Mata,
I am very happy we got this working.
I think you deserve an award for "Most persistent did-all-the-right-things-but-it-still-doesn't-work troubleshooting of a super obscure problem."
Now your roles should work fine and you can build them out and customize them as you need. So all that troubleshooting will not go to waste as you know know roles and permissions far better than you probably ever wanted to
Randy