The manager line reads the org graph — cycle checks on a fresh graph, the directory on the cached one, and a member's own manager needs MANAGE_MEMBER_SECURITY to change (KamoCollab CP02 T12)

Shipped

October 5, 2026 at 4:30 PM UTC

Author

Kamo

Commit

77e81c5

- MemberSecurityController: rejectManager keeps the self, org and record-active refusals and tests the loop with **************** the ten-level bound goes. touchesMemberSecurity gains managerId, compared like the department (only a real change needs the right; an unreadable id counts as one) (D21, D22). - ManagerStepHandler: the hire MANAGER step's loop check is the same test on a graph loaded inside its transaction; MANAGER_OF and the depth bound go. - TeamMemberDirectoryController: one cached graph per page, read only when a row asks; directReports = record-active reports(id, false), so supervised AIs count; the picker hint = candidate == member or managerChain(candidate) contains member.