- Shipped
- August 15, 2026 at 2:15 AM UTC
- Author
- Kamo
- Commit
- f88ed7e
A god account's platform rights may be changed only by another god, and a god account can never be removed from the list — by anyone, including another god. God is the platform's break-glass identity: its holders are what remains when everything else has been misconfigured. An administrator holding MANAGE_PLATFORM_ADMINS but not god could otherwise reach into a god account and take its rights away, which is precisely the edit that would disarm the people able to undo it. Removal is absolute because the row going away strips every right at once; changing rights stays possible, but only between peers. The peerage test is User.isGod on the caller, not an open god-mode window: being god is what makes you the target's equal here, while the window is about deliberately using that power elsewhere. isGod(Member) fails closed in the protective direction — a member whose user record cannot be read is treated as god, so an unreadable row is left alone rather than edited on the strength of a lookup that did not work. The caller's own flag fails the other way, since it only ever enables controls. Applies to all three write paths, including the add endpoint, which replaces rights on a re-add and would otherwise be a way around the rule.