0040 Prefix-grouped superadmin schema contract

This document is the checked-in inventory for the source-defined database contracts behind /superadmin/. The browser reads bounded RPC results and does not receive raw table topology or unrestricted rows.

Screen delivery catalogue

The route catalogue below is the delivery checklist for the current Superadmin surface. super_operations_snapshot is the bounded read model for operational desks; platform-management-views is the existing typed authority read model for Users. Every db-function mutation is issued through GWLink to a generated RPC wrapper and then to a security-definer database function. Read-only screens are intentionally marked as such rather than receiving an invented client-side write.

Status	Screen	Path	Read contract	Mutation contract	E2E contract
[ ]	Overview	/superadmin	super_operations_snapshot	read-only	route-read
[ ]	Users	/superadmin/users	platform-management-views	db-function	route-read-and-step-up
[ ]	Audit	/superadmin/audit	super_operations_snapshot	read-only	route-read
[ ]	User operations	/superadmin/user-operations	super_operations_snapshot	read-only	route-read
[ ]	Organisations	/superadmin/organisations	super_operations_snapshot	read-only	route-read
[ ]	Billing	/superadmin/billing	super_operations_snapshot	db-function	route-read
[ ]	System	/superadmin/system	super_operations_snapshot	db-function	route-read
[ ]	Catalog	/superadmin/catalog	super_operations_snapshot	db-function	route-read-and-step-up
[ ]	Inventory	/superadmin/inventory	super_operations_snapshot	db-function	route-read
[ ]	Market	/superadmin/market	super_operations_snapshot	db-function	route-read
[ ]	Integrations	/superadmin/integrations	super_operations_snapshot	db-function	route-read
[ ]	Content	/superadmin/content	super_operations_snapshot	db-function	route-read
[ ]	Finance	/superadmin/finance	super_operations_snapshot	db-function	route-read
[ ]	Analytics	/superadmin/analytics	super_operations_snapshot	read-only	route-read
[ ]	Compliance	/superadmin/compliance	super_operations_snapshot	db-function	route-read
[ ]	Support	/superadmin/support	super_operations_snapshot	db-function	route-read
[ ]	Releases	/superadmin/releases	super_operations_snapshot	db-function	route-read
[ ]	Access	/superadmin/access	super_operations_snapshot	read-only	route-read
[ ]	Sessions	/superadmin/sessions	super_operations_snapshot	read-only	route-read
[ ]	Health	/superadmin/health	super_operations_snapshot	db-function	route-read
[ ]	Approvals	/superadmin/approvals	super_operations_snapshot	db-function	route-read
[ ]	Settings	/superadmin/settings	super_operations_snapshot	db-function	route-read
[ ]	Platform settings	/superadmin/settings/platform	super_operations_snapshot	db-function	route-read
[ ]	Security settings	/superadmin/settings/security	super_operations_snapshot	read-only	route-read
[ ]	Notification settings	/superadmin/settings/notifications	super_operations_snapshot	db-function	route-read
[ ]	Audit settings	/superadmin/settings/audit	super_operations_snapshot	read-only	route-read
[ ]	Marketing	/superadmin/marketing	super_operations_snapshot	db-function	route-read
[ ]	Audiences	/superadmin/marketing/audiences	super_operations_snapshot	read-only	route-read
[ ]	Invites	/superadmin/marketing/invites	super_operations_snapshot	db-function	route-read
[ ]	Campaigns	/superadmin/marketing/campaigns	super_operations_snapshot	db-function	route-read
[ ]	Templates	/superadmin/marketing/templates	super_operations_snapshot	read-only	route-read
[ ]	Delivery	/superadmin/marketing/delivery	super_operations_snapshot	db-function	route-read
[ ]	Moderation	/superadmin/moderation	super_operations_snapshot	db-function	route-read
[ ]	Suspicious activity	/superadmin/suspicious-activity	super_operations_snapshot	db-function	route-read

The catalogue is checked off only after the generated contract gates and the browser E2E run pass; [ ] is therefore a live work item, not a design-only claim.

Prefix inventory

Standard class columns, timestamps, revision/audit columns supplied by an extension, and generated primary-key details are omitted from the field notes. The source path is authoritative; SQL, RPC, and XTalk files are generated from it.

BRD — billing

Type	Class	Owner/reference	Lifecycle	Source
BrandBillingInvoice	1D/entry	BillingAccount	provider-neutral invoice summary; status and payment totals may be reconciled	backend/src/gwdb/common/type_brand_billing.clj
BrandBillingPayment	1D/log	BillingAccount; typed BrandBillingInvoice reference	append-only payment event; corrections are compensating events	backend/src/gwdb/common/type_brand_billing.clj

The existing BillingAccount, provider-price, subscription, and external-event types remain canonical. No general-ledger table is introduced; authoritative money movement remains in the existing wallet/asset transaction sources.

CNT — content controls

Type	Class	Owner/reference	Lifecycle	Source
ContentControl	2D/base	typed target (class_table, class_context, class_ref); actor is a typed User reference	review, evidence, resolution, and retirement	backend/src/gwdb/common/type_content_control.clj

The proposed 2D/entry shape was not used because this generator's 2D/entry contract supplies table/context but no typed reference column. 2D/base is the reusable extension that preserves the complete typed attachment.

CMP — compliance

Type	Class	Owner/reference	Lifecycle	Source
ComplianceRecord	2D/base	typed subject (class_table, class_context, class_ref); owner is a typed User reference	privacy, consent, legal hold, completion, release, expiry	backend/src/gwdb/common/type_compliance_record.clj

Compliance uses the same 2D/base attachment rule as ContentControl; it does not create separate consent, privacy, or legal-hold tables.

FIN — settlement and exceptions

Type	Class	Owner/reference	Lifecycle	Source
FinanceSettlement	1D/entry	existing Topic/market	queued, processing, succeeded, failed, cancelled	backend/src/gwdb/common/type_finance_settlement.clj
FinanceException	1D/log	FinanceSettlement; optional reference type/id	append-only operational exception; resolution is a compensating state	backend/src/gwdb/common/type_finance_settlement.clj

Settlement rows are market-scoped and unique per market. Exception reference type/id participates in the settlement-scoped idempotency key when supplied. The ledger/read model composes existing AssetTx, stake, wallet, and billing sources rather than duplicating a general ledger.

INT — integrations

Type	Class	Owner/reference	Lifecycle	Source
IntegrationProvider	1D/base	typed Global, Brand, or User owner through (class_table, class_ref)	pending, active, paused, degraded, revoked; health fields are updated in place	backend/src/gwdb/common/type_integration.clj
IntegrationEvent	1D/log	IntegrationProvider	received, processing, processed, ignored, failed, replaying; retry/replay counters are retained	backend/src/gwdb/common/type_integration.clj

IntegrationEvent is idempotent on provider plus provider event id. Payloads are represented by target metadata, hash, response/error metadata, and retry state; raw provider payloads and credentials are not part of the browser contract.

MCP — connections and approvals

Type	Class	Owner/reference	Lifecycle	Source
McpConnection	2D/base	typed owner (class_table, class_context, class_ref); creator is a typed User reference	pending, active, suspended, revoked	backend/src/gwdb/common/type_mcp.clj
McpApproval	2D/log	McpConnection	requested, approved, rejected, expired, cancelled; append-only decisions	backend/src/gwdb/common/type_mcp.clj

The proposed 0D/entry connection was changed to 2D/base so connection ownership remains typed and cannot degrade into an unconstrained owner-type/id pair. Op, Audit/AuditLog, and Activity/ActivityLog remain the durable operation/audit foundations; no MCP-specific audit table is added.

MKT — audiences and campaigns

Type	Class	Owner/reference	Lifecycle	Source
MarketingAudience	1D/base	typed owner (class_table, class_ref); creator is a typed User reference	saved audience definition; recipient selection remains bounded metadata	backend/src/gwdb/common/type_marketing.clj
MarketingCampaign	1D/entry	MarketingAudience; typed EmailTemplate reference	draft, scheduled, running, paused, completed, cancelled, expired	backend/src/gwdb/common/type_marketing.clj

Campaign delivery reuses EmailTemplate, EmailDelivery, and workflow types. There is no MarketingDelivery or per-recipient fan-out table in this slice; MarketingAudienceRecipient remains a measured future extension only.

SAF — safety and moderation

Type	Class	Owner/reference	Lifecycle	Source
SafetyCase	0D/entry	explicit typed target type/id; reporter and assignee are typed User references	open, triage, investigating, actioned, resolved, dismissed	backend/src/gwdb/common/type_safety.clj
SafetyCaseEvent	2D/log	SafetyCase; actor is a typed User reference	append-only evidence, action, or note history	backend/src/gwdb/common/type_safety.clj

Moderation and suspicious activity share one case lifecycle. Existing Lock/LockLog types remain the lock/unlock foundation; no split moderation, suspicious-activity, evidence, or action tables are added.

SUP — support

Type	Class	Owner/reference	Lifecycle	Source
SupportCase	0D/entry	explicit typed subject type/id; owner is a typed User reference	open, pending, in-progress, waiting, resolved, closed	backend/src/gwdb/common/type_support.clj

Operator notes and activity reuse ActivityLog. A separate support-event table is not needed until retention, authorization, or query scale proves a different lifecycle.

SYS — system catalog and platform approvals

Type	Class	Owner/reference	Lifecycle	Source
SystemCatalogItem	0D/entry	canonical system-owned catalog item	draft, active, retired	backend/src/gwdb/common/type_system_catalog.clj
SystemCatalogPlan	1D/entry	SystemCatalogItem	versioned plan with effective start/end and draft/active/retired state	backend/src/gwdb/common/type_system_catalog.clj
SystemPlatformApproval	1D/entry	target User; request/decision actors are typed User references	requested, approved, rejected, expired, cancelled	backend/src/gwdb/common/type_system_catalog.clj

The active source generator has no CatalogItem/CatalogPlan definitions. The old names survive only in stale, unassembled SQL and an older superadmin schema note; SystemCatalogItem/SystemCatalogPlan are the one canonical generated pair. Existing legacy product consumers must be migrated before that stale artifact can be reactivated. This implementation does not create a second active catalog pair.

SystemPlatformApproval is a current approval entry unique per target user; the shared Op and audit/activity foundations retain the operation history.

Shared access and generation contract

• New operational tables are source-defined and generated into main/sql/files/src/common; generated SQL, RPC, and XTalk files are not hand-authored.
• Sensitive operational tables use hidden access and service-role grants; they do not grant authenticated table reads. Secrets, credentials, tokens, raw event payloads, and recipient sets are never returned by the browser read model.
• super_operations_snapshot is a bounded, security-definer RPC. Its source authenticates the actor at platform-admin level and returns counts, a generation time, and named redacted projections capped at 25 rows per dataset; it never accepts arbitrary table names or returns secrets, credentials, tokens, raw payloads, or recipient sets. Loading this read model does not require a recent MFA step-up; mutation RPCs retain the reauthentication requirement.
• Typed foreign keys, owner/status/time indexes, provider-event idempotency uniqueness, and partitioning for high-volume logs are part of the source definitions.
• The initial target is 18 new or newly activated physical types. Existing organisation/brand identity, workflow, audit/activity, lock, email, economy, wallet, asset, and billing foundations are reused.