- Shipped
- September 6, 2026 at 6:40 PM UTC
- Author
- Kamo
- Commit
- 821f389
The Users tab locked every god row for everybody, and both halves were wrong. Too loose, because the lock lived only in this component — the endpoints behind it answered a direct call from anyone holding MANAGE_USERS. Too tight, because it also locked out the one caller entitled to the edit. GodAccountGuard is the authority now, and the drawer reads callerIsGod from the same response as the row: locked for everyone else, live for a peer, and said out loud in the warning tone when it is live, because an editable god row looks ordinary. The synthetic flag was the one control that stayed live on a god row, and it is the heaviest on the screen — it stops the account authenticating at all. It moves onto the same gate as the rest. Impersonate is withdrawn on a god target. The server refuses it on both doors, and a button that is offered and then refuses reads as a fault rather than as the rule it is. accountIsGod rides up from the profile the way memberType already does, and the server tells only a god-eligible reader.