- Department move: set ldap_user.base_dn via ModifyDnMixin (replaces DirectoryService) - Position sync: assign/unassign POS-groups via PositionService on position change - DB update: position_id saved to Employee in atomic block - Best-effort: position sync errors logged but don't interrupt update