BulkRoleCache.prefetch caches the legacy loop variable for openedx-authz roles #39168

Checked 2026-09-30: master source at ca039029e4918f02903b1c7d62adf8b3ad74f75b and release/verawood source at 18ce9a9c2b20c745b0ee94f615c13855acd9624b. Both carry this code path. This is a source diagnostic; no upstream full integration suite or production mutation ran.

The openedx-authz loop iterates over its own role but inserts compat_role, which belongs to the preceding legacy loop.

Reproduction:

1. Give an author an openedx-authz course assignment with no legacy CourseAccessRole rows in the prefetch batch.
2. Call BulkRoleCache.prefetch for that batch. The first authz assignment raises UnboundLocalError.
3. Repeat with a legacy role present, on another course. The authz course cache receives the last legacy role instead of that author's authz role.

An isolated execution of the current native function body with in-memory model/role fixtures reproduces both outcomes on master and Verawood. Changing only the insertion to the current authz loop role makes both controls cache the expected authz role. This is not a full Django/authorization integration claim.

Expected: authz-only and mixed batches cache their own per-user/course assignments, independent of which legacy role was last enumerated. Suggested regression controls are both cases above, including distinct courses and users.

Duplicate checks: current issue/PR searches for BulkRoleCache and compat_role. #38984 concerns platform-wide scope conversion, not this loop variable; #38943 concerns grade-report query cost. I found no report for this insertion case in those results.