The first thing I notice here
is your call to publisher.commit() in your handler method.
Don't do that.  The DurusPublisher takes care of transactions
so that you don't need to think about it.

You have found a bug in Permissions.ungrant() that I will correct.
The problem is, that the ungrant() method includes the line
del self.data[permission]
which should be
del self[permission].
The difference is the second form makes the change and
calls _p_note_change(), so that the change can be recorded
when the next commit() is called.

Please change that line in your qp.pub.users file and verify
that the problem is corrected.

Good catch.