- Shipped
- November 15, 2026 at 12:45 AM UTC
- Author
- Kamo
- Commit
- 32d9972
- KSessionService.mutateSession: optimistic compare-and-set (Lua, payload compared as a string, remaining TTL read in-script, never renews; ceiling only shortens). updateSession / refreshSessionPolicy / rewriteRightsForMember all go through it, so a god-mode toggle can no longer be lost to a concurrent /session/refresh. Invariant on every write: godModeActive never survives without GD. - God-mode activation re-checks GD on the session being written (403 if revoked). - Refresh re-mints GD, securityLevel, memberType, teamMember (owner, department) and titles via **************** sharing the sign-in loaders and **************** builders. A revoked GD clears an open god-mode window in the same write. Delegated (SI order) sessions are not widened by the refresh. - SessionRightsResolver: a member not eligible for a live session (off-boarded, terminated, pre-hire) holds no rights at sign-in or on refresh; refresh used to restore the full waterfall. - CallerSessionResolver: request-scoped session cache (misses too), kept current by every *** write/delete on the request thread (and the OTK filter attribute). - ReportRequestContext.rightsOf: caller's own rights from their session; others via the sign-in rule (grant-all, eligibility); memoized per request.