- Ya
- 4 Septemba 2026, 21:25 UTC
- Mwandishi
- Kamo
- Ahadi ya
- bebcd28
The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account cannot prove the new one, which is exactly the case the member's own path cannot serve. Who: a god-ELIGIBLE caller, or the platform System User. Deliberately NOT MANAGE_MEMBERS or MANAGE_MEMBER_SECURITY. This address is one of the three identifiers sign-in accepts and the one password recovery writes to, so being able to set it is being able to take the account over — the same line PasswordChangeController draws, for the same reason. Eligibility is read through SessionPlatformFacts rather than by reaching for `GD`, because that parser exists precisely so eligibility and an OPEN god-mode window cannot be confused. The target member must be in the caller's own organization, as the password endpoint requires. What does NOT apply is the security-provider rule: it exists to stop one tenant changing how somebody signs in to another, and a god operator and the System User are platform identities rather than a tenant. Keeping it would leave the capability unusable from the workspace an operator is actually standing in. No verification round trip on this path, and the address is marked UNVERIFIED — nobody proved it, and letting a written address inherit the verified standing of the one it replaced would make the flag a lie. Uniqueness within the provider still holds, because it is a sign-in identifier however it got written. The notice to the old mailbox still goes, and matters more here than on the member's own path: this is the case where the account holder did not start the change. Anything the member had pending is cancelled, so yesterday's confirmation link cannot silently undo the correction. The System User may now CALL this controller — administering other people's accounts is the point. It still may never be the TARGET. /context reports isGodEligible and isSystemUser so the console can decide what to offer. Neither is derivable there: the first must come through the shared parser, and the second is a column in no session at all, so without it the System User would open a profile and not be shown the card it is entitled to use. Both widen a screen; every write re-derives them.