- Shipped
- October 28, 2026 at 4:17 AM UTC
- Author
- Kamo
- Commit
- 5ddde6c
Leadership (OrgLeadershipService): - GET/PATCH **************** for the profile page. - PATCH .../access owner changes go through the same rules (an administrator may now change owners; echoing the current owner flag is no change); the Administrator role moves with it there. - The roles list may only move the Administrator role under those rules. - An administrator is not demoted to a member until that status goes. - Setting the org's only leader to a non-Active status is refused before anything is written. Avatars: MemberAvatarController **************** lists, uploads, creates and deletes the TARGET member's own avatars (self or MANAGE_MEMBER_SECURITY / open god window), and sets the account-wide default only for an org-owned AI. Written 2026-10-20 but never committed; ported onto main with fixes (god ELIGIBILITY no longer passes, missing size variants no longer NPE). PUT /members/{id} now answers 400 for an avatar from someone else's library instead of logging and returning 200, which is why an admin's photo pick looked saved and was not.