-- 027: The hand-made Access Control role "Manager" duplicates the seeded
-- hiring_manager, which has carried the manager_candidates bundle since 024.
-- Consolidate: move its live members onto hiring_manager, then soft-delete
-- it. Both steps are idempotent and guarded; the seeded hiring_manager row
-- is never matched (name check excludes it, and it is is_system).
UPDATE app.users u
SET role_id = hm.id,
    updated_at = NOW()
FROM app.roles hm
WHERE hm.role_name = 'hiring_manager' AND hm.is_deleted = FALSE
  AND u.role_id IN (
    SELECT r.id FROM app.roles r
    WHERE lower(r.role_name) = 'manager'
      AND r.role_name <> 'hiring_manager'
      AND r.is_deleted = FALSE
  )
  AND COALESCE(u.is_deleted, FALSE) = FALSE;

UPDATE app.roles r
SET is_deleted = TRUE,
    is_active  = FALSE,
    updated_at = NOW()
WHERE lower(r.role_name) = 'manager'
  AND r.role_name <> 'hiring_manager'
  AND r.is_deleted = FALSE
  AND NOT EXISTS (
    SELECT 1 FROM app.users u
    WHERE u.role_id = r.id AND COALESCE(u.is_deleted, FALSE) = FALSE
  );