Profile composition checks only dashboard widgets belonging to the displayed profile families. Unrelated widgets and dashboard commands are excluded from this discovery. Runtime selection and validated permission definitions are reused within one read-only calculation and discarded afterward. Actor, organization and subject-population checks remain enforced, and subsequent requests recheck execution state.

Initial Shell bootstrap also reuses runtime selection during its read-only permission and navigation calculation. Dashboard initialization remains outside that scope.

Published App assets check the current installation, tenant, actor and execution when signing the outgoing request, eliminating duplicate checks earlier in that same request. File type, path, size and release identity checks remain enforced.

This patch supplements the startup improvements in Core 0.7.58. Deploy Core only; no App republication, SDK change or database change is required.