@@ -69,7 +69,7 @@ How the code is written for it:
 
 7. **Sync wiring**: the sync is triggered from the `auth.jwt` filter, which fires on login and on every session refresh (~once a day per active tab) - `auth.login` alone would never re-sync a permanently logged-in user. It runs in the background: the token is issued immediately, a failure is only logged, the next login/refresh retries. Syncs on every login and refresh; concurrent syncs of the same user are safe - the unique keys catch the races. The sync-github-data endpoint (manual button) also runs `syncOrganizations` and shows the error to the user. A separate sign-up sync is not needed: the first login emits `auth.jwt` too. The same filter stamps the session claims - `user_type`, `github_username` and, from now on, `user_account_id`: the user's own account, which is what a session bills unless it is switched to an org. It ships here because phase 2 has no Directus deploy; the readers keep a lookup as a fallback for the sessions issued before this, which stay valid for a day.
 
-7a. **Members cron** (`check-members-cron-handler`, daily at 02:00): a user who never opens the dashboard never re-syncs, so their org tokens would survive leaving the org. For each org (all the requests go with the members' own tokens, so there is nothing to save by limiting it): find a checker (member whose token passes the authoritative self check), read every member's org list in one GraphQL query with the checker's token (a fellow member sees private memberships), resolve inconclusive members (stale login, 100+ orgs) by their own token first, then via REST through the checker. Leavers are removed; the DB trigger cleans their org tokens and approvals. An org that restricts the OAuth app or has no working token is reported in the operation output and left untouched.
+7a. **Members cron** (`check-members-cron-handler`, daily at 02:00): a user who never opens the dashboard never re-syncs, so their org tokens would survive leaving the org. For each org (all the requests go with the members' own tokens, so there is nothing to save by limiting it): find a checker (member whose token passes the authoritative self check), read every member's org list in one GraphQL query with the checker's token (a fellow member sees private memberships), resolve inconclusive members (stale login, 100+ orgs) by their own token first, then via REST through the checker. Leavers are removed; the DB trigger cleans their org tokens and approvals. An org that restricts the OAuth app has no in-org checker: any member's token still reads the public org lists, so leavers are removed by them and inconclusive members are left untouched (the same view the sync has of such an org). An org with no working token is reported in the operation output and left untouched.
 
 8. **gp-tokens hook**: on create, validate `account_id` - must be my personal account or an org where my role is admin/member (viewer excluded). Fulfillment is done by a DB trigger, not the hook