partially fix up the lookup_one_noperm mess