+++ b/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
@@ -1,8 +1,8 @@
 # Prod -> Dev mirroring + synthetic shape-coverage fixtures
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66  -  **Date:** May 6, 2026
+> **Version:** 0.55.67  -  **Date:** May 6, 2026
 > **Scope:** dev-tooling, no API surface change
 > **Affects:** [api/src/scripts/mirror-prod-to-dev.ts](../api/src/scripts/mirror-prod-to-dev.ts), [api/src/scripts/seed-shape-coverage.ts](../api/src/scripts/seed-shape-coverage.ts), [scripts/mirror-prod-to-dev.ps1](../scripts/mirror-prod-to-dev.ps1)
 
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 23772239..e055ba5a 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -1,6 +1,6 @@
 # SCIMServer release notes
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.67`
 
 These curated notes explain what changes for operators and integrators, how to
 upgrade, and what remains limited. The [engineering changelog](../CHANGELOG.md)
@@ -15,6 +15,25 @@ notes rather than assuming that a patch label makes every rollback lossless.
 
 ## Unreleased
 
+### 0.55.67 tenant 10 dev-and-canary migration
+
+The operator authorized a performance-admission exception for this migration
+only. **Performance remains unqualified.** Every other security,
+data-integrity, functional, browser and migration gate remains mandatory.
+Customer production must not change.
+
+The [migration execution record](TENANT_10_MIGRATION_EXECUTION_2026_10_30.md)
+contains the exact authorization, decision scope and required final
+merged-source/image-digest binding. Release metadata advances from 0.55.66 to
+0.55.67 without changing runtime source, database schema or dependency graphs.
+Qualification-method research remains separate in draft #251; this exception
+does not change normal qualification protocols or turn failed evidence green.
+
+Protected validation, normal review, merged artifact publication and actual
+target acceptance are pending. The final source-writer freeze, fresh data carry
+and cutover are not complete. This is not a deployed-release announcement.
+Earlier unreleased preparation entries below are historical context.
+
 ### Current source consolidation: 0.55.66
 
 Reviewed #259, #260 and #261 are merged, most recently at `cffc64c8`.
diff --git a/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md b/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
index fc6478cc..f54532f1 100644
--- a/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
+++ b/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
@@ -1,6 +1,6 @@
 # Remote Debugging & Diagnosis Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.67`
 
 > **Version:** 3.2 - **Source-verified against:** v0.55.36 - **Updated:** 2026-10-01
 > Request-history identity and authenticated stream transport re-verified against v0.55.36 on 2026-10-01; the full line-by-line pass dates from v0.53.0.
diff --git a/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md b/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
index 45f96e69..87de46a6 100644
--- a/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
+++ b/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
@@ -1,6 +1,6 @@
 # Schema Attribute Customization Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.67`
 
 > **Version**: 1.1 - **Date**: 2026-08-04 - **Status**: Complete (PATCH merge semantics re-verified against `mergeProfilePartial()` on 2026-08-04; the full line-by-line source pass dates from v0.40.0)  
 > **Audience**: Operators, ISV admins, Entra ID integration engineers  
diff --git a/docs/SCHEMA_CUSTOMIZATION_GUIDE.md b/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
index 7bc9edc1..fc51119e 100644
--- a/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
+++ b/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
@@ -10,7 +10,7 @@ effective mutability and response projection. See
 [reference persistence and migration compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > **P7a correctness, included since 0.55.36:** [Declaration and POST/PUT validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > documents the source changes below, with owned PostgreSQL/InMemory evidence.
diff --git a/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md b/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
index d03b14c8..ab313164 100644
--- a/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
+++ b/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
@@ -1,8 +1,8 @@
 # SCIMServer - Sovereign & Government Cloud Deployment Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** April 28, 2026
+> **Version:** 0.55.67 - **Updated:** April 28, 2026
 > Covers: Azure Government (US), Azure China (21Vianet), Azure BLEU (France), Azure Germany, and custom sovereign environments
 
 ---
diff --git a/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md b/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
index 3440841c..7a74b3c9 100644
--- a/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
+++ b/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
@@ -2,13 +2,83 @@
 
 > **Started:** 2026-10-30
 > **Scope:** dev and canary only; customer production is excluded
-> **Requested release:** 0.55.67, subject to ordinary release and performance admission
+> **Requested release:** 0.55.67; a performance-admission exception is authorized for this dev-and-canary migration only. Performance remains unqualified. Every other gate remains mandatory.
 > **Execution worktree:** `SCIMServer-tenant10-migration-20261030`
 > **Branch:** `ops/tenant10-migration-20261030`
 > **Status:** foundations, both Ready databases, both full-source local replays and disposable Azure transfers pass. Local PostgreSQL browser acceptance passes 348 tests with zero skips, failures or flaky results. No target app is serving; release selection/admission, actual target acceptance and final carry/cutover remain pending.
 
 ## Executive summary
 
+### Authorized performance-admission exception (2026-11-03)
+
+**Decision ID:** `T10-0.55.67-PERF-EXCEPTION-2026-11-03`.
+
+The operator explicitly authorized:
+
+> I authorize a documented performance-admission exception for this 0.55.67 dev-and-canary migration only. Performance remains unqualified. Keep every other security, data-integrity, functional, browser and migration gate mandatory. Do not change customer production.
+
+This supersedes historical statements that no exception was authorized. It
+changes the release-path decision, not the failed qualification evidence.
+Performance remains **unqualified**, failed receipts remain failed, and skipped
+jobs must never be reported as passes.
+
+| Boundary | Authorized scope and mandatory evidence |
+|---|---|
+| Version and operation | Only 0.55.67 for this tenant 09 to tenant 10 dev-and-canary migration. No standing exception for later releases or unrelated deployments. |
+| Environments | Tenant 10 dev and canary only. Customer-production application, database, image, traffic and estate identity must not change. |
+| Performance | Preserve failed receipts, normal protocols, thresholds and qualification logic. No new measurement campaign is authorized by this decision. Record the admission exception explicitly, never as performance-qualified. |
+| Source and artifact | Pass every other applicable exact-tip gate and normal review, merge to master, then build and scan. Before deployment, bind this decision to the exact merged commit, product version and immutable image digest. Those final identities remain pending. |
+| Assurance | Security, dependency/image scans, response contracts, functional tests, persistence-backend parity, migration replay, live HTTP, browser and measured-layout checks remain mandatory. |
+| Data and cutover | Prove effective source-writer freeze, take a fresh consistent final carry, verify complete carried state and resource identities, and validate recovery before switching clients. No freeze or cutover is claimed. |
+| Target acceptance | Report every applicable numbered pipeline gate on the actual targets. Preserve required operator visual acceptance. Report target latency and operational failures separately; the exception does not make an unhealthy target acceptable. |
+| Promotion | Promote the same verified immutable digest from dev to canary through the existing safe process. No customer-production promotion is authorized. |
+
+#### Release-only delivery boundary
+
+Source integration `5823a225ea08b0a2d7af51e6dd7bc9cc3b5fc69e` combines
+held PR251 with reviewed master
+`a80fafb219c07628c7cd0b4fb67bed983570e7cf`. Against that master, the complete
+API/web trees differ only in four version-bearing files: each package manifest
+and its lockfile. Their existing 0.55.67 blobs have been imported unchanged,
+without regenerating a lockfile. The resulting complete API/web trees match
+the integrated candidate, not merely selected production files.
+
+Use the bounded branch `ops/tenant10-release-exception-20261103`, based on that
+reviewed master, for the four metadata changes, source-version documentation
+and this explicit exception. Keep qualification-method research in PR251
+draft. Its three campaign workflows explicitly run on `ready_for_review`;
+marking that research PR ready would allocate campaigns rather than advance
+only the migration release.
+
+The release-only branch changes no workflow, qualification program, threshold,
+runtime source, schema or dependency graph. This is a consciously authorized
+migration release under the exception, not an inferred source-equality waiver.
+Normal campaign behavior remains unchanged for future qualification work.
+
+Owned root and web restores completed successfully after dependency inventory
+failures, with manifest/lock hashes unchanged. Owned API Prisma generation and
+the complete lock provenance check passed. The provenance check reports
+157/684/395 sha512 entries across root/API/web, public registry hosts only.
+Ordinary protected publication and exact-tip hosted checks remain pending.
+No release artifact or target application exists yet.
+
+**Self-improvement disposition:** applied. Keep explicit authorization,
+unqualified performance, mandatory gates and pending exact-artifact binding
+together, and separate release metadata from diagnostic research.
+**Design/architecture disposition:** accepted. Reuse unchanged normal gates
+instead of introducing a general label, workflow bypass or runtime abstraction.
+
+#### Release preparation issues
+
+| Issue | Type / severity | Symptom and root cause | Fix and why it works | Detection / prevention |
+|---|---|---|---|---|
+| TR-1 | Dependency bootstrap / Low | Root and web `npm ls --depth=0` returned ELSPROBLEMS because the new owned worktree lacked its packages. | Owned `npm ci --ignore-scripts` restored both installations; before/after manifest and lock hashes are identical. API Prisma generation passed separately. No dependency borrowing or lock regeneration. | Dependency preflight caught this before publication. Keep the existing missing-dependency-first and owned-installation rules; no gate escape. |
+| TR-2 | Editing friction / Low | A multi-file patch applied its first file but rejected a session-memory anchor copied from the other branch. The current master has a different first checkpoint. | Inspect the current header and retry only the unapplied hunks against the shared document heading. The tool's partial-application report prevents overwriting the successful first edit. | Caught at patch application, the earliest possible stage. Read branch-specific context before using historical anchors. |
+| TR-3 | Documentation completeness / Low | Freshness `-Fix` updated version headers but F4 still rejected unchanged release notes. The existing header already said 0.55.67, so stamping alone could not document the new operational decision. | Add explicit migration-only release notes, including unqualified performance, mandatory gates and pending deployment. | F4 caught missing user-facing explanation before commit. A generated header is not a release explanation; retain the existing coupling check. |
+
+These entries use direct command results from this preparation. They do not
+claim that the full historical session transcript has been reconciled.
+
 ### Current handoff: tooling merged and postmerge validation passes
 
 PR #267 merged normally at `2026-11-03T18:42:17Z`, creating master
diff --git a/docs/UI_GUIDE.md b/docs/UI_GUIDE.md
index f232b4ff..6b5bba76 100644
--- a/docs/UI_GUIDE.md
+++ b/docs/UI_GUIDE.md
@@ -1,8 +1,8 @@
 # SCIMServer Web Admin UI Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Status:** Active | **Last Updated:** 2026-10-16 | **Version:** 0.55.66
+> **Status:** Active | **Last Updated:** 2026-10-16 | **Version:** 0.55.67
 > Single-page React + Fluent UI v9 admin console. Nine pages, one shared app shell, live SSE log stream.
 > **Endpoint/profile/authentication flows:** [PORTABLE_ENDPOINT_PROFILE_AUTHENTICATION_AND_DISCOVERY_DESIGN.md](PORTABLE_ENDPOINT_PROFILE_AUTHENTICATION_AND_DISCOVERY_DESIGN.md) distinguishes the current Create, Discovery, Connect, endpoint Settings, and global Settings surfaces from the target profile-import workflow.
 > **Screenshot provenance:** every image below was re-captured on **2026-07-31** from the live **dev** estate (then `scimserver-dev.proudbush-ae90986e.eastus.azurecontainerapps.io`) running **v0.55.6 / Node v24.18.1**, at a pinned 1440x900 viewport, using:
diff --git a/web/package-lock.json b/web/package-lock.json
index a6a86591..72de10ea 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "scimserver-web",
-  "version": "0.55.66",
+  "version": "0.55.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "scimserver-web",
-      "version": "0.55.66",
+      "version": "0.55.67",
       "dependencies": {
         "@fluentui/react-components": "^9.74.2",
         "@fluentui/react-icons": "^2.0.331",
diff --git a/web/package.json b/web/package.json
index bff93836..38a8d669 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "scimserver-web",
   "private": true,
-  "version": "0.55.66",
+  "version": "0.55.67",
   "type": "module",
   "scripts": {
     "dev": "vite",

From d629628e9869bbfbfe9cc6cd8ea1c3ba9ddd842d Mon Sep 17 00:00:00 2001
From: "Prashant Rane (ALLYIS INC)" <v-prasrane@microsoft.com>
Date: Tue, 3 Nov 2026 14:10:39 -0600
Subject: [PATCH 2/2] docs: align migration release badge and current scope

Existing C13 gate caught the stale independent version badge. Performance remains unqualified; customer production is excluded.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 README.md                                        | 14 +++++++++++---
 docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md |  1 +
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index c6e694e7..0ad33ae1 100644
--- a/README.md
+++ b/README.md
@@ -5,10 +5,18 @@
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
 **What's new and how to upgrade:** [User-facing release notes](docs/RELEASE_NOTES.md)
-cover 0.55.58 correction preparation, merged 0.55.57 source, the deployed 0.55.56 checkpoint,
-cumulative changes since 0.55.20, migration/rollback steps and known limits.
+cover the proposed 0.55.67 tenant 10 dev-and-canary migration, earlier correction
+history, cumulative changes since 0.55.20, migration/rollback steps and known limits.
 See [CHANGELOG.md](CHANGELOG.md) for detailed engineering history.
 
+**0.55.67 migration release preparation:** the operator authorized a
+performance-admission exception for this dev-and-canary migration only.
+Performance remains unqualified; every other gate remains mandatory.
+Customer production must not change. The
+[migration execution record](docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md)
+records the scope and pending final artifact, target acceptance and cutover.
+No deployed release is claimed.
+
 **Current Hono source integration:** [Actual Prisma parent qualification](docs/HONO_PRISMA_PARENT_QUALIFICATION.md)
 records proposed 0.55.66 integrating reviewed master after #259, #260 and
 #261 merged. It preserves the bounded adapter compatibility proof and all
@@ -29,7 +37,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.66-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.67-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()
diff --git a/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md b/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
index 7a74b3c9..f5543418 100644
--- a/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
+++ b/docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md
@@ -75,6 +75,7 @@ instead of introducing a general label, workflow bypass or runtime abstraction.
 | TR-1 | Dependency bootstrap / Low | Root and web `npm ls --depth=0` returned ELSPROBLEMS because the new owned worktree lacked its packages. | Owned `npm ci --ignore-scripts` restored both installations; before/after manifest and lock hashes are identical. API Prisma generation passed separately. No dependency borrowing or lock regeneration. | Dependency preflight caught this before publication. Keep the existing missing-dependency-first and owned-installation rules; no gate escape. |
 | TR-2 | Editing friction / Low | A multi-file patch applied its first file but rejected a session-memory anchor copied from the other branch. The current master has a different first checkpoint. | Inspect the current header and retry only the unapplied hunks against the shared document heading. The tool's partial-application report prevents overwriting the successful first edit. | Caught at patch application, the earliest possible stage. Read branch-specific context before using historical anchors. |
 | TR-3 | Documentation completeness / Low | Freshness `-Fix` updated version headers but F4 still rejected unchanged release notes. The existing header already said 0.55.67, so stamping alone could not document the new operational decision. | Add explicit migration-only release notes, including unqualified performance, mandatory gates and pending deployment. | F4 caught missing user-facing explanation before commit. A generated header is not a release explanation; retain the existing coupling check. |
+| TR-4 | Documentation completeness / Low | Protected Validate stopped after 323.9s at C13: README version badge claimed 0.55.66 while product metadata said 0.55.67. Freshness stamps the header, not this independent badge. Twelve preceding gates passed, including build/lint/type checks and diagram rendering. | Update the badge and README's current migration scope; require the actual content audit GREEN before retrying publication. The existing C13 check catches this precise second-claim drift. | C13 caught the mismatch before push. Earliest detection was the focused content audit after the version bump; use both freshness and content audits for release metadata. No runtime gate escaped and no new gate implementation is needed. |
 
 These entries use direct command results from this preparation. They do not
 claim that the full historical session transcript has been reconciled.