- Shipped
- August 15, 2026 at 6:03 AM UTC
- Author
- kamo
- Commit
- 66d4c13
One chip was carrying two different truths and misleading in opposite directions. Unbuilt means nothing checks the right and granting it does nothing. Superseded means the capability is real and gated, under another right's name — granting this one still does nothing, but deleting it would be wrong and the administrator needs to know which right to grant instead. The four entries are the ones the audit established: VIEW_SCHEDULES and MANAGE_SCHEDULES under MANAGE_TIMECARDS, because the Attendance tab used to open on VIEW_SCHEDULES and each HR tab was later given one right of its own; CREATE_EMPLOYEES and DELETE_EMPLOYEES under MANAGE_MEMBERS, because an employee is a member with an employment record and there is no employee CRUD endpoint. The list is hand-curated, unlike the generated one it annotates, and deliberately so: no analyzer can tell "superseded" from "nobody built it yet". Membership does not remove a right from UNENFORCED_RIGHTS — nothing passes it to a check either way — so the parity test with the committed audit is untouched. Two guards keep the annotation from rotting into a stale comment. A right that is genuinely enforced can never be labelled superseded, which would put two contradictory chips on one switch. And the covering right must not itself be decorative: the message is "grant X instead", so a dead X would send the administrator one step further from a working permission. This was worth doing before the next HR right lands. Two of these four were one check away from being deleted during the audit precisely because the editor said they were dead.