Require an open god-mode window, not eligibility alone, for CONFIGURE_SYSTEM

Shipped

August 28, 2026 at 3:51 AM UTC

Author

Kamo

Commit

04779f9

hasRight was granting the bypass on the raw GD session flag, which SessionPlatformFacts's own javadoc names as the exact anti-pattern it exists to prevent: GD is permanent eligibility, not an open break-glass window. Read via **************** instead, which requires both GD and the deliberate godModeActive flag - otherwise an eligible operator who never opened god mode would silently hold CONFIGURE_SYSTEM at all times. The rights-list check is unchanged.