- Shipped
- November 13, 2026 at 4:40 AM UTC
- Author
- Kamo
- Commit
- 0f92863
The effective timeout (roles -> department -> job title -> teams -> member) was computed once at sign-in and every extend re-read that stored number, so an admin's policy edit never applied to anyone who stayed signed in. The rights-refresh poll kamo-internal already runs (load, focus, every 5 min) now re-bakes the timeout from the live waterfall in the same write. A tighter policy shortens the remaining TTL at once; a longer one is stored and applies at the next activity-driven extend, so a refresh still never renews a session. Ordinary sign-ins opt in at creation and record the mobile floor; voice and SI-order sessions keep the lifetime they were issued with.