Don't have time to review this personally, but I will share a quick thought... unbelievable! I'm highly impressed and wish you the best of luck on this project. Lots of folks have asked about just this sort of functionality, and it sounds like you've done quite a comprehensive job. I would encourage you to make a separate post that catalogs as much of the shortcomings in the core access control as possible so we can improve this in D6 and beyond. That would rock!