feat: streamlined role-revocation logic

src/Repository/UserRepository.php

@@ -25,6 +25,11 @@ class UserRepository extends ServiceEntityRepository
     }
 
     /**
+     * Users holding an administrative role or awaiting approval for one, plus blocked
+     * accounts without a teamer. A user demoted by the CRM may keep no role that would list
+     * them, and a block is only ever lifted from a list: teamers are unblocked from theirs,
+     * everyone else has none but this one.
+     *
      * @return User[]
      */
     public function getAdministrativeUsers(): array
@@ -41,6 +46,11 @@ class UserRepository extends ServiceEntityRepository
             ;
         }
 
+        $qb->orWhere($qb->expr()->andX(
+            $qb->expr()->isNotNull('u.disabledAt'),
+            $qb->expr()->isNull('u.teamer'),
+        ));
+
         return $qb
             ->orderBy('u.lastName', 'ASC')
             ->getQuery()